|
|
|
@@ -5,7 +5,7 @@
|
|
|
|
|
# PYAS Web: https://pyantivirus.wixsite.com/pyas
|
|
|
|
|
#
|
|
|
|
|
# PYAS is managed by PYDT (Python Development Team)
|
|
|
|
|
# Copyright© 2022 87owo (PYAS Security)
|
|
|
|
|
# Copyright© 2020-2022 87owo (PYAS Security)
|
|
|
|
|
####################################################################################
|
|
|
|
|
#
|
|
|
|
|
###################################### 錯誤日誌 #####################################
|
|
|
|
@@ -24,8 +24,9 @@ def pyas_bug_log(e):
|
|
|
|
|
try:
|
|
|
|
|
import time
|
|
|
|
|
start_m = time.time()
|
|
|
|
|
import os, sys, psutil, subprocess, cryptocode, threading, configparser, datetime
|
|
|
|
|
import os, sys, psutil, subprocess, threading, configparser, datetime
|
|
|
|
|
from pefile import PE, DIRECTORY_ENTRY
|
|
|
|
|
from win10toast import ToastNotifier
|
|
|
|
|
from hashlib import md5, sha1, sha256
|
|
|
|
|
from PYAS_English import english_list
|
|
|
|
|
from PyQt5.QtWidgets import *
|
|
|
|
@@ -39,38 +40,20 @@ except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
print('[LOAD] Mods: '+str(time.time()-start_m)+' sec')
|
|
|
|
|
|
|
|
|
|
###################################### 密鑰認證 #####################################
|
|
|
|
|
##################################### 移除暫存檔 ####################################
|
|
|
|
|
|
|
|
|
|
def pyas_key():
|
|
|
|
|
start = time.time()
|
|
|
|
|
def pyasb_remove():
|
|
|
|
|
try:
|
|
|
|
|
try:
|
|
|
|
|
with open('PYAS.exe',"rb") as f:
|
|
|
|
|
bytes = f.read()
|
|
|
|
|
readable_hash = str(md5(bytes).hexdigest())
|
|
|
|
|
f.close()
|
|
|
|
|
except:
|
|
|
|
|
with open('PYAS.py',"rb") as f:
|
|
|
|
|
bytes = f.read()
|
|
|
|
|
readable_hash = str(md5(bytes).hexdigest())
|
|
|
|
|
f.close()
|
|
|
|
|
try:
|
|
|
|
|
ft = open('Library/PYAS/Setup/PYAS.key','r')
|
|
|
|
|
fe = ft.read()
|
|
|
|
|
ft.close()
|
|
|
|
|
if fe == readable_hash:
|
|
|
|
|
print('[LOAD] Key: '+str(time.time()-start)+' sec')
|
|
|
|
|
return True
|
|
|
|
|
else:
|
|
|
|
|
print('[LOAD] Key: '+str(time.time()-start)+' sec')
|
|
|
|
|
return False
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
print('[LOAD] Key: '+str(time.time()-start)+' sec')
|
|
|
|
|
return False
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASB.log')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def pyasp_remove():
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASP.tmp')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
##################################### 資料庫檢查 ####################################
|
|
|
|
|
|
|
|
|
|
def pyas_library():
|
|
|
|
@@ -91,20 +74,6 @@ def pyas_library():
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
##################################### 移除暫存檔 ####################################
|
|
|
|
|
|
|
|
|
|
def pyasb_remove():
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASB.log')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def pyasp_remove():
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASP.tmp')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
##################################### 更新資料庫 ####################################
|
|
|
|
|
|
|
|
|
|
def pyas_vl_update():
|
|
|
|
@@ -150,6 +119,41 @@ def pyas_vl_update():
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
sys.exit()
|
|
|
|
|
|
|
|
|
|
###################################### 密鑰認證 #####################################
|
|
|
|
|
|
|
|
|
|
def pyas_key():
|
|
|
|
|
start = time.time()
|
|
|
|
|
try:
|
|
|
|
|
if os.path.isfile('Library/PYAS/Setup/PYAS.key'):
|
|
|
|
|
try:
|
|
|
|
|
with open('PYAS.exe',"rb") as f:
|
|
|
|
|
bytes = f.read()
|
|
|
|
|
readable_hash = str(md5(bytes).hexdigest())
|
|
|
|
|
f.close()
|
|
|
|
|
except:
|
|
|
|
|
with open('PYAS.py',"rb") as f:
|
|
|
|
|
bytes = f.read()
|
|
|
|
|
readable_hash = str(md5(bytes).hexdigest())
|
|
|
|
|
f.close()
|
|
|
|
|
try:
|
|
|
|
|
ft = open('Library/PYAS/Setup/PYAS.key','r')
|
|
|
|
|
fe = ft.read()
|
|
|
|
|
ft.close()
|
|
|
|
|
if fe == readable_hash:
|
|
|
|
|
print('[LOAD] Key: '+str(time.time()-start)+' sec')
|
|
|
|
|
return True
|
|
|
|
|
else:
|
|
|
|
|
print('[LOAD] Key: '+str(time.time()-start)+' sec')
|
|
|
|
|
return False
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
else:
|
|
|
|
|
return False
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
print('[LOAD] Key: '+str(time.time()-start)+' sec')
|
|
|
|
|
return False
|
|
|
|
|
|
|
|
|
|
###################################### 主要程式 #####################################
|
|
|
|
|
|
|
|
|
|
class MainWindow_Controller(QtWidgets.QMainWindow):#,FileSystemEventHandler):
|
|
|
|
@@ -326,7 +330,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):#,FileSystemEventHandler):
|
|
|
|
|
|
|
|
|
|
###################################### 許可條款 #####################################
|
|
|
|
|
|
|
|
|
|
self.ui.License_terms.setText('''Copyright (C) 2022 87owo (PYAS Security)
|
|
|
|
|
self.ui.License_terms.setText('''Copyright (C) 2020-2022 87owo (PYAS Security)
|
|
|
|
|
=====================================================
|
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
|
|
|
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
|
|
@@ -347,7 +351,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.effect_shadow3.setColor(QtCore.Qt.gray)
|
|
|
|
|
