Add files via upload

增加中文

Driver/Install_Driver.bat

@@ -0,0 +1,34 @@
+@echo off
+setlocal
+
+:: Check for permissions
+>nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
+
+if %errorlevel% NEQ 0 goto NoAdmin
+goto gotAdmin
+
+:NoAdmin
+    echo You do not have administrator rights, please run this script as administrator.
+    pause
+    exit /B
+
+:gotAdmin
+    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
+
+set "script_dir=%~dp0"
+set "script_dir=%script_dir:~0,-1%"
+
+bcdedit -debug on
+bcdedit /set testsigning on
+bcdedit /deletevalue {current} safeboot
+
+powershell.exe -ExecutionPolicy Bypass -Command ^
+"$endDate = (Get-Date).AddYears(100); ^
+ $cert = New-SelfSignedCertificate -DnsName PYAS -CertStoreLocation cert:\LocalMachine\My -Type CodeSigning -NotAfter $endDate; ^
+ $pwd = ConvertTo-SecureString -String 'PYAS' -Force -AsPlainText; ^
+ Export-PfxCertificate -Cert $cert -FilePath '%script_dir%\PYAS.pfx' -Password $pwd;"
+"%script_dir%\signtool.exe" sign /f "%script_dir%\PYAS.pfx" /p PYAS "%script_dir%\PYAS_Driver.sys"
+sc create PYAS_Driver type= kernel start= demand binPath= "%script_dir%\PYAS_Driver.sys"
+
+shutdown -r -t 0
+endlocal

Driver/Uninstall_Driver.bat

@@ -0,0 +1,25 @@
+@echo off
+setlocal
+
+:: Check for permissions
+>nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
+
+if %errorlevel% NEQ 0 goto NoAdmin
+goto gotAdmin
+
+:NoAdmin
+    echo You do not have administrator rights, please run this script as administrator.
+    pause
+    exit /B
+
+:gotAdmin
+    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
+
+sc stop PYAS_Driver
+sc delete PYAS_Driver
+
+bcdedit /set testsigning off
+bcdedit -debug off
+
+shutdown -r -t 0
+endlocal

LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020-2024 87owo (PYAS Security)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Model/PYAS_Model.json

@@ -0,0 +1 @@
+{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 27853809242729492000984914092533936796891917926358854729439436487683423285261, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 60491018752293550079699763462944244393253888103551546202593483014975813742967, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 6759146298068049614085390992799666053918974602489525613718797088468975708017, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 5354562433688861244299028006341553420425390015040147574513776499404802540118, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 817984956081990458969224676381868506770627801582748844000835755782736667191, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 2916561284514958799877078174216081002558870786437593202464334407456915288119, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 14623491695050192413097067629676318500123044497134202517578785087180871258165, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 79047998258892679051555952202178856054614923426747250310189496005785954516966, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707Line truncated

PYAS_Engine.py

@@ -0,0 +1,84 @@
+import time, json, hashlib, numpy
+from collections import Counter
+
+class ListSimHash:
+    def __init__(self):
+        self.model = {}
+
+    def save_model(self, file_name):
+        with open(file_name, 'w') as f:
+            json.dump(self.model, f)
+        print(f"\nModel Is Saved In {file_name}")
+
+    def load_model(self, model_data):
+        if isinstance(model_data, str):
+            with open(model_data, 'r') as f:
+                model_data = json.load(f)
+        self.model = model_data
+
+    def get_model(self, label):
+        return self.model[label]
+
+    def train_model(self, label, data):
+        start = time.time()
+        print(f"Convert {label}")
+        if label not in self.model:
+            self.model[label] = []
+        for i, x in enumerate(data, 1):
+            self.model[label].append(self.build_text(x))
+            used = "{0:.2f}".format(time.time()-start)
+            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
+            self.progress_bar(i, len(data), prefix, suffix)
+
+    def build_text(self, content):
+        sums, batch, count = [], [], 0
+        features = dict(Counter(sorted(content)))
+        for f, w in features.items():
+            count += w
+            batch.append(hashlib.sha256(json.dumps(f).encode('utf-8')).digest() * w)
+            if len(batch) >= 10000:
+                sums.append(self.sum_hashes(batch))
+                batch = []
+        if batch:
+            sums.append(self.sum_hashes(batch))
+        combined_sums = numpy.sum(sums, 0)
+        v = numpy.packbits(combined_sums > count / 2).tobytes()
+        return int.from_bytes(v, 'big')
+
+    def sum_hashes(self, digests):
+        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
+        return numpy.sum(numpy.reshape(bitarray, (-1, 256)), 0)
+
+    def progress_bar(self, items, total, prefix='', suffix='', length=50, fill='█'):
+        percent = min(100.0, max(0.0, 100 * (items / float(total))))
+        end_char = '\n' if percent >= 100 else '\r'
+        percent_string = "{0:.2f}".format(percent)
+        filled_length = int(length * items // total)
+        bar = fill * filled_length + ' ' * (length - filled_length)
+        print(f'\r{prefix: <15} |{bar}| {percent_string}% {suffix}', end=end_char)
+
+    def predict_all(self, query):
+        label_similarities = {}
+        query_hash = self.build_text(query)
+        for label in self.model:
+            max_similarity = 0
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity = similarity
+            label_similarities[label] = max_similarity
+        return label_similarities
+
+    def predict(self, query):
+        max_similarity, max_label = 0, None
+        query_hash = self.build_text(query)
+        for label in self.model:
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity, max_label = similarity, label
+        return max_label, max_similarity
+
+    def similar(self, x, y):
+        hamming_distance = bin(x ^ y).count('1')
+        return 1 - hamming_distance / 256

PYAS_Extension.py

@@ -0,0 +1,8 @@
+slist = [".exe",".dll",".com",".msi",".scr",
+         ".js",".bat",".cmd",".ps1",".vbs"]
+
+alist = [".ppt",".pptx",".wps",".txt",".rtf",
+         ".pdf",".xls",".xlsx",".doc",".docx",
+         ".jpg",".jpeg",".png",".webp",".gif",
+         ".mp3",".wav",".aac",".ogg",".flac",
+         ".mp4",".avi",".mov",".wmv",".mkv"]

PYAS_Language.py

@@ -0,0 +1,55 @@
+translate_dict = {
+    "zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"已開啟","Off":"已關閉"},
+    "zh_CN": {"已開啟":"已开启","已關閉":"已关闭","On":"已开启","Off":"已关闭",
+              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
+              "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
+              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
+              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","誤":"误","報":"报",
+              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
+              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
+              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
+              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
+              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
+              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
+              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
+              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
+              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
+              "強":"强","驅":"驱","為":"为","腳":"脚","增":"增","單":"单","開":"开",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别"},
+    "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
+              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website ",
+              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索行為":"Ransom ",
+              "惡意腳本":"Script ","惡意行為":"Behavior ","可疑軟體":"Suspicious ",
+              "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
+              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
+              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
+              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
+              "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
+              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Communication ",
+              "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
+              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
+              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
+              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
+              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhanced ",
+              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
+              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
+              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
+              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
+              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"To ",
+              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
+              "分區":"Partition ","設定":"Settings","關於":"About","模式":"Mode ",
+              "提高":"Improve ","安全":"Security ","顯色":"Color ","主題":"Themes ",
+              "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
+              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
+              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
+              "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
+              "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
+              "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
+              "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
+              "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
+              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
+              "自動":"Auto ","上報":"Report ","分析":"Analysis ","  ":" "}}

PYAS_Version.py

@@ -0,0 +1,11 @@
+import pyinstaller_versionfile
+
+pyinstaller_versionfile.create_versionfile(
+output_file="versionfile.txt",
+version='3.1.2',
+company_name="PYAS Security",
+file_description="Python Antivirus Software",
+internal_name="PYAS",
+legal_copyright="PYAS Security",
+original_filename="PYAS.exe",
+product_name="PYAS")

README.md

@@ -1,12 +1,176 @@
-PYAS ( Python 免費殺毒軟體 )
+# PYAS (Python Antivirus Software)
 
-PYAS 免費防毒軟體使用 Python 程式語言開發，包含超過 15 種免費功能
-且不會拖慢您的電腦速度，也不造成干擾，並採用 PYAE V1.2.3 掃毒引擎。
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
 
-網站:
+## Readme Language
+
+[繁體中文](https://github.com/87owo/PYAS/blob/main/README_zh_TW.md) , 
+[简体中文](https://github.com/87owo/PYAS/blob/main/README_zh_CN.md)
+
+## File Information
+
+PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
+
+PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
+
+PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
+
+PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
+
+PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
+
+PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
+
+PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
+
+PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
+
+## Dir Information
+
+```
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json
+│   ├── PYAS_Model.txt
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar
+│   ├── Compile_Rules.yrc
+│   └── ...
+│
+├── PYAS.py
+├── PYAS_Engine.py
+└── ...
+```
+
+## Requirements
+
+Use pip install requirements to install import module
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## Pefile Scanning
+
+Get the pefile file function import table for scanning
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## Process Detect
+
+Show the new process name, file path, cmd line, pid
+
+```
+import psutil, time
+
+def proc_detect():
+    existing_process = set()
+    for p in psutil.process_iter():
+        existing_process.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        new_process = set()
+        for p in psutil.process_iter():
+            new_process.add(p.pid)
+        for pid in new_process - existing_process:
+            try:
+                p = psutil.Process(pid)
+                name, file, cmd = p.name(), p.exe(), p.cmdline()
+                print(f"Name: {name}")
+                print(f"File: {file}")
+                print(f"Pid: {p.pid}")
+                print(f"Cmd: {cmd}")
+            except Exception as e:
+                print(f"Error: {e}")
+        existing_process = new_process
+
+proc_detect()
+```
+
+## File Detect
+
+Monitor file changes under the specified path
+
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## Official Website
+
+https://pyantivirus.wixsite.com/pyas
 
-https://xiaomi69ai.wixsite.com/pyas , 
 https://github.com/87owo/PYAS
 
-特別感謝: 
-Wix, Avast, Github, Google, Python, Microsoft, VirusTotal, VirusShare, LenStevens
+## PYAS Driver
+
+https://github.com/0sha0/PYAS_Protection
+
+## MIT license
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## Support System
+
+Windows 8.1, 10, 11 (64-bit), Ram 500MB, Rom 200MB or higher
+
+Other systems may experience software malfunctions or crash
+
+## Special Thanks
+
+Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo

README_zh_CN.md

@@ -0,0 +1,171 @@
+# PYAS (Python 杀毒软件)
+
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+
+## 文件信息
+
+PYAS.py -> PYAS主程式（包括动画、扫描、保护功能等）
+
+PYAS_Engine.py -> 转换资料库（用于相互转换资料库字典和清单）
+
+PYAS_Extension.py -> 副文件名（包括扫描文件副文件名和常用副文件名）
+
+PYAS_Model.* -> 病毒库（病毒库必须放在同一目录下）
+
+PYAS_Interface.py -> PyQt5界面（由QT设计师设计，必须与主程式相符）
+
+PYAS_Resource.py -> PyQt5资源（状态图片、图示包、按钮图示等）
+
+PYAS_Language.py -> 翻译字典（繁体中文、简体中文、英文）
+
+PYAS_Version.py -> Pyinstaller资讯（文件资讯、版本资讯、原名等）
+
+## 目录信息
+
+```
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json
+│   ├── PYAS_Model.txt
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar
+│   ├── Compile_Rules.yrc
+│   └── ...
+│
+├── PYAS.py
+├── PYAS_Engine.py
+└── ...
+```
+
+## 安装要求
+
+使用 pip install requirements 来安装需要的模组
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## 文件扫描
+
+取得pefile文件函数导入表进行扫描
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## 进程监控
+
+显示新进程名称、文件路径、cmd 行、pid
+
+```
+import psutil, time
+
+def proc_detect():
+    existing_process = set()
+    for p in psutil.process_iter():
+        existing_process.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        new_process = set()
+        for p in psutil.process_iter():
+            new_process.add(p.pid)
+        for pid in new_process - existing_process:
+            try:
+                p = psutil.Process(pid)
+                name, file, cmd = p.name(), p.exe(), p.cmdline()
+                print(f"Name: {name}")
+                print(f"File: {file}")
+                print(f"Pid: {p.pid}")
+                print(f"Cmd: {cmd}")
+            except Exception as e:
+                print(f"Error: {e}")
+        existing_process = new_process
+
+proc_detect()
+```
+
+## 文件监控
+
+监控指定路径下的文件变化
+
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## 官方网页
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 开源协议
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 驱动程序
+
+https://github.com/0sha0/PYAS_Protection
+
+## 支援系统
+
+Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
+
+其他系统或版本可能会遇到软体功能故障或程序崩溃
+
+## 特别感谢
+
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo

README_zh_TW.md

@@ -0,0 +1,169 @@
+# PYAS (Python 防毒軟體)
+
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+
+## 檔案資訊
+
+PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
+
+PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
+
+PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
+
+PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
+
+PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
+
+PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
+
+PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
+
+PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
+
+## 目錄資訊
+
+```
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json
+│   ├── PYAS_Model.txt
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar
+│   ├── Compile_Rules.yrc
+│   └── ...
+│
+├── PYAS.py
+├── PYAS_Engine.py
+└── ...
+```
+
+## 安裝要求
+
+使用 pip install requirements 來安裝需要的模組
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## 檔案掃描
+
+取得pefile檔案函數導入表進行掃描
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## 進程監控
+
+顯示新進程名稱、檔案路徑、cmd 行、pid
+```
+import psutil, time
+
+def proc_detect():
+    existing_process = set()
+    for p in psutil.process_iter():
+        existing_process.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        new_process = set()
+        for p in psutil.process_iter():
+            new_process.add(p.pid)
+        for pid in new_process - existing_process:
+            try:
+                p = psutil.Process(pid)
+                name, file, cmd = p.name(), p.exe(), p.cmdline()
+                print(f"Name: {name}")
+                print(f"File: {file}")
+                print(f"Pid: {p.pid}")
+                print(f"Cmd: {cmd}")
+            except Exception as e:
+                print(f"Error: {e}")
+        existing_process = new_process
+
+proc_detect()
+```
+
+## 檔案監控
+
+監控指定路徑下的檔案變化
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## 官方網頁
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 開源協議
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 驅動程式
+
+https://github.com/0sha0/PYAS_Protection
+
+## 支援系統
+
+Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
+
+其他系統或版本可能會遇到軟體功能故障或程序崩潰
+
+## 特別感謝
+
+Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo