|
|
|
@@ -6,8 +6,6 @@
|
|
|
|
|
#
|
|
|
|
|
# Copyright© 2020-2023 87owo (PYAS Security)
|
|
|
|
|
####################################################################################
|
|
|
|
|
#
|
|
|
|
|
##################################### 載入模組套件 ###################################
|
|
|
|
|
|
|
|
|
|
import os, sys, time, json, psutil, struct, win32api, win32con
|
|
|
|
|
import requests, socket, platform, cryptocode, subprocess
|
|
|
|
@@ -32,6 +30,13 @@ def pyas_bug_log(e):
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def remove_tmp():
|
|
|
|
|
try:
|
|
|
|
|
if os.path.isfile('Library/PYAS/Temp/PYASB.log'):
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASB.log')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def create_lib():
|
|
|
|
|
try:
|
|
|
|
|
checkPath = ['Library/PYAS/Temp','Library/PYAS/Setup','Library/PYAS/Icon','Library/PYAE/Hashes']
|
|
|
|
@@ -41,13 +46,6 @@ def create_lib():
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
|
|
|
|
|
def remove_tmp():
|
|
|
|
|
try:
|
|
|
|
|
if os.path.isfile('Library/PYAS/Temp/PYASB.log'):
|
|
|
|
|
os.remove('Library/PYAS/Temp/PYASB.log')
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
###################################### 密鑰認證 #####################################
|
|
|
|
|
|
|
|
|
|
def pyas_key():
|
|
|
|
@@ -56,11 +54,10 @@ def pyas_key():
|
|
|
|
|
file_md5 = str(md5(f.read()).hexdigest())
|
|
|
|
|
try:
|
|
|
|
|
response = requests.get("http://27.147.30.238:5001/pyas", params={'key': file_md5})
|
|
|
|
|
if response.status_code == 200:
|
|
|
|
|
if response.text == 'True':
|
|
|
|
|
with open('Library/PYAS/Setup/PYAS.key', 'w') as fc:
|
|
|
|
|
fc.write(file_md5)
|
|
|
|
|
return True
|
|
|
|
|
if response.status_code == 200 and response.text == 'True':
|
|
|
|
|
with open('Library/PYAS/Setup/PYAS.key', 'w') as fc:
|
|
|
|
|
fc.write(file_md5)
|
|
|
|
|
return True
|
|
|
|
|
except:
|
|
|
|
|
if os.path.isfile('Library/PYAS/Setup/PYAS.key'):
|
|
|
|
|
with open('Library/PYAS/Setup/PYAS.key', 'r') as fc:
|
|
|
|
@@ -76,7 +73,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
def __init__(self):
|
|
|
|
|
super(MainWindow_Controller, self).__init__()
|
|
|
|
|
self.ui = Ui_MainWindow() #繼承
|
|
|
|
|
self.ui.pyas_opacity = 100
|
|
|
|
|
self.ui.pyas_opacity = 0
|
|
|
|
|
self.setAttribute(Qt.WA_TranslucentBackground) #去掉邊框
|
|
|
|
|
self.setWindowFlags(Qt.FramelessWindowHint) #取消使用Windows預設得窗口模式
|
|
|
|
|
self.tray_icon = QSystemTrayIcon(self)
|
|
|
|
@@ -86,10 +83,15 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
self.createContextMenu()
|
|
|
|
|
self.ui.setupUi(self)
|
|
|
|
|
self.setup_control()
|
|
|
|
|
self.show_pyas_ui()
|
|
|
|
|
|
|
|
|
|
def writeConfig(self, config):
|
|
|
|
|
with open('Library/PYAS/Setup/PYAS.json', 'w', encoding='utf-8') as f:
|
|
|
|
|
f.write(json.dumps(config, indent=4, ensure_ascii=False))
|
|
|
|
|
try:
|
|
|
|
|
with open('Library/PYAS/Setup/PYAS.json', 'w', encoding='utf-8') as f:
|
|
|
|
|
f.write(json.dumps(config, indent=4, ensure_ascii=False))
|
|
|
|
|
except Exception as e:
|
|
|
|
|
create_lib()
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|
|
|
|
|
|
def setup_control(self):
|
|
|
|
|
self.init()#調用本地函數"init"
|
|
|
|
@@ -250,7 +252,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
self.ui.Change_Users_Password_widget.hide()
|
|
|
|
|
self.ui.Customize_REG_Command_widget.hide()
|
|
|
|
|
self.ui.Setting_widget.hide()
|
|
|
|
|
Thread(target=self.pyas_protect_init).start()
|
|
|
|
|
self.pyas_protect_init()
|
|
|
|
|
Thread(target=self.pyas_vl_update).start()