self.ui.Window_widget.setGraphicsEffect(self.effect_shadow3)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
self.ui.Virus_Scan_choose_widget.hide()#hide()函數的用意是隱藏物件
|
|
|
|
|
self.ui.Virus_Scan_widget.hide()
|
|
|
|
|
self.ui.Tools_widget.hide()
|
|
|
|
@@ -402,11 +405,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.Window_title.setText(_translate("MainWindow", "PYAS V"+pyas_version))
|
|
|
|
|
now_time = datetime.datetime.now()
|
|
|
|
|
try:
|
|
|
|
|
ft = open('Library/PYAS/Temp/PYASP.tmp','r',encoding='utf-8')
|
|
|
|
|
fe = ft.read()
|
|
|
|
|
ft.close()
|
|
|
|
|
except:
|
|
|
|
|
if not os.path.isfile('Library/PYAS/Temp/PYASP.tmp'):
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.State_output.append(str(now_time.strftime('%Y/%m/%d %H:%M:%S')) + ' > [Tips] Real-time Protect is not enabled')
|
|
|
|
|
else:
|
|
|
|
@@ -494,7 +493,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
cy = datetime.datetime.now().strftime('%Y')
|
|
|
|
|
if int(cy) < 2020:
|
|
|
|
|
cy = str('2020')
|
|
|
|
|
self.ui.PYAS_CopyRight.setText(_translate("MainWindow", "Copyright© "+str(cy)+" 87owo (PYAS Security)"))
|
|
|
|
|
self.ui.PYAS_CopyRight.setText(_translate("MainWindow", "Copyright© 2020-"+str(cy)+" 87owo (PYAS Security)"))
|
|
|
|
|
try:
|
|
|
|
|
vl = open('Library/PYAE/Hashes/Viruslist.num','r').read()
|
|
|
|
|
if int(vl)-1 < 0:
|
|
|
|
@@ -545,11 +544,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.Window_title.setText(_translate("MainWindow", "PYAS V"+pyas_version))
|
|
|
|
|
now_time = datetime.datetime.now()
|
|
|
|
|
try:
|
|
|
|
|
ft = open('Library/PYAS/Temp/PYASP.tmp','r',encoding='utf-8')
|
|
|
|
|
fe = ft.read()
|
|
|
|
|
ft.close()
|
|
|
|
|
except:
|
|
|
|
|
if not os.path.isfile('Library/PYAS/Temp/PYASP.tmp'):
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.State_output.append(str(now_time.strftime('%Y/%m/%d %H:%M:%S')) + ' > [提示] 尚未启用实时防护')
|
|
|
|
|
else:
|
|
|
|
@@ -590,7 +585,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.System_Process_Manage_Button.setText(_translate("MainWindow", "系统进程管理"))
|
|
|
|
|
self.ui.Repair_System_Permission_Button.setText(_translate("MainWindow", "修复系统权限"))
|
|
|
|
|
self.ui.Repair_System_Files_Button.setText(_translate("MainWindow", "修复系统档案"))
|
|
|
|
|
self.ui.Clean_System_Files_Button.setText(_translate("MainWindow", "清理系统档案"))
|
|
|
|
|
self.ui.Clean_System_Files_Button.setText(_translate("MainWindow", "清理系统垃圾"))
|
|
|
|
|
self.ui.Enable_Safe_Mode_Button.setText(_translate("MainWindow", "启动安全模式"))
|
|
|
|
|
self.ui.Disable_Safe_Mode_Button.setText(_translate("MainWindow", "关闭安全模式"))
|
|
|
|
|
self.ui.System_Info_Button.setText(_translate("MainWindow", "系统版本资讯"))
|
|
|
|
@@ -637,7 +632,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
cy = datetime.datetime.now().strftime('%Y')
|
|
|
|
|
if int(cy) < 2020:
|
|
|
|
|
cy = str('2020')
|
|
|
|
|
self.ui.PYAS_CopyRight.setText(_translate("MainWindow", "Copyright© "+str(cy)+" 87owo (PYAS Security)"))
|
|
|
|
|
self.ui.PYAS_CopyRight.setText(_translate("MainWindow", "Copyright© 2020-"+str(cy)+" 87owo (PYAS Security)"))
|
|
|
|
|
try:
|
|
|
|
|
vl = open('Library/PYAE/Hashes/Viruslist.num','r').read()
|
|
|
|
|
if int(vl)-1 < 0:
|
|
|
|
@@ -688,11 +683,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.Window_title.setText(_translate("MainWindow", "PYAS V"+pyas_version))
|
|
|
|
|
now_time = datetime.datetime.now()
|
|
|
|
|
try:
|
|
|
|
|
ft = open('Library/PYAS/Temp/PYASP.tmp','r',encoding='utf-8')
|
|
|
|
|
fe = ft.read()
|
|
|
|
|
ft.close()
|
|
|
|
|
except:
|
|
|
|
|
if not os.path.isfile('Library/PYAS/Temp/PYASP.tmp'):
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.State_output.append(str(now_time.strftime('%Y/%m/%d %H:%M:%S')) + ' > [提示] 尚未啟用實時防護')
|
|
|
|
|
else:
|
|
|
|
@@ -733,7 +724,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.System_Process_Manage_Button.setText(_translate("MainWindow", "系統進程管理"))
|
|
|
|
|
self.ui.Repair_System_Permission_Button.setText(_translate("MainWindow", "修復系統權限"))
|
|
|
|
|
self.ui.Repair_System_Files_Button.setText(_translate("MainWindow", "修復系統檔案"))
|
|
|
|
|
self.ui.Clean_System_Files_Button.setText(_translate("MainWindow", "清理系統檔案"))
|
|
|
|
|
self.ui.Clean_System_Files_Button.setText(_translate("MainWindow", "清理系統垃圾"))
|
|
|
|
|
self.ui.Enable_Safe_Mode_Button.setText(_translate("MainWindow", "啟動安全模式"))
|
|
|
|
|
self.ui.Disable_Safe_Mode_Button.setText(_translate("MainWindow", "關閉安全模式"))
|
|
|
|
|
self.ui.System_Info_Button.setText(_translate("MainWindow", "系統版本資訊"))
|
|
|
|
@@ -780,7 +771,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
cy = datetime.datetime.now().strftime('%Y')
|
|
|
|
|
if int(cy) < 2020:
|
|
|
|
|
cy = str('2020')
|
|
|
|
|
self.ui.PYAS_CopyRight.setText(_translate("MainWindow", "Copyright© "+str(cy)+" 87owo (PYAS Security)"))
|
|
|
|
|
self.ui.PYAS_CopyRight.setText(_translate("MainWindow", "Copyright© 2020-"+str(cy)+" 87owo (PYAS Security)"))
|
|
|
|
|
try:
|
|
|
|
|
vl = open('Library/PYAE/Hashes/Viruslist.num','r').read()
|
|
|
|
|
if int(vl)-1 < 0:
|
|
|
|
@@ -840,6 +831,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
text = text.replace("軟體","软件")
|
|
|
|
|
text = text.replace("惡意","恶意")
|
|
|
|
|
text = text.replace("設定","设置")
|
|
|
|
|
text = text.replace("密鑰","密钥")
|
|
|
|
|
text = text.replace("關於","关于")
|
|
|
|
|
text = text.replace("當前","当前")
|
|
|
|
|
