diff --git a/PYAS.py b/PYAS.py index 401eb7a..175c7ab 100644 --- a/PYAS.py +++ b/PYAS.py @@ -992,6 +992,7 @@ class MainWindow_Controller(QMainWindow): def start_scan(self, file): try: + ftype = str(f".{file.split('.')[-1]}").lower() label, level = self.pe_scan(file) if label and "Unknown" == label: if self.rule_scan(file): @@ -1007,6 +1008,11 @@ class MainWindow_Controller(QMainWindow): return "Rules" elif self.exten.bdc_scan(file): return "Exten" + elif not label and ftype in slist: + if self.rule_scan(file): + return "Rules" + elif self.exten.bdc_scan(file): + return "Exten" elif self.json["high_sensitive"]: if self.rule_scan(file): return "Rules" @@ -1470,11 +1476,9 @@ class MainWindow_Controller(QMainWindow): self.kill_process(p, "加載攔截", False) return True self.lock_process(p, False) - file = p.exe().replace("\\", "/") - if ":/Windows" not in file and ":/Program" not in file: - time.sleep(0.2) - if self.exten.pe_sieve(p): - self.kill_process(p, "記憶體攔截", True) + time.sleep(0.2) + if self.exten.pe_sieve(p): + self.kill_process(p, "記憶體攔截", True) return False except: return False diff --git a/PYAS_Extension.py b/PYAS_Extension.py index aa31429..d64b7f5 100644 --- a/PYAS_Extension.py +++ b/PYAS_Extension.py @@ -30,7 +30,7 @@ class ExtenRules: output = p.communicate()[0] for match in re.finditer(r'(\d+)', output): line = output[:match.start()].split('\n')[-1].strip().replace(':', '') - if line in ["Implanted shc", "Replaced", "IAT Hooks", "Unreachable files", "Other"]: + if line in ["Implanted shc", "Replaced", "IAT Hooks", "Other"]: if int(match.group(1)) > 0: return line return False