|
|
|
|
|
|
|
|
|
|
##################################### 英文初始化 ####################################
|
|
|
|
@@ -869,14 +871,6 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
self.Safe = False
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("錯誤: 執行失敗。"))
|
|
|
|
|
|
|
|
|
|
def sign_scan(self, file):
|
|
|
|
|
try:
|
|
|
|
|
pe = PE(file, fast_load=True)
|
|
|
|
|
pe.close()
|
|
|
|
|
return pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_SECURITY']].VirtualAddress == 0
|
|
|
|
|
except:
|
|
|
|
|
return True # 未簽名
|
|
|
|
|
|
|
|
|
|
def md5_scan(self, file, rfp):
|
|
|
|
|
try:
|
|
|
|
|
with open(file, "rb") as f:
|
|
|
|
@@ -885,18 +879,6 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
except:
|
|
|
|
|
return False # 無惡意
|
|
|
|
|
|
|
|
|
|
def pe_scan(self,file):
|
|
|
|
|
try:
|
|
|
|
|
pe = PE(file)
|
|
|
|
|
pe.close()
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:
|
|
|
|
|
for func in entry.imports:
|
|
|
|
|
if '_CorExeMain' in func.name.decode('utf-8'):
|
|
|
|
|
return True # 有惡意
|
|
|
|
|
return False # 無惡意
|
|
|
|
|
except:
|
|
|
|
|
return False # 無惡意
|
|
|
|
|
|
|
|
|
|
def api_scan(self, types, file):
|
|
|
|
|
try:
|
|
|
|
|
with open(file, "rb") as f:
|
|
|
|
@@ -906,6 +888,39 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
except:
|
|
|
|
|
return False # 無惡意
|
|
|
|
|
|
|
|
|
|
def sign_scan(self, file):
|
|
|
|
|
try:
|
|
|
|
|
pe = PE(file, fast_load=True)
|
|
|
|
|
pe.close()
|
|
|
|
|
return pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_SECURITY']].VirtualAddress == 0
|
|
|
|
|
except:
|
|
|
|
|
return True # 未簽名
|
|
|
|
|
|
|
|
|
|
def pe_scan(self,file):
|
|
|
|
|
try:
|
|
|
|
|
|
|
|
|
|
fn = []
|
|
|
|
|
pe = PE(file)
|
|
|
|
|
pe.close()
|
|
|
|
|
for entry in pe.DIRECTORY_ENTRY_IMPORT:
|
|
|
|
|
for func in entry.imports:
|
|
|
|
|
fn.append(str(func.name.decode('utf-8')))
|
|
|
|
|
if '_CorExeMain' in fn:
|
|
|
|
|
#print(f'Corexe Detected: {os.path.basename(file)}')
|
|
|
|
|
return True
|
|
|
|
|
if self.high_sensitivity == 1:
|
|
|
|
|
if 'VirtualAlloc' in fn and 'GetProcAddress' in fn and 'LoadLibraryA' in fn:
|
|
|
|
|
if 'TlsSetValue' in fn or 'TlsGetValue' in fn or 'TlsAlloc' in fn:
|
|
|
|
|
#print(f'Torjan Detected: {os.path.basename(file)}')
|
|
|
|
|
return True
|
|
|
|
|
if 'LockResource' in fn and 'LoadResource' in fn and 'GetProcAddress' in fn:
|
|
|
|
|
if 'CryptReleaseContext' in fn or 'MultiByteToWideChar' in fn or 'SizeofResource' in fn:
|
|
|
|
|
#print(f'Ransom Detected: {os.path.basename(file)}')
|
|
|
|
|
return True
|
|
|
|
|
return False
|
|
|
|
|
except:
|
|
|
|
|
return False # 無惡意
|
|
|
|
|
|
|
|
|
|
def write_scan(self,file):
|
|
|
|
|
try:
|
|
|
|
|
self.Virus_List.append(file)
|
|
|
|
@@ -968,7 +983,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
except:
|
|
|
|
|
rfp = ''
|
|
|
|
|
if self.high_sensitivity == 0 and self.sign_scan(file):
|
|
|
|
|
if self.md5_scan(file,rfp) or self.pe_scan(file) or self.api_scan('md5', file):
|
|
|
|
|
if self.md5_scan(file,rfp) or self.pe_scan(file):
|
|
|
|
|
self.write_scan(file)
|
|
|
|
|
elif self.high_sensitivity == 1:
|
|
|
|
|
if self.md5_scan(file,rfp) or self.pe_scan(file) or self.api_scan('md5', file):
|
|
|
|
@@ -1023,7 +1038,6 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
rfp = fp.read()
|
|
|
|
|
except:
|
|
|
|
|
rfp = ''
|
|
|
|
|
self.fp.close()
|
|
|
|
|
self.Virus_Scan = True
|
|
|
|
|
self.ui.Virus_Scan_Solve_Button.hide()
|
|
|
|
|
self.ui.Virus_Scan_ProgressBar.hide()
|
|
|
|
@@ -1060,7 +1074,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
