Add files via upload

增加中文

PYAS.py

@@ -1,10 +1,9 @@
-import os, gc, sys, time, json, psutil
-import hashlib, pefile, socket, msvcrt
-import xml.etree.ElementTree as xmlet
-import requests, pyperclip, win32file
+import os, gc, sys, time, json, yara
+import requests, pefile, socket, msvcrt
+import pyperclip, win32file, psutil
 import win32gui, win32api, win32con
+from PYAS_Engine import ListSimHash
 from PYAS_Extension import slist, alist
-from PYAS_Compress import ListCompressor
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
 from threading import Thread
@@ -19,11 +18,12 @@ class MainWindow_Controller(QMainWindow):
         self.setWindowFlags(Qt.FramelessWindowHint)
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
-        self.pyae_version = "0000-00-00"
-        self.pyas_version = "3.0.2"
+        self.pyae_version = "Fusion Engine"
+        self.pyas_version = "3.0.9"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
-        self.init_show_pyas()
+        self.init_startup()
+        self.init_rule_dict()
         self.init_data_base()
         self.init_read_json()
         self.init_tray_icon()
@@ -50,13 +50,41 @@ class MainWindow_Controller(QMainWindow):
         self.tray_icon.activated.connect(self.init_show_pyas)
         self.tray_icon.show()
 
+    def init_startup(self):
+        try:
+            if len(sys.argv) > 1:
+                param = sys.argv[1]
+                if "h" in param or "hid" in param:
+                    pass
+                else:
+                    self.init_show_pyas()
+            elif len(sys.argv) <= 1:
+                self.init_show_pyas()
+        except Exception as e:
+            self.bug_event(e)
+
     def init_data_base(self):
         try:
-            file_path = os.path.join(self.dir, "PYAS_Function.vdb")
+            file_path = os.path.join(self.dir, "PYAS_Model.json")
             if os.path.exists(file_path):
-                self.pe = ListCompressor()
+                self.pe = ListSimHash()
                 self.pe.load_model(file_path)
-                self.pyae_version = self.pe.get_label()
+        except Exception as e:
+            self.bug_event(e)
+
+    def init_rule_dict(self):
+        try:
+            self.compiled_rules = {}
+            file_path = os.path.join(self.dir, "Rules")
+            for root, dirs, files in os.walk(file_path):
+                for file in files:
+                    yara_path = os.path.join(root, file)
+                    ftype = str(f".{file.split('.')[-1]}").lower()
+                    if ftype in [".yara", ".yar"]:
+                        rules = yara.compile(yara_path)
+                    elif ftype in [".yc", ".yrc"]:
+                        rules = yara.load(yara_path)
+                    self.compiled_rules[yara_path] = rules
         except Exception as e:
             self.bug_event(e)
 
@@ -293,8 +321,8 @@ class MainWindow_Controller(QMainWindow):
         self.ui.high_sensitivity_title.setText(self.trans("高靈敏度模式"))
         self.ui.high_sensitivity_illustrate.setText(self.trans("啟用此選項可以提高引擎的靈敏度"))
         self.ui.high_sensitivity_switch_Button.setText(self.trans(self.ui.high_sensitivity_switch_Button.text()))
-        self.ui.cloud_services_title.setText(self.trans("雲端掃描服務"))
-        self.ui.cloud_services_illustrate.setText(self.trans("啟用此選項可以連接雲端掃描服務"))
+        self.ui.cloud_services_title.setText(self.trans("雲端上報服務"))
+        self.ui.cloud_services_illustrate.setText(self.trans("啟用此選項可以自動上報雲端分析"))
         self.ui.cloud_services_switch_Button.setText(self.trans(self.ui.cloud_services_switch_Button.text()))
         self.ui.Add_White_list_title.setText(self.trans("增加到白名單"))
         self.ui.Add_White_list_illustrate.setText(self.trans("此選項可以選擇檔案並增加到白名單"))
@@ -565,8 +593,8 @@ class MainWindow_Controller(QMainWindow):
                 self.setWindowOpacity(self.pyas_opacity/100)
             else:
                 self.timer.stop()
-        self.show()
         self.pyas_opacity = 0
+        self.show()
         self.timer = QTimer()
         self.timer.timeout.connect(update_opacity)
         self.timer.start(2)
@@ -590,6 +618,12 @@ class MainWindow_Controller(QMainWindow):
 
     def closeEvent(self, event):
         if self.question_event("您確定要退出 PYAS 和所有防護嗎?"):
+            self.block_window = False
+            self.proc_protect = False
+            self.file_protect = False
+            self.mbr_protect = False
+            self.reg_protect = False
+            self.net_protect = False
             self.virus_scan_break()
             event.accept()
         else:
@@ -625,22 +659,6 @@ class MainWindow_Controller(QMainWindow):
         except:
             pass
 
-    def update_database(self):
-        try:
-            if self.question_event("您確定要更新數據庫嗎?"):
-                file_path = os.path.join(self.dir, "PYAS_Function.vdb")
-                response = requests.get('http://27.147.30.238:5001/database', params={"version": self.pyae_version}, timeout=5)
-                if response.status_code == 200:
-                    with open(file_path, 'wb') as f:
-                        f.write(response.content)
-                    self.init_data_base()
-                    self.init_lang_text()
-                    self.info_event(f"數據庫更新成功: {self.pyae_version}")
-                elif response.status_code == 204:
-                    self.info_event(f"數據庫已經是最新: {self.pyae_version}")
-        except Exception as e:
-            self.bug_event(e)
-
     def show_menu(self):
         self.WindowMenu = QMenu()
         Main_Settings = QAction(self.trans("設定"),self)
@@ -668,6 +686,34 @@ class MainWindow_Controller(QMainWindow):
         if Qusetion == Main_Update:
             self.update_database()
 
+    def update_database(self):
+        try:
+            if self.question_event("您確定要更新數據庫嗎?"):
+                params = {"version": self.pyas_version}
+                file_path = os.path.join(self.dir, "PYAS_Model.json")
+                response = requests.get('http://27.147.30.238:5001/model', params=params)
+                if response.status_code == 200:
+                    with open(file_path, 'wb') as f:
+                        f.write(response.content)
+                    self.init_data_base()
+                    self.init_lang_text()
+                    self.info_event(f"數據庫更新成功: PYAS_Model.json")
+                else:
+                    self.bug_event(response.status_code)
+        except Exception as e:
+            self.bug_event(e)
+
+    def report_file(self, file):
+        try:
+            if self.json["cloud_services"] and os.path.getsize(file) <= 209715200:
+                files = {'file': open(file, 'rb')}
+                response = requests.post('http://27.147.30.238:5001/report', files=files)
+                if response.status_code == 200:
+                    return True
+            return False
+        except:
+            return False
+
     def change_sensitive(self):
         sw_state = self.ui.high_sensitivity_switch_Button.text()
         if sw_state == self.trans("已開啟"):
@@ -706,7 +752,7 @@ class MainWindow_Controller(QMainWindow):
             QApplication.processEvents()
             try:
                 for file in self.virus_list:
-                    self.unlock_file(file)
+                    self.lock_file(file, False)
             except:
                 pass
             self.scan_file = True
@@ -733,17 +779,14 @@ class MainWindow_Controller(QMainWindow):
         copyPath.triggered.connect(lambda: copyPathFunc())
         menu.exec_(self.ui.Virus_Scan_output.mapToGlobal(point))
 
-    def lock_file(self, file):
+    def lock_file(self, file, lock):
         try:
-            self.virus_lock[file] = os.open(file, os.O_RDWR)
-            msvcrt.locking(self.virus_lock[file], msvcrt.LK_NBLCK, 0)
-        except:
-            pass
-
-    def unlock_file(self, file):
-        try:
-            msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
-            os.close(self.virus_lock[file])
+            if lock:
+                self.virus_lock[file] = os.open(file, os.O_RDWR)
+                msvcrt.locking(self.virus_lock[file], msvcrt.LK_NBLCK, 0)
+            else:
+                msvcrt.locking(self.virus_lock[file], msvcrt.LK_UNLCK, 0)
+                os.close(self.virus_lock[file])
         except:
             pass
 
@@ -755,10 +798,10 @@ class MainWindow_Controller(QMainWindow):
                     if self.ui.Virus_Scan_output.findItems(file, Qt.MatchContains)[0].checkState() == Qt.Checked:
                         self.ui.Virus_Scan_text.setText(self.trans("正在刪除: ")+file)
                         QApplication.processEvents()
-                        self.unlock_file(file)
+                        self.lock_file(file, False)
                         os.remove(file)
                     else:
-                        self.unlock_file(file)
+                        self.lock_file(file, False)
                 except:
                     continue
             self.virus_lock = {}
@@ -771,14 +814,15 @@ class MainWindow_Controller(QMainWindow):
 
     def write_scan(self, state, file):
         try:
-            self.lock_file(file)
-            self.virus_list.append(file)
-            self.virus_list_ui.append(f"[{state}] {file}")
-            item = QListWidgetItem()
-            item.setText(f"[{state}] {file}")
-            item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
-            item.setCheckState(Qt.Checked)
-            self.ui.Virus_Scan_output.addItem(item)
+            if state and file:
+                self.lock_file(file, True)
+                self.virus_list.append(file)
+                self.virus_list_ui.append(f"[{state}] {file}")
+                item = QListWidgetItem()
+                item.setText(f"[{state}] {file}")
+                item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
+                item.setCheckState(Qt.Checked)
+                self.ui.Virus_Scan_output.addItem(item)
         except:
             pass
 
