Add files via upload

Update PYAS_Language.py

Engine/Model/convert.py

@@ -0,0 +1,68 @@
+from PIL import Image
+import numpy, pefile, os
+
+####################################################################################################
+
+def preprocess_image(file_data, size, channels=1):
+    width, height = size
+    wah = int(numpy.ceil(numpy.sqrt(len(file_data) / channels)))
+    arr = numpy.frombuffer(file_data, dtype=numpy.uint8)
+    img = numpy.zeros(wah*wah*channels, dtype=numpy.uint8)
+    img[:len(file_data)] = arr
+    image = Image.fromarray(img.reshape((wah, wah)), 'L')
+    return image.resize((width, height), Image.Resampling.NEAREST)
+
+####################################################################################################
+
+def is_text_file(content, sample_size=1024):
+    raw = content[:sample_size]
+    if not raw:
+        return False
+    text_char = set(range(32, 127)) | {9, 10, 13}
+    nontext = sum(b not in text_char for b in raw)
+    return nontext / len(raw) < 0.15
+
+def get_type(file_path):
+    suffix = {".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui", ".cpl"}
+
+    match_data = {}
+    if not os.path.splitext(file_path)[-1].lower() in suffix:
+        return match_data
+    try:
+        with pefile.PE(file_path, fast_load=True) as pe:
+            for section in pe.sections:
+                name = section.Name.rstrip(b'\x00').decode('latin1').lower()
+                data = section.get_data()
+                if data:
+                    match_data[name] = section.get_data()
+    except pefile.PEFormatError:
+        with open(file_path, 'rb') as f:
+            file_content = f.read()
+        if is_text_file(file_content):
+            match_data[os.path.splitext(file_path)[-1].lower()] = file_content
+    return match_data
+
+####################################################################################################
+
+def file_to_images(input_dir, output_dir):
+    for root, dirs, files in os.walk(input_dir):
+        for file in files:
+            try:
+                file_path = os.path.join(root, file)
+                for name, data in get_type(file_path).items():
+                    print(name, file_path)
+                    relative_path = os.path.relpath(root, input_dir)
+                    output_path_dir = os.path.join(output_dir, relative_path)
+                    if not os.path.exists(output_path_dir):
+                        os.makedirs(output_path_dir)
+                    image = preprocess_image(data, (224, 224))
+                    image.save(os.path.join(output_path_dir, f"{name}_{file}.png"))
+            except Exception as e:
+                print(e)
+
+####################################################################################################
+
+input_directory = input('Enter the folder path: ')
+output_directory = "./Image_Output"
+file_to_images(input_directory, output_directory)
+input('Conversion Complete')

Engine/Model/deduplicate.py

@@ -0,0 +1,34 @@
+import os, hashlib
+
+####################################################################################################
+
+def calc_sha256(path):
+    with open(path, "rb") as f:
+        return hashlib.sha256(f.read()).digest()
+
+def dedup_realtime(root):
+    seen = set()
+    deleted = 0
+    for dirpath, _, files in os.walk(root):
+        for name in files:
+            p = os.path.join(dirpath, name)
+            try:
+                h = calc_sha256(p)
+            except Exception:
+                continue
+            if h in seen:
+                try:
+                    os.remove(p)
+                    print(p)
+                    deleted += 1
+                except Exception:
+                    pass
+            else:
+                seen.add(h)
+    print(f"deleted {deleted}")
+
+####################################################################################################
+
+if __name__ == "__main__":
+    dedup_realtime(input("Input file path: "))
+input('Deduplicate Complete')

Engine/Model/train.py

@@ -0,0 +1,163 @@
+import tensorflow as tf
+import os, tf2onnx, numpy, random
+from PIL import Image
+from tensorflow.keras import *
+from collections import Counter
+
+####################################################################################################
+
+Image.MAX_IMAGE_PIXELS = None
+tf.keras.mixed_precision.set_global_policy('mixed_float16')
+
+####################################################################################################
+
+def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=256, color_mode="grayscale"):
+    channels = 1 if color_mode == "grayscale" else 3
+    file_paths, labels, class_indices = get_file_list(data_dir)
+    
+    combined = list(zip(file_paths, labels))
+    random.shuffle(combined)
+    file_paths[:], labels[:] = zip(*combined)
+
+    num_val = int(val_split * len(file_paths))
+    train_files = file_paths[num_val:]
+    train_labels = labels[num_val:]
+    val_files = file_paths[:num_val]
+    val_labels = labels[:num_val]
+    num_classes = len(class_indices)
+
+    train_ds = tf.data.Dataset.from_tensor_slices((train_files, train_labels))
+    train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    train_ds = train_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
+
+    val_ds = tf.data.Dataset.from_tensor_slices((val_files, val_labels))
+    val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    val_ds = val_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
+
+    train_ds.class_indices = class_indices
+    return train_ds, val_ds
+
+####################################################################################################
+
+def parse_fn(filename, label, image_size, channels, num_classes):
+    img = tf.io.read_file(filename)
+    img = tf.image.decode_image(img, channels=channels, expand_animations=False)
+    img = tf.cond(tf.reduce_all(tf.equal(tf.shape(img)[:2], image_size)), lambda: tf.cast(img, tf.float32), lambda: tf.image.resize(img, image_size))
+    img = tf.cast(img, tf.float32) / 255.0
+    label = tf.one_hot(label, depth=num_classes)
+    return img, label
+
+def get_file_list(directory):
+    file_paths, labels, class_indices = [], [], {}
+    for i, cls in enumerate(sorted([d for d in os.listdir(directory) if os.path.isdir(os.path.join(directory, d))])):
+        class_indices[cls] = i
+        cls_dir = os.path.join(directory, cls)
+
+        for root, _, files in os.walk(cls_dir):
+            for file in files:
+                if file.lower().endswith(('.jpg', '.jpeg', '.png', '.bmp', '.gif')):
+                    file_paths.append(os.path.join(root, file))
+                    labels.append(i)
+    return file_paths, labels, class_indices
+
+####################################################################################################
+
+def multi_conv(x, strides):
+    convs = []
+    for k in [(1, 7), (1, 1), (3, 3), (5, 5)]:
+        c = layers.DepthwiseConv2D(kernel_size=k, strides=strides, padding='same', activation='gelu')(x)
+        convs.append(c)
+
+    x = layers.Concatenate()(convs)
+    x = layers.BatchNormalization()(x)
+    return layers.Activation('gelu')(x)
+
+def gated_conv(x, strides):
+    c = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='gelu')(x)
+    g = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='sigmoid')(x)
+    return layers.Multiply()([c, g])
+
+def coordinate_attention(x, reduction):
+    input_shape = tf.shape(x)
+    h, w = input_shape[1], input_shape[2]
+    filters = x.shape[-1]
+    mip = max(8, filters // reduction)
+
+    x_h = layers.Lambda(lambda t: tf.reduce_mean(t, axis=2, keepdims=True))(x)
+    x_w = layers.Lambda(lambda t: tf.reduce_mean(t, axis=1, keepdims=True))(x)
+    x_w_t = layers.Permute((2, 1, 3))(x_w)
+
+    x_cat = layers.Concatenate(axis=1)([x_h, x_w_t])
+    x_cat = layers.Conv2D(mip, 1, padding='valid', use_bias=False)(x_cat)
+    x_cat = layers.BatchNormalization()(x_cat)
+    x_cat = layers.Activation('gelu')(x_cat)
+
+    x_cat_h, x_cat_w = layers.Lambda(lambda t: tf.split(t[0], [t[1], t[2]], axis=1))([x_cat, h, w])
+    x_h_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_h)
+    x_cat_w = layers.Permute((2, 1, 3))(x_cat_w)
+    x_w_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_w)
+
+    return layers.Multiply()([x, x_h_sigmoid, x_w_sigmoid])
+
+def build_model(input_shape, num_classes):
+    i = layers.Input(shape=input_shape)
+    x = multi_conv(i, strides=1)
+    x = gated_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+
+    x = coordinate_attention(x, reduction=4)
+    x = layers.GlobalMaxPooling2D()(x)
+
+    x = layers.Dense(x.shape[-1] // 2, activation='gelu', dtype='float32')(x)
+    o = layers.Dense(num_classes, activation='softmax', dtype='float32')(x)
+    return models.Model(i, o)
+
+####################################################################################################
+
+def calculate_lr_cosine_sq(epoch, total_epochs=25, lr_start=5e-4, lr_end=1e-6):
+    cos_val = 0.5 * (1 + numpy.cos(epoch / total_epochs * numpy.pi))
+    return lr_end + (lr_start - lr_end) * (cos_val ** 2)
+
+def lr_scheduler(epoch):
+    return calculate_lr_cosine_sq(epoch)
+
+def categorical_focal_loss(gamma=2.0, alpha=0.25):
+    def focal_loss(y_true, y_pred):
+        y_pred = tf.clip_by_value(y_pred, tf.keras.backend.epsilon(), 1.0 - tf.keras.backend.epsilon())
+        cross_entropy = -y_true * tf.math.log(y_pred)
+        loss = alpha * tf.math.pow(1.0 - y_pred, gamma) * cross_entropy
+        return tf.reduce_sum(loss, axis=-1)
+    return focal_loss
+
+class CustomModelCheckpoint(callbacks.Callback):
+    def on_epoch_end(self, epoch, logs=False):
+        models.save_model(self.model, f"PYAS_Model_Epoch_{epoch + 1}.h5")
+        spec = (tf.TensorSpec((None,) + train_ds.image_shape, tf.float32),)
+        model_proto, _ = tf2onnx.convert.from_keras(self.model, input_signature=spec, opset=17)
+        with open(f"PYAS_Model_Epoch_{epoch + 1}.onnx", "wb") as f:
+            f.write(model_proto.SerializeToString())
+
+####################################################################################################
+
+train_ds, val_ds = load_dataset(r'.\Image_File_Pefile')
+for imgs, _ in train_ds.take(1):
+    train_ds.image_shape = imgs.shape[1:]
+    break
+
+try:
+    model = models.load_model('PYAS_Model_Epoch_0.h5')
+    print("Load model from disk")
+except:
+    print("Creating a new model")
+    model = build_model(train_ds.image_shape, len(train_ds.class_indices))
+
+print(f"Total parameters: {model.count_params()}")
+model.compile(optimizer='adam', loss=categorical_focal_loss(gamma=2.0, alpha=0.25), 
+    metrics=['accuracy', metrics.Precision(name='precision'), metrics.Recall(name='recall'),
+    metrics.FalsePositives(name='fp'), metrics.TrueNegatives(name='tn')])
+
+model.fit(train_ds, epochs=25, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds)
+input('Training Complete')

LICENSE.md

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2020-2023 87owo (PYAS Security)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

LICENSE.txt

@@ -0,0 +1,31 @@
+87owo Publicly Available Source Code License Agreement
+Last updated: 2025-12-19
+
+1. License and Ownership
+   - This software and its source code are source available for public view.
+   - Access or execution of certain features may require an activation key.
+   - 87owo reserves all legal rights, no intellectual property is transferred.
+   - All project archives, source code, and binaries remain fully proprietary.
+
+2. Use and Prohibitions
+   - You may view, download, and modify the code for local and personal use.
+   - Redistribution of any original or modified code requires prior consent.
+   - Commercial hosting or SaaS deployment is prohibited without permission.
+   - Reverse engineering, license removal, or illegal use is strictly barred.
+
+3. Data and Privacy
+   - This project may collect operational data for optimization and analysis.
+   - All collected data is strictly anonymized to ensure the user's privacy.
+   - Transmission of information is encrypted to prevent unauthorized access.
+
+4. Updates and Terms
+   - New releases may include critical patches, enhancements, or UI changes.
+   - Continued use of these services constitutes acceptance of updated terms.
+   - The author reserves the right to modify these license terms at any time.
+
+5. Warranty and Liability
+   - All services and assets are provided "as is" without any form of warranty.
+   - 87owo is not liable for any direct or indirect damages from software use.
+   - Users assume all risks regarding performance, data, and system integrity.
+
+© 2020-2026 87owo (PYAS Security). All rights reserved.

Library/PYAS.json

@@ -1,5 +0,0 @@
-{
-    "language": "en_US",
-    "high_sensitivity": 0,
-    "cloud_services": 1
-}

PYAS_Config.py

@@ -0,0 +1,130 @@
+translate_dict = {
+    "traditional_switch": {"开启":"開啟","关闭":"關閉","On":"開啟","Off":"關閉"},
+
+    "simplified_switch": {"開啟":"开启","關閉":"关闭","On":"开启","Off":"关闭",
+              "錯誤":"错误","發現":"发现","關閉":"关闭","裝置":"设备","記憶體":"内存",
+              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
+              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
+              "位元":"字节","靈敏":"敏感","複製":"复制","開啟":"开启","靜態":"静态",
+              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
+              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
+              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
+              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
+              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
+              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
+              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
+              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
+              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
+              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
+              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","與":"与",
+              "異":"异","實":"实","時":"时","彈":"弹","窗":"窗","暫":"暂","訂":"订",
+              "資":"资","產":"产","金":"密","離":"离","規":"规","則":"则","來":"来",
+              "殼":"壳","碼":"码","線":"线","餘":"余",},
+
+    "english_switch": {"開啟":"On","關閉":"Off","开启":"On","关闭":"Off","，":", ",
+              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Official Website ",
+              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
+              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ","主要":"Main ",
+              "許可條款":"License Terms ","惡意":"Malicious", "開發":"Developers ",
+              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
+              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
+              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
+              "藍色主題":"Blue","綠色主題":"Green","自訂主題":"Custom","黑色主題":"Black",
+              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
+              "註冊":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
+              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
+              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
+              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
+              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
+              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
+              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
+              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
+              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
+              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"Can ",
+              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
+              "分區":"Partition ","設定":"Setting ","關於":"About","模式":"Mode ",
+              "提高":"Improve ","安全":"Security ","顯色":"Color ","顏色":"Color ",
+              "主題":"Theme ", "回收":"Collect ", "無用":"Useless ","導入":"Import ",
+              "風險":"Risk ","介面":"UI ","核心":"Core ","服務":"Services ",
+              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
+              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
+              "到":"To ","白名單":"White List ","軟體":"Software ","正在":"",
+              "增加":"Add ","移除":"Delete ","項目":"Items ","生成":"Create ","稱":"",
+              "複製":"Copy ","此":"This ","並":"And ","全盤":"Full ","最新":"Latest ",
+              "已存在":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Rule ",
+              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
+              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
+              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","列表":"List ",
+              "竄改":"Tamper ","第三方":"Other ","實時":"Real Time ","查看":"View ",
+              "指定":"Specify ","清空":"Empty ","資源回收桶":"Recycle Bin ", "無法":"Cannot ",
+              "與":"With ","當":"When ","功能":"Function ","異常":"Abnormal ", "來":"To ",
+              "重置":"Reset ","窗口":"Window ","暫存":"Temp ","自訂":"Custom ",
+              "不支持":"Not Support ","共":"Total ","秒":"Seconds ","耗時":"Takes ",
+              "沙箱":"Sandbox ", "虛擬":"Virtual ", "隔離":"Quarantine ", "時":"",
+              "建立":"Create ","環境":"Environment ","沙箱":"Sandbox ","化":"", "表":"",
+              "達":"Reached ", "上限":"Limit ", "區":"", "金鑰":"Key ", "產品":"Product ",
+              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Inject ",
+              "前往":"Go ","檢查":"Check ","可用":"Available ","靜態":"Static ",
+              "版本":"Version ","是":"","剩餘":"Remain ","遠控":"Remote ","監控":"Monitor ",
+              "  ":" "},
+
+    "white_switch": {
+        "_white": "_black",},
+    "red_switch": {
+        "235, 235, 235": "255, 235, 235",
+        "245, 245, 245": "255, 225, 225",
+        "255, 255, 255": "255, 245, 245",
+        "240, 240, 240": "255, 220, 220",
+        "250, 250, 250": "255, 210, 210",
+        "220, 255, 220": "255, 220, 220",
+        "210, 255, 210": "255, 210, 210",
+        "_white": "_black"
+    },
+    "yellow_switch": {
+        "235, 235, 235": "255, 255, 235",
+        "245, 245, 245": "255, 255, 225",
+        "255, 255, 255": "255, 255, 245",
+        "240, 240, 240": "255, 255, 220",
+        "250, 250, 250": "255, 255, 210",
+        "220, 255, 220": "255, 255, 220",
+        "210, 255, 210": "255, 255, 210",
+        "_white": "_black"
+    },
+    "green_switch": {
+        "235, 235, 235": "235, 255, 235",
+        "245, 245, 245": "225, 255, 225",
+        "255, 255, 255": "245, 255, 245",
+        "240, 240, 240": "220, 255, 220",
+        "250, 250, 250": "210, 255, 210",
+        "_white": "_black"
+    },
+    "blue_switch": {
+        "235, 235, 235": "235, 235, 255",
+        "245, 245, 245": "225, 225, 255",
+        "255, 255, 255": "245, 245, 255",
+        "240, 240, 240": "220, 220, 255",
+        "250, 250, 250": "210, 210, 255",
+        "220, 255, 220": "220, 220, 255",
+        "210, 255, 210": "210, 210, 255",
+        "_white": "_black"
+    },
+    "black_switch": {
+        "255, 255, 255": "20, 20, 20", 
+        "245, 245, 245": "40, 40, 40",
+        "235, 235, 235": "30, 30, 30", 
+        "240, 240, 240": "70, 70, 70",
+        "250, 250, 250": "80, 80, 80",
+        "220, 255, 220": "70, 70, 70",
+        "210, 255, 210": "80, 80, 80",
+        "0, 0, 0": "255, 255, 255",
+        "_black": "_white"
+    }
+}

PYAS_Engine.py

@@ -0,0 +1,208 @@
+import os, yara, numpy, base64, onnxruntime
+import ctypes, ctypes.wintypes, pefile
+from PIL import Image
+from io import BytesIO
+
+####################################################################################################
+
+class GUID(ctypes.Structure):
+    _fields_ = [
+        ("Data1", ctypes.wintypes.DWORD),
+        ("Data2", ctypes.wintypes.WORD),
+        ("Data3", ctypes.wintypes.WORD),
+        ("Data4", ctypes.c_ubyte * 8)]
+
+class WINTRUST_FILE_INFO(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
+        ("hFile", ctypes.wintypes.HANDLE),
+        ("pgKnownSubject", ctypes.wintypes.LPVOID)]
+
+class WINTRUST_DATA(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pPolicyCallbackData", ctypes.wintypes.LPVOID),
+        ("pSIPClientData", ctypes.wintypes.LPVOID),
+        ("dwUIChoice", ctypes.wintypes.DWORD),
+        ("fdwRevocationChecks", ctypes.wintypes.DWORD),
+        ("dwUnionChoice", ctypes.wintypes.DWORD),
+        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("dwStateAction", ctypes.wintypes.DWORD),
+        ("hWVTStateData", ctypes.wintypes.HANDLE),
+        ("pwszURLReference", ctypes.wintypes.LPCWSTR),
+        ("dwProvFlags", ctypes.wintypes.DWORD),
+        ("dwUIContext", ctypes.wintypes.DWORD),
+        ("pSignatureSettings", ctypes.wintypes.LPVOID)]
+
+####################################################################################################
+
+class sign_scanner:
+    def __init__(self):
+        self.verify = GUID(0x00AAC56B, 0xCD44, 0x11D0, (0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
+
+    def init_windll(self, path):
+        for name in path:
+            try:
+                setattr(self, name.lower(), ctypes.WinDLL(name, use_last_error=True))
+            except Exception as e:
+                self.send_message(e, "warn", False)
+
+        self.WinVerifyTrust = self.wintrust.WinVerifyTrust
+        self.WinVerifyTrust.restype = ctypes.wintypes.LONG
+        self.WinVerifyTrust.argtypes = [ctypes.wintypes.HWND, ctypes.POINTER(GUID), ctypes.c_void_p]
+
+    def is_sign(self, file_path):
+        with pefile.PE(file_path, fast_load=True) as pe:
+            sec_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_SECURITY']]
+            return sec_dir.VirtualAddress != 0 and sec_dir.Size > 0
+
+    def sign_verify(self, file_path):
+        fi = WINTRUST_FILE_INFO(ctypes.sizeof(WINTRUST_FILE_INFO), file_path, None, None)
+        data = WINTRUST_DATA(ctypes.sizeof(WINTRUST_DATA), None, None, 2, 0, 1,
+            ctypes.pointer(fi), 1, None, None, 0, 0, None)
+        s = self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
+        data.dwStateAction = 2
+        self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
+        return s == 0
+
+####################################################################################################
+
+class rule_scanner:
+    def __init__(self):
+        self.rules = {}
+        self.network = []
+
+    def load_path(self, path):
+        for root, _, files in os.walk(path):
+            for file in files:
+                self.load_file(os.path.join(root, file))
+
+    def load_file(self, file):
+        ext = os.path.splitext(file)[1].lower()
+        try:
+            if ext in ('.yara', '.yar'):
+                self.rules[file] = yara.compile(file)
+            elif ext in ('.yc', '.yrc'):
+                self.rules[file] = yara.load(file)
+            elif ext in ('.ip', '.txt'):
+                with open(file, "r", encoding="utf-8", errors="ignore") as f:
+                    self.network.extend(line.strip() for line in f if line.strip())
+        except Exception:
+            return False
+
+    def yara_scan(self, file_path):
+        try:
+            for rules in self.rules.values():
+                matches = rules.match(filepath=file_path)
+                if matches:
+                    rule_name = str(matches[0])
+                    label = rule_name.split("_")[0]
+                    level = rule_name.split("_")[-1]
+                    return f"Rules/{label}", level
+            return False, False
+        except Exception:
+            return False, False
+
+####################################################################################################
+
+class model_scanner:
+    def __init__(self):
+        self.model = None
+        self.suffix = {".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys"}
+        self.labels = ["Pefile/White", "Pefile/General"]
+        self.detect_set = {"Pefile/General"}
+        self.resize = (224, 224)
+
+    def load_path(self, path):
+        for root, _, files in os.walk(path):
+            for file in files:
+                self.load_file(os.path.join(root, file))
+
+    def load_file(self, file):
+        if file.lower().endswith('.onnx'):
+            try:
+                self.model = onnxruntime.InferenceSession(file)
+            except Exception:
+                return False
+
+    def model_scan(self, file_path, full_output=False):
+        if not self.model:
+            return (False, False) if not full_output else ([], str(file_path), None)
+
+        sections = self.extract_sections(file_path)
+        if not sections:
+            return (False, False) if not full_output else ([], str(file_path), None)
+            
+        images = [self.preprocess_image(data, self.resize) for data in sections.values()]
+        if not images:
+            return (False, False) if not full_output else ([], str(file_path), None)
+
+        arr = numpy.stack([numpy.asarray(img).astype('float32') / 255.0 for img in images])
+        if arr.ndim == 3:
+            arr = numpy.expand_dims(arr, axis=-1)
+
+        input_meta = self.model.get_inputs()[0]
+        input_name = input_meta.name
+        input_shape = input_meta.shape
+
+        if len(input_shape) == 4:
+            if input_shape[1] in (1, 3) and input_shape[3] not in (1, 3):
+                arr = arr.transpose(0, 3, 1, 2)
+        try:
+            probs = self.model.run(None, {input_name: arr})[0]
+        except Exception:
+            return (False, False) if not full_output else ([], str(file_path), None)
+
+        results = []
+        best_malicious = None
+
+        for name, pred, img in zip(sections.keys(), probs, images):
+            idx = int(numpy.argmax(pred))
+            label = self.labels[idx] if idx < len(self.labels) else f"Class_{idx}"
+            conf = round(float(pred[idx]) * 100, 2)
+            print(f"Section: {name} | Label: {label} | Confidence: {conf}%")
+
+            if full_output:
+                results.append((name, label, conf, self.pil_to_base64(img)))
+            if label in self.detect_set:
+                if best_malicious is None or conf > best_malicious[1]:
+                    best_malicious = (label, int(conf))
+
+        if full_output:
+            results.sort(key=lambda x: (x[1] not in self.detect_set, -x[2]))
+            malicious_count = sum(1 for _, lbl, _, _ in results if lbl in self.detect_set)
+            total = len(results)
+            return results, str(file_path), f"{malicious_count}/{total}"
+
+        return best_malicious if best_malicious else (False, False)
+
+    def pil_to_base64(self, img):
+        buf = BytesIO()
+        img.save(buf, format='PNG')
+        return base64.b64encode(buf.getvalue()).decode()
+
+    def preprocess_image(self, data, size, channels=1):
+        width, height = size
+        wah = int(numpy.ceil(numpy.sqrt(len(data) / channels)))
+        arr = numpy.frombuffer(data, dtype=numpy.uint8)
+        imgbuf = numpy.zeros(wah * wah * channels, dtype=numpy.uint8)
+        imgbuf[:len(arr)] = arr
+        image = Image.fromarray(imgbuf.reshape((wah, wah)), 'L')
+        return image.resize((width, height), Image.Resampling.NEAREST)
+
+    def extract_sections(self, file_path):
+        match_data = {}
+        fpath_str = str(file_path)
+        ext = os.path.splitext(fpath_str)[-1].lower()
+        if ext in self.suffix:
+            try:
+                with pefile.PE(fpath_str, fast_load=True) as pe:
+                    for section in pe.sections:
+                        name = section.Name.rstrip(b'\x00').decode('latin1', errors='ignore').lower()
+                        data = section.get_data()
+                        if data:
+                            match_data[name] = data
+            except Exception:
+                pass
+        return match_data

PYAS_Language.py

@@ -1,47 +0,0 @@
-translations = {"zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"已開啟","Off":"已關閉"},
-                "zh_CN": {"已開啟":"已开启","已關閉":"已关闭","On":"已开启","Off":"已关闭",
-                          "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
-                          "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
-                          "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-                          "位元":"字节","增":"增","單":"单","簽":"签","無":"无","關":"关",
-                          "項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保","鑰":"钥",
-                          "當":"当","後":"后","護":"护","導":"导","區":"区","復":"复","攔":"拦",
-                          "請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选","啟":"启",
-                          "監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动","狀":"状",
-                          "誌":"志","靈":"灵","這":"这","會":"会","題":"题","擇":"择","語":"语",
-                          "顯":"显","變":"变","戶":"户","碼":"码","雲":"云","訂":"订","稱":"称",
-                          "類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网","詢":"询",
-                          "製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红","綠":"绿",
-                          "態":"态","務":"务","連":"连","檢":"检","測":"测","強":"强"},
-                "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
-                          "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website",
-                          "許可條款":"License Terms","可疑":"Suspicious ","惡意軟體":"Malware ",
-                          "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
-                          "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-                          "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update",
-                          "白色主題":"White","黑色主題":"Black","黃色主題":"Yellow","紅色主題":"Red",
-                          "藍色主題":"Blue","綠色主題":"Green","語言":"Language ","製作":"Make",
-                          "測試人員":"Testers","版本資訊":"Information","無效簽名":"Unsign ",
-                          "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
-                          "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
-                          "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
-                          "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
-                          "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
-                          "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhanced ",
-                          "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
-                          "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
-                          "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
-                          "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
-                          "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"To ",
-                          "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
-                          "分區":"Partition ","設定":"Settings","關於":"About","模式":"Mode ",
-                          "提高":"Improve ","安全":"Security ","顯色":"Color ","主題":"Themes ",
-                          "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
-                          "管理":"Manage","所有":"All ","全盤":"Full ","日誌":"Log",
-                          "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-                          "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
-                          "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ",
-                          "開啟":"Open ","您":"You ","此":"This ","並":"And ","未":"Not ",
-                          "高":"High ","新":"New ","和":"And ","會":"Can ","密鑰":"Key ",
-                          "已":"Has ","立即":"","顯示":"","個":"","的":"","嗎":"","中":"",
-                          "了":"","行":"","稱":"","  ":" "}}

PYAS_Model.py

@@ -1 +0,0 @@
-function_list = [['_CorExeMain'], ['GetProcessHeap', 'RtlUnwind', 'RaiseException', 'HeapSize', 'TerminateProcess', 'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsDebuggerPresent', 'HeapDestroy', 'HeapCreate', 'VirtualFree', 'Sleep', 'GetStdHandle', 'GetTimeZoneInformation', 'GetACP', 'SetHandleCount', 'GetFileType', 'GetStartupInfoA', 'GetCommandLineA', 'GetEnvironmentStrings', 'FreeEnvironmentStringsW', 'GetEnvironmentStringsW', 'QueryPerformanceCounter', 'GetSystemTimeAsFileTime', 'LCMapStringA', 'LCMapStringW', 'GetConsoleCP', 'GetConsoleMode', 'GetStringTypeA', 'GetStringTypeW', 'SetStdHandle', 'WriteConsoleA', 'GetConsoleOutputCP', 'WriteConsoleW', 'GetDateFormatA', 'GetTimeFormatA', 'GetDriveTypeA', 'SetEnvironmentVariableA', 'HeapReAlloc', 'VirtualAlloc', 'SetCurrentDirectoryA', 'HeapAlloc', 'HeapFree', 'GetTickCount', 'GetCurrentDirectoryA', 'LocalFileTimeToFileTime', 'CreateFileA', 'GetShortPathNameA', 'GetVolumeInformationA', 'GetCurrentProcess', 'DuplicateHandle', 'GetFileSize', 'SetEndOfFile', 'UnlockFile', 'LockFile', 'FlushFileBuffers', 'SetFilePointer', 'WriteFile', 'ReadFile', 'DeleteFileA', 'MoveFileA', 'GetOEMCP', 'GetCPInfo', 'InterlockedIncrement', 'SystemTimeToFileTime', 'GetThreadLocale', 'GlobalFlags', 'TlsFree', 'DeleteCriticalSection', 'LocalReAlloc', 'TlsSetValue', 'TlsAlloc', 'InitializeCriticalSection', 'GlobalHandle', 'GlobalReAlloc', 'EnterCriticalSection', 'TlsGetValue', 'LeaveCriticalSection', 'LocalAlloc', 'CloseHandle', 'GetPrivateProfileStringA', 'WritePrivateProfileStringA', 'GetPrivateProfileIntA', 'GetCurrentProcessId', 'GetCurrentThread', 'ConvertDefaultLocale', 'GetModuleFileNameA', 'EnumResourceLanguagesA', 'GetLocaleInfoA', 'lstrcmpA', 'GetDiskFreeSpaceA', 'GetFullPathNameA', 'GetTempFileNameA', 'GetFileTime', 'SetFileTime', 'GetFileAttributesA', 'FreeResource', 'GetCurrentThreadId', 'GlobalGetAtomNameA', 'GlobalAddAtomA', 'GlobalFindAtomA', 'GlobalDeleteAtom', 'lstrcmpW', 'GetVersionExA', 'GlobalFree', 'GlobalAlloc', 'FormatMessageA', 'LocalFree', 'GlobalLock', 'GlobalUnlock', 'MulDiv', 'FindFirstFileA', 'FileTimeToLocalFileTime', 'FileTimeToSystemTime', 'FindNextFileA', 'FindClose', 'FreeLibrary', 'InterlockedDecrement', 'LockResource', 'SizeofResource', 'LoadResource', 'FindResourceA', 'ExitProcess', 'GetVersion', 'CompareStringA', 'GetModuleHandleA', 'LoadLibraryA', 'GetProcAddress', 'lstrcmpiA', 'SetLastError', 'GetLastError', 'InterlockedExchange', 'GetStringTypeExA', 'MultiByteToWideChar', 'CompareStringW', 'WideCharToMultiByte', 'lstrlenA', 'FreeEnvironmentStringsA', 'GetComputerNameA', 'CopyAcceleratorTableA', 'CreateMenu', 'PostThreadMessageA', 'GetTabbedTextExtentA', 'RegisterClipboardFormatA', 'GetSysColorBrush', 'UnregisterClassA', 'LoadCursorA', 'DestroyCursor', 'SetCursorPos', 'SetCapture', 'RedrawWindow', 'InflateRect', 'UnpackDDElParam', 'ReuseDDElParam', 'LoadMenuA', 'DestroyMenu', 'ReleaseCapture', 'LoadAcceleratorsA', 'InsertMenuItemA', 'CreatePopupMenu', 'BringWindowToTop', 'SetMenu', 'TranslateAcceleratorA', 'IsZoomed', 'WindowFromPoint', 'KillTimer', 'SetTimer', 'SetRect', 'SetParent', 'GetSystemMenu', 'DeleteMenu', 'SetRectEmpty', 'IsRectEmpty', 'GetDesktopWindow', 'CreateDialogIndirectParamA', 'GetNextDlgTabItem', 'EndDialog', 'GetMessageA', 'TranslateMessage', 'GetActiveWindow', 'GetCursorPos', 'ValidateRect', 'GetWindowThreadProcessId', 'ShowOwnedPopups', 'SetCursor', 'PostQuitMessage', 'IsWindowEnabled', 'SetWindowTextA', 'IsDialogMessageA', 'SetDlgItemTextA', 'RegisterWindowMessageA', 'LoadIconA', 'SendDlgItemMessageA', 'WinHelpA', 'GetCapture', 'SetWindowsHookExA', 'CallNextHookEx', 'GetClassNameA', 'SetPropA', 'GetPropA', 'RemovePropA', 'SetFocus', 'GetWindowTextLengthA', 'GetWindowTextA', 'GetLastActivePopup', 'SetActiveWindow', 'DispatchMessageA', 'BeginDeferWindowPos', 'EndDeferWindowPos', 'GetDlgItem', 'GetTopWindow', 'DestroyWindow', 'GetMessageTime', 'GetMessagePos', 'PeekMessageA', 'MapWindowPoints', 'ScrollWindow', 'TrackPopupMenu', 'GetKeyState', 'SetScrollRange', 'GetScrollRange', 'SetScrollPos', 'GetScrollPos', 'SetForegroundWindow', 'ShowScrollBar', 'IsWindowVisible', 'GetMenu', 'PostMessageA', 'MessageBoxA', 'CreateWindowExA', 'GetClassInfoExA', 'GetClassInfoA', 'RegisterClassA', 'EqualRect', 'DeferWindowPos', 'GetScrollInfo', 'SetScrollInfo', 'PtInRect', 'DefWindowProcA', 'CallWindowProcA', 'SetWindowPos', 'OffsetRect', 'IntersectRect', 'SystemParametersInfoA', 'GetWindowPlacement', 'GetWindowRect', 'GetSystemMetrics', 'GetWindow', 'GetMenuStringA', 'AppendMenuA', 'GetMenuItemID', 'InsertMenuA', 'GetMenuItemCount', 'GetSubMenu', 'RemoveMenu', 'GetSysColor', 'EndPaint', 'BeginPaint', 'GetWindowDC', 'ClientToScreen', 'ScreenToClient', 'GrayStringA', 'DrawTextExA', 'DrawTextA', 'TabbedTextOutA', 'FillRect', 'SetWindowRgn', 'DrawIcon', 'FindWindowA', 'LockWindowUpdate', 'GetDCEx', 'DestroyIcon', 'GetClassLongA', 'GetMenuItemInfoA', 'GetDlgCtrlID', 'IsChild', 'InvalidateRect', 'IsIconic', 'AdjustWindowRectEx',Line truncated

PYAS_Version.py

@@ -1,10 +1,11 @@
 import pyinstaller_versionfile
+
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='2.7.3',
+version='3.3.7',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",
-legal_copyright="© PYAS Security",
+legal_copyright="PYAS Security",
 original_filename="PYAS.exe",
 product_name="PYAS")

Plugins/Filter/DriverEntry.c

@@ -0,0 +1,265 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectRules.h"
+
+LARGE_INTEGER g_CmRegHandle;
+PDEVICE_OBJECT g_ControlDeviceObject;
+KSPIN_LOCK g_ProtectLock;
+FAST_MUTEX HookMutex;
+PDRIVER_OBJECT DiskDrvObj = NULL;
+KEVENT g_LogDrainEvent;
+BOOLEAN g_Unloading = FALSE;
+BOOLEAN g_CmRegActive = FALSE;
+EX_RUNDOWN_REF g_Rundown;
+PDEVICE_OBJECT g_GuardDevice = NULL;
+PDRIVER_OBJECT g_DriverObject = NULL;
+
+PDEVICE_OBJECT g_MbrFilterTargets[MAX_MBR_TARGETS] = { 0 };
+ULONG g_MbrFilterCount = 0;
+
+volatile LONG g_LogWorkCount = 0;
+static UNICODE_STRING g_DeviceName;
+static WCHAR g_DeviceNameBuf[64];
+static UNICODE_STRING g_SymLink = RTL_CONSTANT_STRING(L"\\??\\PYAS_Driver");
+static BOOLEAN g_SymLinkCreated = FALSE;
+
+static NTSTATUS CombinedDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+{
+    if (DeviceObject == g_ControlDeviceObject) {
+        PIO_STACK_LOCATION s = IoGetCurrentIrpStackLocation(Irp);
+        if (s->MajorFunction == IRP_MJ_CREATE || s->MajorFunction == IRP_MJ_CLOSE || s->MajorFunction == IRP_MJ_CLEANUP) {
+            Irp->IoStatus.Status = STATUS_SUCCESS;
+            Irp->IoStatus.Information = 0;
+            IoCompleteRequest(Irp, IO_NO_INCREMENT);
+            return STATUS_SUCCESS;
+        }
+        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
+        Irp->IoStatus.Information = 0;
+        IoCompleteRequest(Irp, IO_NO_INCREMENT);
+        return STATUS_INVALID_DEVICE_REQUEST;
+    }
+
+    PIO_STACK_LOCATION s = IoGetCurrentIrpStackLocation(Irp);
+    if (s->MajorFunction == IRP_MJ_PNP) {
+        PDEVICE_OBJECT lower = (PDEVICE_OBJECT)DeviceObject->DeviceExtension;
+        if (s->MinorFunction == IRP_MN_REMOVE_DEVICE) {
+            NTSTATUS st;
+            IoSkipCurrentIrpStackLocation(Irp);
+            st = lower ? IoCallDriver(lower, Irp) : STATUS_SUCCESS;
+            if (lower) IoDetachDevice(lower);
+            IoDeleteDevice(DeviceObject);
+            return st;
+        }
+        IoSkipCurrentIrpStackLocation(Irp);
+        return IoCallDriver((PDEVICE_OBJECT)DeviceObject->DeviceExtension, Irp);
+    }
+
+    return BootProtectDispatch(DeviceObject, Irp);
+}
+
+static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject)
+{
+    UNICODE_STRING name = RTL_CONSTANT_STRING(L"\\Driver\\Disk");
+    UNICODE_STRING sym = RTL_CONSTANT_STRING(L"IoDriverObjectType");
+    POBJECT_TYPE* pType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&sym);
+
+    if (!pType || !*pType)
+        return STATUS_NOT_SUPPORTED;
+
+    NTSTATUS status = ObReferenceObjectByName(&name, OBJ_CASE_INSENSITIVE, NULL, 0, *pType, KernelMode, NULL, (PVOID*)&DiskDrvObj);
+    if (!NT_SUCCESS(status))
+        return status;
+
+    ULONG done = 0;
+    status = IoEnumerateDeviceObjectList(DiskDrvObj, NULL, 0, &done);
+    if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS) {
+        ObDereferenceObject(DiskDrvObj);
+        DiskDrvObj = NULL;
+        return status;
+    }
+
+    PDEVICE_OBJECT* list = ExAllocatePool2(POOL_FLAG_NON_PAGED, done * sizeof(PDEVICE_OBJECT), 'dskT');
+    if (!list) {
+        ObDereferenceObject(DiskDrvObj);
+        DiskDrvObj = NULL;
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    status = IoEnumerateDeviceObjectList(DiskDrvObj, list, done * sizeof(PDEVICE_OBJECT), &done);
+    if (!NT_SUCCESS(status)) {
+        ExFreePool2(list, 'dskT', NULL, 0);
+        ObDereferenceObject(DiskDrvObj);
+        DiskDrvObj = NULL;
+        return status;
+    }
+
+    for (ULONG i = 0; i < done && g_MbrFilterCount < MAX_MBR_TARGETS; ++i) {
+        PDEVICE_OBJECT lower = list[i], filter, attached = NULL;
+
+        status = IoCreateDevice(DriverObject, 0, NULL, lower->DeviceType, lower->Characteristics, FALSE, &filter);
+        if (!NT_SUCCESS(status))
+            continue;
+
+        filter->Flags |= (lower->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE));
+
+        status = IoAttachDeviceToDeviceStackSafe(filter, lower, &attached);
+        if (!NT_SUCCESS(status) || !attached) {
+            IoDeleteDevice(filter);
+            continue;
+        }
+
+        filter->StackSize = lower->StackSize + 1;
+        filter->AlignmentRequirement = lower->AlignmentRequirement;
+        filter->DeviceExtension = attached;
+        filter->Flags &= ~DO_DEVICE_INITIALIZING;
+        g_MbrFilterTargets[g_MbrFilterCount++] = filter;
+    }
+
+    for (ULONG i = 0; i < done; ++i)
+        ObDereferenceObject(list[i]);
+    ExFreePool2(list, 'dskT', NULL, 0);
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
+{
+    UNREFERENCED_PARAMETER(RegistryPath);
+
+    g_DriverObject = DriverObject;
+
+    KeInitializeSpinLock(&g_ProtectLock);
+    ExInitializeFastMutex(&HookMutex);
+    KeInitializeEvent(&g_LogDrainEvent, NotificationEvent, TRUE);
+    g_Unloading = FALSE;
+    g_CmRegActive = FALSE;
+
+    InterlockedExchange(&g_LogWorkCount, 0);
+    ExInitializeRundownProtection(&g_Rundown);
+
+    {
+        UNICODE_STRING guardName = RTL_CONSTANT_STRING(L"\\Device\\PYAS_Driver_Guard");
+        NTSTATUS gs = IoCreateDevice(DriverObject, 0, &guardName, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_GuardDevice);
+        if (!NT_SUCCESS(gs))
+            return STATUS_DEVICE_BUSY;
+    }
+
+    {
+        LARGE_INTEGER t = KeQueryPerformanceCounter(NULL);
+        g_DeviceName.Buffer = g_DeviceNameBuf;
+        g_DeviceName.MaximumLength = sizeof(g_DeviceNameBuf);
+        RtlStringCchPrintfW(g_DeviceName.Buffer, RTL_NUMBER_OF(g_DeviceNameBuf), L"\\Device\\PYAS_Driver_%p_%I64x", DriverObject, t.QuadPart);
+        g_DeviceName.Length = (USHORT)(wcslen(g_DeviceName.Buffer) * sizeof(WCHAR));
+    }
+
+    NTSTATUS status = IoCreateDevice(DriverObject, 0, &g_DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_ControlDeviceObject);
+    if (!NT_SUCCESS(status))
+        return status;
+
+    DriverObject->DriverUnload = DriverUnload;
+    for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i)
+        DriverObject->MajorFunction[i] = CombinedDispatch;
+
+    DriverObject->Flags |= 0x20;
+    g_ControlDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
+
+    IoDeleteSymbolicLink(&g_SymLink);
+    {
+        UINT i = 0;
+        for (; i < 50; ++i) {
+            status = IoCreateSymbolicLink(&g_SymLink, &g_DeviceName);
+            if (NT_SUCCESS(status))
+                break;
+            LARGE_INTEGER d = { 0 };
+            d.QuadPart = -10LL * 1000LL * 10LL;
+            KeDelayExecutionThread(KernelMode, FALSE, &d);
+            IoDeleteSymbolicLink(&g_SymLink);
+        }
+        if (!NT_SUCCESS(status)) {
+            IoDeleteDevice(g_ControlDeviceObject);
+            g_ControlDeviceObject = NULL;
+            if (g_GuardDevice) { IoDeleteDevice(g_GuardDevice); g_GuardDevice = NULL; }
+            return status;
+        }
+    }
+    g_SymLinkCreated = TRUE;
+
+    {
+        static WCHAR regAltBuf[32];
+        static UNICODE_STRING regAlt;
+        LARGE_INTEGER t = KeQueryPerformanceCounter(NULL);
+        RtlStringCchPrintfW(regAltBuf, RTL_NUMBER_OF(regAltBuf), L"385100.%I64x", t.QuadPart);
+        RtlInitUnicodeString(&regAlt, regAltBuf);
+
+        status = CmRegisterCallbackEx(RegistryProtectCallback, &regAlt, DriverObject, NULL, &g_CmRegHandle, NULL);
+        if (NT_SUCCESS(status))
+            g_CmRegActive = TRUE;
+    }
+
+    InitImageProtect();
+    InitInjectProtect();
+    InitRemoteProtect();
+    InitScreenProtect();
+    InitProcessProtect();
+
+    InitFileProtect();
+    AttachDiskFilters(DriverObject);
+
+    return STATUS_SUCCESS;
+}
+
+VOID DriverUnload(PDRIVER_OBJECT DriverObject)
+{
+    UNREFERENCED_PARAMETER(DriverObject);
+
+    g_Unloading = TRUE;
+
+    if (g_SymLinkCreated) {
+        IoDeleteSymbolicLink(&g_SymLink);
+        g_SymLinkCreated = FALSE;
+    }
+
+    if (g_CmRegActive) {
+        CmUnRegisterCallback(g_CmRegHandle);
+        g_CmRegActive = FALSE;
+    }
+
+    UninitFileProtect();
+    UninitInjectProtect();
+    UninitImageProtect();
+    UninitRemoteProtect();
+    UninitScreenProtect();
+    UninitProcessProtect();
+
+    ExWaitForRundownProtectionRelease(&g_Rundown);
+
+    if (InterlockedCompareExchange((volatile LONG*)&g_LogWorkCount, 0, 0) != 0) {
+        KeWaitForSingleObject(&g_LogDrainEvent, Executive, KernelMode, FALSE, NULL);
+    }
+    if (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0) {
+        KeResetEvent(&g_LogDrainEvent);
+        while (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0)
+            KeWaitForSingleObject(&g_LogDrainEvent, Executive, KernelMode, FALSE, NULL);
+    }
+
+    for (ULONG i = 0; i < g_MbrFilterCount; ++i) {
+        if (g_MbrFilterTargets[i]) {
+            IoDetachDevice((PDEVICE_OBJECT)g_MbrFilterTargets[i]->DeviceExtension);
+            IoDeleteDevice(g_MbrFilterTargets[i]);
+            g_MbrFilterTargets[i] = NULL;
+        }
+    }
+    g_MbrFilterCount = 0;
+
+    if (DiskDrvObj) {
+        ObDereferenceObject(DiskDrvObj);
+        DiskDrvObj = NULL;
+    }
+    if (g_ControlDeviceObject) {
+        IoDeleteDevice(g_ControlDeviceObject);
+        g_ControlDeviceObject = NULL;
+    }
+    if (g_GuardDevice) {
+        IoDeleteDevice(g_GuardDevice);
+        g_GuardDevice = NULL;
+    }
+}

Plugins/Filter/DriverEntry.h

@@ -0,0 +1,187 @@
+#pragma once
+#include <ntifs.h>
+#include <ntstrsafe.h>
+#include <ntdddisk.h>
+#include <ntddscsi.h>
+#include <fltKernel.h>
+
+#define PIPE_NAME L"\\??\\pipe\\PYAS_Output_Pipe"
+
+#ifndef POOL_FLAG_NON_PAGED
+#define POOL_FLAG_NON_PAGED 0x00000001
+#endif
+#ifndef PROCESS_TERMINATE
+#define PROCESS_TERMINATE 0x0001
+#endif
+#ifndef PROCESS_CREATE_THREAD
+#define PROCESS_CREATE_THREAD 0x0002
+#endif
+#ifndef PROCESS_VM_OPERATION
+#define PROCESS_VM_OPERATION 0x0008
+#endif
+#ifndef PROCESS_VM_WRITE
+#define PROCESS_VM_WRITE 0x0020
+#endif
+#ifndef PROCESS_VM_READ
+#define PROCESS_VM_READ 0x0010
+#endif
+#ifndef PROCESS_DUP_HANDLE
+#define PROCESS_DUP_HANDLE 0x0040
+#endif
+#ifndef PROCESS_CREATE_PROCESS
+#define PROCESS_CREATE_PROCESS 0x0080
+#endif
+#ifndef PROCESS_SET_QUOTA
+#define PROCESS_SET_QUota 0x0100
+#endif
+#ifndef PROCESS_SET_INFORMATION
+#define PROCESS_SET_INFORMATION 0x0200
+#endif
+#ifndef PROCESS_SUSPEND_RESUME
+#define PROCESS_SUSPEND_RESUME 0x0800
+#endif
+#ifndef PROCESS_QUERY_LIMITED_INFORMATION
+#define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
+#endif
+#ifndef PROCESS_SET_LIMITED_INFORMATION
+#define PROCESS_SET_LIMITED_INFORMATION 0x2000
+#endif
+#ifndef THREAD_TERMINATE
+#define THREAD_TERMINATE 0x0001
+#endif
+#ifndef THREAD_SUSPEND_RESUME
+#define THREAD_SUSPEND_RESUME 0x0002
+#endif
+#ifndef THREAD_SET_CONTEXT
+#define THREAD_SET_CONTEXT 0x0010
+#endif
+#ifndef THREAD_IMPERSONATE
+#define THREAD_IMPERSONATE 0x0100
+#endif
+#ifndef THREAD_DIRECT_IMPERSONATION
+#define THREAD_DIRECT_IMPERSONATION 0x0200
+#endif
+#ifndef JOB_OBJECT_ASSIGN_PROCESS
+#define JOB_OBJECT_ASSIGN_PROCESS 0x0001
+#endif
+#ifndef JOB_OBJECT_TERMINATE
+#define JOB_OBJECT_TERMINATE 0x0008
+#endif
+#ifndef FILE_DISPOSITION_DELETE
+#define FILE_DISPOSITION_DELETE 0x00000001
+#endif
+#ifndef UINT
+typedef unsigned int UINT;
+#endif
+#define MAX_MBR_TARGETS 64
+
+extern POBJECT_TYPE* PsJobType;
+extern volatile LONG g_LogWorkCount;
+extern BOOLEAN g_Unloading;
+extern KEVENT g_LogDrainEvent;
+extern KSPIN_LOCK g_ProtectLock;
+extern LARGE_INTEGER g_CmRegHandle;
+extern POBJECT_TYPE* IoDriverObjectType;
+extern POBJECT_TYPE* IoFileObjectType;
+extern FAST_MUTEX HookMutex;
+extern EX_RUNDOWN_REF g_Rundown;
+extern PDEVICE_OBJECT g_GuardDevice;
+extern PDRIVER_OBJECT g_DriverObject;
+extern PFLT_FILTER g_FilterHandle;
+
+NTSYSAPI PCSTR NTAPI PsGetProcessImageFileName(PEPROCESS Process);
+
+typedef PVOID(NTAPI* _pyas_ExAllocatePool2)(ULONG, SIZE_T, ULONG);
+typedef VOID(NTAPI* _pyas_ExFreePool2)(PVOID, ULONG, PVOID, ULONG);
+typedef PVOID(NTAPI* _pyas_ExAllocatePoolWithTag)(POOL_TYPE, SIZE_T, ULONG);
+typedef VOID(NTAPI* _pyas_ExFreePoolWithTag)(PVOID, ULONG);
+
+static __forceinline PVOID PYAS_ExAllocatePool2(ULONG f, SIZE_T s, ULONG t) {
+    static _pyas_ExAllocatePool2 p2 = 0;
+    if (!p2) {
+        UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExAllocatePool2");
+        p2 = (_pyas_ExAllocatePool2)MmGetSystemRoutineAddress(&n);
+    }
+    if (p2)
+        return p2(f, s, t);
+    static _pyas_ExAllocatePoolWithTag p1 = 0;
+    if (!p1) {
+        UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExAllocatePoolWithTag");
+        p1 = (_pyas_ExAllocatePoolWithTag)MmGetSystemRoutineAddress(&n);
+    }
+    if (p1)
+        return p1((f & POOL_FLAG_NON_PAGED) ? NonPagedPoolNx : PagedPool, s, t);
+    return NULL;
+}
+
+static __forceinline VOID PYAS_ExFreePool2(PVOID a, ULONG t, PVOID h, ULONG f) {
+    UNREFERENCED_PARAMETER(h);
+    UNREFERENCED_PARAMETER(f);
+
+    static _pyas_ExFreePool2 p2 = 0;
+    if (!p2) {
+        UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExFreePool2");
+        p2 = (_pyas_ExFreePool2)MmGetSystemRoutineAddress(&n);
+    }
+    if (p2) {
+        p2(a, t, h, f);
+        return;
+    }
+    static _pyas_ExFreePoolWithTag p1 = 0;
+    if (!p1) {
+        UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExFreePoolWithTag");
+        p1 = (_pyas_ExFreePoolWithTag)MmGetSystemRoutineAddress(&n);
+    }
+    if (p1) {
+        p1(a, t);
+        return;
+    }
+}
+
+#define ExAllocatePool2 PYAS_ExAllocatePool2
+#define ExFreePool2 PYAS_ExFreePool2
+
+VOID DriverUnload(PDRIVER_OBJECT DriverObject);
+VOID SendPipeLog(PCSTR msg, SIZE_T len);
+VOID UninitImageProtect(VOID);
+VOID UninitInjectProtect(VOID);
+VOID UninitRemoteProtect(VOID);
+VOID UninitScreenProtect(VOID);
+VOID UninitProcessProtect(VOID);
+VOID UninitFileProtect(VOID);
+
+VOID LogAnsi3(PCSTR tag, ULONG upid, PUNICODE_STRING s1, PUNICODE_STRING s2);
+
+NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(
+    _In_ HANDLE ProcessHandle,
+    _In_ PROCESSINFOCLASS ProcessInformationClass,
+    _Out_writes_bytes_opt_(ProcessInformationLength) PVOID ProcessInformation,
+    _In_ ULONG ProcessInformationLength,
+    _Out_opt_ PULONG ReturnLength
+);
+
+NTSTATUS ObReferenceObjectByName(
+    IN PUNICODE_STRING ObjectName,
+    IN ULONG Attributes,
+    IN PACCESS_STATE PassedAccessState OPTIONAL,
+    IN ACCESS_MASK DesiredAccess OPTIONAL,
+    IN POBJECT_TYPE ObjectType,
+    IN KPROCESSOR_MODE AccessMode,
+    IN OUT PVOID ParseContext OPTIONAL,
+    OUT PVOID* Object
+);
+
+NTSTATUS BootProtectDispatch(
+    PDEVICE_OBJECT DeviceObject,
+    PIRP Irp
+);
+
+NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2);
+NTSTATUS InitImageProtect(VOID);
+NTSTATUS InitInjectProtect(VOID);
+NTSTATUS InitRemoteProtect(VOID);
+NTSTATUS InitScreenProtect(VOID);
+NTSTATUS InitProcessProtect(VOID);
+NTSTATUS InitFileProtect(VOID);
+
+BOOLEAN GetProcessImagePathByPid(HANDLE pid, PUNICODE_STRING ProcessImagePath);

Plugins/Filter/DriverPipe.c

@@ -0,0 +1,80 @@
+#include <ntifs.h>
+#include <ntstrsafe.h>
+#include "DriverEntry.h"
+
+extern PDEVICE_OBJECT g_ControlDeviceObject;
+
+typedef struct _PIPE_LOG_CTX {
+    PIO_WORKITEM Item;
+    SIZE_T Len;
+    PCHAR Buf;
+}PIPE_LOG_CTX, * PPIPE_LOG_CTX;
+
+static VOID PipeLogWork(PDEVICE_OBJECT DeviceObject, PVOID Context)
+{
+    UNREFERENCED_PARAMETER(DeviceObject);
+    PPIPE_LOG_CTX ctx = (PPIPE_LOG_CTX)Context;
+    HANDLE h = NULL;
+    UNICODE_STRING name;
+    OBJECT_ATTRIBUTES oa = { 0 };
+    IO_STATUS_BLOCK iosb;
+    
+    RtlInitUnicodeString(&name, PIPE_NAME);
+    InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+    if (NT_SUCCESS(ZwCreateFile(&h, FILE_GENERIC_WRITE, &oa, &iosb, NULL, 0, 0, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0))) {
+        ZwWriteFile(h, NULL, NULL, NULL, &iosb, ctx->Buf, (ULONG)(ctx->Len > 0xFFFFFFFF ? 0xFFFFFFFF : ctx->Len), NULL, NULL);
+        ZwClose(h);
+    }
+    IoFreeWorkItem(ctx->Item);
+    ExFreePool2(ctx->Buf, 'golP', NULL, 0);
+    ExFreePool2(ctx, 'golP', NULL, 0);
+    
+    if (InterlockedDecrement(&g_LogWorkCount) == 0) {
+        KeSetEvent(&g_LogDrainEvent, IO_NO_INCREMENT, FALSE);
+    }
+}
+
+VOID SendPipeLog(PCSTR msg, SIZE_T len)
+{
+    if (!msg || len == 0)
+        return;
+    if (!g_ControlDeviceObject)
+        return;
+    if (g_Unloading)
+        return;
+    PPIPE_LOG_CTX ctx = (PPIPE_LOG_CTX)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(PIPE_LOG_CTX), 'golP');
+    if (!ctx)
+        return;
+    ctx->Len = len;
+    ctx->Buf = (PCHAR)ExAllocatePool2(POOL_FLAG_NON_PAGED, ctx->Len, 'golP');
+    if (!ctx->Buf) {
+        ExFreePool2(ctx, 'golP', NULL, 0);
+        return;
+    }
+    RtlCopyMemory(ctx->Buf, msg, ctx->Len);
+    ctx->Item = IoAllocateWorkItem(g_ControlDeviceObject);
+    if (!ctx->Item) {
+        ExFreePool2(ctx->Buf, 'golP', NULL, 0);
+        ExFreePool2(ctx, 'golP', NULL, 0);
+        return;
+    }
+    InterlockedIncrement(&g_LogWorkCount);
+    IoQueueWorkItem(ctx->Item, PipeLogWork, DelayedWorkQueue, ctx);
+}
+
+VOID LogAnsi3(PCSTR tag, ULONG upid, PUNICODE_STRING s1, PUNICODE_STRING s2)
+{
+    ANSI_STRING a1 = { 0 }, a2 = { 0 };
+    CHAR buf[1024] = { 0 };
+
+    if (s1)
+        RtlUnicodeStringToAnsiString(&a1, s1, TRUE);
+    if (s2)
+        RtlUnicodeStringToAnsiString(&a2, s2, TRUE);
+
+    RtlStringCchPrintfA(buf, RTL_NUMBER_OF(buf), "%s | %u | %s | %s", tag, upid, a1.Buffer ? a1.Buffer : "",  a2.Buffer ? a2.Buffer : "");
+    SendPipeLog(buf, strlen(buf));
+
+    RtlFreeAnsiString(&a1);
+    RtlFreeAnsiString(&a2);
+}

Plugins/Filter/PYAS_Driver.inf

@@ -0,0 +1,27 @@
+[Version]
+Signature   = "$WINDOWS NT$"
+Class       = System 
+ClassGuid   = {4d36e97d-e325-11ce-bfc1-08002be10318}
+Provider    = %ManufacturerName%
+CatalogFile = PYAS_Driver.cat
+PnpLockdown = 1
+DriverVer   = 
+
+[DestinationDirs]
+DefaultDestDir = 13
+
+[DefaultInstall.ntamd64]
+CopyFiles = @PYAS_Driver.sys
+AddService = PYAS_Driver,0x00000002
+
+[SourceDisksFiles]
+PYAS_Driver.sys = 1
+
+[SourceDisksNames]
+1 = %DiskName%,,,""
+
+[Strings]
+ManufacturerName = "PYAS_Driver"
+DiskName = "PYAS_Driver"
+ServiceName="PYAS_Driver"
+ServiceDisplayName="PYAS_Driver"

Plugins/Filter/ProtectBoot.c

@@ -0,0 +1,175 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+#define PROTECTED_BOOT_AREA_SIZE (34 * 512)
+
+static VOID GetExeNameForLog(HANDLE pid, PUNICODE_STRING exe)
+{
+    if (!exe || !exe->Buffer || exe->MaximumLength == 0)
+        return;
+
+    exe->Length = 0;
+    if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+        if (GetProcessImagePathByPid(pid, exe))
+            return;
+    }
+    PEPROCESS eproc = PsGetCurrentProcess();
+    PCSTR n = PsGetProcessImageFileName(eproc);
+    size_t l = n ? strlen(n) : 0;
+
+    for (size_t i = 0; i < l && i < (exe->MaximumLength / sizeof(WCHAR)) - 1; i++)
+        exe->Buffer[i] = (WCHAR)n[i];
+    exe->Buffer[l] = 0;
+    exe->Length = (USHORT)(l * sizeof(WCHAR));
+}
+
+static BOOLEAN QueryDevName(PDEVICE_OBJECT dev, PUNICODE_STRING out)
+{
+    if (KeGetCurrentIrql() > APC_LEVEL)
+        return FALSE;
+
+    if (!dev || !out || !out->Buffer || out->MaximumLength == 0)
+        return FALSE;
+
+    ULONG need = 0;
+    NTSTATUS s = ObQueryNameString(dev, NULL, 0, &need);
+    if (s != STATUS_INFO_LENGTH_MISMATCH || need == 0)
+        return FALSE;
+
+    POBJECT_NAME_INFORMATION oni = (POBJECT_NAME_INFORMATION)ExAllocatePool2(POOL_FLAG_NON_PAGED, need, 'nOmD');
+    if (!oni)
+        return FALSE;
+
+    BOOLEAN ok = FALSE;
+    s = ObQueryNameString(dev, oni, need, &need);
+    if (NT_SUCCESS(s) && oni->Name.Buffer && oni->Name.Length && oni->Name.Length < out->MaximumLength) {
+        RtlCopyMemory(out->Buffer, oni->Name.Buffer, oni->Name.Length);
+        out->Length = (USHORT)oni->Name.Length;
+        out->Buffer[out->Length / sizeof(WCHAR)] = 0;
+        ok = TRUE;
+    }
+    ExFreePool2(oni, 'nOmD', NULL, 0);
+    return ok;
+}
+
+static BOOLEAN IsDangerousDiskIo(PIO_STACK_LOCATION s)
+{
+    if (!s) return FALSE;
+
+    if (s->MajorFunction == IRP_MJ_DEVICE_CONTROL || s->MajorFunction == IRP_MJ_INTERNAL_DEVICE_CONTROL) {
+        ULONG code = s->Parameters.DeviceIoControl.IoControlCode;
+        if (code == IOCTL_DISK_SET_DRIVE_LAYOUT || code == IOCTL_DISK_SET_DRIVE_LAYOUT_EX) return TRUE;
+        if (code == IOCTL_DISK_DELETE_DRIVE_LAYOUT) return TRUE;
+        if (code == IOCTL_DISK_FORMAT_TRACKS || code == IOCTL_DISK_FORMAT_TRACKS_EX) return TRUE;
+        if (code == IOCTL_DISK_SET_PARTITION_INFO || code == IOCTL_DISK_SET_PARTITION_INFO_EX) return TRUE;
+        if (code == IOCTL_SCSI_PASS_THROUGH || code == IOCTL_SCSI_PASS_THROUGH_DIRECT) return TRUE;
+    }
+
+    return FALSE;
+}
+
+static BOOLEAN IsBootSectorWrite(PIO_STACK_LOCATION s)
+{
+    if (s->MajorFunction == IRP_MJ_WRITE) {
+        LARGE_INTEGER offset = s->Parameters.Write.ByteOffset;
+        if (offset.QuadPart < PROTECTED_BOOT_AREA_SIZE) {
+            return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+NTSTATUS BootProtectDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+{
+    PDEVICE_OBJECT lower = (PDEVICE_OBJECT)DeviceObject->DeviceExtension;
+    if (!lower) {
+        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
+        Irp->IoStatus.Information = 0;
+        IoCompleteRequest(Irp, IO_NO_INCREMENT);
+        return STATUS_INVALID_DEVICE_REQUEST;
+    }
+
+    if (!ExAcquireRundownProtection(&g_Rundown)) {
+        IoSkipCurrentIrpStackLocation(Irp);
+        return IoCallDriver(lower, Irp);
+    }
+
+    if (g_Unloading) {
+        IoSkipCurrentIrpStackLocation(Irp);
+        NTSTATUS rs = IoCallDriver(lower, Irp);
+        ExReleaseRundownProtection(&g_Rundown);
+        return rs;
+    }
+
+    PIO_STACK_LOCATION s = IoGetCurrentIrpStackLocation(Irp);
+
+    if (s->MajorFunction == IRP_MJ_POWER) {
+        PoStartNextPowerIrp(Irp);
+        IoSkipCurrentIrpStackLocation(Irp);
+        NTSTATUS ps = PoCallDriver(lower, Irp);
+        ExReleaseRundownProtection(&g_Rundown);
+        return ps;
+    }
+
+    HANDLE pid = PsGetCurrentProcessId();
+    ULONG upid = (ULONG)(ULONG_PTR)pid;
+
+    if (upid == 0 || upid == 4) {
+        IoSkipCurrentIrpStackLocation(Irp);
+        NTSTATUS ns = IoCallDriver(lower, Irp);
+        ExReleaseRundownProtection(&g_Rundown);
+        return ns;
+    }
+
+    BOOLEAN blocked = FALSE;
+    WCHAR eb[512] = { 0 };
+    UNICODE_STRING exe = { 0 };
+    exe.Buffer = eb;
+    exe.MaximumLength = sizeof(eb);
+
+    if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+        GetExeNameForLog(pid, &exe);
+        if (IsWhitelist(&exe)) {
+            IoSkipCurrentIrpStackLocation(Irp);
+            NTSTATUS ns2 = IoCallDriver(lower, Irp);
+            ExReleaseRundownProtection(&g_Rundown);
+            return ns2;
+        }
+    }
+
+    if (lower->DeviceType == FILE_DEVICE_DISK) {
+        if (IsDangerousDiskIo(s)) {
+            blocked = TRUE;
+        }
+
+        if (!blocked && IsBootSectorWrite(s)) {
+            blocked = TRUE;
+        }
+
+        if (blocked) {
+            if (KeGetCurrentIrql() <= APC_LEVEL) {
+                WCHAR db[512] = { 0 };
+                UNICODE_STRING dev = { 0 };
+                dev.Buffer = db;
+                dev.MaximumLength = sizeof(db);
+                QueryDevName(lower, &dev);
+
+                LogAnsi3("BOOT_BLOCK", upid, &exe, dev.Length ? &dev : &exe);
+            }
+        }
+    }
+
+    if (blocked) {
+        Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
+        Irp->IoStatus.Information = 0;
+        IoCompleteRequest(Irp, IO_NO_INCREMENT);
+        ExReleaseRundownProtection(&g_Rundown);
+        return STATUS_ACCESS_DENIED;
+    }
+
+    IoSkipCurrentIrpStackLocation(Irp);
+    NTSTATUS rs2 = IoCallDriver(lower, Irp);
+    ExReleaseRundownProtection(&g_Rundown);
+    return rs2;
+}

