609635aba1
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
66 lines
2.5 KiB
Bash
66 lines
2.5 KiB
Bash
#!/system/bin/sh
|
|
# 抓 TigerTally fread 阻塞的 pipe 写端进程，命中后立即 dump 该进程身份/冻结状态。
|
|
PKG="my.com.tngdigital.ewallet"
|
|
|
|
am force-stop "$PKG" 2>/dev/null
|
|
sleep 1
|
|
am start -n "$PKG/.ui.SplashActivity" 2>/dev/null
|
|
|
|
i=0
|
|
while [ $i -lt 60 ]; do
|
|
i=$((i+1))
|
|
pid=""
|
|
for p in $(pidof "$PKG"); do
|
|
if [ "$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null | tr -d ' ')" = "$PKG" ]; then pid=$p; break; fi
|
|
done
|
|
if [ -z "$pid" ]; then sleep 0.5; continue; fi
|
|
|
|
for d in /proc/$pid/task/*/; do
|
|
t="${d%/}"
|
|
s=$(cat "$t/syscall" 2>/dev/null)
|
|
case "$s" in
|
|
63*)
|
|
c=$(cat "$t/comm" 2>/dev/null)
|
|
case "$c" in
|
|
*pool*|*Tiger*|*tiger*|*tally*|*Tally*)
|
|
fd=$(echo "$s" | awk '{print $2}')
|
|
fd=$((fd))
|
|
tgt=$(readlink "/proc/$pid/fd/$fd" 2>/dev/null)
|
|
echo "[$i] MAIN pid=$pid TID=${t##*/} comm=$c wchan=$(cat "$t/wchan" 2>/dev/null)"
|
|
echo "[$i] MAIN fd=$fd -> $tgt"
|
|
ino=$(echo "$tgt" | sed 's/.*\[//; s/\]//')
|
|
[ -z "$ino" ] && continue
|
|
echo "[$i] writer-search inode=$ino:"
|
|
for wp in $(find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null); do
|
|
echo "[$i] $wp"
|
|
done
|
|
# dump 所有非主进程端点
|
|
for wp in $(find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null); do
|
|
wproc=$(echo "$wp" | cut -d/ -f3)
|
|
[ "$wproc" = "$pid" ] && continue
|
|
wfd=$(echo "$wp" | cut -d/ -f5)
|
|
echo "[$i] WRITER proc=$wproc fd=$wfd"
|
|
echo "[$i] cmdline: $(tr '\0' ' ' < /proc/$wproc/cmdline 2>/dev/null)"
|
|
echo "[$i] comm: $(cat /proc/$wproc/comm 2>/dev/null) state=$(cat /proc/$wproc/stat 2>/dev/null | awk '{print $3}')"
|
|
cg=$(cat /proc/$wproc/cgroup 2>/dev/null | grep -v freezer | head -1)
|
|
echo "[$i] cgroup: $cg"
|
|
# cgroup v2 freezer
|
|
cgpath=$(echo "$cg" | sed 's/^[0-9]*://')
|
|
if [ -f "/sys/fs/cgroup${cgpath}/cgroup.freeze" ]; then
|
|
echo "[$i] cgroup.freeze=$(cat /sys/fs/cgroup${cgpath}/cgroup.freeze 2>/dev/null)"
|
|
fi
|
|
echo "[$i] threads(wchan):"
|
|
for td in /proc/$wproc/task/*/; do
|
|
ttn=${td%/}
|
|
echo "[$i] ${ttn##*/} $(cat $ttn/comm 2>/dev/null) $(cat $ttn/wchan 2>/dev/null)"
|
|
done
|
|
done
|
|
;;
|
|
esac
|
|
;;
|
|
esac
|
|
done
|
|
sleep 0.4
|
|
done
|
|
echo "=== scan done ==="
|