Add files via upload

PYAS.py

@@ -3,7 +3,7 @@ import hashlib, pefile, socket, msvcrt
 import requests, pyperclip, win32file
 import win32gui, win32api, win32con
 import xml.etree.ElementTree as xmlet
-from PYAS_Scripts import scripts_list
+from PYAS_Rules import pyasrule_dict
 from PYAS_Function import function_list
 from PYAS_Extension import slist, alist
 from PYAS_Language import translate_dict
@@ -19,16 +19,17 @@ class MainWindow_Controller(QMainWindow):
         self.setAttribute(Qt.WA_TranslucentBackground)
         self.setWindowFlags(Qt.FramelessWindowHint)
         self.pyas = str(sys.argv[0]).replace("\\", "/")
-        self.pyas_version = "2.8.7"
+        self.pyas_version = "2.9.2"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_tray_icon()
         self.init_virus_list()
         self.init_state_safe()
         self.init_config_path()
+        self.init_config_read()
+        self.init_config_json()
         self.init_config_list()
         self.init_config_boot()
-        self.init_config_json()
         self.init_config_qtui()
         self.init_change_lang()
         self.init_control()
@@ -93,11 +94,18 @@ class MainWindow_Controller(QMainWindow):
         except:
             self.mbr_value = False
 
-    def init_config_json(self):
-        if not os.path.exists("C:/ProgramData/PYAS/PYAS.json"):
+    def init_config_read(self):
+        try:
+            if not os.path.exists("C:/ProgramData/PYAS/PYAS.json"):
+                self.write_config({"language":"en_US","high_sensitivity":0,"cloud_services":1})
+            with open("C:/ProgramData/PYAS/PYAS.json", "r", encoding="utf-8") as f:
+                self.json = json.load(f)
+        except:
             self.write_config({"language":"en_US","high_sensitivity":0,"cloud_services":1})
-        with open("C:/ProgramData/PYAS/PYAS.json", "r", encoding="utf-8") as f:
-            self.json = json.load(f)
+            with open("C:/ProgramData/PYAS/PYAS.json", "r", encoding="utf-8") as f:
+                self.json = json.load(f)
+
+    def init_config_json(self):
         self.high_sensitivity = self.json.get("high_sensitivity", 0)
         if self.high_sensitivity == 1:
             self.ui.high_sensitivity_switch_Button.setText(self.trans("已開啟"))
@@ -261,7 +269,7 @@ class MainWindow_Controller(QMainWindow):
         self.ui.Window_Block_Button.setText(self.trans("軟體彈窗攔截"))
         self.ui.Repair_System_Network_Button.setText(self.trans("系統網路修復"))
         self.ui.About_Back.setText(self.trans("返回"))
-        self.ui.PYAS_Version.setText(self.trans(f"PYAS V{self.pyas_version}"))
+        self.ui.PYAS_Version.setText(self.trans(f"PYAS V{self.pyas_version} (ML Engine)"))
         self.ui.GUI_Made_title.setText(self.trans("介面製作:"))
         self.ui.GUI_Made_Name.setText(self.trans("mtkiao"))
         self.ui.Core_Made_title.setText(self.trans("核心製作:"))
@@ -529,14 +537,15 @@ class MainWindow_Controller(QMainWindow):
 
     def closeEvent(self, event):
         if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要退出 PYAS 和所有防護嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+            self.virus_scan_break()
             event.accept()
         else:
             event.ignore()
 
-    def bug_event(self, error):
+    def bug_event(self, text):
         try:
-            print(f"[Error] {error}")
-            QMessageBox.critical(self,self.trans("錯誤"),error,QMessageBox.Ok)
+            print(f"[Error] {text}")
+            QMessageBox.critical(self,self.trans("錯誤"), text, QMessageBox.Ok)
         except:
             pass
 
@@ -628,11 +637,7 @@ class MainWindow_Controller(QMainWindow):
             self.ui.Virus_Scan_text.setText(self.trans("正在初始化中"))
             QApplication.processEvents()
             for file in self.virus_list:
-                try:
-                    msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
-                    os.close(self.virus_lock[file])
-                except:
-                    continue
+                self.unlock_file(file)
             self.scan_file = True
             self.init_virus_list()
             self.ui.Virus_Scan_Solve_Button.hide()
@@ -655,6 +660,20 @@ class MainWindow_Controller(QMainWindow):
         copyPath.triggered.connect(lambda: copyPathFunc())
         menu.exec_(self.ui.Virus_Scan_output.mapToGlobal(point))
 
+    def lock_file(self, file):
+        try:
+            self.virus_lock[file] = os.open(file, os.O_RDWR)
+            msvcrt.locking(self.virus_lock[file], msvcrt.LK_NBLCK, 0)
+        except:
+            pass
+
+    def unlock_file(self, file):
+        try:
+            msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
+            os.close(self.virus_lock[file])
+        except:
+            pass
+
     def virus_solve(self):
         try:
             self.ui.Virus_Scan_Solve_Button.hide()
@@ -663,12 +682,10 @@ class MainWindow_Controller(QMainWindow):
                     if self.ui.Virus_Scan_output.findItems(file, Qt.MatchContains)[0].checkState() == Qt.Checked:
                         self.ui.Virus_Scan_text.setText(self.trans("正在刪除: ")+file)
                         QApplication.processEvents()
-                        msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
-                        os.close(self.virus_lock[file])
+                        self.unlock_file(file)
                         os.remove(file)
                     else:
-                        msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
-                        os.close(self.virus_lock[file])
+                        self.unlock_file(file)
                 except:
                     continue
             self.init_state_safe()
@@ -680,6 +697,7 @@ class MainWindow_Controller(QMainWindow):
 
     def write_scan(self, state, file):
         try:
+            self.lock_file(file)
             self.virus_list.append(file)
             self.virus_list_ui.append(f"[{state}] {file}")
             item = QListWidgetItem()
@@ -687,8 +705,6 @@ class MainWindow_Controller(QMainWindow):
             item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
             item.setCheckState(Qt.Checked)
             self.ui.Virus_Scan_output.addItem(item)
-            self.virus_lock[file] = os.open(file, os.O_RDWR)
-            msvcrt.locking(self.virus_lock[file], msvcrt.LK_NBLCK, 0)
         except:
             pass
 
@@ -776,15 +792,15 @@ class MainWindow_Controller(QMainWindow):
         for fd in os.listdir(path):
             try:
                 file = str(os.path.join(path,fd)).replace("\\", "/")
-                self.ui.Virus_Scan_text.setText(self.trans(f"正在掃描: ")+file)
-                QApplication.processEvents()
                 if self.scan_file == False:
-                    return
+                    break
                 elif ":/Windows" in file:
                     continue
                 elif os.path.isdir(file):
                     self.traverse_path(file)
                 elif file not in self.whitelist:
+                    self.ui.Virus_Scan_text.setText(self.trans(f"正在掃描: ")+file)
+                    QApplication.processEvents()
                     self.start_scan(file)
                 gc.collect()
             except:
@@ -809,26 +825,25 @@ class MainWindow_Controller(QMainWindow):
         except:
             return True
 
-    def scr_scan(self, text):
-        try:
-            if os.path.isfile(text):
-                with open(text, "r", encoding="utf-8") as f:
-                    text = f.read()
-            return any(sn.lower() in str(text).lower() for sn in scripts_list)
-        except:
-            return False
-
     def pe_scan(self, file):
         try:
-            pe_func = []
+            fn = []
             with pefile.PE(file) as pe:
                 for entry in pe.DIRECTORY_ENTRY_IMPORT:
                     for func in entry.imports:
                         try:
-                            pe_func.append(str(func.name, "utf-8"))
+                            fn.append(str(func.name, "utf-8"))
                         except:
                             pass
-            return pe_func in function_list
+            max_vfl = []
+            for vfl in function_list:
+                QApplication.processEvents()
+                max_vfl.append(len(set(fn)&set(vfl))/len(set(fn)|set(vfl)))
+            if self.high_sensitivity and max(max_vfl) == 1.0:
+                return True
+            elif "_CorExeMain" not in fn and max(max_vfl) == 1.0:
+                return True
+            return False
         except:
             return False
 
@@ -1164,27 +1179,32 @@ class MainWindow_Controller(QMainWindow):
                         existing_processes.add(p.pid)
                         psutil.Process(p.pid).suspend()
                         name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                        if ":/Windows" in file or ":/Program" in file:
-                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
-                                p.kill()
-                                self.send_notify(self.trans("惡意腳本攔截: ")+name)
-                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                                p.kill()
-                                self.send_notify(self.trans("惡意腳本攔截: ")+name)
-                            elif self.scr_scan(cmd) or self.api_scan(cmd[-1]):
-                                p.kill()
-                                self.send_notify(self.trans("惡意軟體攔截: ")+name)
-                        elif file != self.pyas and file not in self.whitelist:
-                            if self.sign_scan(file):
-                                self.proc = p
-                            if self.api_scan(file) or self.pe_scan(file):
-                                p.kill()
-                                self.send_notify(self.trans("惡意軟體攔截: ")+name)
+                        if self.protect_proc_scan(name, file, cmd):
+                            p.kill()
+                            self.send_notify(self.trans("惡意軟體攔截: ")+file)
+                        elif ":/Windows" not in file and self.sign_scan(file):
+                            self.proc = p
                         psutil.Process(p.pid).resume()
                         gc.collect()
                 except:
                     pass
 
+    def protect_proc_scan(self, name, file, cmd):
+        try:
+            if file != self.pyas and file not in self.whitelist:
+                if "powershell" in name:
+                    file = str(cmd[-1].split("'")[-2])
+                elif "cmd.exe" in name:
+                    file = str(" ".join(cmd[2:]))
+                elif ":/Windows" in file:
+                    file = str(cmd[-1])
+                elif ":/Program" in file:
+                    file = str(cmd[-1])
+                return self.api_scan(file) or self.pe_scan(file)
+            return False
+        except:
+            pass
+
     def protect_file_thread(self):
         hDir = win32file.CreateFile("C:/Users/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
         self.ransom_block = False

PYAS_Extension.py

@@ -1,5 +1,6 @@
 slist = [".exe",".dll",".com",".msi",".scr",
-         ".bat",".cmd",".ps1",".vbs",".js"]
+         ".bat",".cmd",".ps1",".vbs",".jar",
+         ".js",".elf",".doc",".xls",".xlsx"]
 
 alist = [".ppt",".pptx",".wps",".txt",".rtf",
          ".pdf",".xls",".xlsx",".doc",".docx",

PYAS_Scripts.py

@@ -1 +0,0 @@
-scripts_list = ["%0|%0","ExclusionPath","cmdkey","eiculwo","random","bypass"]

PYAS_Version.py

@@ -1,10 +1,10 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='2.8.7',
+version='2.9.2',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",
-legal_copyright="© PYAS Security",
+legal_copyright="PYAS Security",
 original_filename="PYAS.exe",
 product_name="PYAS")