self.ui.Virus_Scan_text.setText(self.text_Translate("正在掃描: ")+fullpath)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
if self.high_sensitivity == 0 and str(os.path.splitext(fd)[1]).lower() in sflist and self.sign_scan(fullpath):
|
|
|
|
|
if self.md5_scan(fullpath,rfp) or self.pe_scan(fullpath) or self.api_scan('md5', fullpath):
|
|
|
|
|
if self.md5_scan(fullpath,rfp) or self.pe_scan(fullpath):
|
|
|
|
|
self.write_scan(fullpath)
|
|
|
|
|
elif self.high_sensitivity == 1:
|
|
|
|
|
if self.md5_scan(fullpath,rfp) or self.pe_scan(fullpath) or self.api_scan('md5', fullpath):
|
|
|
|
@@ -1421,75 +1435,78 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
self.ui.Protection_switch_Button.setStyleSheet("""
|
|
|
|
|
QPushButton{border:none;background-color:rgba(20,20,20,30);border-radius: 15px;}
|
|
|
|
|
QPushButton:hover{background-color:rgba(20,20,20,50);}""")
|
|
|
|
|
text = self.text_Translate('尚未啟用實時防護')
|
|
|
|
|
now_time = time.strftime('%Y/%m/%d %H:%M:%S')
|
|
|
|
|
self.ui.State_output.append(f'[{now_time}] {text}')
|
|
|
|
|
self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('尚未啟用實時防護'))
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
else:
|
|
|
|
|
self.ui.Protection_illustrate.setText(self.text_Translate("正在初始化中,請稍後..."))
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
Thread(target=self.pyas_protect_init).start()
|
|
|
|
|
self.pyas_protect_init()
|
|
|
|
|
|
|
|
|
|
def protect_system_reg_repair(self):
|
|
|
|
|
try:
|
|
|
|
|
Permission = ['NoControlPanel', 'NoDrives', 'NoControlPanel', 'NoFileMenu', 'NoFind', 'NoRealMode', 'NoRecentDocsMenu','NoSetFolders', \
|
|
|
|
|
'NoSetFolderOptions', 'NoViewOnDrive', 'NoClose', 'NoRun', 'NoDesktop', 'NoLogOff', 'NoFolderOptions', 'RestrictRun','DisableCMD', \
|
|
|
|
|
'NoViewContexMenu', 'HideClock', 'NoStartMenuMorePrograms', 'NoStartMenuMyGames', 'NoStartMenuMyMusic' 'NoStartMenuNetworkPlaces', \
|
|
|
|
|
'NoStartMenuPinnedList', 'NoActiveDesktop', 'NoSetActiveDesktop', 'NoActiveDesktopChanges', 'NoChangeStartMenu', 'ClearRecentDocsOnExit', \
|
|
|
|
|
'NoFavoritesMenu', 'NoRecentDocsHistory', 'NoSetTaskbar', 'NoSMHelp', 'NoTrayContextMenu', 'NoViewContextMenu', 'NoWindowsUpdate', \
|
|
|
|
|
'NoWinKeys', 'StartMenuLogOff', 'NoSimpleNetlDList', 'NoLowDiskSpaceChecks', 'DisableLockWorkstation', 'NoManageMyComputerVerb',\
|
|
|
|
|
'DisableTaskMgr', 'DisableRegistryTools', 'DisableChangePassword', 'Wallpaper', 'NoComponents', 'NoAddingComponents', 'Restrict_Run']
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'Explorer')#創建鍵
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'Explorer')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'ActiveDesktop')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Policies\Microsoft\Windows',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Policies\Microsoft\Windows',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'Software\Policies\Microsoft',0,win32con.KEY_ALL_ACCESS),'MMC')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'Software\Policies\Microsoft\MMC',0,win32con.KEY_ALL_ACCESS),'{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}')
|
|
|
|
|
keys = [win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Policies\Microsoft\Windows\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Policies\Microsoft\Windows\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}',0,win32con.KEY_ALL_ACCESS)]
|
|
|
|
|
for key in keys:
|
|
|
|
|
for i in Permission:
|
|
|
|
|
try:
|
|
|
|
|
win32api.RegDeleteValue(key,i)#刪除值
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
win32api.RegCloseKey(key)#關閉已打開的鍵
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
while self.protect_running:
|
|
|
|
|
try:
|
|
|
|
|
Permission = ['NoControlPanel', 'NoDrives', 'NoControlPanel', 'NoFileMenu', 'NoFind', 'NoRealMode', 'NoRecentDocsMenu','NoSetFolders', \
|
|
|
|
|
'NoSetFolderOptions', 'NoViewOnDrive', 'NoClose', 'NoRun', 'NoDesktop', 'NoLogOff', 'NoFolderOptions', 'RestrictRun','DisableCMD', \
|
|
|
|
|
'NoViewContexMenu', 'HideClock', 'NoStartMenuMorePrograms', 'NoStartMenuMyGames', 'NoStartMenuMyMusic' 'NoStartMenuNetworkPlaces', \
|
|
|
|
|
'NoStartMenuPinnedList', 'NoActiveDesktop', 'NoSetActiveDesktop', 'NoActiveDesktopChanges', 'NoChangeStartMenu', 'ClearRecentDocsOnExit', \
|
|
|
|
|
'NoFavoritesMenu', 'NoRecentDocsHistory', 'NoSetTaskbar', 'NoSMHelp', 'NoTrayContextMenu', 'NoViewContextMenu', 'NoWindowsUpdate', \
|
|
|
|
|
'NoWinKeys', 'StartMenuLogOff', 'NoSimpleNetlDList', 'NoLowDiskSpaceChecks', 'DisableLockWorkstation', 'NoManageMyComputerVerb',\
|
|
|
|
|
'DisableTaskMgr', 'DisableRegistryTools', 'DisableChangePassword', 'Wallpaper', 'NoComponents', 'NoAddingComponents', 'Restrict_Run']
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'Explorer')#創建鍵
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'Explorer')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies',0,win32con.KEY_ALL_ACCESS),'ActiveDesktop')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Policies\Microsoft\Windows',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Policies\Microsoft\Windows',0,win32con.KEY_ALL_ACCESS),'System')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'Software\Policies\Microsoft',0,win32con.KEY_ALL_ACCESS),'MMC')
|
|
|
|
|
win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'Software\Policies\Microsoft\MMC',0,win32con.KEY_ALL_ACCESS),'{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}')
|
|
|
|
|
keys = [win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'SOFTWARE\Policies\Microsoft\Windows\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,'SOFTWARE\Policies\Microsoft\Windows\System',0,win32con.KEY_ALL_ACCESS),\
|
|
|
|
|
win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,'Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}',0,win32con.KEY_ALL_ACCESS)]
|
|
|
|
|
for key in keys:
|
|
|
|
|
for i in Permission:
|
|
|
|
|
try:
|
|
|
|
|
win32api.RegDeleteValue(key,i)#刪除值
|
|
|
|
|
#self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('成功修復註冊表: ')+i)
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
win32api.RegCloseKey(key)#關閉已打開的鍵
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def protect_system_mbr_repair(self):
|
|
|
|
|
try:
|
|
|
|
|
with open(r"\\.\PhysicalDrive0", "r+b") as f:
|
|
|
|
|
if self.mbr_value != None and struct.unpack("<H", f.read(512)[510:512])[0] != 0xAA55:
|
|
|
|
|
f.seek(0)
|
|
|
|
|
f.write(self.mbr_value)
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
while self.protect_running:
|
|
|
|
|
try:
|
|
|
|
|
with open(r"\\.\PhysicalDrive0", "r+b") as f:
|
|
|
|
|
if self.mbr_value != None and struct.unpack("<H", f.read(512)[510:512])[0] != 0xAA55:
|
|
|
|
|
f.seek(0)
|
|
|
|
|
f.write(self.mbr_value)
|
|
|
|
|
self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('成功修復引導扇區: PhysicalDrive0'))
|
|
|
|
|
except:
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
def protect_system_processes(self):
|
|
|
|
|
for p in psutil.process_iter():
|
|
|
|
|
time.sleep(0.0001)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
try:
|
|
|
|
|
file, name = str(p.exe()), str(p.name())
|
|
|
|
|
if '' == file or str(sys.argv[0]) == file or ':\Windows' in file or ':\Program' in file or ':\XboxGames' in file or 'mem' in file.lower() or 'Registry' in file or 'AppData' in file:
|
|
|
|
|
while self.protect_running:
|
|
|
|
|
for p in psutil.process_iter():
|
|
|
|
|
time.sleep(0.0001)
|
|
|
|
|
try:
|
|
|
|
|
file, name = str(p.exe()), str(p.name())
|
|
|
|
|
if '' == file or str(sys.argv[0]) == file or ':\Windows' in file or ':\Program' in file or ':\XboxGames' in file or 'mem' in file.lower() or 'Registry' in file or 'AppData' in file:
|
|
|
|
|
continue
|
|
|
|
|
elif self.sign_scan(file) or self.pe_scan(file) or self.api_scan('md5', file):
|
|
|
|
|
try:
|
|
|
|
|
if p.kill() == None:
|
|
|
|
|
self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('成功攔截惡意軟體: ')+name)
|
|
|
|
|
except:
|
|
|
|
|
self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('惡意軟體攔截失敗: ')+name)
|
|
|
|
|
except:
|
|
|
|
|
continue
|
|
|
|
|
elif self.sign_scan(file) or self.api_scan('md5', file):
|
|
|
|
|
if subprocess.call(f'taskkill /f /pid "{p.pid}" /t',shell=True) == 0:
|
|
|
|
|
self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('成功攔截惡意軟體: ')+name)
|
|
|
|
|
else:
|
|
|
|
|
self.system_notification(time.strftime('%Y/%m/%d %H:%M:%S'),self.text_Translate('惡意軟體攔截失敗: ')+name)
|
|
|
|
|
except:
|
|
|
|
|
continue
|
|
|
|
|
|
|
|
|
|
def pyas_protect_init(self):
|
|
|
|
|
print('[INFO] Start Action (Real-time Process Protect)')
|
|
|
|
@@ -1500,10 +1517,9 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
|
|
|
|
|
QPushButton:hover{background-color:rgba(20,200,20,120);}""")
|
|
|
|
|
self.protect_running = True
|
|
|
|
|
while self.protect_running:
|
|
|
|
|
self.protect_system_reg_repair()
|
|
|
|
|
self.protect_system_mbr_repair()
|
|
|
|
|
self.protect_system_processes()
|
|
|
|
|
Thread(target=self.protect_system_mbr_repair).start()
|
|
|
|
|
Thread(target=self.protect_system_reg_repair).start()
|
|
|
|
|
Thread(target=self.protect_system_processes).start()
|
|
|
|
|
|
|
|
|
|
##################################### 系統設置 #####################################
|
|
|
|
|
|
|
|
|
@@ -1668,6 +1684,14 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
|
|
|
|
|
self.setWindowOpacity(self.ui.pyas_opacity/100)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
|
|
|
|
|
def show_pyas_ui(self):
|
|
|
|
|
self.show()
|
|
|
|
|
while self.ui.pyas_opacity < 100:
|
|
|
|
|
time.sleep(0.001)
|
|
|
|
|
self.ui.pyas_opacity += 1
|
|
|
|
|
self.setWindowOpacity(self.ui.pyas_opacity/100)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
|
|
|
|
|
def closeEvent(self, event):
|
|
|
|
|
event.ignore()
|
|
|
|
|
while self.ui.pyas_opacity > 0:
|
|
|
|
@@ -1683,17 +1707,12 @@ if __name__ == '__main__':
|
|
|
|
|
try:
|
|
|
|
|
create_lib()
|
|
|
|
|
remove_tmp()
|
|
|
|
|
pyas_version, pyae_version = "2.6.2", "2.3.0"
|
|
|
|
|
pyas_version, pyae_version = "2.6.3", "2.3.1"
|
|
|
|
|
print(f'[INFO] PYAS V{pyas_version} , PYAE V{pyae_version}')
|
|
|
|
|
QtCore.QCoreApplication.setAttribute(Qt.AA_EnableHighDpiScaling)# 自適應窗口縮放
|
|
|
|
|
QtGui.QGuiApplication.setAttribute(Qt.HighDpiScaleFactorRoundingPolicy.PassThrough)# 自適應窗口縮放
|
|
|
|
|
app = QtWidgets.QApplication(sys.argv)
|
|
|
|
|
window = MainWindow_Controller()
|
|
|
|
|
window.show()
|
|
|
|
|
for i in range(101):
|
|
|
|
|
time.sleep(0.001)
|
|
|
|
|
window.setWindowOpacity(i/100)
|
|
|
|
|
QApplication.processEvents()
|
|
|
|
|
MainWindow_Controller()
|
|
|
|
|
sys.exit(app.exec_())
|
|
|
|
|
except Exception as e:
|
|
|
|
|
pyas_bug_log(e)
|
|
|
|
|