@@ -814,9 +858,9 @@ class MainWindow_Controller(QMainWindow):
     def file_scan(self):
         try:
             file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
-            if file and file not in self.whitelist:
+            if file and file not in self.whitelist and file != self.pyas:
                 self.init_scan()
-                self.start_scan(file)
+                self.write_scan(self.start_scan(file),file)
                 self.answer_scan()
         except Exception as e:
             self.bug_event(e)
@@ -844,59 +888,40 @@ class MainWindow_Controller(QMainWindow):
             self.bug_event(e)
             self.virus_scan_break()
 
-    def start_scan(self, file):
-        try:
-            file_type = str(f".{file.split('.')[-1]}").lower()
-            if self.json["high_sensitive"] and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-            elif file_type in slist and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-        except:
-            pass
-
     def traverse_path(self,path):
         for fd in os.listdir(path):
             try:
                 file = str(os.path.join(path,fd)).replace("\\", "/")
                 if self.scan_file == False:
                     break
-                elif ":/Windows" in file:
-                    continue
                 elif os.path.isdir(file):
                     self.traverse_path(file)
-                elif file not in self.whitelist:
+                elif file not in self.whitelist and file != self.pyas:
                     self.ui.Virus_Scan_text.setText(self.trans(f"正在掃描: ")+file)
                     QApplication.processEvents()
-                    self.start_scan(file)
+                    self.write_scan(self.start_scan(file),file)
                 gc.collect()
             except:
                 pass
 
-    def api_scan(self, file):
+    def start_scan(self, file):
         try:
-            if self.json["cloud_services"] == 1:
-                with open(file, "rb") as f:
-                    text = str(hashlib.md5(f.read()).hexdigest())
-                strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
-                response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=5)
-                return response.status_code == 200 and float(xmlet.fromstring(response.text).find('.//e_level').text) > 50
+            Thread(target=self.report_file, args=(file,)).start()
+            label, level = self.pe_scan(file)
+            if label and "Unknown" in label:
+                if self.json["high_sensitive"]:
+                    return label
+            elif label and "White" not in label:
+                if level and level >= 0.9:
+                    return label
+                elif self.json["high_sensitive"]:
+                    return label
+            elif self.rule_scan(file):
+                return "Rules"
             return False
         except:
             return False
 
-    def sign_scan(self, file):
-        try:
-            with pefile.PE(file, fast_load=True) as pe:
-                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
-        except:
-            return True
-
     def pe_scan(self, file):
         try:
             fn = []
@@ -907,20 +932,37 @@ class MainWindow_Controller(QMainWindow):
                             fn.append(str(func.name, "utf-8"))
                         except:
                             pass
-            if self.json["high_sensitive"]:
-                return self.pe.predict(fn)
-            elif "_CorExeMain" not in fn:
-                return self.pe.predict(fn)
+            QApplication.processEvents()
+            label, level = self.pe.predict(fn)
+            return label, int(level*100)
+        except:
+            return False, False
+
+    def sign_scan(self, file):
+        try:
+            with pefile.PE(file, fast_load=True) as pe:
+                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+        except:
+            return True
+
+    def rule_scan(self, file):
+        try:
+            with open(file, "rb") as f:
+                data = f.read()
+            for name, rules in self.compiled_rules.items():
+                QApplication.processEvents()
+                if rules.match(data=data):
+                    return True
             return False
         except:
             return False
 
-    def proc_scan(self, pid):
+    def proc_scan(self, p):
         try:
-            for entry in psutil.Process(pid).memory_maps():
+            for entry in p.memory_maps():
                 file = entry.path.replace("\\", "/")
                 if ":/Windows" not in file and ":/Program" not in file:
-                    if self.api_scan(file) or self.pe_scan(file):
+                    if self.start_scan(file):
                         return True
             return False
         except:
@@ -1027,9 +1069,7 @@ class MainWindow_Controller(QMainWindow):
                 for i in Permission:
                     try:
                         win32api.RegDeleteValue(key,i)
-                        self.proc.kill()
-                        file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截")
                     except:
                         pass
                 win32api.RegCloseKey(key)
@@ -1111,7 +1151,7 @@ class MainWindow_Controller(QMainWindow):
                         self.block_window = True
             self.block_window_init()
         except Exception as e:
-            self.bug_event(e) 
+            self.bug_event(e)
 
     def block_window_init(self):
         self.block_window = True
@@ -1120,7 +1160,7 @@ class MainWindow_Controller(QMainWindow):
     def block_software_window(self):
         while self.block_window:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 for window_name in self.blocklist:
                     win32gui.PostMessage(win32gui.FindWindow(None, window_name), 274, 61536, 0)
             except:
@@ -1169,7 +1209,11 @@ class MainWindow_Controller(QMainWindow):
             if self.Process_popMenu.exec_(self.ui.Process_list.mapToGlobal(pos)) == self.kill_Process:
                 for p in psutil.process_iter():
                     if p.pid == self.pid:
-                        p.kill()
+                        file = p.exe().replace("\\", "/")
+                        if file == self.pyas:
+                            self.close()
+                        else:
+                            p.kill()
         except:
             pass
 
@@ -1249,77 +1293,101 @@ class MainWindow_Controller(QMainWindow):
             Thread(target=self.protect_net_thread, daemon=True).start()
 
     def protect_proc_thread(self):
-        existing_processes = set()
+        self.proc = None
+        existing_process = set()
         for p in psutil.process_iter():
-            if p.pid not in existing_processes:
-                existing_processes.add(p.pid)
+            existing_process.add(p.pid)
         while self.proc_protect:
             time.sleep(0.01)
+            new_process = set()
             for p in psutil.process_iter():
+                new_process.add(p.pid)
+            for pid in new_process - existing_process:
                 try:
-                    if p.pid not in existing_processes:
-                        existing_processes.add(p.pid)
-                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                        if file != self.pyas and file not in self.whitelist:
-                            psutil.Process(p.pid).suspend()
-                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
-                                p.kill()
-                                file = cmd[-1].split("'")[-2].replace("\\", "/")
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                                p.kill()
-                                file = " ".join(cmd[2:]).replace("\\", "/")
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
-                                p.kill()
-                                file = cmd[-1].replace("\\", "/")
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif ":/Windows" not in file and self.proc_scan(p.pid):
-                                p.kill()
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif ":/Windows" not in file and self.sign_scan(file):
-                                self.proc = p
-                            psutil.Process(p.pid).resume()
-                            gc.collect()
+                    p = psutil.Process(pid)
+                    self.handle_new_process(p)
                 except:
                     pass
+            existing_process = new_process
+
+    def handle_new_process(self, p):
+        try:
+            name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+            if file != self.pyas and file not in self.whitelist:
+                self.lock_process(p, True)
+                if "powershell" in name and self.start_scan(cmd[-1].split("'")[-2]):
+                    self.kill_process(p, "惡意腳本攔截")
+                elif "cmd.exe" in name and self.start_scan(" ".join(cmd[2:])):
+                    self.kill_process(p, "惡意腳本攔截")
+                elif ":/Windows" in file and self.start_scan(cmd[-1]):
+                    self.kill_process(p, "惡意軟體攔截")
+                elif ":/Windows" not in file and self.proc_scan(p):
+                    self.kill_process(p, "惡意軟體攔截")
+                elif ":/Windows" not in file and self.sign_scan(file):
+                    self.proc = p
+                self.lock_process(p, False)
+                gc.collect()
+        except:
+            self.lock_process(p, False)
+
+    def lock_process(self, p, lock):
+        try:
+            if lock:
+                p.suspend()
+            else:
+                p.resume()
+        except:
+            pass
+
+    def kill_process(self, p, info):
+        try:
+            if p.is_running():
+                file = p.exe().replace("\\", "/")
+                self.send_notify(self.trans(f"{info}: ")+file)
+                for child in p.children(recursive=True):
+                    child.kill()
+                p.kill()
+            self.proc = None
+        except:
+            pass
 
     def protect_file_thread(self):
-        hDir = win32file.CreateFile("C:/Users/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+        hDir = win32file.CreateFile("C:/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
         while self.file_protect:
             for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
                 try:
-                    fpath = str(f"C:/Users/{file}").replace("\\", "/")
+                    fpath = str(f"C:/{file}").replace("\\", "/")
                     ftype = str(f".{fpath.split('.')[-1]}").lower()
-                    if action == 3 and ftype in slist and os.path.getsize(fpath) <= 20971520:
-                        if self.api_scan(fpath) or self.pe_scan(fpath):
-                            os.remove(fpath)
-                            self.send_notify(self.trans("惡意軟體刪除: ")+fpath)
+                    if action == 2 and ":/Users" in fpath and "/AppData/" not in fpath:
+                        file = self.proc.exe().replace("\\", "/")
+                        if ":/Program" not in file and ftype in alist:
+                            self.kill_process(self.proc, "勒索行為攔截")
+                    elif action == 3 and ":/Users" in fpath and "/AppData/" not in fpath:
+                        if os.path.getsize(fpath) <= 52428800 and ftype in slist:
+                            if self.start_scan(fpath):
+                                os.remove(fpath)
+                                self.send_notify(self.trans("惡意軟體刪除: ")+fpath)
                 except:
                     pass
 
     def protect_boot_thread(self):
         while self.mbr_protect and self.mbr_value:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
-                        self.proc.kill()
-                        file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截")
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
-                        self.proc.kill()
-                        file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截")
             except:
-                pass
+                self.kill_process(self.proc, "惡意行為攔截")
 
     def protect_reg_thread(self):
         while self.reg_protect:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 self.repair_system_image()
                 self.repair_system_restrict()
                 self.repair_system_file_type()
@@ -1330,14 +1398,12 @@ class MainWindow_Controller(QMainWindow):
     def protect_net_thread(self):
         while self.net_protect:
             try:
-                time.sleep(0.5)
+                time.sleep(0.2)
                 local = socket.gethostbyname(socket.gethostname())
                 for conn in self.proc.connections():
-                    file = self.proc.exe().replace("\\", "/")
-                    if ":/Windows" not in file and ":/Program" not in file:
+                    if "/AppData/" not in file and ":/Program" not in file:
                         if conn.laddr.ip == local:
-                            self.proc.kill()
-                            self.send_notify(self.trans("網路通訊攔截: ")+file)
+                            self.kill_process(self.proc, "網路通訊攔截")
             except:
                 pass
 

PYAS_Compress.py

@@ -1,31 +0,0 @@
-import json, hashlib
-
-class ListCompressor:
-    def __init__(self):
-        self.model = {}
-
-    def save_model(self, file_name):
-        with open(file_name, 'w') as f:
-            json.dump(self.model, f)
-        print(f"\nModel Is Saved In {file_name}")
-
-    def load_model(self, model_data):
-        if isinstance(model_data, str):
-            with open(model_data, 'r') as f:
-                model_data = json.load(f)
-        self.model = model_data
-
-    def train_model(self, label, data):
-        if label not in self.model:
-            self.model[label] = []
-        for lst in data:
-            self.model[label].append(hashlib.md5(''.join(map(str, lst)).encode()).hexdigest()[:8])
-
-    def predict(self, new_list):
-        for label, items in self.model.items():
-            if label != 'word' and hashlib.md5(''.join(map(str, new_list)).encode()).hexdigest()[:8] in items:
-                return True
-        return False
-
-    def get_label(self):
-        return list(self.model.keys())[0]

PYAS_Engine.py

@@ -0,0 +1,84 @@
+import time, json, hashlib, numpy
+from collections import Counter
+
+class ListSimHash:
+    def __init__(self):
+        self.model = {}
+
+    def save_model(self, file_name):
+        with open(file_name, 'w') as f:
+            json.dump(self.model, f)
+        print(f"\nModel Is Saved In {file_name}")
+
+    def load_model(self, model_data):
+        if isinstance(model_data, str):
+            with open(model_data, 'r') as f:
+                model_data = json.load(f)
+        self.model = model_data
+
+    def get_model(self, label):
+        return self.model[label]
+
+    def train_model(self, label, data):
+        start = time.time()
+        print(f"Convert {label}")
+        if label not in self.model:
+            self.model[label] = []
+        for i, x in enumerate(data, 1):
+            self.model[label].append(self.build_text(x))
+            used = "{0:.2f}".format(time.time()-start)
+            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
+            self.progress_bar(i, len(data), prefix, suffix)
+
+    def build_text(self, content):
+        sums, batch, count = [], [], 0
+        features = dict(Counter(sorted(content)))
+        for f, w in features.items():
+            count += w
+            batch.append(hashlib.sha256(json.dumps(f).encode('utf-8')).digest() * w)
+            if len(batch) >= 10000:
+                sums.append(self.sum_hashes(batch))
+                batch = []
+        if batch:
+            sums.append(self.sum_hashes(batch))
+        combined_sums = numpy.sum(sums, 0)
+        v = numpy.packbits(combined_sums > count / 2).tobytes()
+        return int.from_bytes(v, 'big')
+
+    def sum_hashes(self, digests):
+        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
+        return numpy.sum(numpy.reshape(bitarray, (-1, 256)), 0)
+
+    def progress_bar(self, iteration, total, prefix='', suffix='', length=50, fill='█'):
+        percent = min(100.0, max(0.0, 100 * (iteration / float(total))))
+        end_char = '\n' if percent >= 100 else '\r'
+        percent_string = "{0:.2f}".format(percent)
+        filled_length = int(length * iteration // total)
+        bar = fill * filled_length + ' ' * (length - filled_length)
+        print(f'\r    {prefix: <10} |{bar}| {percent_string}% {suffix}', end=end_char)
+
+    def predict_all(self, query):
+        label_similarities = {}
+        query_hash = self.build_text(query)
+        for label in self.model:
+            max_similarity = 0
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity = similarity
+            label_similarities[label] = max_similarity
+        return label_similarities
+
+    def predict(self, query):
+        max_similarity, max_label = 0, None
+        query_hash = self.build_text(query)
+        for label in self.model:
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity, max_label = similarity, label
+        return max_label, max_similarity
+
+    def similar(self, x, y):
+        hamming_distance = bin(x ^ y).count('1')
+        return 1 - hamming_distance / 256

PYAS_Extension.py

@@ -5,5 +5,4 @@ alist = [".ppt",".pptx",".wps",".txt",".rtf",
          ".pdf",".xls",".xlsx",".doc",".docx",
          ".jpg",".jpeg",".png",".webp",".gif",
          ".mp3",".wav",".aac",".ogg",".flac",
-         ".mp4",".avi",".mov",".wmv",".mkv",
-         ".zip",".7z",".rar",".tar",".gz"]
+         ".mp4",".avi",".mov",".wmv",".mkv"]

PYAS_Function.vdb

@@ -1 +0,0 @@
-{"2024-01-30 18:57:47": ["f8eaca69", "f0f5732f", "1b02d2da", "9b83055e", "fa39258e", "ebad499a", "7e7275ce", "f9f96fde", "dc2bd521", "2e3086b1", "4cbbe367", "62a39640", "628691a4", "7feb71ad", "c8756155", "724103b9", "21bb3aef", "8b136daa", "d2668208", "5e47ce27", "55e78944", "ec90753b", "cb9e21ee", "55634643", "d1ad686f", "319e2db4", "632f4531", "ecf51f02", "57b1794e", "cf04dfb7", "68b4c29f", "776c99fe", "bafe8409", "07483ddf", "e4753bc3", "86f8c21f", "c069d7d5", "0513868a", "55433105", "a51343e5", "5dd1e0c9", "8b6a35fc", "b2c4204c", "736a55d1", "0e2d378e", "221b87e3", "62a348cf", "1f53d69f", "ac0b27eb", "bee130c7", "00b0d86d", "f1dc8325", "d1e142b8", "87074aa5", "2bd013a0", "d2528b9e", "d90657b4", "b16889df", "c21af82e", "e81da5d7", "0ae06db8", "a072f779", "6c48e028", "acf0fbaa", "846a7177", "97be1e02", "94c2d42c", "e1240e10", "ee0a9c21", "0facf2a6", "2beae172", "39ae5ad7", "6a0c7324", "f074f5b4", "e952305f", "c969fd9d", "9af5a01e", "14688765", "596a470f", "94691d9a", "f30de2e7", "191f1163", "bdcb5a86", "18b3bf16", "30739d24", "e91746a4", "36888e71", "e26dfd80", "d8261ac3", "1a5cb45a", "23191f29", "20cb7eec", "94497ba5", "ce095672", "acf3bb61", "94bff605", "aea0475c", "b6a46047", "f1ae2ce5", "f25e7c70", "4c626e62", "d4da4030", "35eeb9fc", "010bd7e6", "088b5c3d", "4e552f39", "234f232b", "be39b5c7", "4d57d439", "3efc231b", "e3e0254f", "cf88078b", "957e7561", "0157ab1a", "6d75bcaa", "fdf069cb", "a1895d33", "aebc3614", "43d61eab", "967929f9", "11b631fb", "fbe63639", "0593e9a2", "c838e850", "a33c2ab4", "fa8ceeae", "71fa160a", "05178537", "f1bde64f", "30547b8f", "7fe931dd", "5dea0cda", "af0d6ebb", "f242ebc1", "ef2ac9f8", "09082309", "85a4b8a4", "65284f49", "cf215013", "6be2182a", "39d583d4", "e65f4785", "3cbb09cf", "73b78451", "61099a43", "1fe35f2e", "690b5995", "19d85999", "fcaa2063", "522ec9f6", "dfea1c9a", "1e54fc8c", "3d19c3b6", "13102764", "f0949aca", "7782a5e0", "a141f55e", "16eb1d17", "f14e284b", "3c36ae8e", "44349994", "0077b966", "8d8e66bb", "26dbaaa7", "69134125", "6be14646", "d4afaff6", "10c1954f", "07687215", "18b6668e", "295e94f1", "4beef072", "15bbc35a", "833b1998", "b81c15eb", "d0c36eb5", "30ff5635", "23edb694", "b5f2dd11", "9542f014", "2ba7934b", "8ac3e370", "be5348af", "2f7ca0b7", "c11f9756", "72646e9e", "ebaa875f", "d8efdadd", "cea3f4a5", "8f74e253", "c8ee6a44", "29a60790", "b6ed92dc", "022ab8d8", "f45011dd", "5606be13", "9fe86003", "c90d1128", "7bf6f523", "5dc456d1", "d41f3fb7", "839f31ff", "72e25499", "d0008616", "d6d13cfd", "018b8805", "3bd56a87", "7bf71a77", "302c6754", "639a51eb", "3025c6b7", "b233ddd9", "9297a1cb", "c10f2cf6", "a0a8dfd1", "6399f135", "8d394492", "d786ef37", "f516133b", "b71b7a0d", "a51484ee", "b6ec2abf", "184ccf63", "6cc57095", "897e3a5f", "5064bd10", "0abbe6f4", "57d2bb57", "3e3a904e", "cb25c53f", "35ebf1ea", "ec883603", "6c3d2e9a", "cd48542a", "e0b6a475", "1ed5d4af", "5cfe1ec3", "2f3f077c", "817d5bcb", "e7e4805a", "a8ac4be7", "3ae3b681", "781b603d", "99e3aca7", "d3cb5549", "e4e549d2", "eda8c8fd", "5a34fc94", "35385307", "b47d2a97", "8c0d1b23", "5529b024", "068c506c", "41858343", "861a909a", "96471e95", "a2b9d78f", "97255487", "506d0366", "7c5e3180", "e1aee43f", "99ad8db1", "1f4f4ab1", "cc431464", "cffd3e92", "ece85b50", "de6d3489", "9425f525", "c9dfa23f", "a97155f3", "002e23f2", "d440e8ed", "08798831", "96474097", "34962f83", "979532a1", "31f03b48", "5b692416", "c56d5e02", "5c2a1c1e", "6d642743", "fb15345a", "1bf7af93", "bb94e602", "4492b29b", "355885b6", "1e62932b", "f1bede8b", "6104f9a3", "86a6529d", "971f7f79", "8ace816a", "86a8a864", "4f85c567", "333b7df1", "cebe043f", "aa818d5e", "5458e526", "5354fc59", "14238173", "4794d596", "bd2797bd", "7e5013a9", "4211942c", "8c919cb4", "39bae570", "c8476924", "59d0bcc8", "29a47420", "62145122", "0b95337c", "55cd1300", "6fec3fac", "7abd0227", "ec842bbb", "f60b523e", "8ec73106", "e29225d6", "54224ade", "d722b746", "9342c1e3", "ce494c91", "4c1e1a2e", "20879280", "1c623712", "0ab6b9b5", "3cbe70c8", "090a5016", "1176c81f", "c4ca6358", "0ac1e588", "327018cc", "1aa3b54f", "9d8ed7e1", "98ecee4c", "1250f47d", "b48f6dcc", "2fd8a8a8", "df5292b9", "43ca2196", "eabebfd0", "5ef75e18", "6043426b", "5668ab16", "5694217b", "8da2c149", "8e108bc2", "4c44a17c", "ccdbc95c", "d578162e", "a828b92d", "226217c3", "5008e44f", "6ff4ce20", "10f2a2b1", "ee6b50e6", "1bc9bab0", "a69a2aba", "9dbfcd08", "539bc501", "640f2927", "e7e38d5e", "43adb03a", "7033ad33", "a98e1d1d", "19c928b8", "20fcecfd", "2038f57b", "1938493f", "47a32506", "6aa98b23", "051020bf", "4f5a3b25", "34d7276a", "79f68a23", "5b28a176", "15826bb9", "6a2eaaab", "23269a41", "79d85fa6", "51fe1954", "8f737801", "44dde6a5", "f8b69084", "136c1369", "086c7679", "0016c379", "2fe5822d", "1b146d77", "ff778b87", "6357bd68", "95840477", "c605b02a", "d9e4a2da", "1488771c", "1d067fed", "6c1c79f2", "4ce7e503", "c0d7b8fb", "ef0a1059", "f8984bae", "c9f98890", "f4eb7828", "5e570d46", "9ea12215", "de09d16e", "a470767a", "8c43a7fe", "65f145c0", "e425c385", "51453f5f", "fbca4af8", "5f213b95", "a6e2669f", "0d8e3Line truncated

PYAS_Language.py

@@ -4,7 +4,7 @@ translate_dict = {
               "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
               "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
               "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","誤報":"误报","複製":"复制",
+              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","誤":"误","報":"报",
               "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
               "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
               "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
@@ -18,7 +18,7 @@ translate_dict = {
               "惡":"恶","據":"据","庫":"库","經":"经","敗":"败"},
     "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
               "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website",
-              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索軟體":"Ransom ",
+              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索行為":"Ransom ",
               "惡意腳本":"Script ","惡意行為":"Behavior ","可疑軟體":"Suspicious ",
               "許可條款":"License Terms","惡意":"Malicious","可疑":"Suspicious",
               "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
@@ -47,8 +47,9 @@ translate_dict = {
               "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
               "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
               "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
-              "已經是":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
               "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
               "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
               "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
-              "密鑰":"Key ","檢測":"Detect ","製作":"Make","  ":" "}}
+              "密鑰":"Key ","檢測":"Detect ","製作":"Make","運行":"Running",
+              "自動":"Auto ","上報":"Report ","分析":"Analysis ","  ":" "}}

PYAS_Model.json

@@ -0,0 +1 @@
+{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707164921800767104952565848716212381967476981614870260538046339441223, 55577404054451500506896476492698809966352434385747804245366700591039970820656, 42705951800174486650758821275676750976088492908259259071295096144374682903086, 49945662818205539045803005800855628211260206264132745568273429553565001939621, 1971375257262090905519581299578819107262783557741928617138401738281487651430, 67127122082652960454880863806860982496794993755611567566069420845524589662948, 57127399177553064908500130304367752154959631068358693908588410859476595732550, 56385502860012719143972853477010089794786740533379580779686668832776244294324, 7116326Line truncated

PYAS_Version.py

@@ -1,7 +1,8 @@
 import pyinstaller_versionfile
+
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.0.2',
+version='3.0.9',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,16 +1,20 @@
 # PYAS (Python Antivirus Software)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+
+## Readme Language
+
+[繁體中文](https://github.com/zackzheng1121/PYAS/blob/main/README_zh.md)
 
 ## File Information
 
 PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
 
-PYAS_Compress.py -> Conversion Database (used to convert database dict and list to and from each other)
+PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
 
 PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
 
-PYAS_Function.* -> Virus Database (the virus database must be placed in the same directory)
+PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
 
 PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
 
@@ -33,35 +37,6 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## Hash Scanning
-
-Use Qihoo 360 cloud service to scan known malicious files
-
-```
-import hashlib, requests
-import xml.etree.ElementTree as xmlet
-
-def hash_scan(file):
-    try:
-        with open(file, "rb") as f:
-            text = str(hashlib.md5(f.read()).hexdigest())
-        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
-        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
-        if response.status_code == 200:
-            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
-            if level > 50:
-                return "Virus"
-            elif level <= 10:
-                return "Safe"
-            return "Unknown"
-        return f"Error: {response.status_code}"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = hash_scan("path to file")
-print(info)
-```
-
 ## Pefile Scanning
 
 Get the pefile file function import table for scanning
@@ -113,6 +88,8 @@ def proc_detect():
                     print(f"File: {file}")
                     print(f"Pid: {p.pid}")
                     print(f"Cmd: {cmd}")
+                elif not psutil.pid_exists(p.pid):
+                    existing_processes.remove(p.pid)
             except:
                 pass
 

README_zh.md

@@ -0,0 +1,167 @@
+# PYAS (Python 防毒軟體)
+
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+
+## 文件訊息
+
+PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
+
+PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
+
+PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
+
+PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
+
+PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
+
+PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
+
+PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
+
+PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
+
+## 要求
+
+使用 pip install requirements 來安裝需要的模組
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## 哈希掃描
+
+使用奇虎360雲端服務掃描已知惡意文件
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## 文件掃描
+
+取得pefile檔案函數導入表進行掃描
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## 進程偵測
+
+顯示新進程名稱、檔案路徑、cmd 行、pid
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+            except:
+                pass
+
+proc_detect()
+```
+
+## 檔案偵測
+
+監控指定路徑下的檔案變化
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## 官方網頁
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 開源許可證
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 支援的系統
+
+Windows 8.1, 10, 11 (64-bit),記憶體 1GB, 磁碟容量 1GB 或更高
+Other systems may experience software malfunctions or crash
+
+## Special Thanks
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo