Add files via upload

增加中文

PYAS.py

@@ -3,9 +3,8 @@ import hashlib, pefile, socket, msvcrt
 import xml.etree.ElementTree as xmlet
 import requests, pyperclip, win32file
 import win32gui, win32api, win32con
-from PYAS_Function import model_dict
+from PYAS_Engine import ListSimHash
 from PYAS_Extension import slist, alist
-from PYAS_Compress import ListCompressor
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
 from threading import Thread
@@ -18,15 +17,17 @@ class MainWindow_Controller(QMainWindow):
         super(MainWindow_Controller, self).__init__()
         self.setAttribute(Qt.WA_TranslucentBackground)
         self.setWindowFlags(Qt.FramelessWindowHint)
-        self.pyas = str(sys.argv[0]).replace("\\", "/")
-        self.pyae_version = "2024-01-19"
-        self.pyas_version = "3.0.0"
+        self.pyas = sys.argv[0].replace("\\", "/")
+        self.dir = os.path.dirname(self.pyas)
+        self.pyae_version = "SimHash Engine"
+        self.pyas_version = "3.0.8"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_show_pyas()
         self.init_data_base()
         self.init_read_json()
         self.init_tray_icon()
+        self.init_config_boot()
         self.init_config_json()
         self.init_config_list()
         self.init_config_qtui()
@@ -35,10 +36,6 @@ class MainWindow_Controller(QMainWindow):
         self.init_control()
         self.init_threads()
 
-    def init_data_base(self):
-        self.pe = ListCompressor()
-        self.pe.load_model(model_dict)
-
     def init_threads(self):
         self.protect_proc_init()
         self.protect_file_init()
@@ -53,6 +50,24 @@ class MainWindow_Controller(QMainWindow):
         self.tray_icon.activated.connect(self.init_show_pyas)
         self.tray_icon.show()
 
+    def init_data_base(self):
+        try:
+            file_path = os.path.join(self.dir, "PYAS_Model.json")
+            if os.path.exists(file_path):
+                self.pe = ListSimHash()
+                self.pe.load_model(file_path)
+        except Exception as e:
+            self.bug_event(e)
+
+    def init_config_boot(self):
+        try:
+            with open(r"\\.\PhysicalDrive0", "r+b") as f:
+                self.mbr_value = f.read(512)
+            if self.mbr_value[510:512] != b'\x55\xAA':
+                self.mbr_value = False
+        except:
+            self.mbr_value = False
+
     def write_config(self, config):
         try:
             with open("C:/ProgramData/PYAS/PYAS.json", "w") as f:
@@ -328,6 +343,7 @@ class MainWindow_Controller(QMainWindow):
                 self.ui.State_icon.setPixmap(QPixmap(file))
         except:
             self.ui.Theme_White.setChecked(True)
+            self.ui.State_icon.setPixmap(QPixmap(":/icon/Check.png"))
             self.ui.Window_widget.setStyleSheet("QWidget#Window_widget {background-color:rgb(240,240,240);}")
             self.ui.Navigation_Bar.setStyleSheet("QWidget#Navigation_Bar {background-color:rgb(230,230,230);}")
 
@@ -397,7 +413,7 @@ class MainWindow_Controller(QMainWindow):
 
     def timeout(self):
         if self.opacity.i <= 1:
-            self.opacity.i += 0.03
+            self.opacity.i += 0.05
             self.opacity.setOpacity(self.opacity.i)
         else:
             self.timer.stop()
@@ -544,7 +560,7 @@ class MainWindow_Controller(QMainWindow):
     def init_show_pyas(self):
         def update_opacity():
             if self.pyas_opacity <= 100:
-                self.pyas_opacity += 1
+                self.pyas_opacity += 2
                 self.setWindowOpacity(self.pyas_opacity/100)
             else:
                 self.timer.stop()
@@ -557,7 +573,7 @@ class MainWindow_Controller(QMainWindow):
     def init_hide_pyas(self):
         def update_opacity():
             if self.pyas_opacity >= 0:
-                self.pyas_opacity -= 1
+                self.pyas_opacity -= 2
                 self.setWindowOpacity(self.pyas_opacity/100)
             else:
                 self.timer.stop()
@@ -572,7 +588,7 @@ class MainWindow_Controller(QMainWindow):
             self.send_notify(self.trans("PYAS 已最小化到系統托盤圖標"))
 
     def closeEvent(self, event):
-        if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要退出 PYAS 和所有防護嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+        if self.question_event("您確定要退出 PYAS 和所有防護嗎?"):
             self.virus_scan_break()
             event.accept()
         else:
@@ -580,14 +596,29 @@ class MainWindow_Controller(QMainWindow):
 
     def bug_event(self, text):
         try:
-            print(f"[Error] {text}")
-            QMessageBox.critical(self,self.trans("錯誤"), text, QMessageBox.Ok)
+            print(f"[Error] > {text}")
+            QMessageBox.critical(self, "Error", str(text), QMessageBox.Ok)
         except:
             pass
 