Plugins/Filter/ProtectFile.c

@@ -0,0 +1,322 @@
+#include <ntifs.h>
+#include <fltKernel.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+#pragma comment(lib, "FltMgr.lib")
+
+PFLT_FILTER g_FilterHandle = NULL;
+extern PDRIVER_OBJECT g_DriverObject;
+EX_RUNDOWN_REF g_Rundown;
+
+// 定義標誌以便在不同 IRQL 下安全操作
+#define MAX_PATH_LEN 512
+
+// 獲取進程名稱 (僅在確定需要攔截時調用，減少性能開銷)
+static VOID GetExeNameSafe(HANDLE pid, PUNICODE_STRING exe)
+{
+    if (!exe || !exe->Buffer || !exe->MaximumLength)
+        return;
+
+    exe->Length = 0;
+
+    // 嘗試獲取短名稱 (最安全)
+    PEPROCESS cur = PsGetCurrentProcess();
+    PCSTR n = NULL;
+    if (cur) n = PsGetProcessImageFileName(cur);
+
+    // 如果在 PASSIVE_LEVEL，嘗試獲取完整路徑 (用於精確白名單)
+    // 注意：這裡依然有風險，但僅在攔截路徑執行
+    if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+        if (GetProcessImagePathByPid(pid, exe)) {
+            return;
+        }
+    }
+
+    // 降級方案：使用短名稱
+    size_t l = n ? strlen(n) : 0;
+    for (size_t i = 0; i < l && i < (exe->MaximumLength / sizeof(WCHAR)) - 1; i++)
+        exe->Buffer[i] = (WCHAR)n[i];
+    exe->Buffer[l] = 0;
+    exe->Length = (USHORT)(l * sizeof(WCHAR));
+}
+
+static BOOLEAN PreOpCheck(VOID)
+{
+    if (g_Unloading)
+        return FALSE;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return FALSE;
+    return TRUE;
+}
+
+static VOID PostOpRelease(VOID)
+{
+    ExReleaseRundownProtection(&g_Rundown);
+}
+
+static BOOLEAN IsDeleteOrRename(PFLT_CALLBACK_DATA Data)
+{
+    FILE_INFORMATION_CLASS infoClass = Data->Iopb->Parameters.SetFileInformation.FileInformationClass;
+
+    if (infoClass == FileDispositionInformation) {
+        PFILE_DISPOSITION_INFORMATION di = (PFILE_DISPOSITION_INFORMATION)Data->Iopb->Parameters.SetFileInformation.InfoBuffer;
+        return di && di->DeleteFile;
+    }
+    if (infoClass == FileDispositionInformationEx) {
+        PFILE_DISPOSITION_INFORMATION_EX dx = (PFILE_DISPOSITION_INFORMATION_EX)Data->Iopb->Parameters.SetFileInformation.InfoBuffer;
+        return dx && (dx->Flags & FILE_DISPOSITION_DELETE);
+    }
+    if (infoClass == FileRenameInformation || infoClass == FileRenameInformationEx)
+        return TRUE;
+
+    return FALSE;
+}
+
+static BOOLEAN IsWriteAccess(PFLT_CALLBACK_DATA Data)
+{
+    // 如果是寫入操作，直接返回
+    if (Data->Iopb->MajorFunction == IRP_MJ_WRITE)
+        return TRUE;
+
+    // 如果是設置信息 (已經通過 IsDeleteOrRename 過濾)，視為寫入(修改元數據)
+    if (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION)
+        return TRUE;
+
+    // 如果是創建/打開文件，檢查權限
+    if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {
+        ULONG access = Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;
+        // 檢查是否包含寫入數據、追加數據、刪除、修改屬性等權限
+        if (access & (FILE_WRITE_DATA | FILE_APPEND_DATA | DELETE |
+            WRITE_DAC | WRITE_OWNER | GENERIC_WRITE | GENERIC_ALL)) {
+            return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+static FLT_PREOP_CALLBACK_STATUS FilePreOp(
+    _Inout_ PFLT_CALLBACK_DATA Data,
+    _In_ PCFLT_RELATED_OBJECTS FltObjects,
+    _Flt_CompletionContext_Outptr_ PVOID* CompletionContext
+)
+{
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+
+    // 1. 基礎檢查 (Paging IO 不攔截)
+    if (FlagOn(Data->Iopb->IrpFlags, IRP_PAGING_IO)) {
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    if (!PreOpCheck())
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    // 2. 獲取 PID
+    HANDLE pid = PsGetCurrentProcessId();
+    ULONG upid = (ULONG)(ULONG_PTR)pid;
+
+    // 忽略 System (4) 和 Idle (0) 進程，避免系統崩潰
+    if (upid == 0 || upid == 4) {
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // 3. 檢查操作類型 (僅關心 Create, Write, SetInfo)
+    BOOLEAN checkFile = (Data->Iopb->MajorFunction == IRP_MJ_CREATE || Data->Iopb->MajorFunction == IRP_MJ_WRITE);
+    BOOLEAN checkSetInfo = (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION);
+
+    if (!checkFile && !checkSetInfo) {
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    if (checkSetInfo && !IsDeleteOrRename(Data)) {
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // 4. 獲取文件名 (這一步最關鍵)
+    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
+    // 使用 QUERY_DEFAULT | NORMALIZED 確保獲取標準化路徑
+    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+
+    if (!NT_SUCCESS(status)) {
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    status = FltParseFileNameInformation(nameInfo);
+    if (!NT_SUCCESS(status)) {
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // 5. 邏輯判斷 (優化順序：文件名白名單 -> 黑名單 -> 操作檢查 -> 進程白名單)
+
+    // A. 全局文件白名單 (例如 Windows 目錄下的某些操作)
+    if (IsWhitelist(&nameInfo->Name)) {
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // B. 黑名單匹配
+    BOOLEAN hitFile = MatchBlockFile(&nameInfo->Name);
+    // 勒索防護：必須在敏感目錄 且 有敏感後綴 (如 .txt, .doc)
+    // 註：Updater.bat 產生 .txt，應命中這裡
+    BOOLEAN hitRansom = MatchBlockRansom(&nameInfo->Name) && HasBlockedSuffix(&nameInfo->Name);
+
+    // 如果沒有命中任何規則，直接放行，節省資源
+    if (!hitFile && !hitRansom) {
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // C. 檢查是否為寫入行為 (讀取不攔截)
+    if (!IsWriteAccess(Data)) {
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // D. 到了這裡，說明命中規則且正在寫入，準備攔截
+    //    這時候才去獲取進程名稱，檢查進程白名單
+    WCHAR exe_buffer[MAX_PATH_LEN] = { 0 };
+    UNICODE_STRING exe = { 0 };
+    exe.Buffer = exe_buffer;
+    exe.MaximumLength = sizeof(exe_buffer);
+
+    GetExeNameSafe(pid, &exe); // 獲取進程名
+
+    if (IsWhitelistExcept(&exe)) {
+        // 進程在白名單中 (如 ntoskrnl, explorer 等)
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    // E. 執行攔截
+    if (hitRansom) {
+        LogAnsi3("RANSOM_BLOCK", upid, &exe, &nameInfo->Name);
+        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+        Data->IoStatus.Information = 0;
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_COMPLETE;
+    }
+
+    if (hitFile) {
+        LogAnsi3("FILE_BLOCK", upid, &exe, &nameInfo->Name);
+        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+        Data->IoStatus.Information = 0;
+        FltReleaseFileNameInformation(nameInfo);
+        PostOpRelease();
+        return FLT_PREOP_COMPLETE;
+    }
+
+    // 默認放行
+    FltReleaseFileNameInformation(nameInfo);
+    PostOpRelease();
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
+
+static NTSTATUS FilterUnloadCallback(FLT_FILTER_UNLOAD_FLAGS Flags)
+{
+    UNREFERENCED_PARAMETER(Flags);
+    g_Unloading = TRUE;
+    ExWaitForRundownProtectionRelease(&g_Rundown);
+    if (g_FilterHandle != NULL) {
+        FltUnregisterFilter(g_FilterHandle);
+        g_FilterHandle = NULL;
+    }
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS FilterInstanceSetup(
+    _In_ PCFLT_RELATED_OBJECTS FltObjects,
+    _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
+    _In_ DEVICE_TYPE VolumeDeviceType,
+    _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
+)
+{
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    UNREFERENCED_PARAMETER(VolumeDeviceType);
+    UNREFERENCED_PARAMETER(VolumeFilesystemType);
+    // 自動附加到所有卷
+    return STATUS_SUCCESS;
+}
+
+static VOID FilterInstanceTeardownStart(
+    _In_ PCFLT_RELATED_OBJECTS FltObjects,
+    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
+)
+{
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static VOID FilterInstanceTeardownComplete(
+    _In_ PCFLT_RELATED_OBJECTS FltObjects,
+    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
+)
+{
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+const FLT_OPERATION_REGISTRATION Callbacks[] = {
+    { IRP_MJ_CREATE, 0, FilePreOp, NULL },
+    { IRP_MJ_WRITE, 0, FilePreOp, NULL },
+    { IRP_MJ_SET_INFORMATION, 0, FilePreOp, NULL },
+    { IRP_MJ_OPERATION_END }
+};
+
+const FLT_REGISTRATION FilterRegistration = {
+    sizeof(FLT_REGISTRATION),
+    FLT_REGISTRATION_VERSION,
+    0,
+    NULL,
+    Callbacks,
+    FilterUnloadCallback,
+    FilterInstanceSetup,
+    NULL,
+    FilterInstanceTeardownStart,
+    FilterInstanceTeardownComplete,
+    NULL,
+    NULL,
+    NULL,
+    NULL
+};
+
+NTSTATUS InitFileProtect(VOID)
+{
+    ExInitializeRundownProtection(&g_Rundown);
+
+    if (!g_DriverObject)
+        return STATUS_UNSUCCESSFUL;
+
+    NTSTATUS status = FltRegisterFilter(g_DriverObject, &FilterRegistration, &g_FilterHandle);
+    if (!NT_SUCCESS(status))
+        return status;
+
+    status = FltStartFiltering(g_FilterHandle);
+    if (!NT_SUCCESS(status)) {
+        FltUnregisterFilter(g_FilterHandle);
+        g_FilterHandle = NULL;
+    }
+    return status;
+}
+
+VOID UninitFileProtect(VOID)
+{
+    g_Unloading = TRUE;
+    ExWaitForRundownProtectionRelease(&g_Rundown);
+    if (g_FilterHandle != NULL) {
+        FltUnregisterFilter(g_FilterHandle);
+        g_FilterHandle = NULL;
+    }
+}

Plugins/Filter/ProtectImage.c

@@ -0,0 +1,124 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+static BOOLEAN g_ImageNotifyEnabled = FALSE;
+
+static BOOLEAN CheckVadExec(PVOID a)
+{
+    MEMORY_BASIC_INFORMATION mbi = { 0 };
+    SIZE_T ret = 0;
+    NTSTATUS s = ZwQueryVirtualMemory(NtCurrentProcess(), a, MemoryBasicInformation, &mbi, sizeof(mbi), &ret);
+    
+    if (!NT_SUCCESS(s))
+        return FALSE;
+    if (mbi.State != MEM_COMMIT)
+        return FALSE;
+    if (mbi.Type == SEC_IMAGE)
+        return FALSE;
+    if (mbi.Type != MEM_PRIVATE && mbi.Type != MEM_MAPPED)
+        return FALSE;
+    return (mbi.Protect & (PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY)) != 0;
+}
+
+static BOOLEAN WalkForShellcode(ULONG h)
+{
+#define MAXWALK 20
+    PVOID frames[MAXWALK] = { 0 };
+    ULONG c = RtlWalkFrameChain(frames, MAXWALK, 1);
+    if (c == 0)
+        return FALSE;
+    
+    ULONG limit = RTL_NUMBER_OF(frames);
+    ULONG count = c < limit ? c : limit;
+    ULONG d = h < count ? h : count;
+    
+    for (ULONG i = 0; i < d; i++) {
+        PVOID p = frames[i];
+        if (p && CheckVadExec(p))
+            return TRUE;
+    }
+    for (ULONG i = 0; i < d; i++) {
+        ULONG idx = count - 1 - i;
+        if (idx >= d) {
+            PVOID p = frames[idx];
+            if (p && CheckVadExec(p))
+                return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+static VOID ImageLoadNotify(IN PUNICODE_STRING FullImageName, IN HANDLE ProcessId, IN PIMAGE_INFO ImageInfo)
+{
+    UNREFERENCED_PARAMETER(ImageInfo);
+    if (g_Unloading)
+        return;
+    if (ProcessId == (HANDLE)0 || ProcessId == (HANDLE)4)
+        return;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL)
+        return;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return;
+
+    WCHAR eb[512] = { 0 };
+    UNICODE_STRING exe = { 0 };
+    exe.Buffer = eb;
+    exe.MaximumLength = sizeof(eb);
+    exe.Length = 0;
+
+    if (!GetProcessImagePathByPid(ProcessId, &exe)) {
+        PEPROCESS eproc = PsGetCurrentProcess();
+        PCSTR n = PsGetProcessImageFileName(eproc);
+        size_t l = n ? strlen(n) : 0;
+        for (size_t i = 0; i < l && i < RTL_NUMBER_OF(eb) - 1; i++)
+            eb[i] = (WCHAR)n[i];
+        eb[l] = 0;
+        exe.Length = (USHORT)(l * sizeof(WCHAR));
+    }
+    if (exe.Length & 1) exe.Length--;
+
+    {
+        size_t elen = exe.Length / sizeof(WCHAR);
+        if ((elen >= 14 && _wcsnicmp(exe.Buffer + elen - 14, L"powershell.exe", 14) == 0) ||
+            (elen >= 8 && _wcsnicmp(exe.Buffer + elen - 8, L"pwsh.exe", 8) == 0) ||
+            (elen >= 10 && _wcsnicmp(exe.Buffer + elen - 10, L"sppsvc.exe", 10) == 0)) {
+            ExReleaseRundownProtection(&g_Rundown);
+            return;
+        }
+    }
+    if (IsWhitelist(&exe)) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+    if (FullImageName && FullImageName->Buffer) {
+        if (MatchClrFromNonFramework(FullImageName)) {
+            LogAnsi3("CLR_BLOCK", (ULONG)(ULONG_PTR)ProcessId, &exe, FullImageName);
+            ExReleaseRundownProtection(&g_Rundown);
+            return;
+        }
+    }
+    if (WalkForShellcode(8)) {
+        UNICODE_STRING none = RTL_CONSTANT_STRING(L"None");
+        LogAnsi3("SHELLCODE_BLOCK", (ULONG)(ULONG_PTR)ProcessId, &exe, &none);
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+    ExReleaseRundownProtection(&g_Rundown);
+}
+
+NTSTATUS InitImageProtect(VOID)
+{
+    NTSTATUS s = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+    if (NT_SUCCESS(s))
+        g_ImageNotifyEnabled = TRUE;
+    return s;
+}
+
+VOID UninitImageProtect(VOID)
+{
+    if (g_ImageNotifyEnabled) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        g_ImageNotifyEnabled = FALSE;
+    }
+}

Plugins/Filter/ProtectInject.c

@@ -0,0 +1,177 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+static PVOID g_ObRegHandle = NULL;
+static POB_OPERATION_REGISTRATION g_ObOps = NULL;
+static OB_CALLBACK_REGISTRATION g_ObReg = { 0 };
+
+static OB_PREOP_CALLBACK_STATUS PreProcessCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info)
+{
+    UNREFERENCED_PARAMETER(RegistrationContext);
+    if (g_Unloading)
+        return OB_PREOP_SUCCESS;
+    if (!Info || Info->KernelHandle)
+        return OB_PREOP_SUCCESS;
+    if (!Info->Object)
+        return OB_PREOP_SUCCESS;
+    if (Info->Operation != OB_OPERATION_HANDLE_CREATE && Info->Operation != OB_OPERATION_HANDLE_DUPLICATE)
+        return OB_PREOP_SUCCESS;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return OB_PREOP_SUCCESS;
+
+    HANDLE cur = PsGetCurrentProcessId();
+    if (cur == (HANDLE)0 || cur == (HANDLE)4) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    HANDLE target = PsGetProcessId((PEPROCESS)Info->Object);
+    if (target == cur) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    ACCESS_MASK* desired = (Info->Operation == OB_OPERATION_HANDLE_CREATE) ? &Info->Parameters->CreateHandleInformation.DesiredAccess : &Info->Parameters->DuplicateHandleInformation.DesiredAccess;
+    ACCESS_MASK mask = PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE;
+    PCSTR tn = PsGetProcessImageFileName((PEPROCESS)Info->Object);
+    if (tn && (_stricmp(tn, "lsass.exe") == 0))
+        mask |= PROCESS_VM_READ;
+
+    if ((*desired & mask) == 0) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    BOOLEAN logok = (KeGetCurrentIrql() == PASSIVE_LEVEL);
+    WCHAR cbuf[512] = { 0 }, tbuf[512] = { 0 };
+    UNICODE_STRING cexe = { 0 }, texe = { 0 };
+    cexe.Buffer = cbuf; cexe.MaximumLength = sizeof(cbuf);
+    texe.Buffer = tbuf; texe.MaximumLength = sizeof(tbuf);
+
+    if (logok)
+        GetProcessImagePathByPid(cur, &cexe);
+    if (logok && IsWhitelist(&cexe)) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    ACCESS_MASK old = *desired;
+    *desired &= ~mask;
+    if ((*desired) != old && logok) {
+        GetProcessImagePathByPid(target, &texe);
+        if (cexe.Length == 0) {
+            PEPROCESS eproc = PsGetCurrentProcess();
+            PCSTR n = PsGetProcessImageFileName(eproc);
+            size_t l = n ? strlen(n) : 0;
+            for (size_t i = 0; i < l && i < RTL_NUMBER_OF(cbuf) - 1; i++)
+                cbuf[i] = (WCHAR)n[i];
+            cbuf[l] = 0;
+            cexe.Length = (USHORT)(l * sizeof(WCHAR));
+        }
+        LogAnsi3("INJECT_BLOCK", (ULONG)(ULONG_PTR)cur, &cexe, &texe);
+    }
+    ExReleaseRundownProtection(&g_Rundown);
+    return OB_PREOP_SUCCESS;
+}
+
+static OB_PREOP_CALLBACK_STATUS PreThreadCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info)
+{
+    UNREFERENCED_PARAMETER(RegistrationContext);
+    if (!Info || Info->KernelHandle)
+        return OB_PREOP_SUCCESS;
+    if (Info->Object == NULL)
+        return OB_PREOP_SUCCESS;
+    if (Info->Operation != OB_OPERATION_HANDLE_CREATE && Info->Operation != OB_OPERATION_HANDLE_DUPLICATE)
+        return OB_PREOP_SUCCESS;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return OB_PREOP_SUCCESS;
+
+    HANDLE cur = PsGetCurrentProcessId();
+    if (cur == (HANDLE)0 || cur == (HANDLE)4) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    HANDLE owner = PsGetThreadProcessId((PETHREAD)Info->Object);
+    if (owner == cur) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    ACCESS_MASK tmask = THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME | THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION;
+    ACCESS_MASK* desired = (Info->Operation == OB_OPERATION_HANDLE_CREATE) ? &Info->Parameters->CreateHandleInformation.DesiredAccess : &Info->Parameters->DuplicateHandleInformation.DesiredAccess;
+    if ((*desired & tmask) == 0) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    BOOLEAN logok = (KeGetCurrentIrql() == PASSIVE_LEVEL);
+    WCHAR cbuf[512] = { 0 };
+    UNICODE_STRING cexe = { 0 };
+    cexe.Buffer = cbuf;
+    cexe.MaximumLength = sizeof(cbuf);
+
+    if (logok)
+        GetProcessImagePathByPid(cur, &cexe);
+    if (logok && IsWhitelist(&cexe)) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return OB_PREOP_SUCCESS;
+    }
+    ACCESS_MASK old = *desired;
+    *desired &= ~tmask;
+    if ((*desired) != old && logok) {
+        if (cexe.Length == 0) {
+            PEPROCESS eproc = PsGetCurrentProcess();
+            PCSTR n = PsGetProcessImageFileName(eproc);
+            size_t l = n ? strlen(n) : 0;
+            for (size_t i = 0; i < l && i < RTL_NUMBER_OF(cbuf) - 1; i++)
+                cbuf[i] = (WCHAR)n[i];
+            cbuf[l] = 0;
+            cexe.Length = (USHORT)(l * sizeof(WCHAR));
+        }
+        UNICODE_STRING tnone = RTL_CONSTANT_STRING(L"None");
+        LogAnsi3("THREAD_BLOCK", (ULONG)(ULONG_PTR)cur, &cexe, &tnone);
+    }
+    ExReleaseRundownProtection(&g_Rundown);
+    return OB_PREOP_SUCCESS;
+}
+
+NTSTATUS InitInjectProtect(VOID)
+{
+    static UNICODE_STRING obAlt;
+    RtlInitUnicodeString(&obAlt, L"385000");
+
+    g_ObOps = (POB_OPERATION_REGISTRATION)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(OB_OPERATION_REGISTRATION) * 2, 'bOpr');
+    if (!g_ObOps)
+        return STATUS_INSUFFICIENT_RESOURCES;
+
+    RtlZeroMemory(g_ObOps, sizeof(OB_OPERATION_REGISTRATION) * 2);
+    g_ObOps[0].ObjectType = PsProcessType;
+    g_ObOps[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    g_ObOps[0].PreOperation = PreProcessCallback;
+    g_ObOps[1].ObjectType = PsThreadType;
+    g_ObOps[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    g_ObOps[1].PreOperation = PreThreadCallback;
+
+    RtlZeroMemory(&g_ObReg, sizeof(g_ObReg));
+    g_ObReg.Version = OB_FLT_REGISTRATION_VERSION;
+    g_ObReg.OperationRegistrationCount = 2;
+    g_ObReg.Altitude = obAlt;
+    g_ObReg.RegistrationContext = NULL;
+    g_ObReg.OperationRegistration = g_ObOps;
+
+    NTSTATUS s = ObRegisterCallbacks(&g_ObReg, &g_ObRegHandle);
+    if (!NT_SUCCESS(s)) {
+        ExFreePool2(g_ObOps, 'bOpr', NULL, 0);
+        g_ObOps = NULL;
+        RtlZeroMemory(&g_ObReg, sizeof(g_ObReg));
+    }
+    return s;
+}
+
+VOID UninitInjectProtect(VOID)
+{
+    if (g_ObRegHandle) {
+        ObUnRegisterCallbacks(g_ObRegHandle);
+        g_ObRegHandle = NULL;
+    }
+    if (g_ObOps) {
+        ExFreePool2(g_ObOps, 'bOpr', NULL, 0);
+        g_ObOps = NULL;
+    }
+    RtlZeroMemory(&g_ObReg, sizeof(g_ObReg));
+}