text = text.replace("確定","确定")
|
|
|
|
@@ -1064,7 +1056,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
def Virus_Solve(self):
|
|
|
|
|
try:
|
|
|
|
|
for line in self.Virus_List:
|
|
|
|
|
if 'C:/Windows' in str(line):
|
|
|
|
|
if ':/Windows' in str(line):
|
|
|
|
|
pass
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate('正在刪除: ')+str(line))
|
|
|
|
@@ -1100,31 +1092,28 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
return 0
|
|
|
|
|
|
|
|
|
|
def pyas_scan_start(self,file,rfp):
|
|
|
|
|
def pyas_scan_start(self,file,rfp):#MD5較驗
|
|
|
|
|
try:
|
|
|
|
|
with open(file,"rb") as f:
|
|
|
|
|
if str(md5(f.read()).hexdigest())[:10] in str(rfp):
|
|
|
|
|
f.close()
|
|
|
|
|
return True
|
|
|
|
|
return True#回傳是病毒
|
|
|
|
|
else:
|
|
|
|
|
return False
|
|
|
|
|
return False#回傳不是病毒
|
|
|
|
|
except:
|
|
|
|
|
return False
|
|
|
|
|
return False#回傳不是病毒
|
|
|
|
|
|
|
|
|
|
def pyas_sign_start(self,file):
|
|
|
|
|
def pyas_sign_start(self,file):#簽名檢查
|
|
|
|
|
try:
|
|
|
|
|
pe = PE(file,fast_load=True)
|
|
|
|
|
if pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_SECURITY']].VirtualAddress == 0:
|
|
|
|
|
pe.close()
|
|
|
|
|
#print('UNsign: '+file)
|
|
|
|
|
return True
|
|
|
|
|
return True#回傳未簽名
|
|
|
|
|
else:
|
|
|
|
|
pe.close()
|
|
|
|
|
#print('sign: '+file)
|
|
|
|
|
return False
|
|
|
|
|
return False#回傳已簽名
|
|
|
|
|
except:
|
|
|
|
|
#print('ERsign: '+file)
|
|
|
|
|
return True
|
|
|
|
|
return True#回傳未簽名
|
|
|
|
|
|
|
|
|
|
#定義紀錄掃描
|
|
|
|
|
def pyas_scan_write_en(self,file):
|
|
|
|
@@ -1173,6 +1162,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
ft.close()
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def pyas_del_virus_temp(self):
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASV.tmp')
|
|
|
|
|
except:
|
|
|
|
@@ -1182,6 +1173,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
|
|
|
|
|
def File_Scan(self):
|
|
|
|
|
print('[SCAN] Start Scan Action (File Scan)')
|
|
|
|
|
self.pyas_del_virus_temp()
|
|
|
|
|
self.ui.Virus_Scan_choose_widget.hide()
|
|
|
|
|
self.ui.Virus_Scan_Solve_Button.hide()
|
|
|
|
|
self.ui.Virus_Scan_ProgressBar.hide()
|
|
|
|
@@ -1191,102 +1183,59 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
|
|
|
|
|
file, filetype= QFileDialog.getOpenFileName(self,self.text_Translate("病毒掃描"),"C:/",'')
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASV.tmp')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
if file != "":
|
|
|
|
|
try:
|
|
|
|
|
if file != "":
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中,請稍後..."))
|
|
|
|
|
self.Virus_Scan = 1
|
|
|
|
|
self.ui.Virus_Scan_choose_Button.hide()
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
try:
|
|
|
|
|
print('[INFO] Reading Viruslist Database')
|
|
|
|
|
with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
rfp = fp.read()
|
|
|
|
|
fp.close()
|
|
|
|
|
if self.show_virus_scan_progress_bar != 0:
|
|
|
|
|
with open('Library/PYAE/Function/Viruslist.func','r') as fn:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
rfn = fn.read()
|
|
|
|
|
fn.close()
|
|
|
|
|
else:
|
|
|
|
|
rfn = ''
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
if self.show_virus_scan_progress_bar == 0:
|
|
|
|
|
if self.pyas_sign_start(file):
|
|
|
|
|
if self.pyas_scan_start(file,rfp):
|
|
|
|
|
self.pyas_scan_write_en(file)
|
|
|
|
|
print('[INFO] Reading Viruslist Database')#讀取
|
|
|
|
|
with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
|
|
|
|
|
rfp = fp.read()
|
|
|
|
|
fp.close()
|
|
|
|
|
if self.show_virus_scan_progress_bar != 0:
|
|
|
|
|
with open('Library/PYAE/Function/Viruslist.func','r') as fn:
|
|
|
|
|
rfn = fn.read()
|
|
|
|
|
fn.close()
|
|
|
|
|
else:
|
|
|
|
|
rfn = ''
|
|
|
|
|
if self.show_virus_scan_progress_bar == 0:#確認是否高靈敏
|
|
|
|
|
if self.pyas_sign_start(file):#簽名檢查
|
|
|
|
|
if self.pyas_scan_start(file,rfp):#MD5較驗
|
|
|
|
|
self.pyas_scan_write_en(file)#寫入發現病毒
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("✖當前已發現惡意軟體。"))
|
|
|
|
|
else:
|
|
|
|
|
fts = False
|
|
|
|
|
try:
|
|
|
|
|
if self.pyas_sign_start(file):
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:
|
|
|
|
|
if self.pyas_scan_start(file,rfp):#MD5較驗
|
|
|
|
|
self.pyas_scan_write_en(file)#寫入發現病毒
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("✖當前已發現惡意軟體。"))
|
|
|
|
|
else:#未發現病毒
|
|
|
|
|
fts = False
|
|
|
|
|
pe = PE(file)
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:#函數檢測
|
|
|
|
|
for function in entry.imports:
|
|
|
|
|
if fts != True:
|
|
|
|
|
if str(function.name.decode('utf-8')) in rfn:
|
|
|
|
|
fts = True
|
|
|
|
|
pe.close()
|
|
|
|
|
if fts:
|
|
|
|
|
self.pyas_scan_write_en(file)
|
|
|
|
|
self.pyas_scan_write_en(file)#寫入發現病毒
|
|
|
|
|
fts = False
|
|
|
|
|
print('[SCAN] Malware has been detected')
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("✖當前已發現惡意軟體。"))
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
self.pyas_scan_answer_en()
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
|
|
|
|
|
|
|
|
|
|
##################################### 路徑掃描 #####################################
|
|
|
|
|
|
|
|
|
|
def pyas_scan_path_en(self,path,rfp,rfn,fts):
|
|
|
|
|
try:
|
|
|
|
|
for fd in os.listdir(path):
|
|
|
|
|
try:
|
|
|
|
|
if self.Virus_Scan == 0:
|
|
|
|
|
self.ui.Virus_Scan_Break_Button.hide()
|
|
|
|
|
break
|
|
|
|
|
else:
|
|
|
|
|
fullpath = os.path.join(path,fd)
|
|
|
|
|
if os.path.isdir(fullpath):
|
|
|
|
|
self.pyas_scan_path_en(fullpath,rfp,rfn,fts)
|
|
|
|
|
else:
|
|
|
|
|
try:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("正在掃描: ")+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.show_virus_scan_progress_bar == 0:
|
|
|
|
|
if self.pyas_sign_start(fullpath):
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):
|
|
|
|
|
self.pyas_scan_write_en(fullpath)
|
|
|
|
|
else:
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):
|
|
|
|
|
self.pyas_scan_write_en(fullpath)
|
|
|
|
|
else:
|
|
|
|
|
pe = PE(fullpath,fast_load=True)
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:
|
|
|
|
|
for function in entry.imports:
|
|
|
|
|
if fts != True:
|
|
|
|
|
if str(function.name.decode('utf-8')) in rfn:
|
|
|
|
|
fts = True
|
|
|
|
|
if fts:
|
|
|
|
|
self.pyas_scan_write_en(fullpath)
|
|
|
|
|
fts = False
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
except:
|
|
|
|
|
continue
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def Path_Scan(self):
|
|
|
|
|
print('[SCAN] Start Scan Action (Path Scan)')
|
|
|
|
|
self.pyas_del_virus_temp()
|
|
|
|
|
self.ui.Virus_Scan_choose_widget.hide()
|
|
|
|
|
self.ui.Virus_Scan_Solve_Button.hide()
|
|
|
|
|
self.ui.Virus_Scan_ProgressBar.hide()
|
|
|
|
@@ -1299,45 +1248,77 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.Virus_List_output=QStringListModel()
|
|
|
|
|
self.Virus_List_output.setStringList(self.Virus_List)
|
|
|
|
|
self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
|
|
|
|
|
file = QFileDialog.getExistingDirectory(self,self.text_Translate("病毒掃描"),"C:/")
|
|
|
|
|
file = QFileDialog.getExistingDirectory(self,self.text_Translate("病毒掃描"),"C:/")
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASV.tmp')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
if file != "":
|
|
|
|
|
try:
|
|
|
|
|
if file != "":
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中,請稍後..."))
|
|
|
|
|
self.Virus_Scan = 1
|
|
|
|
|
self.ui.Virus_Scan_choose_Button.hide()
|
|
|
|
|
self.ui.Virus_Scan_Break_Button.show()
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
try:
|
|
|
|
|
print('[INFO] Reading Viruslist Database')
|
|
|
|
|
with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
rfp = fp.read()
|
|
|
|
|
fp.close()
|
|
|
|
|
if self.show_virus_scan_progress_bar != 0:
|
|
|
|
|
with open('Library/PYAE/Function/Viruslist.func','r') as fn:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
rfn = fn.read()
|
|
|
|
|
fn.close()
|
|
|
|
|
else:
|
|
|
|
|
rfn = ''
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
print('[INFO] Reading Viruslist Database')#讀取
|
|
|
|
|
with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
|
|
|
|
|
rfp = fp.read()
|
|
|
|
|
fp.close()
|
|
|
|
|
if self.show_virus_scan_progress_bar != 0:
|
|
|
|
|
with open('Library/PYAE/Function/Viruslist.func','r') as fn:
|
|
|
|
|
rfn = fn.read()
|
|
|
|
|
fn.close()
|
|
|
|
|
else:
|
|
|
|
|
rfn = ''
|
|
|
|
|
self.pyas_scan_path_en(file,rfp,rfn,False)
|
|
|
|
|
self.pyas_scan_answer_en()
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
|
|
|
|
|
|
|
|
|
|
def pyas_scan_path_en(self,path,rfp,rfn,fts):
|
|
|
|
|
try:
|
|
|
|
|
for fd in os.listdir(path):#遍歷檔案
|
|
|
|
|
try:
|
|
|
|
|
if self.Virus_Scan == 0:
|
|
|
|
|
self.ui.Virus_Scan_Break_Button.hide()
|
|
|
|
|
break
|
|
|
|
|
else:
|
|
|
|
|
fullpath = str(os.path.join(path,fd)).replace("\\", "/")
|
|
|
|
|
if os.path.isdir(fullpath):#資料夾 深入遍歷
|
|
|
|
|
self.pyas_scan_path_en(fullpath,rfp,rfn,fts)
|
|
|
|
|
else:#檔案
|
|
|
|
|
try:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("正在掃描: ")+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.show_virus_scan_progress_bar == 0:#確認是否高靈敏
|
|
|
|
|
if self.pyas_sign_start(fullpath):#簽名檢查
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):#MD5較驗
|
|
|
|
|
self.pyas_scan_write_en(fullpath)#寫入發現病毒
|
|
|
|
|
else:
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):#MD5較驗
|
|
|
|
|
self.pyas_scan_write_en(fullpath)#寫入發現病毒
|
|
|
|
|
else:
|
|
|
|
|
pe = PE(fullpath)#函數檢測
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:
|
|
|
|
|
for function in entry.imports:
|
|
|
|
|
if fts != True:
|
|
|
|
|
if str(function.name.decode('utf-8')) in rfn:
|
|
|
|
|
fts = True
|
|
|
|
|
pe.close()
|
|
|
|
|
if fts:
|
|
|
|
|
self.pyas_scan_write_en(fullpath)#寫入發現病毒
|
|
|
|
|
fts = False
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
except:
|
|
|
|
|
continue
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
##################################### 全盤掃描 #####################################
|
|
|
|
|
|
|
|
|
|
def pyas_scan_disk_init_en(self):
|
|
|
|
|
print('[SCAN] Start Scan Action (Disk Scan)')
|
|
|
|
|
self.pyas_del_virus_temp()
|
|
|
|
|
self.Virus_Scan = 1
|
|
|
|
|
self.ui.Virus_Scan_choose_widget.hide()
|
|
|
|
|
self.ui.Virus_Scan_Solve_Button.hide()
|
|
|
|
@@ -1349,47 +1330,15 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.Virus_List_output.setStringList(self.Virus_List)
|
|
|
|
|
self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
|
|
|
|
|
self.scaning = self.text_Translate("正在掃描: ")
|
|
|
|
|
try:
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASV.tmp')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
try:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中,請稍後..."))
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
try:
|
|
|
|
|
print('[INFO] Reading Viruslist Database')
|
|
|
|
|
with open('Library/PYAE/Hashes/Viruslist.md5','r') as self.fp:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
rfp = self.fp.read()
|
|
|
|
|
self.fp.close()
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
self.pyas_scan_disk_en('A:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('B:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('C:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('D:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('E:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('F:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('G:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('H:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('I:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('J:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('K:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('L:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('M:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('N:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('O:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('P:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('Q:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('R:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('S:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('T:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('U:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('V:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('W:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('X:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('Y:/',rfp)
|
|
|
|
|
self.pyas_scan_disk_en('Z:/',rfp)
|
|
|
|
|
print('[INFO] Reading Viruslist Database')
|
|
|
|
|
with open('Library/PYAE/Hashes/Viruslist.md5','r') as self.fp:
|
|
|
|
|
rfp = self.fp.read()
|
|
|
|
|
self.fp.close()
|
|
|
|
|
for d in range(26):
|
|
|
|
|
self.pyas_scan_disk_en(str(chr(65+d))+':/',rfp)
|
|
|
|
|
self.pyas_scan_answer_en()
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
@@ -1403,37 +1352,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.Virus_Scan_Break_Button.hide()
|
|
|
|
|
break
|
|
|
|
|
else:
|
|
|
|
|
fullpath = str(os.path.join(path,fd))
|
|
|
|
|
if os.path.isdir(fullpath):
|
|
|
|
|
self.pyas_scan_disk_en(fullpath,rfp)
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.show_virus_scan_progress_bar == 0:
|
|
|
|
|
if 'C:/Windows' in fullpath or 'C:/$Recycle.Bin' in fullpath:
|
|
|
|
|
pass
|
|
|
|
|
else:
|
|
|
|
|
root, extension = os.path.splitext(fd)
|
|
|
|
|
sfd = str(extension).lower()
|
|
|
|
|
if 'C:/Program' in fullpath:
|
|
|
|
|
sflist = ['.exe','.dll']
|
|
|
|
|
else:
|
|
|
|
|
sflist = ['.exe','.dll','.com','.cmd','.bat','.vbs','.js','.scr']
|
|
|
|
|
#sflist = ['.exe','.dll','.com','.cmd','.bat','.msi','.reg',
|
|
|
|
|
#'.vbs','.js','.jar','.py','.cpp','.htm','.html',
|
|
|
|
|
#'.doc','.docx','.ppt','.pptx','.xls','.xlm','.pdf',
|
|
|
|
|
#'.ico','.jpg','.png','.wav','.ogg','.mp3','.mp4',
|
|
|
|
|
#'.zip','.7z','.rar','.gz','.tar','.wim','.iso',
|
|
|
|
|
#'.inf','.ini','.tmp','.temp','.log','.scr']
|
|
|
|
|
if self.pyas_sign_start(fullpath) and sfd in sflist:
|
|
|
|
|
root, extension = os.path.splitext(fd)
|
|
|
|
|
sfd = str(extension).lower()
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):
|
|
|
|
|
self.pyas_scan_write_en(fullpath)
|
|
|
|
|
if self.show_virus_scan_progress_bar == 0:
|
|
|
|
|
fullpath = str(os.path.join(path,fd)).replace("\\", "/")
|
|
|
|
|
if ':/Windows' in fullpath or ':/$Recycle.Bin' in fullpath:#路徑過濾
|
|
|
|
|
continue
|
|
|
|
|
elif ':/Program' in fullpath or ':/Users/Default' in fullpath:
|
|
|
|
|
sflist = ['.exe','.dll']
|
|
|
|
|
else:
|
|
|
|
|
sflist = ['.exe','.dll','.com','.bat','.vbs','.scr','.cpl','.htm','.html']
|
|
|
|
|
if os.path.isdir(fullpath):#資料夾 深入遍歷
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
self.pyas_scan_disk_en(fullpath,rfp)
|
|
|
|
|
else:#檔案
|
|
|
|
|
root, extension = os.path.splitext(fd)
|
|
|
|
|
sfd = str(extension).lower()
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):
|
|
|
|
|
if self.pyas_sign_start(fullpath) and sfd in sflist:#簽名檢查+副檔名過濾檢測
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):#MD5較驗
|
|
|
|
|
self.pyas_scan_write_en(fullpath)#寫入發現病毒
|
|
|
|
|
else:
|
|
|
|
|
fullpath = str(os.path.join(path,fd)).replace("\\", "/")
|
|
|
|
|
if os.path.isdir(fullpath):#資料夾 深入遍歷
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
self.pyas_scan_disk_en(fullpath,rfp)
|
|
|
|
|
else:#檔案
|
|
|
|
|
root, extension = os.path.splitext(fd)
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.pyas_scan_start(fullpath,rfp):#簽名檢查(所有檔案類型都掃)
|
|
|
|
|
self.pyas_scan_write_en(fullpath)
|
|
|
|
|
except:
|
|
|
|
|
continue
|
|
|
|
@@ -1674,6 +1623,21 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
|
|
|
|
|
def Customize_CMD_Command(self):
|
|
|
|
|
CMD_Command = self.ui.Customize_CMD_Command_lineEdit.text()
|
|
|
|
|
#try: #Not Cplt
|
|
|
|
|
#if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'professional':
|
|
|
|
|
#self.ui.Window_title.setText("PYAS V"+pyas_version+' (Professional Edition)')
|
|
|
|
|
#return
|
|
|
|
|
#if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'business':
|
|
|
|
|
#self.ui.Window_title.setText("PYAS V"+pyas_version+' (Business Edition)')
|
|
|
|
|
#return
|
|
|
|
|
#if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'professional_ltsc':
|
|
|
|
|
#self.ui.Window_title.setText("PYAS V"+pyas_version+' (Professional Edition LTSC)')
|
|
|
|
|
#return
|
|
|
|
|
#if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'business_ltsc':
|
|
|
|
|
#self.ui.Window_title.setText("PYAS V"+pyas_version+' (Business Edition LTSC)')
|
|
|
|
|
#return
|
|
|
|
|
#except:
|
|
|
|
|
#pass
|
|
|
|
|
if CMD_Command == "":
|
|
|
|
|
return
|
|
|
|
|
if CMD_Command.lower() == "never gonna give you up" or CMD_Command.lower() == "rickroll" or CMD_Command.lower() == "rick roll":
|
|
|
|
@@ -1684,21 +1648,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
or CMD_Command == "PYAS" or CMD_Command == "pyas":
|
|
|
|
|
self.ui.Customize_CMD_Command_output.setText(english_list["PYAS"])#about pyas
|
|
|
|
|
return
|
|
|
|
|
try: #Not Cplt
|
|
|
|
|
if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'professional':
|
|
|
|
|
self.ui.Window_title.setText("PYAS V"+pyas_version+' (Professional Edition)')
|
|
|
|
|
return
|
|
|
|
|
if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'business':
|
|
|
|
|
self.ui.Window_title.setText("PYAS V"+pyas_version+' (Business Edition)')
|
|
|
|
|
return
|
|
|
|
|
if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'professional_ltsc':
|
|
|
|
|
self.ui.Window_title.setText("PYAS V"+pyas_version+' (Professional Edition LTSC)')
|
|
|
|
|
return
|
|
|
|
|
if str(cryptocode.decrypt(CMD_Command,pyas_version)) == 'business_ltsc':
|
|
|
|
|
self.ui.Window_title.setText("PYAS V"+pyas_version+' (Business Edition LTSC)')
|
|
|
|
|
return
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
try:
|
|
|
|
|
if CMD_Command.split()[0].lower() == "/add" or CMD_Command.split()[0].lower() == "/a":
|
|
|
|
|
self.ui.Customize_CMD_Command_output.setText("Tips: Custom rules need to wait for the rule conditions to be met before proceeding to the next step.")
|
|
|
|
@@ -1738,6 +1687,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
value = CMD_Command.split()[3]
|
|
|
|
|
while 1:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
time.sleep(0.0001)
|
|
|
|
|
for p in psutil.process_iter():
|
|
|
|
|
if str(value) == str(p.name()):
|
|
|
|
|
return
|
|
|
|
@@ -1749,7 +1699,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
try:
|
|
|
|
|
si = subprocess.STARTUPINFO()
|
|
|
|
|
si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
|
|
|
|
|
p = subprocess.Popen(CMD_Command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,)#encoding='utf-8')
|
|
|
|
|
p = subprocess.Popen(CMD_Command,stdin=subprocess.PIPE,stdout=subprocess.PIPE)
|
|
|
|
|
out = p.stdout.read()
|
|
|
|
|
try:
|
|
|
|
|
self.ui.Customize_CMD_Command_output.setText(str(out.decode('utf-8')))
|
|
|
|
@@ -1764,11 +1714,11 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
def Customize_REG_Command(self):
|
|
|
|
|
import win32api,win32con
|
|
|
|
|
continue_v = True
|
|
|
|
|
Value_name = self.ui.Value_Name_input.text()
|
|
|
|
|
Value_Path = self.ui.Value_Path_input.text()
|
|
|
|
|
Value_Data = self.ui.Value_Data_input.text()
|
|
|
|
|
Value_Type = self.ui.Value_Type_input.text()
|
|
|
|
|
Value_HEKY = self.ui.Value_HEKY_input.text()
|
|
|
|
|
Value_name = str(self.ui.Value_Name_input.text())
|
|
|
|
|
Value_Path = str(self.ui.Value_Path_input.text())
|
|
|
|
|
Value_Data = str(self.ui.Value_Data_input.text())
|
|
|
|
|
Value_Type = str(self.ui.Value_Type_input.text())
|
|
|
|
|
Value_HEKY = str(self.ui.Value_HEKY_input.text())
|
|
|
|
|
if Value_HEKY == "HKEY_CLASSES_ROOT":
|
|
|
|
|
Value_HEKY = win32con.HKEY_LOCAL_MACHINE
|
|
|
|
|
elif Value_HEKY == "HKEY_CURRENT_USER":
|
|
|
|
@@ -1782,11 +1732,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
else:
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate("錯誤"),self.text_Translate('錯誤: ')+self.text_Translate("您輸入了錯誤的HEKY"),QMessageBox.Ok)
|
|
|
|
|
continue_v = False
|
|
|
|
|
if Value_Type == "REG_BINARY":
|
|
|
|
|
Value_Type = win32con.REG_BINARY
|
|
|
|
|
elif Value_Type == "REG_DWORD":
|
|
|
|
|
Value_Type = win32con.REG_DWORD
|
|
|
|
|
elif Value_Type == "REG_DWORD_LITTLE_ENDIAN":
|
|
|
|
|
Value_Type = win32con.REG_DWORD_LITTLE_ENDIAN
|
|
|
|
|
elif Value_Type == "REG_DWORD_BIG_ENDIAN":
|
|
|
|
|
Value_Type = win32con.REG_DWORD_BIG_ENDIAN
|
|
|
|
|
elif Value_Type == "REG_EXPAND_SZ":
|
|
|
|
|
Value_Type = win32con.REG_EXPAND_SZ
|
|
|
|
|
elif Value_Type == "REG_LINK":
|
|
|
|
|
Value_Type = win32con.REG_LINK
|
|
|
|
|
elif Value_Type == "REG_MULTI_SZ":
|
|
|
|
|
Value_Type = win32con.REG_MULTI_SZ
|
|
|
|
|
elif Value_Type == "REG_NONE":
|
|
|
|
|
Value_Type = win32con.REG_NONE
|
|
|
|
|
elif Value_Type == "REG_QWORD":
|
|
|
|
|
Value_Type = win32con.REG_QWORD
|
|
|
|
|
elif Value_Type == "REG_QWORD_LITTLE_ENDIAN":
|
|
|
|
|
Value_Type = win32con.REG_QWORD_LITTLE_ENDIAN
|
|
|
|
|
elif Value_Type == "REG_SZ":