+    def info_event(self, text):
+        try:
+            print(f"[Info] > {text}")
+            QMessageBox.information(self, "Info", self.trans(str(text)), QMessageBox.Ok)
+        except:
+            pass
+
+    def question_event(self, text):
+        try:
+            print(f"[Quest] > {text}")
+            return QMessageBox.question(self, "Quest", self.trans(str(text)),QMessageBox.Yes|QMessageBox.No) == 16384
+        except:
+            return False
+
     def send_notify(self, text):
         try:
-            now_time = time.strftime('%Y/%m/%d %H:%M:%S')
+            now_time = time.strftime('%Y-%m-%d %H:%M:%S')
+            print(f"[Notify] > [{now_time}] {text}")
             self.tray_icon.showMessage(now_time, text, 5000)
             QMetaObject.invokeMethod(self.ui.State_output, "append", Qt.QueuedConnection, Q_ARG(str, f"[{now_time}] {text}"))
         except:
@@ -624,7 +655,7 @@ class MainWindow_Controller(QMainWindow):
             self.ui.high_sensitivity_switch_Button.setStyleSheet("""
             QPushButton{border:none;background-color:rgb(230,230,230);border-radius: 10px;}
             QPushButton:hover{background-color:rgb(220,220,220);}""")
-        elif QMessageBox.warning(self,self.trans("警告"),self.trans("此選項可能會誤報檔案，您確定要開啟嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+        elif self.question_event("此選項可能會誤報檔案，您確定要開啟嗎?"):
             self.json["high_sensitive"] = 1
             self.ui.high_sensitivity_switch_Button.setText(self.trans("已開啟"))
             self.ui.high_sensitivity_switch_Button.setStyleSheet("""
@@ -654,7 +685,7 @@ class MainWindow_Controller(QMainWindow):
             QApplication.processEvents()
             try:
                 for file in self.virus_list:
-                    self.unlock_file(file)
+                    self.lock_file(file, False)
             except:
                 pass
             self.scan_file = True
@@ -681,17 +712,14 @@ class MainWindow_Controller(QMainWindow):
         copyPath.triggered.connect(lambda: copyPathFunc())
         menu.exec_(self.ui.Virus_Scan_output.mapToGlobal(point))
 
-    def lock_file(self, file):
+    def lock_file(self, file, lock):
         try:
-            self.virus_lock[file] = os.open(file, os.O_RDWR)
-            msvcrt.locking(self.virus_lock[file], msvcrt.LK_NBLCK, 0)
-        except:
-            pass
-
-    def unlock_file(self, file):
-        try:
-            msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
-            os.close(self.virus_lock[file])
+            if lock:
+                self.virus_lock[file] = os.open(file, os.O_RDWR)
+                msvcrt.locking(self.virus_lock[file], msvcrt.LK_NBLCK, 0)
+            else:
+                msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
+                os.close(self.virus_lock[file])
         except:
             pass
 
@@ -703,10 +731,10 @@ class MainWindow_Controller(QMainWindow):
                     if self.ui.Virus_Scan_output.findItems(file, Qt.MatchContains)[0].checkState() == Qt.Checked:
                         self.ui.Virus_Scan_text.setText(self.trans("正在刪除: ")+file)
                         QApplication.processEvents()
-                        self.unlock_file(file)
+                        self.lock_file(file, False)
                         os.remove(file)
                     else:
-                        self.unlock_file(file)
+                        self.lock_file(file, False)
                 except:
                     continue
             self.virus_lock = {}
@@ -719,14 +747,15 @@ class MainWindow_Controller(QMainWindow):
 
     def write_scan(self, state, file):
         try:
-            self.lock_file(file)
-            self.virus_list.append(file)
-            self.virus_list_ui.append(f"[{state}] {file}")
-            item = QListWidgetItem()
-            item.setText(f"[{state}] {file}")
-            item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
-            item.setCheckState(Qt.Checked)
-            self.ui.Virus_Scan_output.addItem(item)
+            if state and file:
+                self.lock_file(file, True)
+                self.virus_list.append(file)
+                self.virus_list_ui.append(f"[{state}] {file}")
+                item = QListWidgetItem()
+                item.setText(f"[{state}] {file}")
+                item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
+                item.setCheckState(Qt.Checked)
+                self.ui.Virus_Scan_output.addItem(item)
         except:
             pass
 
@@ -764,7 +793,7 @@ class MainWindow_Controller(QMainWindow):
             file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
             if file and file not in self.whitelist:
                 self.init_scan()
-                self.start_scan(file)
+                self.write_scan(self.start_scan(file),file)
                 self.answer_scan()
         except Exception as e:
             self.bug_event(e)
@@ -792,59 +821,59 @@ class MainWindow_Controller(QMainWindow):
             self.bug_event(e)
             self.virus_scan_break()
 
