Add files via upload

增加中文

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020-2023 87owo (PYAS Security)
+Copyright (c) 2020-2024 87owo (PYAS Security)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

PYAS_Engine.py

@@ -0,0 +1,84 @@
+import time, json, hashlib, numpy
+from collections import Counter
+
+class ListSimHash:
+    def __init__(self):
+        self.model = {}
+
+    def save_model(self, file_name):
+        with open(file_name, 'w') as f:
+            json.dump(self.model, f)
+        print(f"\nModel Is Saved In {file_name}")
+
+    def load_model(self, model_data):
+        if isinstance(model_data, str):
+            with open(model_data, 'r') as f:
+                model_data = json.load(f)
+        self.model = model_data
+
+    def get_model(self, label):
+        return self.model[label]
+
+    def train_model(self, label, data):
+        start = time.time()
+        print(f"Convert {label}")
+        if label not in self.model:
+            self.model[label] = []
+        for i, x in enumerate(data, 1):
+            self.model[label].append(self.build_text(x))
+            used = "{0:.2f}".format(time.time()-start)
+            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
+            self.progress_bar(i, len(data), prefix, suffix)
+
+    def build_text(self, content):
+        sums, batch, count = [], [], 0
+        features = dict(Counter(sorted(content)))
+        for f, w in features.items():
+            count += w
+            batch.append(hashlib.md5(json.dumps(f).encode('utf-8')).digest() * w)
+            if len(batch) >= 10000:
+                sums.append(self.sum_hashes(batch))
+                batch = []
+        if batch:
+            sums.append(self.sum_hashes(batch))
+        combined_sums = numpy.sum(sums, 0)
+        v = numpy.packbits(combined_sums > count / 2).tobytes()
+        return int.from_bytes(v, 'big')
+
+    def sum_hashes(self, digests):
+        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
+        return numpy.sum(numpy.reshape(bitarray, (-1, 128)), 0)
+
+    def progress_bar(self, iteration, total, prefix='', suffix='', length=50, fill='█'):
+        percent = min(100.0, max(0.0, 100 * (iteration / float(total))))
+        end_char = '\n' if percent >= 100 else '\r'
+        percent_string = "{0:.2f}".format(percent)
+        filled_length = int(length * iteration // total)
+        bar = fill * filled_length + ' ' * (length - filled_length)
+        print(f'\r    {prefix: <10} |{bar}| {percent_string}% {suffix}', end=end_char)
+
+    def predict_all(self, query):
+        label_similarities = {}
+        query_hash = self.build_text(query)
+        for label in self.model:
+            max_similarity = 0
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity = similarity
+            label_similarities[label] = max_similarity
+        return label_similarities
+
+    def predict(self, query):
+        max_similarity, max_label = 0, None
+        query_hash = self.build_text(query)
+        for label in self.model:
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity, max_label = similarity, label
+        return max_label, max_similarity
+
+    def similar(self, x, y):
+        hamming_distance = bin(x ^ y).count('1')
+        return 1 - hamming_distance / 128

PYAS_Extension.py

@@ -0,0 +1,8 @@
+slist = [".exe",".dll",".com",".msi",".scr",
+         ".js",".bat",".cmd",".ps1",".vbs"]
+
+alist = [".ppt",".pptx",".wps",".txt",".rtf",
+         ".pdf",".xls",".xlsx",".doc",".docx",
+         ".jpg",".jpeg",".png",".webp",".gif",
+         ".mp3",".wav",".aac",".ogg",".flac",
+         ".mp4",".avi",".mov",".wmv",".mkv"]

PYAS_Language.py

@@ -1,50 +1,54 @@
-translations = {"zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"已開啟","Off":"已關閉"},
-                "zh_CN": {"已開啟":"已开启","已關閉":"已关闭","On":"已开启","Off":"已关闭",
-                          "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
-                          "錯誤":"错误","實時":"实时","發現":"发现","本機":"电脑","資料":"数据",
-                          "誤殺":"误杀","開發":"开发","關閉":"关闭","試":"试","資訊":"资讯",
-                          "總數":"总数","註冊":"注册","嗎":"吗","項":"项","掃":"扫","鑰":"钥",
-                          "當":"当","後":"后","護":"护","導":"导","區":"区","復":"复","攔":"拦",
-                          "請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选","啟":"启",
-                          "監":"监","並":"并","裝":"装","徑":"径","盤":"盘","隱":"隐","動":"动",
-                          "誌":"志","靈":"灵","這":"这","會":"会","題":"题","擇":"择","語":"语",
-                          "顯":"显","變":"变","戶":"户","碼":"码","雲":"云","訂":"订","稱":"称",
-                          "類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网","詢":"询",
-                          "製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红","綠":"绿",
-                          "態":"态","擇":"择","務":"务","連":"连","檢":"检","測":"测",},
-                "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","啟用":"Enable ",
-                          "正在掃描":"Scanning ","正在刪除":"Deleting ","正在尋找":"Searching ",
-                          "正在檢測":"Checking ","無法確定":"Can't Confirm ","可疑":"Suspicious ",
-                          "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
-                          "禁用":"Disable ","系統":"System ","雲端":"Cloud ","重啟":"Reboot ",
-                          "創建":"Create ","日期":"Date ","檔案":"File ","當前":"Currently ",
-                          "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
-                          "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
-                          "裝置":"Device ","發現":"Found ","，":", ","密鑰錯誤":"Key Error",
-                          "找到":"Find ","受到":"Been ","錯誤":"Error ","完成":"Complete ",
-                          "修復":"Repair ","正在初始化中":"Initializing ","實時":"Real-Time ",
-                          "立即刪除":"Delete Now","安全模式":"Safe Mode","不安全":"Unsafe",
-                          "確定要":"Sure Want To ","成功":"Success ","清理":"Cleanup ",
-                          "確定":"OK","執行":"Execute ","警告":"Warning ","輸入了":"Input ",
-                          "搜尋":"Search ","不是有效":"Is Not A Valid ","命令":"Command",
-                          "修改":"Modify ","用戶":"User ","使用":"Use ","哈希":"Hash",
-                          "更多":"More","重置":"Reset ","網路":"Network ","配置":"Config ",
-                          "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"To ",
-                          "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
-                          "分區":"Partition ","設定":"Setting","關於":"About","模式":"Mode ",
-                          "靈敏度":"Sensitivity ","提高":"Improve ","安全":"Security ",
-                          "白色主題":"White","黑色主題":"Black","黃色主題":"Yellow","紅色主題":"Red",
-                          "藍色主題":"Blue","綠色主題":"Green","語言":"Language ","製作":"Make",
-                          "但":"But ","註冊表":"Regedit ","顯色":"Color ","主題":"Themes ",
-                          "介面":"GUI ","核心":"Core ","服務":"Services ","測試人員":"Testers",
-                          "官方網站":"Website","許可條款":"License Terms","全盤":"Full ",
-                          "隱私":"Privacy ","更多":"More ","開發":"Devs ","管理":"Manage",
-                          "垃圾":"Junk ","輸出":"Output ","版本資訊":"Information","位元":"Bits",
-                          "粉碎":"Shredding","自訂":"Customize ","分析":"Analyze ","函數":"Func",
-                          "變更":"Change ","位置查詢":"Location Query","總數":"Total","結束":"End ",
-                          "本機":"Computer ","加密":"Encrypt ","解密":"Decrypt ","文字":"Text",
-                          "類型":"Type","資料":"Data","日誌":"Log","停止":"Stop ","值":"Value ",
-                          "前":"Before","後":"After","密碼":"Password ","此":"This ","立即":"",
-                          "名":"Name","高":"High ","新":"New ","稱":"","是":"Is ","中":"",
-                          "您":"You ","未":"Not ","已":"Has ","個":"","的":"","到":"For ",
-                          "嗎":"","並":"And ","會":"Can ","行":"","  ":" "}}
+translate_dict = {
+    "zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"已開啟","Off":"已關閉"},
+    "zh_CN": {"已開啟":"已开启","已關閉":"已关闭","On":"已开启","Off":"已关闭",
+              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
+              "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
+              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
+              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","誤報":"误报","複製":"复制",
+              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
+              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
+              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
+              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
+              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
+              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
+              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
+              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
+              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
+              "強":"强","驅":"驱","為":"为","腳":"脚","增":"增","單":"单","開":"开",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败"},
+    "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
+              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website",
+              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索行為":"Ransom ",
+              "惡意腳本":"Script ","惡意行為":"Behavior ","可疑軟體":"Suspicious ",
+              "許可條款":"License Terms","惡意":"Malicious","可疑":"Suspicious",
+              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
+              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
+              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
+              "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
+              "測試人員":"Testers","版本資訊":"Information","通訊":"Communication ",
+              "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
+              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
+              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
+              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
+              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhanced ",
+              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
+              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
+              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
+              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
+              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"To ",
+              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
+              "分區":"Partition ","設定":"Settings","關於":"About","模式":"Mode ",
+              "提高":"Improve ","安全":"Security ","顯色":"Color ","主題":"Themes ",
+              "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
+              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
+              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
+              "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
+              "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
+              "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
+              "已經是":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
+              "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
+              "密鑰":"Key ","檢測":"Detect ","製作":"Make","  ":" "}}

PYAS_Model.json

@@ -0,0 +1 @@
+{"Virus": [261318414186602332274638176436767278092, 138027491891768042595443233665640385515, 110357087572968576943094470150101987119, 89628141614819275279501592421270658611, 9625936089192481713091234633207548145, 146573019333239184433892013297795962994, 264541877314875483358485439014616010241, 89378687258170412207570345845754816506, 295491687946453794463476073658069199320, 270110569967616684464025230399867156597, 317767290038007567692141082439138927345, 18885788501897915917239730749935859793, 95067756796967225976055101492886444145, 5340774248576581325353819949912031489, 127221069722257753511418504633757572348, 10415246439899713411029597770193411184, 95651985866123533435079044203969354868, 188173655331549916271106901837471791624, 115920025419090664908814181482465136245, 264555963058906459534362468816145940272, 95651985871075295954016225919772204788, 230418814927598623996991522865620895293, 307822865305226887780395456446154510073, 292376319578571219959135358926367053520, 894545638663197114170691953086909252, 307408049865722049855100904733744729280, 281395069059347277039468499503754758797, 10580035239361434345353152238353587444, 116667039230079911205687280113439840357, 105638824952820428052005376209508641704, 10159525814797641639514752130410024305, 799868415884320332536138129537778698, 22744055344958721368630687581251847176, 255349869106614732679810651086278546442, 315759149185061187179391478424305256898, 95315785306000038407304639293114375376, 110684881900941951709859261701564766961, 145716650028545025053236635988099140033, 95562399119788972561845288789790891122, 222253752239577871278657531622986138289, 94821380653995263056920242811808354032, 105453663146661214242864956330772860016, 133237106118017744142061791759548170883, 106285815540718769887458629487913147505, 171522714730243767599747450471850906780, 201783522381387157888199381457569830339, 95559052534575041823542189821460810608, 6803412338476848613694005563166320666, 105787286451833022929870383496648011249, 106280623246394143467097978838728292593, 94820584548412181705953186602301163257, 95563048166632561463187231032275512432, 108010814655804390841927389574188560953, 173324173206867137081876750353781475864, 95232708608642156662699453866682554993, 106285815540717561551934825217444224113, 95318319972117721345303221798918291186, 95559057605177442847140260259121040241, 305010456281757544171469123445447117681, 106198844586809641198104478887777078384, 179710050855676845982141937253360453053, 94818541689698630943530703193593974512, 105455042350511842344155948214062747248, 20881613063668797611160339818896853168, 31018193447326218505924275935240096368, 143088668467296939342778818474878950647, 110684892675972091428741019788518218489, 137521268273704145345759177480636558327, 106119662154515582210221674170892663408, 105949568716338471638768471668461534962, 89670460543521034706908097860639104624, 10332169700047182535948410013892054257, 95145598865408927095247444731707367024, 100629312664727978741143555078594927795, 148748393343889971317559945312215468786, 93989806751692355346109462915386284256, 107244620726926889373575057027717450762, 94987377598500779420569757831453449840, 100878647073583869926186814218125905113, 20215706740235798874506125693183790832, 110684912958381676190945511157408029425, 105949568706125465724368274041836011250, 300558662558418689647121992472167150144, 106201415362574605111426884001172884597, 110684882592911957008875737340312369917, 94987377577609631169063907051139341428, 105039010693725170460743583068113023705, 114380135952416886874949645426965728392, 124017012583193473160915936873388365506, 94662072863013290725024950240040430327, 143175020845977086618208175741834533027, 132011016412170201801452237305311191441, 10580035240599374384629243014119103732, 105576376886969565715901422869178687219, 172003113737697601641723035082316482624, 109023346904934388839803760995464461049, 10496943991486934504031035936730090609, 127216527016950104546694906326424083058, 336983008266790509743060629130917677774, 10248965448213412269216028810651597936, 79036768232931406417351794113275712068, 105532141803327881065557146349585635569, 100963036754215599502702416838888975610, 105787367661937540200783035652543688177, 95319034907171535697107975830043465952, 95150935027941497330695649661434404081, 31018193447326218505924275935240096368, 176177498613631404614794194516575496896, 136271405179532594000996159423307548914, 66833476002653370931812317778542555093, 9915421242395013439142248483403569396, 162357332045345094604141502928937491106, 95650044561417669529155573147468110960, 95065159985079431125978131216282192112, 18639272732092977493351497242647705306, 230570463661756059397447611038616439025, 95484514342568128463910419849540603504, 266025808443819672030174370144173223456, 47343025305025541868952332865095320248, 100968228555433537808235270915390512872, 105953482575652408268669106292717067508, 95311896151231050439910957073435270256, 105867687984072457600475937752904732400, 116Line truncated

PYAS_Model.py

@@ -1 +0,0 @@
-function_list = [['_CorExeMain'], ['GetProcessHeap', 'RtlUnwind', 'RaiseException', 'HeapSize', 'TerminateProcess', 'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsDebuggerPresent', 'HeapDestroy', 'HeapCreate', 'VirtualFree', 'Sleep', 'GetStdHandle', 'GetTimeZoneInformation', 'GetACP', 'SetHandleCount', 'GetFileType', 'GetStartupInfoA', 'GetCommandLineA', 'GetEnvironmentStrings', 'FreeEnvironmentStringsW', 'GetEnvironmentStringsW', 'QueryPerformanceCounter', 'GetSystemTimeAsFileTime', 'LCMapStringA', 'LCMapStringW', 'GetConsoleCP', 'GetConsoleMode', 'GetStringTypeA', 'GetStringTypeW', 'SetStdHandle', 'WriteConsoleA', 'GetConsoleOutputCP', 'WriteConsoleW', 'GetDateFormatA', 'GetTimeFormatA', 'GetDriveTypeA', 'SetEnvironmentVariableA', 'HeapReAlloc', 'VirtualAlloc', 'SetCurrentDirectoryA', 'HeapAlloc', 'HeapFree', 'GetTickCount', 'GetCurrentDirectoryA', 'LocalFileTimeToFileTime', 'CreateFileA', 'GetShortPathNameA', 'GetVolumeInformationA', 'GetCurrentProcess', 'DuplicateHandle', 'GetFileSize', 'SetEndOfFile', 'UnlockFile', 'LockFile', 'FlushFileBuffers', 'SetFilePointer', 'WriteFile', 'ReadFile', 'DeleteFileA', 'MoveFileA', 'GetOEMCP', 'GetCPInfo', 'InterlockedIncrement', 'SystemTimeToFileTime', 'GetThreadLocale', 'GlobalFlags', 'TlsFree', 'DeleteCriticalSection', 'LocalReAlloc', 'TlsSetValue', 'TlsAlloc', 'InitializeCriticalSection', 'GlobalHandle', 'GlobalReAlloc', 'EnterCriticalSection', 'TlsGetValue', 'LeaveCriticalSection', 'LocalAlloc', 'CloseHandle', 'GetPrivateProfileStringA', 'WritePrivateProfileStringA', 'GetPrivateProfileIntA', 'GetCurrentProcessId', 'GetCurrentThread', 'ConvertDefaultLocale', 'GetModuleFileNameA', 'EnumResourceLanguagesA', 'GetLocaleInfoA', 'lstrcmpA', 'GetDiskFreeSpaceA', 'GetFullPathNameA', 'GetTempFileNameA', 'GetFileTime', 'SetFileTime', 'GetFileAttributesA', 'FreeResource', 'GetCurrentThreadId', 'GlobalGetAtomNameA', 'GlobalAddAtomA', 'GlobalFindAtomA', 'GlobalDeleteAtom', 'lstrcmpW', 'GetVersionExA', 'GlobalFree', 'GlobalAlloc', 'FormatMessageA', 'LocalFree', 'GlobalLock', 'GlobalUnlock', 'MulDiv', 'FindFirstFileA', 'FileTimeToLocalFileTime', 'FileTimeToSystemTime', 'FindNextFileA', 'FindClose', 'FreeLibrary', 'InterlockedDecrement', 'LockResource', 'SizeofResource', 'LoadResource', 'FindResourceA', 'ExitProcess', 'GetVersion', 'CompareStringA', 'GetModuleHandleA', 'LoadLibraryA', 'GetProcAddress', 'lstrcmpiA', 'SetLastError', 'GetLastError', 'InterlockedExchange', 'GetStringTypeExA', 'MultiByteToWideChar', 'CompareStringW', 'WideCharToMultiByte', 'lstrlenA', 'FreeEnvironmentStringsA', 'GetComputerNameA', 'CopyAcceleratorTableA', 'CreateMenu', 'PostThreadMessageA', 'GetTabbedTextExtentA', 'RegisterClipboardFormatA', 'GetSysColorBrush', 'UnregisterClassA', 'LoadCursorA', 'DestroyCursor', 'SetCursorPos', 'SetCapture', 'RedrawWindow', 'InflateRect', 'UnpackDDElParam', 'ReuseDDElParam', 'LoadMenuA', 'DestroyMenu', 'ReleaseCapture', 'LoadAcceleratorsA', 'InsertMenuItemA', 'CreatePopupMenu', 'BringWindowToTop', 'SetMenu', 'TranslateAcceleratorA', 'IsZoomed', 'WindowFromPoint', 'KillTimer', 'SetTimer', 'SetRect', 'SetParent', 'GetSystemMenu', 'DeleteMenu', 'SetRectEmpty', 'IsRectEmpty', 'GetDesktopWindow', 'CreateDialogIndirectParamA', 'GetNextDlgTabItem', 'EndDialog', 'GetMessageA', 'TranslateMessage', 'GetActiveWindow', 'GetCursorPos', 'ValidateRect', 'GetWindowThreadProcessId', 'ShowOwnedPopups', 'SetCursor', 'PostQuitMessage', 'IsWindowEnabled', 'SetWindowTextA', 'IsDialogMessageA', 'SetDlgItemTextA', 'RegisterWindowMessageA', 'LoadIconA', 'SendDlgItemMessageA', 'WinHelpA', 'GetCapture', 'SetWindowsHookExA', 'CallNextHookEx', 'GetClassNameA', 'SetPropA', 'GetPropA', 'RemovePropA', 'SetFocus', 'GetWindowTextLengthA', 'GetWindowTextA', 'GetLastActivePopup', 'SetActiveWindow', 'DispatchMessageA', 'BeginDeferWindowPos', 'EndDeferWindowPos', 'GetDlgItem', 'GetTopWindow', 'DestroyWindow', 'GetMessageTime', 'GetMessagePos', 'PeekMessageA', 'MapWindowPoints', 'ScrollWindow', 'TrackPopupMenu', 'GetKeyState', 'SetScrollRange', 'GetScrollRange', 'SetScrollPos', 'GetScrollPos', 'SetForegroundWindow', 'ShowScrollBar', 'IsWindowVisible', 'GetMenu', 'PostMessageA', 'MessageBoxA', 'CreateWindowExA', 'GetClassInfoExA', 'GetClassInfoA', 'RegisterClassA', 'EqualRect', 'DeferWindowPos', 'GetScrollInfo', 'SetScrollInfo', 'PtInRect', 'DefWindowProcA', 'CallWindowProcA', 'SetWindowPos', 'OffsetRect', 'IntersectRect', 'SystemParametersInfoA', 'GetWindowPlacement', 'GetWindowRect', 'GetSystemMetrics', 'GetWindow', 'GetMenuStringA', 'AppendMenuA', 'GetMenuItemID', 'InsertMenuA', 'GetMenuItemCount', 'GetSubMenu', 'RemoveMenu', 'GetSysColor', 'EndPaint', 'BeginPaint', 'GetWindowDC', 'ClientToScreen', 'ScreenToClient', 'GrayStringA', 'DrawTextExA', 'DrawTextA', 'TabbedTextOutA', 'FillRect', 'SetWindowRgn', 'DrawIcon', 'FindWindowA', 'LockWindowUpdate', 'GetDCEx', 'DestroyIcon', 'GetClassLongA', 'GetMenuItemInfoA', 'GetDlgCtrlID', 'IsChild', 'InvalidateRect', 'IsIconic', 'AdjustWindowRectEx',Line truncated

PYAS_Version.py

@@ -0,0 +1,11 @@
+import pyinstaller_versionfile
+
+pyinstaller_versionfile.create_versionfile(
+output_file="versionfile.txt",
+version='3.0.7',
+company_name="PYAS Security",
+file_description="Python Antivirus Software",
+internal_name="PYAS",
+legal_copyright="PYAS Security",
+original_filename="PYAS.exe",
+product_name="PYAS")

PYAS_Version_File.py

@@ -1,10 +0,0 @@
-import pyinstaller_versionfile
-pyinstaller_versionfile.create_versionfile(
-    output_file="versionfile.txt",
-    version='2.6.7',
-    company_name="PYAS Security",
-    file_description="Python Antivirus Software",
-    internal_name="PYAS",
-    legal_copyright="© PYAS Security",
-    original_filename="PYAS.exe",
-    product_name="PYAS")

README.md

@@ -1,21 +1,176 @@
 # PYAS (Python Antivirus Software)
-![PYAS](https://user-images.githubusercontent.com/85057800/202692146-e55848d5-7e24-405d-b33d-f4fa3883fba6.png)
 
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+
+## Readme Language
+
+[繁體中文](https://github.com/zackzheng1121/PYAS/blob/main/README_zh.md)
+
+## File Information
+
+PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
+
+PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
+
+PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
+
+PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
+
+PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
+
+PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
+
+PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
+
+PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
+
+## Requirements
+
+Use pip install requirements to install import module
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## Hash Scanning
+
+Use Qihoo 360 cloud service to scan known malicious files
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## Pefile Scanning
+
+Get the pefile file function import table for scanning
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## Process Detect
+
+Show the new process name, file path, cmd line, pid
+
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+                elif not psutil.pid_exists(p.pid):
+                    existing_processes.remove(p.pid)
+            except:
+                pass
+
+proc_detect()
+```
+
+## File Detect
+
+Monitor file changes under the specified path
+
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## Official Website
+
+https://pyantivirus.wixsite.com/pyas
 
-## Official Website 
-https://pyantivirus.wixsite.com/pyas , 
 https://github.com/87owo/PYAS
 
-## MIT License
+## MIT license
+
 https://github.com/87owo/PYAS/blob/main/LICENSE.md
 
 ## Support System
+
 Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
 
-## Import Module
-os, sys, time, json, psutil, struct, win32api, win32con, requests, socket, platform, cryptocode, subprocess, pefile, hashlib, PYAS_Language, threading, random, PyQt5, PYAS_UI
+Other systems may experience software malfunctions or crash
 
 ## Special Thanks
-Wix, VirusShare, mtkiao129, LenStevens
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
 
-Copyright© 2020~2023 PYAS Security By 87owo
+Copyright© 2020~2024 PYAS Security By 87owo

README_zh.md

@@ -0,0 +1,167 @@
+# PYAS (Python 防毒軟體)
+
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+
+## 文件訊息
+
+PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
+
+PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
+
+PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
+
+PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
+
+PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
+
+PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
+
+PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
+
+PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
+
+## 要求
+
+使用 pip install requirements 來安裝需要的模組
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## 哈希掃描
+
+使用奇虎360雲端服務掃描已知惡意文件
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## 文件掃描
+
+取得pefile檔案函數導入表進行掃描
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## 進程偵測
+
+顯示新進程名稱、檔案路徑、cmd 行、pid
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+            except:
+                pass
+
+proc_detect()
+```
+
+## 檔案偵測
+
+監控指定路徑下的檔案變化
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## 官方網頁
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 開源許可證
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 支援的系統
+
+Windows 8.1, 10, 11 (64-bit),記憶體 1GB, 磁碟容量 1GB 或更高
+Other systems may experience software malfunctions or crash
+
+## Special Thanks
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo