87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
PYDT authored and GitHub committed 2023-09-22 18:34:39 +08:00
1 parent f029636757
commit 6d8ef1d4a4
2 files changed
+17 -17
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

PYAS.py
+16 -16
View File
@@ -1,9 +1,8 @@
import os, gc, sys, time, json, psutil
import requests, subprocess, win32con
import win32file, win32gui, win32api
import subprocess, requests, msvcrt
import hashlib, pefile, win32file
import win32gui, win32api, win32con
import xml.etree.ElementTree as xmlet
from hashlib import md5, sha1, sha256
from pefile import PE, DIRECTORY_ENTRY
from PYAS_Scripts import scripts_list
from PYAS_Function import function_list
from PYAS_Extension import slist, alist
@@ -20,6 +19,7 @@ class MainWindow_Controller(QMainWindow):
self.setAttribute(Qt.WA_TranslucentBackground)
self.setWindowFlags(Qt.FramelessWindowHint)
self.pyas = str(sys.argv[0]).replace("\\", "/")
self.pyas_file = os.open(self.pyas, os.O_RDWR)
self.pyas_version = "2.8.4"
self.ui = Ui_MainWindow()
self.ui.setupUi(self)
@@ -755,7 +755,7 @@ class MainWindow_Controller(QMainWindow):
try:
if self.cloud_services == 1:
with open(file, "rb") as f:
text = str(md5(f.read()).hexdigest())
text = str(hashlib.md5(f.read()).hexdigest())
strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
return response.status_code == 200 and float(xmlet.fromstring(response.text).find('.//e_level').text) > 50
@@ -764,8 +764,8 @@ class MainWindow_Controller(QMainWindow):
def sign_scan(self, file):
try:
with PE(file, fast_load=True) as pe:
return pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
with pefile.PE(file, fast_load=True) as pe:
return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
except:
return True
@@ -780,7 +780,7 @@ class MainWindow_Controller(QMainWindow):
def pe_scan(self, file):
try:
fn = []
with PE(file) as pe:
with pefile.PE(file) as pe:
for entry in pe.DIRECTORY_ENTRY_IMPORT:
for func in entry.imports:
try:
@@ -1111,17 +1111,18 @@ class MainWindow_Controller(QMainWindow):
def protect_enh_init(self):
if self.ui.Protection_switch_Button_5.text() == self.trans("已開啟"):
self.enh_protect = False
self.ui.Protection_switch_Button_5.setText(self.trans("已關閉"))
self.ui.Protection_switch_Button_5.setStyleSheet("""
QPushButton{border:none;background-color:rgba(20,20,20,30);border-radius: 15px;}
QPushButton:hover{background-color:rgba(20,20,20,50);}""")
msvcrt.locking(self.pyas_file, msvcrt.LK_UNLCK, os.path.getsize(self.pyas))
os.close(self.pyas_file)
else:
self.enh_protect = True
self.ui.Protection_switch_Button_5.setText(self.trans("已開啟"))
self.ui.Protection_switch_Button_5.setStyleSheet("""
QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
QPushButton:hover{background-color:rgba(20,200,20,120);}""")
msvcrt.locking(self.pyas_file, msvcrt.LK_LOCK, os.path.getsize(self.pyas))
def protect_proc_thread(self):
existing_processes = set()
@@ -1135,18 +1136,17 @@ class MainWindow_Controller(QMainWindow):
if p.pid not in existing_processes:
existing_processes.add(p.pid)
name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
if ":/Windows" in file and self.enh_protect:
if ":/Windows" in file or ":/Program" in file:
if "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
p.kill()
self.send_notify(self.trans("惡意腳本攔截: ")+name)
elif "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
p.kill()
self.send_notify(self.trans("惡意腳本攔截: ")+name)
elif "msiexec.exe" in name and self.api_scan(cmd[-1]):
p.kill()
self.send_notify(self.trans("惡意軟體攔截: ")+name)
elif "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
p.kill()
self.send_notify(self.trans("惡意腳本攔截: ")+name)
elif ":/Program" in file and self.enh_protect:
if self.sign_scan(file) and self.api_scan(file):
elif self.sign_scan(file) and self.api_scan(file):
p.kill()
self.send_notify(self.trans("惡意軟體攔截: ")+name)
elif file != self.pyas and file not in self.whitelist:
PYAS_Function.py
+1 -1
View File
@@ -1 +1 @@
function_list = [['LoadLibraryA', 'GetProcAddress', 'SetUnhandledExceptionFilter', 'GetCurrentProcess', 'TerminateProcess', 'IsProcessorFeaturePresent', 'QueryPerformanceCounter', 'GetCurrentProcessId', 'GetCurrentThreadId', 'GetSystemTimeAsFileTime', 'InitializeSListHead', 'IsDebuggerPresent', 'GetModuleHandleW', 'UnhandledExceptionFilter', 'GetDC', '?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ', '?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z', '?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ', '?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z', '??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ', '?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ', '?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z', '?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ', '?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ', '?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z', '?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z', '??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ', '??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z', '?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z', '?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z', '?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ', '??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ', '?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ', '?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z', '?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z', '??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ', '??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z', '??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ', '?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z', '?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z', '?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ', '?width@ios_base@std@@QAE_J_J@Z', '?width@ios_base@std@@QBE_JXZ', '?flags@ios_base@std@@QBEHXZ', '?good@ios_base@std@@QBE_NXZ', '?always_noconv@codecvt_base@std@@QBE_NXZ', '??Bid@locale@std@@QAEIXZ', '?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z', '??1_Lockit@std@@QAE@XZ', '??0_Lockit@std@@QAE@H@Z', '?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A', '?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ', '?uncaught_exception@std@@YA_NXZ', '?_Xout_of_range@std@@YAXPBD@Z', '?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A', '?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z', '?_Xlength_error@std@@YAXPBD@Z', '?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '_CxxThrowException', '__current_exception_context', '__std_exception_copy', '__std_exception_destroy', '__CxxFrameHandler3', 'memcpy', '__current_exception', 'memset', '_except_handler4_common', 'memmove', '_fseeki64', '__p__commode', 'fsetpos', 'ungetc', 'setvbuf', 'fgetpos', 'fwrite', '_set_fmode', '_get_stream_buffer_pointers', '__stdio_common_vfprintf', 'fgetc', 'fclose', 'fflush', '__acrt_iob_func', 'fputc', 'fread', '_lock_file', '_unlock_file', 'exit', '_exit', '_configure_narrow_argv', '__p___argc', '_initterm_e', '_cexit', '_c_exit', '_register_thread_local_exe_atexit_callback', '_initterm', '_set_app_type', '_get_initial_narrow_environment', '_seh_filter_exe', '_initialize_onexit_table', '_register_onexit_function', '_crt_atexit', '_controlfp_s', 'terminate', '_initialize_narrow_environment', '_invalid_parameter_noinfo_noreturn', '__p___argv', 'free', '_set_new_mode', 'malloc', '_callnewh', '__setusermatherr', '_configthreadlocale'], ['GetCurrentProcess', 'FindNextFileA', 'FindClose', 'GetSystemDirectoryA', 'DeleteFileA', 'SetFileAttributesA', 'ExitProcess', 'FLine truncated
function_list = [['LoadLibraryA', 'GetProcAddress', 'SetUnhandledExceptionFilter', 'GetCurrentProcess', 'TerminateProcess', 'IsProcessorFeaturePresent', 'QueryPerformanceCounter', 'GetCurrentProcessId', 'GetCurrentThreadId', 'GetSystemTimeAsFileTime', 'InitializeSListHead', 'IsDebuggerPresent', 'GetModuleHandleW', 'UnhandledExceptionFilter', 'GetDC', '?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ', '?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z', '?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ', '?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z', '??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ', '?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ', '?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z', '?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ', '?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ', '?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z', '?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z', '??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ', '??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z', '?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z', '?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z', '?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ', '??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ', '?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ', '?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z', '?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z', '??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ', '??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z', '??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ', '?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z', '?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z', '?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ', '?width@ios_base@std@@QAE_J_J@Z', '?width@ios_base@std@@QBE_JXZ', '?flags@ios_base@std@@QBEHXZ', '?good@ios_base@std@@QBE_NXZ', '?always_noconv@codecvt_base@std@@QBE_NXZ', '??Bid@locale@std@@QAEIXZ', '?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z', '??1_Lockit@std@@QAE@XZ', '??0_Lockit@std@@QAE@H@Z', '?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A', '?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ', '?uncaught_exception@std@@YA_NXZ', '?_Xout_of_range@std@@YAXPBD@Z', '?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A', '?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z', '?_Xlength_error@std@@YAXPBD@Z', '?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '_CxxThrowException', '__current_exception_context', '__std_exception_copy', '__std_exception_destroy', '__CxxFrameHandler3', 'memcpy', '__current_exception', 'memset', '_except_handler4_common', 'memmove', '_fseeki64', '__p__commode', 'fsetpos', 'ungetc', 'setvbuf', 'fgetpos', 'fwrite', '_set_fmode', '_get_stream_buffer_pointers', '__stdio_common_vfprintf', 'fgetc', 'fclose', 'fflush', '__acrt_iob_func', 'fputc', 'fread', '_lock_file', '_unlock_file', 'exit', '_exit', '_configure_narrow_argv', '__p___argc', '_initterm_e', '_cexit', '_c_exit', '_register_thread_local_exe_atexit_callback', '_initterm', '_set_app_type', '_get_initial_narrow_environment', '_seh_filter_exe', '_initialize_onexit_table', '_register_onexit_function', '_crt_atexit', '_controlfp_s', 'terminate', '_initialize_narrow_environment', '_invalid_parameter_noinfo_noreturn', '__p___argv', 'free', '_set_new_mode', 'malloc', '_callnewh', '__setusermatherr', '_configthreadlocale'], ['GetCurrentProcess', 'FindNextFileA', 'FindClose', 'GetSystemDirectoryA', 'DeleteFileA', 'SetFileAttributesA', 'ExitProcess', 'FLine truncated