-    def start_scan(self, file):
-        try:
-            file_type = str(f".{file.split('.')[-1]}").lower()
-            if self.json["high_sensitive"] and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-            elif file_type in slist and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-        except:
-            pass
-
     def traverse_path(self,path):
         for fd in os.listdir(path):
             try:
                 file = str(os.path.join(path,fd)).replace("\\", "/")
                 if self.scan_file == False:
                     break
-                elif ":/Windows" in file:
-                    continue
                 elif os.path.isdir(file):
                     self.traverse_path(file)
                 elif file not in self.whitelist:
                     self.ui.Virus_Scan_text.setText(self.trans(f"正在掃描: ")+file)
                     QApplication.processEvents()
-                    self.start_scan(file)
+                    self.write_scan(self.start_scan(file),file)
                 gc.collect()
             except:
                 pass
 
-    def api_scan(self, file):
+    def start_scan(self, file):
         try:
-            if self.json["cloud_services"] == 1:
-                with open(file, "rb") as f:
-                    text = str(hashlib.md5(f.read()).hexdigest())
-                QApplication.processEvents()
-                strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
-                response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
-                return response.status_code == 200 and float(xmlet.fromstring(response.text).find('.//e_level').text) > 50
+            label, level = self.api_scan(file)
+            if file != self.pyas and level > 50:
+                return f"{label}"#.{level}"
+            elif file != self.pyas and level > 10:
+                label_2, level_2 = self.pe_scan(file)
+                if "White" not in label_2 and "Unknown" not in label_2:
+                    return f"{label_2}"#.{int(level_2*100)}"
+                elif "Unknown" in label_2 and self.json["high_sensitive"]:
+                    return f"{label_2}"#.{int(level_2*100)}"
+            elif file != self.pyas and not level:
+                label_2, level_2 = self.pe_scan(file)
+                if "White" not in label_2 and "Unknown" not in label_2:
+                    return f"{label_2}"#.{int(level_2*100)}"
+                elif "Unknown" in label_2 and self.json["high_sensitive"]:
+                    return f"{label_2}"#.{int(level_2*100)}"
             return False
         except:
             return False
 
-    def sign_scan(self, file):
+    def api_scan(self, file):
         try:
-            with pefile.PE(file, fast_load=True) as pe:
-                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+            if self.json["cloud_services"]:
+                with open(file, "rb") as f:
+                    text = str(hashlib.md5(f.read()).hexdigest())
+                QApplication.processEvents()
+                strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+                response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=5)
+                QApplication.processEvents()
+                if response.status_code == 200:
+                    label = str(xmlet.fromstring(response.text).find('.//malware').text).split('/')[1].split('.')
+                    level = int(float(xmlet.fromstring(response.text).find('.//e_level').text))
+                    return f"{label[0]}", level#/{label[1]}"
+            return False, False
         except:
-            return True
+            return False, False
 
     def pe_scan(self, file):
         try:
@@ -856,20 +885,26 @@ class MainWindow_Controller(QMainWindow):
                             fn.append(str(func.name, "utf-8"))
                         except:
                             pass
-            if self.json["high_sensitive"]:
-                return self.pe.predict(fn)
-            elif "_CorExeMain" not in fn:
-                return self.pe.predict(fn)
-            return False
+            QApplication.processEvents()
+            return self.pe.predict(fn)
         except:
-            return False
+            return False, False
 
-    def proc_scan(self, pid):
+    def sign_scan(self, file):
         try:
-            for entry in psutil.Process(pid).memory_maps():
+            with pefile.PE(file, fast_load=True) as pe:
+                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+        except:
+            return True
+
+    def proc_scan(self, p):
+        try:
+            if isinstance(p, str) and os.path.exists(p):
+                return self.start_scan(file)
+            for entry in psutil.Process(p.pid).memory_maps():
                 file = entry.path.replace("\\", "/")
                 if ":/Windows" not in file and ":/Program" not in file:
-                    if self.api_scan(file) or self.pe_scan(file):
+                    if self.start_scan(file):
                         return True
             return False
         except:
@@ -877,13 +912,13 @@ class MainWindow_Controller(QMainWindow):
 
     def repair_system(self):
         try:
-            if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要修復系統檔案嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+            if self.question_event("您確定要修復系統檔案嗎?"):
                 self.repair_system_wallpaper()
                 self.repair_system_restrict()
                 self.repair_system_file_type()
                 self.repair_system_file_icon()
                 self.repair_system_image()
-                QMessageBox.information(self,self.trans("成功"),self.trans("修復系統檔案成功"),QMessageBox.Ok)
+                self.info_event("修復系統檔案成功")
         except Exception as e:
             self.bug_event(e)
 