|
|
|
|
|
Value_Type = win32con.REG_SZ
|
|
|
|
|
else:
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate("錯誤"),self.text_Translate('錯誤: ')+self.text_Translate("您輸入了錯誤的TYPE"),QMessageBox.Ok)
|
|
|
|
|
continue_v = False
|
|
|
|
|
if continue_v:
|
|
|
|
|
if QMessageBox.warning(self,self.text_Translate("警告"),self.text_Translate("您確定要新增值或是修改值嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
|
|
|
|
|
try:
|
|
|
|
|
key = win32api.RegOpenKey(Value_HEKY,Value_Path,0,win32con.KEY_ALL_ACCESS())
|
|
|
|
|
key = win32api.RegOpenKey(Value_HEKY,Value_Path,0,win32con.KEY_ALL_ACCESS)
|
|
|
|
|
win32api.RegSetValueEx(key, Value_name,0,Value_Type,Value_Data)
|
|
|
|
|
win32api.RegCloseKey(key)
|
|
|
|
|
QMessageBox.information(self,self.text_Translate("完成"),self.text_Translate("成功的創建或修改註冊表值"),QMessageBox.Ok)
|
|
|
|
|
except Exception as e:
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
|
|
|
|
@@ -1795,7 +1771,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
if button == self.ui.Analyze_EXE_Funtion_Button:
|
|
|
|
|
file, filetype= QFileDialog.getOpenFileName(self,self.text_Translate("分析文件函數"),"C:/",'EXE OR DLL File *.exe *.dll')
|
|
|
|
|
if file != '':
|
|
|
|
|
pe = PE(file,fast_load=True)
|
|
|
|
|
pe = PE(file)
|
|
|
|
|
self.ui.Analyze_EXE_Output.setText("")
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:
|
|
|
|
|
for function in entry.imports:
|
|
|
|
@@ -1803,6 +1779,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.Analyze_EXE_Output.append(str(function.name.decode('utf-8')))
|
|
|
|
|
except:
|
|
|
|
|
self.ui.Analyze_EXE_Output.append(str(function.name))
|
|
|
|
|
pe.close()
|
|
|
|
|
self.Change_Tools(self.ui.Analyze_EXE_widget)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
else:
|
|
|
|
@@ -1832,6 +1809,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.ui.Analyze_EXE_Output.append(str(section.Name.decode('utf-8')) + str(hex(section.VirtualAddress)) + str(hex(section.Misc_VirtualSize)) + str(section.SizeOfRawData))
|
|
|
|
|
except:
|
|
|
|
|
self.ui.Analyze_EXE_Output.append(str(section.Name) + str(hex(section.VirtualAddress)) + str(hex(section.Misc_VirtualSize)) + str(section.SizeOfRawData))
|
|
|
|
|
pe.close()
|
|
|
|
|
self.Change_Tools(self.ui.Analyze_EXE_widget)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
|
|
|
|
@@ -1846,32 +1824,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
def find_files_info_zh(self,ffile):
|
|
|
|
|
try:
|
|
|
|
|
start = time.time()
|
|
|
|
|
self.findfile_zh('A:/',ffile,start)
|
|
|
|
|
self.findfile_zh('B:/',ffile,start)
|
|
|
|
|
self.findfile_zh('C:/',ffile,start)
|
|
|
|
|
self.findfile_zh('D:/',ffile,start)
|
|
|
|
|
self.findfile_zh('E:/',ffile,start)
|
|
|
|
|
self.findfile_zh('F:/',ffile,start)
|
|
|
|
|
self.findfile_zh('G:/',ffile,start)
|
|
|
|
|
self.findfile_zh('H:/',ffile,start)
|
|
|
|
|
self.findfile_zh('I:/',ffile,start)
|
|
|
|
|
self.findfile_zh('J:/',ffile,start)
|
|
|
|
|
self.findfile_zh('K:/',ffile,start)
|
|
|
|
|
self.findfile_zh('L:/',ffile,start)
|
|
|
|
|
self.findfile_zh('M:/',ffile,start)
|
|
|
|
|
self.findfile_zh('N:/',ffile,start)
|
|
|
|
|
self.findfile_zh('O:/',ffile,start)
|
|
|
|
|
self.findfile_zh('P:/',ffile,start)
|
|
|
|
|
self.findfile_zh('Q:/',ffile,start)
|
|
|
|
|
self.findfile_zh('R:/',ffile,start)
|
|
|
|
|
self.findfile_zh('S:/',ffile,start)
|
|
|
|
|
self.findfile_zh('T:/',ffile,start)
|
|
|
|
|
self.findfile_zh('U:/',ffile,start)
|
|
|
|
|
self.findfile_zh('V:/',ffile,start)
|
|
|
|
|
self.findfile_zh('W:/',ffile,start)
|
|
|
|
|
self.findfile_zh('X:/',ffile,start)
|
|
|
|
|
self.findfile_zh('Y:/',ffile,start)
|
|
|
|
|
self.findfile_zh('Z:/',ffile,start)
|
|
|
|
|
for d in range(26):
|
|
|
|
|
self.findfile_zh(str(chr(65+d))+':/',ffile,start)
|
|
|
|
|
end = time.time()
|
|
|
|
|
if os.path.isfile('Library/PYAS/Temp/PYASF.tmp'):
|
|
|
|
|
try:
|
|
|
|
@@ -1901,8 +1855,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
for fd in os.listdir(path):
|
|
|
|
|
try:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
fullpath = os.path.join(path,fd)
|
|
|
|
|
if 'C:/Windows' in fullpath or 'AppData' in fullpath or 'PerfLogs' in fullpath:
|
|
|
|
|
fullpath = str(os.path.join(path,fd)).replace("\\", "/")
|
|
|
|
|
if ':/Windows' in fullpath or ':/$Recycle.Bin' in fullpath or ':/ProgramData' in fullpath or 'AppData' in fullpath or 'PerfLogs' in fullpath:
|
|
|
|
|
pass
|
|
|
|
|
else:
|
|
|
|
|
if os.path.isdir(fullpath):
|
|
|
|
@@ -1966,9 +1920,11 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.decrypt_zh(input_text,password)
|
|
|
|
|
|
|
|
|
|
def encrypt_zh(self,e,e2):
|
|
|
|
|
import cryptocode
|
|
|
|
|
self.ui.Encryption_Text_output.setText(str(cryptocode.encrypt(e,e2)))
|
|
|
|
|
|
|
|
|
|
def decrypt_zh(self,e,e2):
|
|
|
|
|
import cryptocode
|
|
|
|
|
self.ui.Encryption_Text_output.setText(str(cryptocode.decrypt(e,e2)))
|
|
|
|
|
|
|
|
|
|
def Change_Users_Password(self):
|
|
|
|
@@ -2063,11 +2019,14 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
self.pause = True
|
|
|
|
|
else:
|
|
|
|
|
try:
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.Protection_illustrate.setText(self.text_Translate("正在初始化中,請稍後..."))
|
|
|
|
|
self.pause = False
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
threading.Thread(target = self.pyas_protect_init_zh).start()
|
|
|
|
|
if pyas_key():
|
|
|
|
|
self.ui.State_output.clear()
|
|
|
|
|
self.ui.Protection_illustrate.setText(self.text_Translate("正在初始化中,請稍後..."))
|
|
|
|
|
self.pause = False
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
threading.Thread(target = self.pyas_protect_init_zh).start()
|
|
|
|
|
else:
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+self.text_Translate('安全密鑰錯誤'),QMessageBox.Ok)
|
|
|
|
|
except Exception as e:
|
|
|
|
|
QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
|
|
|
|
|
|
|
|
|
@@ -2114,31 +2073,33 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
break
|
|
|
|
|
else:
|
|
|
|
|
self.Virus_Scan = 1
|
|
|
|
|
#print('[INFO] Real-time Protect Process Refresh')
|
|
|
|
|
for p in psutil.process_iter():
|
|
|
|
|
try:
|
|
|
|
|
time.sleep(0.0001)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
file = str(p.exe())
|
|
|
|
|
if '' == file or 'C:\Windows' in file or 'AppData' in file or 'C:\Program' in file or 'MemCompression' in file or 'Registry' in file:
|
|
|
|
|
time.sleep(0.0001)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if '' == file or 'C:\Windows' in file or 'C:\Program' in file or 'AppData' in file or 'MemCompression' in file or 'Registry' in file:
|
|
|
|
|
pass
|
|
|
|
|
else:
|
|
|
|
|
if self.pyas_sign_start(file) and 'PYAS.exe' not in file:
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.pyas_sign_start(file) and 'PYAS' not in file:
|
|
|
|
|
try:
|
|
|
|
|
if subprocess.call('taskkill /f /im "'+str(p.name())+'" /t',shell=True) == 0:
|
|
|
|
|
print('[INFO] Malware blocking success: '+str(p.name()))
|
|
|
|
|
self.ui.State_output.append(self.text_Translate('{} > [實時防護] 成功攔截了一個惡意軟體:').format(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')))+str(p.name()))
|
|
|
|
|
toaster = ToastNotifier()
|
|
|
|
|
toaster.show_toast("PYAS Security",self.text_Translate('{} > [實時防護] 成功攔截了一個惡意軟體:').format(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')))+str(p.name()),icon_path="Library/PYAS/Icon/ICON.ico",duration=5,threaded=True)
|
|
|
|
|
else:
|
|
|
|
|
print('[INFO] Malware blocking failed: '+str(p.name()))
|
|
|
|
|
self.ui.State_output.append(self.text_Translate('{} > [實時防護] 惡意軟體攔截失敗:').format(datetime.datetime.now())+str(p.name()))
|
|
|
|
|
toaster = ToastNotifier()
|
|
|
|
|
toaster.show_toast("PYAS Security",self.text_Translate('{} > [實時防護] 惡意軟體攔截失敗:').format(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')))+str(p.name()),icon_path="Library/PYAS/Icon/ICON.ico",duration=5,threaded=True)
|
|
|
|
|
#os.remove(str(p.exe()))
|
|
|
|
|
#try:
|
|
|
|
|
#observer = Observer()
|
|
|
|
|
#observer.schedule(MainWindow_Controller(), os.path.dirname(p.exe()), False)
|
|
|
|
|
#observer.start()
|
|
|
|
|
#except Exception as e:
|
|
|
|
|
#pass
|
|
|
|
|
#os.remove(str(p.exe()))
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
pass
|
|
|
|
@@ -2388,11 +2349,11 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
|
|
|
|
|
|
|
|
|
|
if __name__ == '__main__':
|
|
|
|
|
try:
|
|
|
|
|
pyas_library()
|
|
|
|
|
pyasb_remove()
|
|
|
|
|
pyasp_remove()
|
|
|
|
|
pyas_library()
|
|
|
|
|
pyas_version = "2.4.9"
|
|
|
|
|
pyae_version = "2.2.0"
|
|
|
|
|
pyas_version = "2.5.1"
|
|
|
|
|
pyae_version = "2.2.1"
|
|
|
|
|
threading.Thread(target = pyas_vl_update).start()
|
|
|
|
|
QtCore.QCoreApplication.setAttribute(Qt.AA_EnableHighDpiScaling)# 自適應窗口縮放
|
|
|
|
|
QtGui.QGuiApplication.setAttribute(Qt.HighDpiScaleFactorRoundingPolicy.PassThrough)# 自適應窗口縮放
|
|
|
|
@@ -2407,4 +2368,4 @@ if __name__ == '__main__':
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
|
|
|
|
|
####################################################################################
|
|
|
|
|
#Copyright© 2022 87owo (PYAS Security)
|
|
|
|
|
#Copyright© 2020-2022 87owo (PYAS Security)
|