Plugins/Filter/ProtectMatch.c

@@ -0,0 +1,348 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectRules.h"
+#include "ProtectMatch.h"
+
+static __forceinline BOOLEAN USOK(PUNICODE_STRING s)
+{
+    return s && s->Buffer && s->Length;
+}
+
+static BOOLEAN WildMatchN(const wchar_t* str, SIZE_T n, const wchar_t* pat)
+{
+    if (*pat == 0)
+        return n == 0;
+
+    if (*pat == L'*') {
+        if (pat[1] == L'*') {
+            for (SIZE_T i = 0; i <= n; ++i)
+                if (WildMatchN(str + i, n - i, pat + 2))
+                    return TRUE;
+            return FALSE;
+        }
+        SIZE_T i = 0;
+        for (; i < n && str[i] != L'\\'; ++i)
+            if (WildMatchN(str + i, n - i, pat + 1))
+                return TRUE;
+        return WildMatchN(str + i, n - i, pat + 1);
+    }
+    if (*pat == L'?')
+        return n > 0 && str[0] != L'\\' && WildMatchN(str + 1, n - 1, pat + 1);
+    if (n == 0)
+        return FALSE;
+
+    WCHAR sc = str[0], pc = *pat;
+    if (sc >= L'A' && sc <= L'Z')
+        sc += 32;
+    if (pc >= L'A' && pc <= L'Z')
+        pc += 32;
+    return sc == pc && WildMatchN(str + 1, n - 1, pat + 1);
+}
+
+static BOOLEAN MatchList(PUNICODE_STRING s, wchar_t** list)
+{
+    if (!USOK(s) || !list) 
+        return FALSE;
+    
+    SIZE_T s_len = s->Length / sizeof(WCHAR);
+    for (SIZE_T i = 0; list[i]; ++i) {
+        wchar_t* pat = list[i];
+        if (wcschr(pat, L'*') || wcschr(pat, L'?')) {
+            if (WildMatchN(s->Buffer, s_len, pat)) 
+                return TRUE;
+        }
+        else {
+            SIZE_T pat_len = wcslen(pat);
+            if (s_len >= pat_len && _wcsnicmp(s->Buffer, pat, pat_len) == 0) {
+                if (s_len == pat_len || s->Buffer[s_len - pat_len - 1] == L'\\') {
+                    return TRUE;
+                }
+            }
+            if (s_len >= pat_len && _wcsnicmp(s->Buffer + s_len - pat_len, pat, pat_len) == 0) {
+                return TRUE;
+            }
+        }
+    }
+    return FALSE;
+}
+
+static wchar_t* MatchListGetRule(PUNICODE_STRING s, wchar_t** list)
+{
+    if (!USOK(s) || !list) 
+        return 0;
+   
+    SIZE_T s_len = s->Length / sizeof(WCHAR);
+    for (SIZE_T i = 0; list[i]; ++i) {
+        wchar_t* pat = list[i];
+        if (wcschr(pat, L'*') || wcschr(pat, L'?')) {
+            if (WildMatchN(s->Buffer, s_len, pat))
+                return pat;
+        }
+        else {
+            SIZE_T pat_len = wcslen(pat);
+            if (s_len >= pat_len && _wcsnicmp(s->Buffer, pat, pat_len) == 0) {
+                if (s_len == pat_len || s->Buffer[s_len - pat_len - 1] == L'\\') {
+                    return pat;
+                }
+            }
+            if (s_len >= pat_len && _wcsnicmp(s->Buffer + s_len - pat_len, pat, pat_len) == 0) {
+                return pat;
+            }
+        }
+    }
+    return 0;
+}
+
+static BOOLEAN StrStrIW(const wchar_t* s, const wchar_t* sub) 
+{
+    if (!s || !sub) 
+        return FALSE;
+    
+    SIZE_T n = wcslen(s), m = wcslen(sub);
+    if (m == 0 || n < m) 
+        return FALSE;
+    
+    for (SIZE_T i = 0; i + m <= n; i++) {
+        if (_wcsnicmp(s + i, sub, m) == 0) 
+            return TRUE;
+    }
+    return FALSE;
+}
+
+static BOOLEAN EndsWithNameUS(PUNICODE_STRING s, const wchar_t* name)
+{
+    if (!USOK(s) || !name)
+        return FALSE;
+    
+    SIZE_T n = s->Length / sizeof(WCHAR);
+    SIZE_T m = wcslen(name);
+    return n >= m && _wcsnicmp(s->Buffer + (n - m), name, m) == 0;
+}
+
+BOOLEAN IsRegistryBlock(PUNICODE_STRING key, PUNICODE_STRING valueName, PUNICODE_STRING exe)
+{
+    if (USOK(key) && WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\**"))
+        return FALSE;
+
+    if (USOK(exe) && IsWhitelist(exe))
+        return FALSE;
+
+    if (USOK(exe) && USOK(key)) {
+        if ((EndsWithNameUS(exe, L"services.exe") || EndsWithNameUS(exe, L"svchost.exe") || EndsWithNameUS(exe, L"sc.exe")) &&
+            WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\SYSTEM\\CurrentControlSet\\Services\\**"))
+            return FALSE;
+
+        if ((EndsWithNameUS(exe, L"powershell.exe") || EndsWithNameUS(exe, L"pwsh.exe")) &&
+            (WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\CurrentVersion\\Internet Settings\\ZoneMap\\**") ||
+                WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\CurrentVersion\\Internet Settings\\ZoneMap") ||
+                WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\CurrentVersion\\Notifications\\Data\\**") ||
+                WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\CurrentVersion\\Notifications\\Data")))
+            return FALSE;
+
+        if ((EndsWithNameUS(exe, L"msiexec.exe") || EndsWithNameUS(exe, L"TrustedInstaller.exe")) &&
+            (WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\CurrentVersion\\Installer\\**") ||
+                WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\CurrentVersion\\Uninstall\\**") ||
+                WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\SYSTEM\\CurrentControlSet\\Services\\**")))
+            return FALSE;
+
+        if (EndsWithNameUS(exe, L"schtasks.exe") && WildMatchN(key->Buffer, key->Length / sizeof(WCHAR), L"\\REGISTRY\\**\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\**"))
+            return FALSE;
+    }
+    if (USOK(key) && MatchBlockReg(key))
+        return TRUE;
+
+    if (USOK(valueName)) {
+        for (SIZE_T i = 0; g_BlockReg[i]; ++i) {
+            wchar_t* pat = g_BlockReg[i];
+            if (!wcschr(pat, L'\\') && !wcschr(pat, L'*') && !wcschr(pat, L'?') && _wcsnicmp(valueName->Buffer, pat, wcslen(pat)) == 0)
+                return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+BOOLEAN GetProcessImagePathByPid(HANDLE pid, PUNICODE_STRING ProcessImagePath)
+{
+    PEPROCESS process = NULL;
+    PVOID buf = NULL;
+    HANDLE h = NULL;
+    NTSTATUS status;
+    ULONG len = 0;
+
+    status = PsLookupProcessByProcessId(pid, &process);
+    if (!NT_SUCCESS(status)) 
+        return FALSE;
+
+    status = ObOpenObjectByPointer(process, OBJ_KERNEL_HANDLE, NULL, PROCESS_QUERY_LIMITED_INFORMATION, *PsProcessType, KernelMode, &h);
+    if (!NT_SUCCESS(status))
+        goto cleanup;
+
+    status = ZwQueryInformationProcess(h, ProcessImageFileName, NULL, 0, &len);
+    if (status != STATUS_INFO_LENGTH_MISMATCH || len == 0)
+        goto cleanup;
+
+    buf = ExAllocatePool2(POOL_FLAG_NON_PAGED, len, 'iPgN');
+    if (!buf)
+        goto cleanup;
+
+    status = ZwQueryInformationProcess(h, ProcessImageFileName, buf, len, &len);
+    if (NT_SUCCESS(status)) {
+        PUNICODE_STRING image = (PUNICODE_STRING)buf;
+        if (image->Buffer && image->Length > 0 && ProcessImagePath->MaximumLength >= image->Length + sizeof(WCHAR)) {
+            RtlCopyMemory(ProcessImagePath->Buffer, image->Buffer, image->Length);
+            ProcessImagePath->Length = image->Length;
+            ProcessImagePath->Buffer[image->Length / sizeof(WCHAR)] = 0;
+            status = TRUE;
+        }
+        else {
+            status = FALSE;
+        }
+    }
+    else {
+        status = FALSE;
+    }
+cleanup:
+    if (buf) 
+        ExFreePool2(buf, 'iPgN', NULL, 0);
+    if (h)
+        ZwClose(h);
+    if (process)
+        ObDereferenceObject(process);
+    return NT_SUCCESS(status);
+}
+
+BOOLEAN IsWhitelist(PUNICODE_STRING s)
+{
+    if (MatchList(s, g_WhitelistExcept)) 
+        return FALSE;
+    return MatchList(s, g_Whitelist);
+}
+
+BOOLEAN MatchBlockReg(PUNICODE_STRING s)
+{
+    return MatchList(s, g_BlockReg);
+}
+
+wchar_t* GetMatchedBlockRegRule(PUNICODE_STRING s) 
+{
+    return MatchListGetRule(s, g_BlockReg);
+}
+
+BOOLEAN MatchBlockFile(PUNICODE_STRING s)
+{
+    return MatchList(s, g_BlockFile);
+}
+
+BOOLEAN MatchBlockRansom(PUNICODE_STRING s)
+{
+    return MatchList(s, g_BlockRansom);
+}
+
+wchar_t* GetMatchedBlockFileRule(PUNICODE_STRING s) 
+{
+    return MatchListGetRule(s, g_BlockFile);
+}
+
+BOOLEAN HasBlockedSuffix(PUNICODE_STRING s)
+{
+    if (!USOK(s)) {
+        return FALSE;
+    }
+    for (SIZE_T i = 0; g_Blocksuffix[i]; ++i) {
+        if (EndsWithNameUS(s, g_Blocksuffix[i])) {
+            return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+BOOLEAN MatchRemoteSuspectBin(PUNICODE_STRING img)
+{
+    if (!USOK(img)) 
+        return FALSE;
+    
+    for (SIZE_T i = 0; g_RemoteSuspectBins[i]; ++i)
+        if (EndsWithNameUS(img, g_RemoteSuspectBins[i]))
+            return TRUE;
+    return FALSE;
+}
+
+BOOLEAN MatchRemoteCommand(PUNICODE_STRING cmd, PUNICODE_STRING img)
+{
+    if (!USOK(cmd)) 
+        return FALSE;
+    
+    const wchar_t* s = cmd->Buffer;
+    for (SIZE_T i = 0; g_RemoteCmdIndicatorsHttp[i]; ++i)
+        if (StrStrIW(s, g_RemoteCmdIndicatorsHttp[i])) 
+            return TRUE;
+    
+    for (SIZE_T i = 0; g_RemoteCmdIndicatorsGeneric[i]; ++i)
+        if (StrStrIW(s, g_RemoteCmdIndicatorsGeneric[i])) 
+            return TRUE;
+    
+    if (USOK(img) && EndsWithNameUS(img, L"cmd.exe")) {
+        for (SIZE_T i = 0; g_RemoteCmdFromCmdExe[i]; ++i)
+            if (StrStrIW(s, g_RemoteCmdFromCmdExe[i])) 
+                return TRUE;
+    }
+    if (USOK(img) && EndsWithNameUS(img, L"rundll32.exe")) {
+        for (SIZE_T i = 0; g_RemoteCmdFromRundll32Exe[i]; ++i)
+            if (StrStrIW(s, g_RemoteCmdFromRundll32Exe[i]))
+                return TRUE;
+    }
+    if (USOK(img) && EndsWithNameUS(img, L"regsvr32.exe") && StrStrIW(s, L"/i:") && StrStrIW(s, L"http")) 
+        return TRUE;
+    
+    if (USOK(img) && EndsWithNameUS(img, L"mshta.exe")) {
+        for (SIZE_T i = 0; g_RemoteCmdFromMshtaExe[i]; ++i)
+            if (StrStrIW(s, g_RemoteCmdFromMshtaExe[i]))
+                return TRUE;
+    }
+    return FALSE;
+}
+
+BOOLEAN MatchScreenCapModule(PUNICODE_STRING mod)
+{
+    if (!USOK(mod)) 
+        return FALSE;
+    
+    for (SIZE_T i = 0; g_ScreenCapModules[i]; ++i)
+        if (EndsWithNameUS(mod, g_ScreenCapModules[i]))
+            return TRUE;
+    return FALSE;
+}
+
+BOOLEAN MatchSuspiciousProcPath(PUNICODE_STRING img)
+{
+    if (!USOK(img)) 
+        return FALSE;
+    
+    const wchar_t* s = img->Buffer;
+    if (StrStrIW(s, L"\\Users\\")) {
+        for (SIZE_T i = 0; g_ScreenUserSubdirs[i]; ++i)
+            if (StrStrIW(s, g_ScreenUserSubdirs[i])) 
+                return TRUE;
+    }
+    for (SIZE_T i = 0; g_ScreenOtherProcNeedles[i]; ++i)
+        if (StrStrIW(s, g_ScreenOtherProcNeedles[i])) 
+            return TRUE;
+    return FALSE;
+}
+
+BOOLEAN MatchClrFromNonFramework(PUNICODE_STRING fullImageName) 
+{
+    if (!USOK(fullImageName)) 
+        return FALSE;
+    
+    const wchar_t* s = fullImageName->Buffer;
+    return (StrStrIW(s, L"\\clr.dll") || StrStrIW(s, L"\\mscorwks.dll")) && !StrStrIW(s, L"\\Windows\\Microsoft.NET\\") && !StrStrIW(s, L"\\Framework");
+}
+
+BOOLEAN IsWhitelistExcept(PUNICODE_STRING img)
+{
+    if (!USOK(img)) 
+        return FALSE;
+    
+    return MatchList(img, g_WhitelistExcept);
+}

Plugins/Filter/ProtectMatch.h

@@ -0,0 +1,23 @@
+#pragma once
+#include <ntifs.h>
+
+wchar_t* GetMatchedBlockRegRule(PUNICODE_STRING s);
+wchar_t* GetMatchedBlockFileRule(PUNICODE_STRING s);
+BOOLEAN GetProcessImagePathByPid(HANDLE pid, PUNICODE_STRING ProcessImagePath);
+
+BOOLEAN IsWhitelist(PUNICODE_STRING s);
+BOOLEAN IsWhitelistExcept(PUNICODE_STRING img);
+
+BOOLEAN MatchBlockReg(PUNICODE_STRING s);
+BOOLEAN IsRegistryBlock(PUNICODE_STRING key, PUNICODE_STRING valueName, PUNICODE_STRING exe);
+
+BOOLEAN MatchBlockFile(PUNICODE_STRING s);
+BOOLEAN MatchBlockRansom(PUNICODE_STRING s);
+BOOLEAN HasBlockedSuffix(PUNICODE_STRING s);
+
+BOOLEAN MatchRemoteSuspectBin(PUNICODE_STRING img);
+BOOLEAN MatchRemoteCommand(PUNICODE_STRING cmd, PUNICODE_STRING img);
+
+BOOLEAN MatchScreenCapModule(PUNICODE_STRING mod);
+BOOLEAN MatchSuspiciousProcPath(PUNICODE_STRING img);
+BOOLEAN MatchClrFromNonFramework(PUNICODE_STRING fullImageName);

Plugins/Filter/ProtectProcess.c

@@ -0,0 +1,125 @@
+#include <ntifs.h>
+#include <ntstrsafe.h>
+#include "DriverEntry.h"
+
+typedef union _PS_PROTECTION {
+    UCHAR Level;
+    struct {
+        UCHAR Type : 3;
+        UCHAR Audit : 1;
+        UCHAR Signer : 4;
+    } Flags;
+} PS_PROTECTION, * PPS_PROTECTION;
+
+static PVOID g_PsSetProcessProtection = NULL;
+static HANDLE g_ProtectedPid = NULL;
+static PVOID g_ObCookie = NULL;
+
+static NTSTATUS SetPPL31(_In_ PEPROCESS proc)
+{
+    if (!proc || !g_PsSetProcessProtection)
+        return STATUS_PROCEDURE_NOT_FOUND;
+
+    PS_PROTECTION p = { 0 };
+    p.Level = 0x31;
+    ((VOID(NTAPI*)(PEPROCESS, PS_PROTECTION))g_PsSetProcessProtection)(proc, p);
+    return STATUS_SUCCESS;
+}
+
+static OB_PREOP_CALLBACK_STATUS ObPreOperation(
+    _In_ PVOID RegistrationContext,
+    _Inout_ POB_PRE_OPERATION_INFORMATION info
+)
+{
+    UNREFERENCED_PARAMETER(RegistrationContext);
+
+    if (!info || info->KernelHandle)
+        return OB_PREOP_SUCCESS;
+
+    if (info->ObjectType == *PsProcessType) {
+        PEPROCESS proc = (PEPROCESS)info->Object;
+        HANDLE pid = PsGetProcessId(proc);
+        if (g_ProtectedPid && pid == g_ProtectedPid && PsGetCurrentProcessId() != g_ProtectedPid) {
+            ACCESS_MASK* mask = (info->Operation == OB_OPERATION_HANDLE_CREATE)
+                ? &info->Parameters->CreateHandleInformation.DesiredAccess
+                : &info->Parameters->DuplicateHandleInformation.DesiredAccess;
+
+            if (*mask & PROCESS_TERMINATE) {
+                LogAnsi3("KILL_ATTEMPT",
+                    (ULONG)(ULONG_PTR)PsGetCurrentProcessId(),
+                    NULL, NULL);
+                *mask &= ~(PROCESS_TERMINATE | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD);
+            }
+        }
+    }
+    return OB_PREOP_SUCCESS;
+}
+
+static VOID ProcessNotify(
+    _In_opt_ PEPROCESS Process,
+    _In_ HANDLE Pid,
+    _In_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo
+)
+{
+    UNICODE_STRING target = RTL_CONSTANT_STRING(L"\\??\\C:\\PYAS.exe");
+    if (CreateInfo) {
+        if (Process && CreateInfo->ImageFileName &&
+            RtlEqualUnicodeString(CreateInfo->ImageFileName, &target, TRUE)) {
+
+            NTSTATUS st = SetPPL31(Process);
+            UNREFERENCED_PARAMETER(st);
+
+            InterlockedExchangePointer((PVOID*)&g_ProtectedPid, Pid);
+            LogAnsi3("PROC_PPL", (ULONG)(ULONG_PTR)Pid, (PUNICODE_STRING)CreateInfo->ImageFileName, NULL);
+        }
+    }
+    else {
+        if (g_ProtectedPid && Pid == g_ProtectedPid) {
+            InterlockedExchangePointer((PVOID*)&g_ProtectedPid, NULL);
+        }
+    }
+}
+
+NTSTATUS InitProcessProtect(VOID)
+{
+    UNICODE_STRING n = RTL_CONSTANT_STRING(L"PsSetProcessProtection");
+    g_PsSetProcessProtection = MmGetSystemRoutineAddress(&n);
+
+    static OB_OPERATION_REGISTRATION ops[1];
+    RtlZeroMemory(ops, sizeof(ops));
+    ops[0].ObjectType = PsProcessType;
+    ops[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    ops[0].PreOperation = ObPreOperation;
+    ops[0].PostOperation = NULL;
+
+    UNICODE_STRING alt = RTL_CONSTANT_STRING(L"321000");
+    OB_CALLBACK_REGISTRATION reg;
+    RtlZeroMemory(&reg, sizeof(reg));
+    reg.Version = OB_FLT_REGISTRATION_VERSION;
+    reg.OperationRegistrationCount = 1;
+    reg.OperationRegistration = ops;
+    reg.RegistrationContext = NULL;
+    reg.Altitude = alt;
+
+    NTSTATUS s = ObRegisterCallbacks(&reg, &g_ObCookie);
+    if (!NT_SUCCESS(s)) {
+        g_ObCookie = NULL;
+        return s;
+    }
+    s = PsSetCreateProcessNotifyRoutineEx(ProcessNotify, FALSE);
+    if (!NT_SUCCESS(s)) {
+        ObUnRegisterCallbacks(g_ObCookie);
+        g_ObCookie = NULL;
+        return s;
+    }
+    return STATUS_SUCCESS;
+}
+
+VOID UninitProcessProtect(VOID)
+{
+    if (g_ObCookie) {
+        ObUnRegisterCallbacks(g_ObCookie);
+        g_ObCookie = NULL;
+    }
+    PsSetCreateProcessNotifyRoutineEx(ProcessNotify, TRUE);
+}

Plugins/Filter/ProtectRegistry.c

@@ -0,0 +1,118 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+static BOOLEAN QueryRegPathFromObject(PVOID KeyObject, PUNICODE_STRING OutPath, POBJECT_NAME_INFORMATION* OutInfo)
+{
+    ULONG len = 0;
+    NTSTATUS s = ObQueryNameString(KeyObject, NULL, 0, &len);
+    if (s != STATUS_INFO_LENGTH_MISMATCH)
+        return FALSE;
+
+    POBJECT_NAME_INFORMATION p = (POBJECT_NAME_INFORMATION)ExAllocatePool2(POOL_FLAG_NON_PAGED, len, 'rgeR');
+    if (!p)
+        return FALSE;
+
+    s = ObQueryNameString(KeyObject, p, len, &len);
+    if (!NT_SUCCESS(s) || !p->Name.Buffer || p->Name.Length == 0) {
+        ExFreePool2(p, 'rgeR', NULL, 0);
+        return FALSE;
+    }
+    *OutInfo = p;
+    OutPath->Buffer = p->Name.Buffer;
+    OutPath->Length = p->Name.Length;
+    OutPath->MaximumLength = p->Name.Length;
+    return TRUE;
+}
+
+NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2)
+{
+    UNREFERENCED_PARAMETER(ctx);
+    if (g_Unloading)
+        return STATUS_SUCCESS;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return STATUS_SUCCESS;
+
+    REG_NOTIFY_CLASS type = (REG_NOTIFY_CLASS)(ULONG_PTR)arg1;
+    NTSTATUS status = STATUS_SUCCESS;
+    UNICODE_STRING checkReg = { 0 };
+    POBJECT_NAME_INFORMATION nameInfo = NULL;
+
+    UNICODE_STRING exe = { 0 };
+    WCHAR exeBuf[260] = { 0 };
+    exe.Buffer = exeBuf;
+    exe.MaximumLength = sizeof(exeBuf);
+    exe.Length = 0;
+
+    HANDLE pid = PsGetCurrentProcessId();
+    if (pid == (HANDLE)0 || pid == (HANDLE)4) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return STATUS_SUCCESS;
+    }
+    PUNICODE_STRING valueName = NULL;
+    BOOLEAN need_log = FALSE;
+    BOOLEAN canQuery = (KeGetCurrentIrql() == PASSIVE_LEVEL);
+
+    if (type == RegNtPreSetValueKey) {
+        PREG_SET_VALUE_KEY_INFORMATION s = (PREG_SET_VALUE_KEY_INFORMATION)arg2;
+        valueName = s->ValueName;
+        if (canQuery)
+            QueryRegPathFromObject(s->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreDeleteValueKey) {
+        PREG_DELETE_VALUE_KEY_INFORMATION d = (PREG_DELETE_VALUE_KEY_INFORMATION)arg2;
+        valueName = d->ValueName;
+        if (canQuery)
+            QueryRegPathFromObject(d->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreDeleteKey) {
+        PREG_DELETE_KEY_INFORMATION d = (PREG_DELETE_KEY_INFORMATION)arg2;
+        if (canQuery)
+            QueryRegPathFromObject(d->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreRenameKey) {
+        PREG_RENAME_KEY_INFORMATION r = (PREG_RENAME_KEY_INFORMATION)arg2;
+        if (canQuery)
+            QueryRegPathFromObject(r->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreCreateKeyEx) {
+        PREG_CREATE_KEY_INFORMATION c = (PREG_CREATE_KEY_INFORMATION)arg2;
+        if (c->CompleteName)
+            checkReg = *c->CompleteName;
+    }
+    else if (type == RegNtPreReplaceKey) {
+        PREG_REPLACE_KEY_INFORMATION rk = (PREG_REPLACE_KEY_INFORMATION)arg2;
+        if (canQuery)
+            QueryRegPathFromObject(rk->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreSaveKey) {
+        PREG_SAVE_KEY_INFORMATION sk = (PREG_SAVE_KEY_INFORMATION)arg2;
+        if (canQuery)
+            QueryRegPathFromObject(sk->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreRestoreKey) {
+        PREG_RESTORE_KEY_INFORMATION res = (PREG_RESTORE_KEY_INFORMATION)arg2;
+        if (canQuery)
+            QueryRegPathFromObject(res->Object, &checkReg, &nameInfo);
+    }
+    else if (type == RegNtPreLoadKey) {
+        PREG_LOAD_KEY_INFORMATION lk = (PREG_LOAD_KEY_INFORMATION)arg2;
+        if (lk->KeyName)
+            checkReg = *lk->KeyName;
+    }
+
+    if (checkReg.Buffer || (valueName && valueName->Buffer)) {
+        if (canQuery)
+            GetProcessImagePathByPid(pid, &exe);
+        if (IsRegistryBlock(&checkReg, valueName, &exe)) {
+            need_log = TRUE;
+            status = STATUS_ACCESS_DENIED;
+        }
+    }
+    if (nameInfo)
+        ExFreePool2(nameInfo, 'rgeR', NULL, 0);
+    if (need_log)
+        LogAnsi3("REG_BLOCK", (ULONG)(ULONG_PTR)pid, &exe, &checkReg);
+    ExReleaseRundownProtection(&g_Rundown);
+    return status;
+}

Plugins/Filter/ProtectRemote.c

@@ -0,0 +1,83 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+static BOOLEAN g_RemoteNotifyEnabled = FALSE;
+
+static VOID ProcessNotifyEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo)
+{
+    UNREFERENCED_PARAMETER(Process);
+    UNREFERENCED_PARAMETER(ProcessId);
+    
+    if (!CreateInfo)
+        return;
+    if (g_Unloading)
+        return;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL)
+        return;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return;
+
+    HANDLE ppid = CreateInfo->CreatingThreadId.UniqueProcess;
+    if (ppid == (HANDLE)0 || ppid == (HANDLE)4) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+    UNICODE_STRING parent = { 0 };
+    WCHAR pbuf[512] = { 0 };
+    parent.Buffer = pbuf;
+    parent.MaximumLength = sizeof(pbuf);
+
+    if (!GetProcessImagePathByPid(ppid, &parent)) {
+        PEPROCESS eproc = PsGetCurrentProcess();
+        PCSTR n = PsGetProcessImageFileName(eproc);
+        size_t l = n ? strlen(n) : 0;
+        for (size_t i = 0; i < l && i < RTL_NUMBER_OF(pbuf) - 1; i++)
+            pbuf[i] = (WCHAR)n[i];
+        pbuf[l] = 0;
+        parent.Length = (USHORT)(l * sizeof(WCHAR));
+    }
+    if (IsWhitelist(&parent)) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+    UNICODE_STRING img = { 0 };
+    if (CreateInfo->ImageFileName)
+        img = *CreateInfo->ImageFileName;
+    UNICODE_STRING cmd = { 0 };
+    if (CreateInfo->CommandLine)
+        cmd = *CreateInfo->CommandLine;
+
+    BOOLEAN suspect = FALSE;
+    if (MatchRemoteSuspectBin(&img) && MatchRemoteCommand(&cmd, &img))
+        suspect = TRUE;
+
+    if (suspect) {
+        CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
+        if (cmd.Buffer && cmd.Length)
+            LogAnsi3("REMOTE_BLOCK", (ULONG)(ULONG_PTR)ppid, &parent, &cmd);
+        else if (img.Buffer && img.Length)
+            LogAnsi3("REMOTE_BLOCK", (ULONG)(ULONG_PTR)ppid, &parent, &img);
+        else {
+            UNICODE_STRING none = RTL_CONSTANT_STRING(L"None");
+            LogAnsi3("REMOTE_BLOCK", (ULONG)(ULONG_PTR)ppid, &parent, &none);
+        }
+    }
+    ExReleaseRundownProtection(&g_Rundown);
+}
+
+NTSTATUS InitRemoteProtect(VOID)
+{
+    NTSTATUS s = PsSetCreateProcessNotifyRoutineEx(ProcessNotifyEx, FALSE);
+    if (NT_SUCCESS(s))
+        g_RemoteNotifyEnabled = TRUE;
+    return s;
+}
+
+VOID UninitRemoteProtect(VOID)
+{
+    if (g_RemoteNotifyEnabled) {
+        PsSetCreateProcessNotifyRoutineEx(ProcessNotifyEx, TRUE);
+        g_RemoteNotifyEnabled = FALSE;
+    }
+}

Plugins/Filter/ProtectRules.c

@@ -0,0 +1,266 @@
+#include <ntifs.h>
+#include "ProtectRules.h"
+
+wchar_t* g_Whitelist[] = {
+    L"\\Device\\HarddiskVolume*\\Program*\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\**",
+    L"**\\PYAS*.exe",
+    L"Registry",
+    L"vmmem*",
+    NULL
+};
+
+wchar_t* g_WhitelistExcept[] = {
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\vds.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\bcdedit.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\schtasks.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\ntoskrnl.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\wbadmin.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\bcdboot.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\dism.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\bootsect.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\net1.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\msiexec.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\lsass.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\csrss.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\smss.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\Sys*\\wininit.exe",
+    NULL
+};
+
+wchar_t* g_AttachDisk[] = {
+    L"\\FileSystem\\Ntfs",
+    L"\\FileSystem\\Refs",
+    L"\\FileSystem\\Fastfat",
+    L"\\FileSystem\\exfat",
+    L"\\FileSystem\\Udfs",
+    NULL
+};
+
+wchar_t* g_BlockFile[] = {
+    L"\\Device\\Harddisk*\\DR*",
+    L"\\Device\\Harddisk*\\Partition\\**",
+    L"\\Device\\HarddiskVolume*\\Boot\\**",
+    L"\\Device\\HarddiskVolume*\\EFI\\**",
+    L"\\Device\\HarddiskVolume*\\bootmgr",
+    L"\\Device\\HarddiskVolume*\\Recovery\\**",
+    L"\\Device\\HarddiskVolume*\\System Volume Information\\**",
+    L"\\Device\\HarddiskVolume*\\Windows\\**",
+    L"\\Device\\HarddiskVolume*\\$*\\**",
+    L"\\Device\\HarddiskVolume*\\ProgramData\\PYAS\\**",
+    L"**\\PYAS.exe",
+    L"**\\CON**",
+    L"**\\PRN**",
+    L"**\\AUX**",
+    L"**\\NUL**",
+    L"**\\COM*\\**",
+    L"**\\LPT*\\**",
+    L"**\\evil*.exe",
+    L"**\\OSDATA**",
+    NULL
+};
+
+wchar_t* g_BlockRansom[] = {
+    L"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\Documents\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\Music\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\Pictures\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\Videos\\**",
+    L"\\Device\\HarddiskVolume*\\Users\\*\\OneDrive\\**",
+    NULL
+};
+
+wchar_t* g_Blocksuffix[] = {
+    L".exe", L".dll", L".sys", L".com", L".scr",
+    L".zip", L".7z", L".rar", L".tar", L".gz",
+    L".js", L".bat", L".cmd", L".ps1", L".vbs",
+    L".ppt", L".pptx", L".wps", L".txt", L".rtf",
+    L".pdf", L".xls", L".xlsx", L".doc", L".docx",
+    L".jpg", L".jpeg", L".png", L".webp", L".gif",
+    L".mp3", L".wav", L".aac", L".ogg", L".flac",
+    L".mp4", L".avi", L".mov", L".wmv", L".mkv",
+    L".aux", L".cur", L".mui", L".ttf", L".efi",
+    NULL
+};
+
+wchar_t* g_BlockReg[] = {
+    L"\\REGISTRY\\MACHINE\\BCD00000000\\**",
+    L"\\REGISTRY\\MACHINE\\SAM\\**",
+    L"\\REGISTRY\\MACHINE\\SECURITY\\**",
+    L"\\REGISTRY\\USER\\*_Classes\\*\\shell\\open\\command\\**",
+    L"\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\NetWire\\**",
+    L"\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\Remcos*\\**",
+    L"\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\DC3_FEXEC\\**",
+    L"DisableAntiSpyware",
+    L"DisableWindowsUpdateAccess",
+    L"EnableLUA",
+    L"ConsentPromptBehaviorAdmin",
+    L"NoControlPanel",
+    L"NoDrives",
+    L"NoFileMenu",
+    L"NoFind",
+    L"NoStartMenuPinnedList",
+    L"NoSetFolders",
+    L"NoSetFolderOptions",
+    L"NoViewOnDrive",
+    L"NoClose",
+    L"NoDesktop",
+    L"NoLogoff",
+    L"NoFolderOptions",
+    L"RestrictRun",
+    L"NoViewContextMenu",
+    L"HideClock",
+    L"NoStartMenuMyGames",
+    L"NoStartMenuMyMusic",
+    L"DisableCMD",
+    L"NoAddingComponents",
+    L"NoWinKeys",
+    L"NoStartMenuLogOff",
+    L"NoSimpleNetIDList",
+    L"NoLowDiskSpaceChecks",
+    L"DisableLockWorkstation",
+    L"Restrict_Run",
+    L"DisableTaskMgr",
+    L"DisableRegistryTools",
+    L"DisableChangePassword",
+    L"Wallpaper",
+    L"NoComponents",
+    L"NoStartMenuMorePrograms",
+    L"NoActiveDesktop",
+    L"NoSetActiveDesktop",
+    L"NoRecentDocsMenu",
+    L"NoWindowsUpdate",
+    L"NoChangeStartMenu",
+    L"NoFavoritesMenu",
+    L"NoRecentDocsHistory",
+    L"NoSetTaskbar",
+    L"NoSMHelp",
+    L"NoTrayContextMenu",
+    L"NoManageMyComputerVerb",
+    L"NoRealMode",
+    L"NoRun",
+    L"ClearRecentDocsOnExit",
+    L"NoActiveDesktopChanges",
+    L"NoStartMenuNetworkPlaces",
+    L"NoLockScreen",
+    L"HideFastUserSwitching",
+    L"ConsentPromptBehaviorUser",
+    L"EnableSecureUIAPaths",
+    L"NoSRM",
+    L"NoInteractiveServices",
+    L"ShutdownWithoutLogon",
+    L"AutoAdminLogon",
+    L"ImagePath",
+    L"BootExecute",
+    L"SubSystems",
+    L"FirmwareBootDevice",
+    L"BootDriverFlags",
+    L"SystemStartOptions",
+    L"CrashDumpEnabled",
+    L"DisableAutomaticRestartOnFailure",
+    L"SystemBiosVersion",
+    L"NoTheme",
+    L"PendingFileRenameOperations",
+    L"SystemSetupInProgress",
+    L"CmdLine",
+    L"SetupType",
+    L"AutoReboot",
+    L"Userinit",
+    L"UIHost",
+    L"Debugger",
+    L"DefaultUserName",
+    L"DefaultPassword",
+    L"AltDefaultUserName",
+    L"AltDefaultPassword",
+    L"DisableCAD",
+    L"LegalNoticeCaption",
+    L"LegalNoticeText",
+    NULL
+};
+
+wchar_t* g_RemoteSuspectBins[] = {
+    L"powershell.exe",
+    L"pwsh.exe",
+    L"wscript.exe",
+    L"cscript.exe",
+    L"mshta.exe",
+    L"rundll32.exe",
+    L"regsvr32.exe",
+    L"cmd.exe",
+    L"bitsadmin.exe",
+    L"msbuild.exe",
+    L"installutil.exe",
+    L"wmic.exe",
+    NULL
+};
+
+wchar_t* g_RemoteCmdIndicatorsHttp[] = {
+    L"http://",
+    L"https://",
+    NULL
+};
+
+wchar_t* g_RemoteCmdIndicatorsGeneric[] = {
+    L"-enc",
+    L"-e",
+    L"-encodedcommand",
+    L"frombase64string(",
+    L"iex(",
+    L"downloadstring(",
+    NULL
+};
+
+wchar_t* g_RemoteCmdFromCmdExe[] = {
+    L"powershell",
+    L"pwsh",
+    L"mshta",
+    L"rundll32",
+    L"wscript",
+    L"cscript",
+    NULL
+};
+
+wchar_t* g_RemoteCmdFromRundll32Exe[] = {
+    L".dll,",
+    L"javascript:",
+    L"http",
+    NULL
+};
+
+wchar_t* g_RemoteCmdRegsvr32Need[] = {
+    L"/i:",
+    NULL
+};
+
+wchar_t* g_RemoteCmdFromMshtaExe[] = {
+    L"http://",
+    L"https://",
+    NULL
+};
+
+wchar_t* g_ScreenCapModules[] = {
+    L"windows.graphics.capture.dll",
+    L"dxgi.dll",
+    L"d3d11.dll",
+    L"dwmapi.dll",
+    L"dcomp.dll",
+    L"mfreadwrite.dll",
+    L"mfplat.dll",
+    L"opengl32.dll",
+    L"gdi32full.dll",
+    L"win32u.dll",
+    NULL
+};
+
+wchar_t* g_ScreenUserSubdirs[] = {
+    L"\\AppData\\",
+    L"\\Temp\\",
+    L"\\Downloads\\",
+    NULL
+};
+
+wchar_t* g_ScreenOtherProcNeedles[] = {
+    L"\\ProgramData\\",
+    NULL
+};

Plugins/Filter/ProtectRules.h

@@ -0,0 +1,25 @@
+#pragma once
+#include <ntifs.h>
+
+extern wchar_t* g_Whitelist[];
+extern wchar_t* g_WhitelistExcept[];
+
+extern wchar_t* g_AttachDisk[];
+extern wchar_t* g_BlockFile[];
+extern wchar_t* g_BlockRansom[];
+extern wchar_t* g_Blocksuffix[];
+
+extern wchar_t* g_BlockReg[];
+
+extern wchar_t* g_RemoteSuspectBins[];
+
+extern wchar_t* g_RemoteCmdIndicatorsHttp[];
+extern wchar_t* g_RemoteCmdIndicatorsGeneric[];
+extern wchar_t* g_RemoteCmdFromCmdExe[];
+extern wchar_t* g_RemoteCmdFromRundll32Exe[];
+extern wchar_t* g_RemoteCmdRegsvr32Need[];
+extern wchar_t* g_RemoteCmdFromMshtaExe[];
+
+extern wchar_t* g_ScreenCapModules[];
+extern wchar_t* g_ScreenUserSubdirs[];
+extern wchar_t* g_ScreenOtherProcNeedles[];

Plugins/Filter/ProtectScreen.c

@@ -0,0 +1,67 @@
+#include <ntifs.h>
+#include "DriverEntry.h"
+#include "ProtectMatch.h"
+
+static BOOLEAN g_ScreenImgCb = FALSE;
+
+static VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo)
+{
+    UNREFERENCED_PARAMETER(ImageInfo);
+    if (g_Unloading)
+        return;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL)
+        return;
+    if (!ExAcquireRundownProtection(&g_Rundown))
+        return;
+    if (!FullImageName || !FullImageName->Buffer || FullImageName->Length == 0) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+
+    UNICODE_STRING proc = { 0 };
+    WCHAR pbuf[512] = { 0 };
+    proc.Buffer = pbuf;
+    proc.MaximumLength = sizeof(pbuf);
+
+    if (!GetProcessImagePathByPid(ProcessId, &proc)) {
+        PEPROCESS eproc = NULL;
+        if (NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &eproc))) {
+            PCSTR n = PsGetProcessImageFileName(eproc);
+            SIZE_T l = n ? strlen(n) : 0;
+            for (SIZE_T i = 0; i < l && i < RTL_NUMBER_OF(pbuf) - 1; i++)
+                pbuf[i] = (WCHAR)n[i];
+            pbuf[l] = 0;
+            proc.Length = (USHORT)(l * sizeof(WCHAR));
+            ObDereferenceObject(eproc);
+        }
+    }
+    if (proc.Length == 0) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+    if (IsWhitelist(&proc)) {
+        ExReleaseRundownProtection(&g_Rundown);
+        return;
+    }
+
+    BOOLEAN suspicious = MatchSuspiciousProcPath(&proc);
+    if (suspicious && MatchScreenCapModule(FullImageName))
+        LogAnsi3("SCREEN_BLOCK", (ULONG)(ULONG_PTR)ProcessId, &proc, FullImageName);
+
+    ExReleaseRundownProtection(&g_Rundown);
+}
+
+NTSTATUS InitScreenProtect(VOID)
+{
+    NTSTATUS s = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+    if (NT_SUCCESS(s)) g_ScreenImgCb = TRUE;
+    return s;
+}
+
+VOID UninitScreenProtect(VOID)
+{
+    if (g_ScreenImgCb) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        g_ScreenImgCb = FALSE;
+    }
+}

README.md

@@ -1,20 +1,195 @@
-# PYAS (Python Antivirus Software)
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/e49a0aef-6ef6-4485-8f93-e7a73f9571ea)
+# PYAS
 
-## Official Website
-https://pyantivirus.wixsite.com/pyas , 
-https://github.com/87owo/PYAS
+Antivirus software written in Python and C that blocks threats through deep learning and behavioral monitoring!
 
-## MIT License
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+<img width="2245" height="1477" alt="PYAS_UI" src="https://github.com/user-attachments/assets/87d40261-7655-49ad-a19c-1ffcca60584f" />
+
+## Requirements
+
+Python 3.10 is recommended. Other Python versions may require different pip commands.
+
+```
+pip install numpy==1.26.4
+pip install onnxruntime==1.18.1
+pip install pefile==2023.2.7
+pip install Pillow==11.0.0
+pip install pyperclip==1.9.0
+pip install PySide6==6.9.1
+pip install requests==2.32.4
+pip install yara-python==4.5.4
+```
+
+## File Information
+
+The following lists the storage locations of all relevant code and other related documents.
+
+```
+PYAS/
+├── Engine/
+│   ├── Models/
+│   │   ├── convert.py               # Convert executable files or other files to images
+│   │   └── train.py                 # TensorFlow CNN model training complete code
+│   │
+│   └── Rules/
+│       ├── rules.yar                # Yara virus signature rule matching
+│       └── rules.ips                # IP network address rule matching
+│
+├── Plugins/
+│   └── Filter/
+│       ├── DriverEntry.c            # Main driver entry and initialization logic
+│       ├── DriverEntry.h            # Global driver definitions, constants, and functions
+│       ├── DriverPipe.c             # Kernel to user pipe logging implementation
+│       ├── ProtectBoot.c            # Disk boot sector write protection
+│       ├── ProtectImage.c           # Image load monitoring and shellcode detection
+│       ├── ProtectInject.c          # Process thread handle access control to prevent injection
+│       ├── ProtectReg.c             # Registry modification protection
+│       ├── ProtectRules.c           # White, block list, and matching logic for files registry
+│       └── ProtectRules.h           # Protection rule declarations
+│
+├── PYAS.py                          # Main application entry point and UI to engine interface
+├── PYAS_Config.py                   # Configuration loading, saving, and global parameters
+├── PYAS_Engine.py                   # Core scanning engine: YARA, IP, ONNX model execution
+├── PYAS_Interface.py                # User interface components and event handling
+├── PYAS_Resource.py                 # Static image and icon resource management
+├── PYAS_Version.py                  # Version metadata for packaging and updates
+└── ...                              # Other supplementary folders and files
+```
+
+## Architecture diagram
+
+PYAS Security antivirus software general architecture diagram.
+
+```mermaid
+graph TD
+    %% Global Styles
+    classDef ui fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
+    classDef logic fill:#fff9c4,stroke:#fbc02d,stroke-width:2px;
+    classDef engine fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px;
+    classDef thread fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px;
+    classDef kernel fill:#ffebee,stroke:#c62828,stroke-width:2px;
+    classDef data fill:#eceff1,stroke:#455a64,stroke-width:2px,stroke-dasharray: 5 5;
+
+    User((User))
+
+    subgraph Presentation_Layer ["Presentation Layer (View)"]
+        direction TB
+        UI_Static["PYAS_Interface.py<br/>(Ui_main_window Class)"]:::ui
+        UI_Controller["PYAS.py<br/>(MainWindow_Controller Class)"]:::ui
+        TrayIcon["System Tray Icon"]:::ui
+        
+        User <--> UI_Controller
+        UI_Static --- UI_Controller
+        UI_Controller --- TrayIcon
+    end
+
+    subgraph Core_Logic_Layer ["Core Logic & Controller"]
+        direction TB
+        Init_Env["Initialization<br/>(init_environ, init_variable,<br/>init_windll)"]:::logic
+        Config_Mgr["Configuration Manager<br/>(load_config, save_config)"]:::logic
+        
+        subgraph System_Tools ["System Tools"]
+            Sys_Repair["System Repair<br/>(repair_system_mbr,<br/>repair_system_image, etc.)"]:::logic
+            Sys_Clean["System Cleaner<br/>(clean_button, traverse_temp)"]:::logic
+            Proc_Mgr["Process Manager<br/>(list_process, kill_process)"]:::logic
+            List_Mgr["List Manager<br/>(manage_named_list:<br/>Whitelist/Quarantine)"]:::logic
+        end
+
+        UI_Controller --> Init_Env
+        Init_Env --> Config_Mgr
+        UI_Controller --> System_Tools
+    end
+
+    subgraph Protection_Layer ["Real-time Protection Threads (Daemons)"]
+        direction TB
+        Thread_Proc["Process Guard Thread<br/>(protect_proc_thread)<br/>[WMI/Snapshot]"]:::thread
+        Thread_File["File Guard Thread<br/>(protect_file_thread)<br/>[ReadDirectoryChangesW]"]:::thread
+        Thread_Net["Network Guard Thread<br/>(protect_net_thread)<br/>[GetExtendedTcpTable]"]:::thread
+        Thread_Sys["System Guard Thread<br/>(protect_system_thread)<br/>[Reg/MBR Check]"]:::thread
+        Thread_Popup["Popup Blocker Thread<br/>(popup_intercept_thread)<br/>[EnumWindows]"]:::thread
+        Thread_Pipe["Driver IPC Thread<br/>(pipe_server_thread)<br/>[NamedPipe Server]"]:::thread
+
+        Init_Env --> Thread_Proc
+        Init_Env --> Thread_File
+        Init_Env --> Thread_Net
+        Init_Env --> Thread_Sys
+        Init_Env --> Thread_Popup
+        Init_Env --> Thread_Pipe
+    end
+
+    subgraph Engine_Layer ["Detection Engine (PYAS_Engine.py)"]
+        direction TB
+        Scan_Worker["Scan Worker<br/>(scan_worker / scan_engine)"]:::engine
+        
+        subgraph Scanners
+            Sign_Check["Signature Scanner<br/>(sign_scanner)<br/>[WinVerifyTrust]"]:::engine
+            AI_Model["AI Model Scanner<br/>(model_scanner)<br/>[ONNX/ResNet]"]:::engine
+            Yara_Rules["Rule Scanner<br/>(rule_scanner)<br/>[Yara/IP Lists]"]:::engine
+        end
+
+        Thread_Proc --> Scan_Worker
+        Thread_File --> Scan_Worker
+        Thread_Net --> Scan_Worker
+        UI_Controller -->|Manual Scan| Scan_Worker
+
+        Scan_Worker --> Sign_Check
+        Scan_Worker --> AI_Model
+        Scan_Worker --> Yara_Rules
+    end
+
+    subgraph Kernel_OS_Layer ["Windows Kernel & Driver"]
+        direction TB
+        WinAPI["Windows API (ctypes)<br/>(kernel32, user32, ntdll,<br/>advapi32, iphlpapi, psapi)"]:::kernel
+        Driver_Sys["Kernel Driver<br/>(PYAS_Driver.sys)"]:::kernel
+        OS_FS["File System (NTFS)"]:::kernel
+        OS_Net["Network Stack"]:::kernel
+
+        Init_Env -- Load DLLs --> WinAPI
+        Thread_File -- Monitor --> OS_FS
+        Thread_Net -- Monitor --> OS_Net
+        Thread_Proc -- Suspend/Kill --> WinAPI
+        
+        Thread_Pipe <==>|"Named Pipe IPC<br/>(\\.\pipe\PYAS_Output_Pipe)"| Driver_Sys
+        Driver_Sys -- Callback/Block --> WinAPI
+    end
+
+    subgraph Data_Persistence ["Data & Resources"]
+        Config_File[("Config.json")]:::data
+        Model_Files[("Model Files<br/>(.onnx)")]:::data
+        Rule_Files[("Rule Files<br/>(.yar)")]:::data
+        Quarantine_Dir[("/Quarantine/")]:::data
+
+        Config_Mgr <--> Config_File
+        AI_Model <--> Model_Files
+        Yara_Rules <--> Rule_Files
+        List_Mgr <--> Quarantine_Dir
+    end
+```
 
 ## Support System
-Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
 
-## Import Module
-os, sys, time, json, psutil, ctypes, requests, subprocess, win32file, win32api, win32con, elementpath, hashlib, pefile, threading, PyQt5, PYAS_Language, PYAS_Model, PYAS_UI
+| Config    | Permissions   | System version       | Processor | Memory | Storage |
+|-----------|---------------|----------------------|-----------|--------|---------|
+| Minimum   | Administrator | >= Windows 10 (20H1) | 1 GHz     | 200MB  | 100MB   |
+| Recommend | Administrator | >= Windows 10 (21H2) | 3 GHz     | 500MB  | 200MB   |
 
-## Special Thanks
-360, Wix, VirusShare, mtkiao129, LenStevens
+## Packaged Releases
 
-Copyright© 2020~2023 PYAS Security By 87owo
+Download the installer. If it is incompatible with your system, you can repackage it yourself.
+
+Packaged Download: https://github.com/87owo/PYAS/releases
+
+## Official Website
+
+If you are interested in this project, you can visit the website to see other related content.
+
+Source Available : https://github.com/87owo/PYAS
+
+Official Website : https://pyas-security.com/antivirus
+
+## Project License
+
+For any questions, needs, or bug feedback, please contact us through the following website.
+
+Source Issues : https://github.com/87owo/PYAS/issues
+
+Official Email : mailto:service.pyas@gmail.com