Add files via upload

PYAS.py

@@ -19,14 +19,15 @@ class MainWindow_Controller(QMainWindow):
         self.setAttribute(Qt.WA_TranslucentBackground)
         self.setWindowFlags(Qt.FramelessWindowHint)
         self.pyas = str(sys.argv[0]).replace("\\", "/")
-        self.pyae_version = "2024-01-19"
-        self.pyas_version = "3.0.0"
+        self.pyae_version = "2024-01-23"
+        self.pyas_version = "3.0.1"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_show_pyas()
         self.init_data_base()
         self.init_read_json()
         self.init_tray_icon()
+        self.init_config_boot()
         self.init_config_json()
         self.init_config_list()
         self.init_config_qtui()
@@ -53,6 +54,15 @@ class MainWindow_Controller(QMainWindow):
         self.tray_icon.activated.connect(self.init_show_pyas)
         self.tray_icon.show()
 
+    def init_config_boot(self):
+        try:
+            with open(r"\\.\PhysicalDrive0", "r+b") as f:
+                self.mbr_value = f.read(512)
+            if self.mbr_value[510:512] != b'\x55\xAA':
+                self.mbr_value = False
+        except:
+            self.mbr_value = False
+
     def write_config(self, config):
         try:
             with open("C:/ProgramData/PYAS/PYAS.json", "w") as f:
@@ -328,6 +338,7 @@ class MainWindow_Controller(QMainWindow):
                 self.ui.State_icon.setPixmap(QPixmap(file))
         except:
             self.ui.Theme_White.setChecked(True)
+            self.ui.State_icon.setPixmap(QPixmap(":/icon/Check.png"))
             self.ui.Window_widget.setStyleSheet("QWidget#Window_widget {background-color:rgb(240,240,240);}")
             self.ui.Navigation_Bar.setStyleSheet("QWidget#Navigation_Bar {background-color:rgb(230,230,230);}")
 
@@ -397,7 +408,7 @@ class MainWindow_Controller(QMainWindow):
 
     def timeout(self):
         if self.opacity.i <= 1:
-            self.opacity.i += 0.03
+            self.opacity.i += 0.05
             self.opacity.setOpacity(self.opacity.i)
         else:
             self.timer.stop()
@@ -544,7 +555,7 @@ class MainWindow_Controller(QMainWindow):
     def init_show_pyas(self):
         def update_opacity():
             if self.pyas_opacity <= 100:
-                self.pyas_opacity += 1
+                self.pyas_opacity += 2
                 self.setWindowOpacity(self.pyas_opacity/100)
             else:
                 self.timer.stop()
@@ -557,7 +568,7 @@ class MainWindow_Controller(QMainWindow):
     def init_hide_pyas(self):
         def update_opacity():
             if self.pyas_opacity >= 0:
-                self.pyas_opacity -= 1
+                self.pyas_opacity -= 2
                 self.setWindowOpacity(self.pyas_opacity/100)
             else:
                 self.timer.stop()
@@ -1208,24 +1219,23 @@ class MainWindow_Controller(QMainWindow):
                 try:
                     if p.pid not in existing_processes:
                         existing_processes.add(p.pid)
-                        name, file, cmd = p.name(), p.exe(), p.cmdline()
+                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
                         if file != self.pyas and file not in self.whitelist:
                             psutil.Process(p.pid).suspend()
                             if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
                                 p.kill()
-                                file = str(cmd[-1].split("'")[-2]).replace("\\", "/")
+                                file = cmd[-1].split("'")[-2].replace("\\", "/")
                                 self.send_notify(self.trans("惡意腳本攔截: ")+file)
                             elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
                                 p.kill()
-                                file = str(" ".join(cmd[2:])).replace("\\", "/")
+                                file = " ".join(cmd[2:]).replace("\\", "/")
                                 self.send_notify(self.trans("惡意腳本攔截: ")+file)
                             elif ":/Windows" in file and self.api_scan(cmd[-1]):
                                 p.kill()
-                                file = str(cmd[-1]).replace("\\", "/")
+                                file = cmd[-1].replace("\\", "/")
                                 self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif self.proc_scan(p.pid):
+                            elif ":/Windows" not in file and self.proc_scan(p.pid):
                                 p.kill()
-                                file = str(file).replace("\\", "/")
                                 self.send_notify(self.trans("惡意軟體攔截: ")+file)
                             elif ":/Windows" not in file and self.sign_scan(file):
                                 self.proc = p
@@ -1240,7 +1250,7 @@ class MainWindow_Controller(QMainWindow):
             for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
                 try:
                     fpath = str(f"C:/Users/{file}").replace("\\", "/")
-                    ftype = str(f".{full_path.split('.')[-1]}").lower()
+                    ftype = str(f".{fpath.split('.')[-1]}").lower()
                     if action == 3 and ftype in slist and os.path.getsize(fpath) <= 20971520:
                         if self.api_scan(fpath) or self.pe_scan(fpath):
                             os.remove(fpath)
@@ -1249,22 +1259,19 @@ class MainWindow_Controller(QMainWindow):
                     pass
 
     def protect_boot_thread(self):
-        with open(r"\\.\PhysicalDrive0", "r+b") as f:
-            self.mbr_value = f.read(512)
-        if self.mbr_value[510:512] != b'\x55\xAA':
-            self.mbr_value = False
         while self.mbr_protect and self.mbr_value:
             try:
                 time.sleep(0.5)
-                file = self.proc.exe().replace("\\", "/")
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
                         self.proc.kill()
+                        file = self.proc.exe().replace("\\", "/")
                         self.send_notify(self.trans("惡意行為攔截: ")+file)
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
                         self.proc.kill()
+                        file = self.proc.exe().replace("\\", "/")
                         self.send_notify(self.trans("惡意行為攔截: ")+file)
             except:
                 pass

PYAS_Version.py

@@ -1,7 +1,7 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.0.0',
+version='3.0.1',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -2,13 +2,15 @@
 
 ![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
 
-## File Function
+## File Information
 
 PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
 
+PYAS_Compress.py -> Conversion Database (used to convert database dict and list to and from each other)
+
 PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
 
-PYAS_Function*.7z -> Compress Database (need to use 7zip to decompress and put it in the same directory)
+PYAS_Function.* -> Compress Database (need to use zip to decompress and put it in the same directory)
 
 PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
 
@@ -20,6 +22,8 @@ PYAS_Version.py -> Pyinstaller Info (file information, version information, orig
 
 ## Requirements
 
+Use pip install requirements to install import module
+
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -29,6 +33,121 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
+## Hash Scanning
+
+Use Qihoo 360 cloud service to scan known malicious files
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## Pefile Scanning
+
+Get the pefile file function import table for scanning
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## Process Detect
+
+Show the new process name, file path, cmd line, pid
+
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+            except:
+                pass
+
+proc_detect()
+```
+
+## File Detect
+
+Monitor file changes under the specified path
+
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
 ## Official Website
 
 https://pyantivirus.wixsite.com/pyas
@@ -43,7 +162,9 @@ https://github.com/87owo/PYAS/blob/main/LICENSE.md
 
 Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
 
+Other systems may experience software malfunctions or crash
+
 ## Special Thanks
-360, Wix, VirusShare, mtkiao129, LenStevens, AV-T Team of LisectGroup
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo