609635aba1
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
26 lines
891 B
Python
26 lines
891 B
Python
"""Scan TNG AppSecurityManager callbacks and bl methods."""
|
|
import re
|
|
import zipfile
|
|
|
|
APK = r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\base.apk"
|
|
with zipfile.ZipFile(APK) as z:
|
|
data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))
|
|
|
|
keys = [
|
|
b"handleRootingCallback", b"handleEmulatorCallback", b"handleHookingCallback",
|
|
b"handleMalwareCallback", b"onBlockStaticCheck", b"addIntoQueue",
|
|
b"ForceExit", b"exitApplication", b"startForceExit", b"Lxwwqazamx/bl;",
|
|
]
|
|
for k in keys:
|
|
i = data.find(k)
|
|
if i < 0:
|
|
continue
|
|
print("---", k.decode(), "---")
|
|
s = re.sub(rb"[^\x20-\x7e]+", b" ", data[max(0, i - 150) : i + len(k) + 200])
|
|
print(s.decode("ascii", "ignore")[:400])
|
|
print()
|
|
|
|
print("=== bl method refs ===")
|
|
for m in sorted(set(re.findall(rb"Lxwwqazamx/bl;->[a-zA-Z0-9_$<>\[\]]+", data))):
|
|
print(m.decode())
|