609635aba1
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
40 lines
1.1 KiB
Bash
40 lines
1.1 KiB
Bash
#!/system/bin/sh
|
|
# 抓 TigerTally fread 阻塞的 pipe 写端进程。自动启动 TNG 并连续扫描。
|
|
PKG="my.com.tngdigital.ewallet"
|
|
|
|
am force-stop "$PKG" 2>/dev/null
|
|
sleep 1
|
|
am start -n "$PKG/.ui.SplashActivity" 2>/dev/null
|
|
|
|
i=0
|
|
while [ $i -lt 40 ]; do
|
|
i=$((i+1))
|
|
pid=""
|
|
for p in $(pidof "$PKG"); do
|
|
if [ "$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null | tr -d ' ')" = "$PKG" ]; then pid=$p; break; fi
|
|
done
|
|
if [ -z "$pid" ]; then sleep 0.5; continue; fi
|
|
|
|
for d in /proc/$pid/task/*/; do
|
|
t="${d%/}"
|
|
s=$(cat "$t/syscall" 2>/dev/null)
|
|
case "$s" in
|
|
63*)
|
|
c=$(cat "$t/comm" 2>/dev/null)
|
|
fd=$(echo "$s" | awk '{print $2}')
|
|
fd=$((fd))
|
|
tgt=$(readlink "/proc/$pid/fd/$fd" 2>/dev/null)
|
|
echo "[$i] pid=$pid TID=${t##*/} comm=$c wchan=$(cat "$t/wchan" 2>/dev/null) syscall=$s"
|
|
echo "[$i] fd=$fd -> $tgt"
|
|
ino=$(echo "$tgt" | sed 's/.*\[//; s/\]//')
|
|
if [ -n "$ino" ]; then
|
|
echo "[$i] writer-search inode=$ino:"
|
|
find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
sleep 0.5
|
|
done
|
|
echo "=== scan done ==="
|