@@ -976,9 +1011,7 @@ class MainWindow_Controller(QMainWindow):
                 for i in Permission:
                     try:
                         win32api.RegDeleteValue(key,i)
-                        self.proc.kill()
-                        file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截")
                     except:
                         pass
                 win32api.RegCloseKey(key)
@@ -996,12 +1029,12 @@ class MainWindow_Controller(QMainWindow):
 
     def clean_system(self):
         try:
-            if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要清理系統垃圾嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+            if self.question_event("您確定要清理系統垃圾嗎?"):
                 self.total_deleted_size = 0
                 self.traverse_temp(f"C:/Users/{os.getlogin()}/AppData/Local/Temp/")
                 self.traverse_temp(f"C:/Windows/Temp/")
                 self.traverse_temp(f"C:/$Recycle.Bin/")
-                QMessageBox.information(self,self.trans("成功"),self.trans(f"成功清理了 {self.total_deleted_size} 位元的系統垃圾"),QMessageBox.Ok)
+                self.info_event(f"成功清理了 {self.total_deleted_size} 位元的系統垃圾")
         except Exception as e:
             self.bug_event(e)
 
@@ -1023,44 +1056,44 @@ class MainWindow_Controller(QMainWindow):
         try:
             file = str(QFileDialog.getOpenFileName(self,self.trans("增加到白名單"),"C:/")[0]).replace("\\", "/")
             if file and file not in self.whitelist:
-                if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要增加到白名單嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+                if self.question_event("您確定要增加到白名單嗎?"):
                     self.whitelist.append(file)
                     with open("C:/ProgramData/PYAS/Whitelist.ini", "a+") as f:
                         f.write(f"{file}\n")
-                    QMessageBox.information(self,self.trans("成功"),self.trans(f"成功增加到白名單: ")+file,QMessageBox.Ok)
-            elif file and QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要取消增加到白名單嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+                    self.info_event(f"成功增加到白名單: "+file)
+            elif file and self.question_event("您確定要取消增加到白名單嗎?"):
                 self.whitelist.remove(file)
                 with open("C:/ProgramData/PYAS/Whitelist.ini", "w") as f:
                     for white_file in self.whitelist:
                         f.write(f'{white_file}\n')
-                QMessageBox.information(self,self.trans("成功"),self.trans(f"成功取消增加到白名單: ")+file,QMessageBox.Ok)
+                self.info_event(f"成功取消增加到白名單: "+file)
         except Exception as e:
             self.bug_event(e)
 
     def get_software_window(self):
         try:
             self.block_window = False
-            if QMessageBox.warning(self,self.trans("警告"),self.trans("請選擇要攔截的軟體彈窗"),QMessageBox.Yes|QMessageBox.No) == 16384:
+            if self.question_event("請選擇要攔截的軟體彈窗"):
                 while not self.block_window:
                     window_name = str(win32gui.GetWindowText(win32gui.GetForegroundWindow()))
                     QApplication.processEvents()
                     if window_name not in ["","PYAS",self.trans("警告")]:
                         if window_name not in self.blocklist:
-                            if QMessageBox.warning(self,self.trans("警告"),self.trans(f"您確定要攔截 {window_name} 嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+                            if self.question_event(f"您確定要攔截 {window_name} 嗎?"):
                                 self.blocklist.append(window_name)
                                 with open("C:/ProgramData/PYAS/Blocklist.ini", "a+") as f:
                                     f.write(f'{window_name}\n')
-                                QMessageBox.information(self,self.trans("成功"),self.trans(f"成功增加到彈窗攔截: ")+window_name,QMessageBox.Ok)
-                        elif QMessageBox.warning(self,self.trans("警告"),self.trans(f"您確定要取消攔截 {window_name} 嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+                                self.info_event(f"成功增加到彈窗攔截: "+window_name)
+                        elif self.question_event(f"您確定要取消攔截 {window_name} 嗎?"):
                             self.blocklist.remove(window_name)
                             with open("C:/ProgramData/PYAS/Blocklist.ini", "w") as f:
                                 for block_name in self.blocklist:
                                     f.write(f'{block_name}\n')
-                            QMessageBox.information(self,self.trans("成功"),self.trans(f"成功取消彈窗攔截: ")+window_name,QMessageBox.Ok)
+                            self.info_event(f"成功取消彈窗攔截: "+window_name)
                         self.block_window = True
             self.block_window_init()
         except Exception as e:
-            self.bug_event(e) 
+            self.bug_event(e)
 
     def block_window_init(self):
         self.block_window = True
@@ -1069,7 +1102,7 @@ class MainWindow_Controller(QMainWindow):
     def block_software_window(self):
         while self.block_window:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 for window_name in self.blocklist:
                     win32gui.PostMessage(win32gui.FindWindow(None, window_name), 274, 61536, 0)
             except:
@@ -1077,9 +1110,9 @@ class MainWindow_Controller(QMainWindow):
 
     def repair_network(self):
         try:
-            if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要修復系統網路嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+            if self.question_event("您確定要修復系統網路嗎?"):
                 os.system("netsh winsock reset")
-                if QMessageBox.warning(self,self.trans("警告"),self.trans("使用此選項需要重啟，您確定要重啟嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
+                if self.question_event("使用此選項需要重啟，您確定要重啟嗎?"):
                     os.system("shutdown -r -t 0")
         except Exception as e:
             self.bug_event(e)
@@ -1118,7 +1151,11 @@ class MainWindow_Controller(QMainWindow):
             if self.Process_popMenu.exec_(self.ui.Process_list.mapToGlobal(pos)) == self.kill_Process:
                 for p in psutil.process_iter():
                     if p.pid == self.pid:
-                        p.kill()
+                        file = p.exe().replace("\\", "/")
+                        if file == self.pyas:
+                            self.close()
+                        else:
+                            p.kill()
         except:
             pass
 
@@ -1198,81 +1235,99 @@ class MainWindow_Controller(QMainWindow):
             Thread(target=self.protect_net_thread, daemon=True).start()
 
     def protect_proc_thread(self):
-        existing_processes = set()
+        existing_process = set()
         for p in psutil.process_iter():
-            if p.pid not in existing_processes:
-                existing_processes.add(p.pid)
+            existing_process.add(p.pid)
         while self.proc_protect:
-            time.sleep(0.05)
+            time.sleep(0.01)
+            new_process = set()
             for p in psutil.process_iter():
+                new_process.add(p.pid)
+            for pid in new_process - existing_process:
                 try:
-                    if p.pid not in existing_processes:
-                        existing_processes.add(p.pid)
-                        name, file, cmd = p.name(), p.exe(), p.cmdline()
-                        if file != self.pyas and file not in self.whitelist:
-                            psutil.Process(p.pid).suspend()
-                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
-                                p.kill()
-                                file = str(cmd[-1].split("'")[-2]).replace("\\", "/")
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                                p.kill()
-                                file = str(" ".join(cmd[2:])).replace("\\", "/")
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
-                                p.kill()
-                                file = str(cmd[-1]).replace("\\", "/")
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif self.proc_scan(p.pid):
-                                p.kill()
-                                file = str(file).replace("\\", "/")
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif ":/Windows" not in file and self.sign_scan(file):
-                                self.proc = p
-                            psutil.Process(p.pid).resume()
-                            gc.collect()
+                    p = psutil.Process(pid)
+                    self.handle_new_process(p)
                 except:
                     pass
+            existing_process = new_process
+
+    def handle_new_process(self, p):
+        try:
+            name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+            if file != self.pyas and file not in self.whitelist:
+                self.lock_process(p, True)
+                if "powershell" in name and self.start_scan(cmd[-1].split("'")[-2]):
+                    self.kill_process(p, "惡意腳本攔截")
+                elif "cmd.exe" in name and self.start_scan(" ".join(cmd[2:])):
+                    self.kill_process(p, "惡意腳本攔截")
+                elif ":/Windows" in file and self.start_scan(cmd[-1]):
+                    self.kill_process(p, "惡意軟體攔截")
+                elif ":/Windows" not in file and self.proc_scan(p):
+                    self.kill_process(p, "惡意軟體攔截")
+                elif ":/Windows" not in file and self.sign_scan(file):
+                    self.proc = p
+                self.lock_process(p, False)
+        except:
+            self.lock_process(p, False)
+
+    def lock_process(self, p, lock):
+        try:
+            if lock:
+                psutil.Process(p.pid).suspend()
+            else:
+                psutil.Process(p.pid).resume()
+        except:
+            pass
+
+    def kill_process(self, parent, info):
+        try:
+            if psutil.pid_exists(parent.pid):
+                file = parent.exe().replace("\\", "/")
+                self.send_notify(self.trans(f"{info}: ")+file)
+                for child in parent.children(recursive=True):
+                    child.kill()
+                parent.kill()
+            self.proc = None
+        except:
+            pass
 
     def protect_file_thread(self):
-        hDir = win32file.CreateFile("C:/Users/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+        hDir = win32file.CreateFile("C:/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
         while self.file_protect:
             for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
                 try:
-                    fpath = str(f"C:/Users/{file}").replace("\\", "/")
-                    ftype = str(f".{full_path.split('.')[-1]}").lower()
-                    if action == 3 and ftype in slist and os.path.getsize(fpath) <= 20971520:
-                        if self.api_scan(fpath) or self.pe_scan(fpath):
-                            os.remove(fpath)
-                            self.send_notify(self.trans("惡意軟體刪除: ")+fpath)
+                    fpath = str(f"C:/{file}").replace("\\", "/")
+                    ftype = str(f".{fpath.split('.')[-1]}").lower()
+                    if action == 2 and ":/Users" in fpath and "/AppData/" not in fpath:
+                        file = self.proc.exe().replace("\\", "/")
+                        if ":/Program" not in file and ftype in alist:
+                            self.kill_process(self.proc, "勒索行為攔截")
+                    elif action == 3 and ":/Users" in fpath and "/AppData/" not in fpath:
+                        if os.path.getsize(fpath) <= 52428800 and ftype in slist:
+                            if self.start_scan(fpath):
+                                os.remove(fpath)
+                                self.send_notify(self.trans("惡意軟體刪除: ")+fpath)
                 except:
                     pass
 
     def protect_boot_thread(self):
-        with open(r"\\.\PhysicalDrive0", "r+b") as f:
-            self.mbr_value = f.read(512)
-        if self.mbr_value[510:512] != b'\x55\xAA':
-            self.mbr_value = False
         while self.mbr_protect and self.mbr_value:
             try:
-                time.sleep(0.5)
-                file = self.proc.exe().replace("\\", "/")
+                time.sleep(0.2)
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
-                        self.proc.kill()
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截")
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
-                        self.proc.kill()
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截")
             except:
-                pass
+                self.kill_process(self.proc, "惡意行為攔截")
 
     def protect_reg_thread(self):
         while self.reg_protect:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 self.repair_system_image()
                 self.repair_system_restrict()
                 self.repair_system_file_type()
@@ -1283,14 +1338,12 @@ class MainWindow_Controller(QMainWindow):
     def protect_net_thread(self):
         while self.net_protect:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 local = socket.gethostbyname(socket.gethostname())
                 for conn in self.proc.connections():
-                    file = self.proc.exe().replace("\\", "/")
-                    if ":/Windows" not in file and ":/Program" not in file:
+                    if "/AppData/" not in file and ":/Program" not in file:
                         if conn.laddr.ip == local:
-                            self.proc.kill()
-                            self.send_notify(self.trans("網路通訊攔截: ")+file)
+                            self.kill_process(self.proc, "網路通訊攔截")
             except:
                 pass
 

PYAS_Compress.py

@@ -1,31 +0,0 @@
-import json
-
-class ListCompressor:
-    def __init__(self):
-        self.model = {}
-
-    def save_model(self, file_name):
-        with open(file_name, 'w') as f:
-            json.dump(self.model, f)
-        print(f"\nModel Is Saved In {file_name}")
-
-    def load_model(self, model_data):
-        if isinstance(model_data, str):
-            with open(model_data, 'r') as f:
-                model_data = json.load(f)
-        self.model['word'] = model_data['word']
-        self.model.update(model_data)
-
-    def train_model(self, label, data):
-        if label not in self.model:
-            self.model[label] = []
-        unique_words = set([item for sublist in data for item in sublist])
-        self.model['word'] = {word: idx for idx, word in enumerate(unique_words)}
-        self.model[label].extend([[self.model['word'][item] for item in lst] for lst in data])
-
-    def predict(self, new_list):
-        new_list = [self.model['word'].get(item, 1) for item in new_list if item in self.model['word']]
-        for label, items in self.model.items():
-            if label != 'word' and new_list in items:
-                return label
-        return None

PYAS_Engine.py

@@ -0,0 +1,84 @@
+import time, json, hashlib, numpy
+from collections import Counter
+
+class ListSimHash:
+    def __init__(self):
+        self.model = {}
+
+    def save_model(self, file_name):
+        with open(file_name, 'w') as f:
+            json.dump(self.model, f)
+        print(f"\nModel Is Saved In {file_name}")
+
+    def load_model(self, model_data):
+        if isinstance(model_data, str):
+            with open(model_data, 'r') as f:
+                model_data = json.load(f)
+        self.model = model_data
+
+    def get_model(self, label):
+        return self.model[label]
+
+    def train_model(self, label, data):
+        start = time.time()
+        print(f"Convert {label}")
+        if label not in self.model:
+            self.model[label] = []
+        for i, x in enumerate(data, 1):
+            self.model[label].append(self.build_text(x))
+            used = "{0:.2f}".format(time.time()-start)
+            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
+            self.progress_bar(i, len(data), prefix, suffix)
+
+    def build_text(self, content):
+        sums, batch, count = [], [], 0
+        features = dict(Counter(sorted(content)))
+        for f, w in features.items():
+            count += w
+            batch.append(hashlib.md5(json.dumps(f).encode('utf-8')).digest() * w)
+            if len(batch) >= 10000:
+                sums.append(self.sum_hashes(batch))
+                batch = []
+        if batch:
+            sums.append(self.sum_hashes(batch))
+        combined_sums = numpy.sum(sums, 0)
+        v = numpy.packbits(combined_sums > count / 2).tobytes()
+        return int.from_bytes(v, 'big')
+
+    def sum_hashes(self, digests):
+        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
+        return numpy.sum(numpy.reshape(bitarray, (-1, 128)), 0)
+
+    def progress_bar(self, iteration, total, prefix='', suffix='', length=50, fill='█'):
+        percent = min(100.0, max(0.0, 100 * (iteration / float(total))))
+        end_char = '\n' if percent >= 100 else '\r'
+        percent_string = "{0:.2f}".format(percent)
+        filled_length = int(length * iteration // total)
+        bar = fill * filled_length + ' ' * (length - filled_length)
+        print(f'\r    {prefix: <10} |{bar}| {percent_string}% {suffix}', end=end_char)
+
+    def predict_all(self, query):
+        label_similarities = {}
+        query_hash = self.build_text(query)
+        for label in self.model:
+            max_similarity = 0
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity = similarity
+            label_similarities[label] = max_similarity
+        return label_similarities
+
+    def predict(self, query):
+        max_similarity, max_label = 0, None
+        query_hash = self.build_text(query)
+        for label in self.model:
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity, max_label = similarity, label
+        return max_label, max_similarity
+
+    def similar(self, x, y):
+        hamming_distance = bin(x ^ y).count('1')
+        return 1 - hamming_distance / 128

PYAS_Extension.py

@@ -5,5 +5,4 @@ alist = [".ppt",".pptx",".wps",".txt",".rtf",
          ".pdf",".xls",".xlsx",".doc",".docx",
          ".jpg",".jpeg",".png",".webp",".gif",
          ".mp3",".wav",".aac",".ogg",".flac",
-         ".mp4",".avi",".mov",".wmv",".mkv",
-         ".zip",".7z",".rar",".tar",".gz"]
+         ".mp4",".avi",".mov",".wmv",".mkv"]

PYAS_Language.py

@@ -15,17 +15,17 @@ translate_dict = {
               "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
               "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
               "強":"强","驅":"驱","為":"为","腳":"脚","增":"增","單":"单","開":"开",
-              "惡":"恶"},
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败"},
     "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
               "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website",
-              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索軟體":"Ransom ",
+              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索行為":"Ransom ",
               "惡意腳本":"Script ","惡意行為":"Behavior ","可疑軟體":"Suspicious ",
               "許可條款":"License Terms","惡意":"Malicious","可疑":"Suspicious",
               "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
               "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update",
+              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
               "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
-              "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom",
+              "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
               "測試人員":"Testers","版本資訊":"Information","通訊":"Communication ",
               "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
               "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
@@ -47,8 +47,8 @@ translate_dict = {
               "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
               "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
               "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
+              "已經是":"Already ","數據庫":"Database ","誤報":"False Positive ",
               "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
               "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
               "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
-              "密鑰":"Key ","檢測":"Detect ","誤報":"False Positive ","製作":"Make",
-              "  ":" "}}
+              "密鑰":"Key ","檢測":"Detect ","製作":"Make","  ":" "}}

PYAS_Model.json

@@ -0,0 +1 @@
+{"Unknown": [10199010580531108378153827424457992432, 20965212707052912989658218281213053170, 20963924773736013955013492889397430514, 20965222847950647661922877313293420786, 20963924773736089512877253988092938483, 10533913729454048551192748670221101302, 10497567570978277785165438149536581872, 230418814927598623996991522865620895293], "White": [126672244860282820431531292152154892541, 126555244512863767515621062938772454385, 78206639303253050193082960917406129821, 180439547362931620767428561827016696106, 96103515196312870469979178835907426963, 106202738889863580199047548478556282224, 260681472954591486442301293972682570259, 334352372173892944739362819086050576826, 270698534086324527574602815275595168743, 52278935817957542072232518657580445973, 99964490807793194121661552779445205157, 114471449979609419026325537602253303510, 170288120086869810213050150585452458992, 20129952829430162432875533418501193427, 266141180604311766657329911262256522695, 194231769680954789184967343915738715269, 137555894938392968938334822886799145665, 32033385634193095265531812355001705364, 110412723075988544148987035520371252041, 95564371670156926573557604030875376880, 95235309747885939408380636606625811569, 272762168699147334321583996672002378255, 95234011064914281942190040816173653105, 94471327154819245031506476509638106704, 95313696146069105288568328992515893493, 93984468150284189415663958982282127605, 191147052097100843670989027331488156725, 103210672664238242772979731817227685237, 56724333007221946388761990730009660128, 101562244577076015330628724737265682909, 97287175069805646577858533189449166301, 137063300177336245346774014048969161649, 316391968656924997605188916362257077459, 264287352948858755174876745019957203391, 127136776672701393662717729226704358773, 9912885994425979960261799249926495473, 214498205255495472884061693173662060219, 105039659248652423950583866198328679776, 106486519388821918892958052791862913681, 81533898116464931264738244322343722087, 127128973031678141900306064284785253496, 257976287344519798598519417614968543943, 95234579695571071996043856278635879538, 307531936139217865648235621101964847809, 205524205305644077365818951604097443015, 10082933643349790779259596715866791152, 105863211359421133420308580490619723120, 105536091507504387016141979202387910000, 115256152418524974755063297364983094641, 258226055192645594643924661804242821079, 184879672381654838626194080314169453584, 105909917863928976433791749005432917096, 34668429459089199253155684394504639701, 9333342038490638804353570140444499409, 49992947087053905927423189110869930637, 114390951894751980367497997972138956045, 40525380716593540848111929430426386129, 92531564279929657078344831661770634033, 137845158706024438551516917025209916775, 82711778578996712205456007623860083392, 142895363148849470268902285117702200512, 176210598858636561054489191954962668740, 133988075388031745460051108783604183680, 127463789261350104996635356465169505635, 98401956749501984262112138828559240544, 105619903475864025251671385889627380849, 194216192765620392180514937530431948487, 178730848644410936934440792379530771324, 258767967557372966404648755263173813716, 95568909833307793735851930883495894385, 105203216600314032187918420804040465776, 10160172324731669179270431009861737585, 95562338257159239457022778648277753201, 125705675445940363792857463789011840389, 105782103246308081595321955114562886777, 34490061240648476397849656073168201108, 337793686977585440073129666111702532467, 278253338747731733314329375842609871921, 204788843742030229839080201679229506773, 106117654063199359331238217293466812006, 123266687541636144245366511635599982231, 113845713591553304589832425329269218672, 102400300404095555238772811174816483363, 115752031916027952368786798048662461543, 205193551069866139019248248605938239445, 101437234347196055762008445071888009636, 148030553843923537774182040572301348817, 95562399131158503793285318098946563443, 144743835053038288880188325484490464627, 329456512868359962875761871381429648792, 214132526311861388081693372283346711315, 212807863125887894065170197859985748755, 90639505994802779364701320439314232445, 109312881611100283088661575235655027037, 268695571549372555579983860480753996530, 276556254823007156956265006607247855228, 158532724662396204460585683955318721251, 190236918274156159301867868769173894064, 115505281197039501762156314342977388146, 181151739907962908273686170106830254275, 103040304820632656358846714092274654455, 283839353929015376840553872262568182165, 126305356110326106528653817459839286387, 232772214119775911616044955505922667440, 267224571901232164108563912343781345315, 248870611769713486967773923305072182805, 94401261442397178213607895041941511616, 126697942675733486251713755064939650169, 52680527483000227468312744969526057584, 100468409853345213529992161170862574067, 195546595259106600444307572967932415185, 121396668310321681197001161772784753777, 102772203717048361679815565428970429489, 118636962645139146202043096156604144755, 130735009156835Line truncated

PYAS_Version.py

@@ -1,7 +1,8 @@
 import pyinstaller_versionfile
+
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.0.0',
+version='3.0.8',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,14 +1,20 @@
 # PYAS (Python Antivirus Software)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
 
-## File Function
+## Readme Language
+
+[繁體中文](https://github.com/zackzheng1121/PYAS/blob/main/README_zh.md)
+
+## File Information
 
 PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
 
+PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
+
 PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
 
-PYAS_Function*.7z -> Compress Database (need to use 7zip to decompress and put it in the same directory)
+PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
 
 PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
 
@@ -20,6 +26,8 @@ PYAS_Version.py -> Pyinstaller Info (file information, version information, orig
 
 ## Requirements
 
+Use pip install requirements to install import module
+
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -29,6 +37,123 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
+## Hash Scanning
+
+Use Qihoo 360 cloud service to scan known malicious files
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## Pefile Scanning
+
+Get the pefile file function import table for scanning
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## Process Detect
+
+Show the new process name, file path, cmd line, pid
+
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+                elif not psutil.pid_exists(p.pid):
+                    existing_processes.remove(p.pid)
+            except:
+                pass
+
+proc_detect()
+```
+
+## File Detect
+
+Monitor file changes under the specified path
+
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
 ## Official Website
 
 https://pyantivirus.wixsite.com/pyas
@@ -43,7 +168,9 @@ https://github.com/87owo/PYAS/blob/main/LICENSE.md
 
 Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
 
+Other systems may experience software malfunctions or crash
+
 ## Special Thanks
-360, Wix, VirusShare, mtkiao129, LenStevens, AV-T Team of LisectGroup
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo

README_zh.md

@@ -0,0 +1,167 @@
+# PYAS (Python 防毒軟體)
+
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+
+## 文件訊息
+
+PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
+
+PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
+
+PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
+
+PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
+
+PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
+
+PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
+
+PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
+
+PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
+
+## 要求
+
+使用 pip install requirements 來安裝需要的模組
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## 哈希掃描
+
+使用奇虎360雲端服務掃描已知惡意文件
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## 文件掃描
+
+取得pefile檔案函數導入表進行掃描
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## 進程偵測
+
+顯示新進程名稱、檔案路徑、cmd 行、pid
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+            except:
+                pass
+
+proc_detect()
+```
+
+## 檔案偵測
+
+監控指定路徑下的檔案變化
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## 官方網頁
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 開源許可證
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 支援的系統
+
+Windows 8.1, 10, 11 (64-bit),記憶體 1GB, 磁碟容量 1GB 或更高
+Other systems may experience software malfunctions or crash
+
+## Special Thanks
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo