Add files via upload

增加中文

PYAS.py

@@ -20,7 +20,7 @@ class MainWindow_Controller(QMainWindow):
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.pyae_version = "SimHash Engine"
-        self.pyas_version = "3.0.5"
+        self.pyas_version = "3.0.7"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_show_pyas()
@@ -624,29 +624,11 @@ class MainWindow_Controller(QMainWindow):
         except:
             pass
 
-    def update_database(self):
-        try:
-            if self.question_event("您確定要更新數據庫嗎?"):
-                file_path = os.path.join(self.dir, "PYAS_Model.json")
-                response = requests.get('http://27.147.30.238:5001/model', params={"version": self.pyae_version}, timeout=10)
-                if response.status_code == 200:
-                    with open(file_path, 'wb') as f:
-                        f.write(response.content)
-                    self.init_data_base()
-                    self.init_lang_text()
-                    self.info_event(f"數據庫更新成功: {self.pyae_version}")
-                elif response.status_code == 204:
-                    self.info_event(f"數據庫已經是最新: {self.pyae_version}")
-        except Exception as e:
-            self.bug_event(e)
-
     def show_menu(self):
         self.WindowMenu = QMenu()
         Main_Settings = QAction(self.trans("設定"),self)
-        #Main_Update = QAction(self.trans("更新"),self)
         Main_About = QAction(self.trans("關於"),self)
         self.WindowMenu.addAction(Main_Settings)
-        #self.WindowMenu.addAction(Main_Update)
         self.WindowMenu.addAction(Main_About)
         Qusetion = self.WindowMenu.exec_(self.ui.Menu_Button.mapToGlobal(QPoint(0, 30)))
         if Qusetion == Main_About and self.ui.About_widget.isHidden():
@@ -664,8 +646,6 @@ class MainWindow_Controller(QMainWindow):
             self.ui.Window_widget.raise_()
             self.change_animation_3(self.ui.Setting_widget,0.5)
             self.change_animation_5(self.ui.Setting_widget,10,50,831,481)
-        #if Qusetion == Main_Update:
-            #self.update_database()
 
     def change_sensitive(self):
         sw_state = self.ui.high_sensitivity_switch_Button.text()
@@ -767,14 +747,15 @@ class MainWindow_Controller(QMainWindow):
 
     def write_scan(self, state, file):
         try:
-            self.lock_file(file, True)
-            self.virus_list.append(file)
-            self.virus_list_ui.append(f"[{state}] {file}")
-            item = QListWidgetItem()
-            item.setText(f"[{state}] {file}")
-            item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
-            item.setCheckState(Qt.Checked)
-            self.ui.Virus_Scan_output.addItem(item)
+            if state and file:
+                self.lock_file(file, True)
+                self.virus_list.append(file)
+                self.virus_list_ui.append(f"[{state}] {file}")
+                item = QListWidgetItem()
+                item.setText(f"[{state}] {file}")
+                item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
+                item.setCheckState(Qt.Checked)
+                self.ui.Virus_Scan_output.addItem(item)
         except:
             pass
 
@@ -812,7 +793,7 @@ class MainWindow_Controller(QMainWindow):
             file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
             if file and file not in self.whitelist:
                 self.init_scan()
-                self.start_scan(file)
+                self.write_scan(self.start_scan(file),file)
                 self.answer_scan()
         except Exception as e:
             self.bug_event(e)
@@ -840,22 +821,6 @@ class MainWindow_Controller(QMainWindow):
             self.bug_event(e)
             self.virus_scan_break()
 
-    def start_scan(self, file):
-        try:
-            file_type = str(f".{file.split('.')[-1]}").lower()
-            if self.json["high_sensitive"] and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-            elif file_type in slist and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-        except:
-            pass
-
     def traverse_path(self,path):
         for fd in os.listdir(path):
             try:
@@ -867,29 +832,46 @@ class MainWindow_Controller(QMainWindow):
                 elif file not in self.whitelist:
                     self.ui.Virus_Scan_text.setText(self.trans(f"正在掃描: ")+file)
                     QApplication.processEvents()
-                    self.start_scan(file)
+                    self.write_scan(self.start_scan(file),file)
                 gc.collect()
             except:
                 pass
 
-    def api_scan(self, file):
+    def start_scan(self, file):
         try:
-            if self.json["cloud_services"] == 1:
-                with open(file, "rb") as f:
-                    text = str(hashlib.md5(f.read()).hexdigest())
-                strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
-                response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=5)
-                return response.status_code == 200 and float(xmlet.fromstring(response.text).find('.//e_level').text) > 50
+            level = self.api_scan(file)
+            if file != self.pyas and level > 50:
+                return f"Cloud/Blacklist.{level}"
+            elif file != self.pyas and level > 10:
+                vl, wl = self.pe_scan(file)
+                if vl > wl and vl == 100:
+                    return f"Pefile/Blacklist.{vl}"
+                elif vl >= wl and self.json["high_sensitive"]:
+                    return f"Fusion/Predict.{vl}"
+            elif file != self.pyas and not level:
+                vl, wl = self.pe_scan(file)
+                if vl > wl and vl == 100:
+                    return f"Pefile/Blacklist.{vl}"
+                elif vl >= wl and self.json["high_sensitive"]:
+                    return f"Pefile/Predict.{vl}"
             return False
         except:
             return False
 
-    def sign_scan(self, file):
+    def api_scan(self, file):
         try:
-            with pefile.PE(file, fast_load=True) as pe:
-                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+            if self.json["cloud_services"]:
+                with open(file, "rb") as f:
+                    text = str(hashlib.md5(f.read()).hexdigest())
+                QApplication.processEvents()
+                strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+                response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=5)
+                QApplication.processEvents()
+                if response.status_code == 200:
+                    return int(float(xmlet.fromstring(response.text).find('.//e_level').text))
+            return False
         except:
-            return True
+            return False
 
     def pe_scan(self, file):
         try:
@@ -901,20 +883,29 @@ class MainWindow_Controller(QMainWindow):
                             fn.append(str(func.name, "utf-8"))
                         except:
                             pass
-            m1, m0 = self.pe.predict(fn)
-            #print(m1, m0, file)
-            if self.json["high_sensitive"]:
-                return m1 >= m0
-            return m1 > 0.95 and m1 > m0
+            QApplication.processEvents()
+            out = self.pe.predict_all(fn)
+            virus = int(out["Virus"]*100)
+            white = int(out["White"]*100)
+            return virus, white
         except:
             return False
 
+    def sign_scan(self, file):
+        try:
+            with pefile.PE(file, fast_load=True) as pe:
+                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+        except:
+            return True
+
     def proc_scan(self, p):
         try:
+            if isinstance(p, str) and os.path.exists(p):
+                return self.start_scan(file)
             for entry in psutil.Process(p.pid).memory_maps():
                 file = entry.path.replace("\\", "/")
                 if ":/Windows" not in file and ":/Program" not in file:
-                    if self.api_scan(file) or self.pe_scan(file):
+                    if self.start_scan(file):
                         return True
             return False
         except:
@@ -1021,9 +1012,8 @@ class MainWindow_Controller(QMainWindow):
                 for i in Permission:
                     try:
                         win32api.RegDeleteValue(key,i)
-                        self.kill_process(self.proc)
                         file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截", file)
                     except:
                         pass
                 win32api.RegCloseKey(key)
@@ -1247,41 +1237,43 @@ class MainWindow_Controller(QMainWindow):
             Thread(target=self.protect_net_thread, daemon=True).start()
 
     def protect_proc_thread(self):
-        existing_processes = set()
+        existing_process = set()
         for p in psutil.process_iter():
-            existing_processes.add(p.pid)
-        psutil.Process(os.getpid()).nice(256)
+            existing_process.add(p.pid)
         while self.proc_protect:
             time.sleep(0.01)
+            new_process = set()
             for p in psutil.process_iter():
+                new_process.add(p.pid)
+            for pid in new_process - existing_process:
                 try:
-                    if p.pid not in existing_processes:
-                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                        if file != self.pyas and file not in self.whitelist:
-                            self.lock_process(p, True)
-                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
-                                self.kill_process(p)
-                                file = cmd[-1].split("'")[-2].replace("\\", "/")
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                                self.kill_process(p)
-                                file = " ".join(cmd[2:]).replace("\\", "/")
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
-                                self.kill_process(p)
-                                file = cmd[-1].replace("\\", "/")
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif ":/Windows" not in file and self.proc_scan(p):
-                                self.kill_process(p)
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif ":/Windows" not in file and self.sign_scan(file):
-                                self.proc = p
-                            self.lock_process(p, False)
-                            existing_processes.add(p.pid)
-                    elif not psutil.pid_exists(p.pid):
-                        existing_processes.remove(p.pid)
+                    p = psutil.Process(pid)
+                    self.handle_new_process(p)
                 except:
-                    self.lock_process(p, False)
+                    pass
+            existing_process = new_process
+
+    def handle_new_process(self, p):
+        try:
+            name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+            if file != self.pyas and file not in self.whitelist:
+                self.lock_process(p, True)
+                if "powershell" in name and self.start_scan(cmd[-1].split("'")[-2]):
+                    file = cmd[-1].split("'")[-2].replace("\\", "/")
+                    self.kill_process(p, "惡意腳本攔截", file)
+                elif "cmd.exe" in name and self.start_scan(" ".join(cmd[2:])):
+                    file = " ".join(cmd[2:]).replace("\\", "/")
+                    self.kill_process(p, "惡意腳本攔截", file)
+                elif ":/Windows" in file and self.start_scan(cmd[-1]):
+                    file = cmd[-1].replace("\\", "/")
+                    self.kill_process(p, "惡意軟體攔截", file)
+                elif ":/Windows" not in file and self.proc_scan(p):
+                    self.kill_process(p, "惡意軟體攔截", file)
+                elif ":/Windows" not in file and self.sign_scan(file):
+                    self.proc = p
+                self.lock_process(p, False)
+        except:
+            self.lock_process(p, False)
 
     def lock_process(self, p, lock):
         try:
@@ -1292,9 +1284,10 @@ class MainWindow_Controller(QMainWindow):
         except:
             pass
 
-    def kill_process(self, parent):
+    def kill_process(self, parent, info, file):
         try:
             parent.kill()
+            self.send_notify(self.trans(f"{info}: ")+file)
             for child in parent.children(recursive=True):
                 child.kill()
         except:
@@ -1307,17 +1300,15 @@ class MainWindow_Controller(QMainWindow):
                 try:
                     fpath = str(f"C:/{file}").replace("\\", "/")
                     ftype = str(f".{fpath.split('.')[-1]}").lower()
-                    if action == 2 and ":/Users" in fpath and "/AppData/" not in fpath:
-                        if ftype in alist:
-                            self.kill_process(self.proc)
-                            file = self.proc.exe().replace("\\", "/")
-                            self.send_notify(self.trans("勒索行為攔截: ")+file)
-                    elif action == 3 and os.path.getsize(fpath) <= 20971520 and ftype in slist:
-                        if ":/Users" in fpath or ":/Windows" not in fpath:
-                            if self.api_scan(fpath) or self.pe_scan(fpath):
+                    if action == 2 and ":/Users" in fpath and ftype in alist:
+                        file = self.proc.exe().replace("\\", "/")
+                        if "/AppData/" not in file and ":/Program" not in file:
+                            self.kill_process(self.proc, "勒索行為攔截", file)
+                    elif action == 3 and ":/Users" in fpath and "/AppData/" not in fpath:
+                        if os.path.getsize(fpath) <= 52428800 and ftype in slist:
+                            if self.start_scan(fpath):
                                 os.remove(fpath)
                                 self.send_notify(self.trans("惡意軟體刪除: ")+fpath)
-                    gc.collect()
                 except:
                     pass
 
@@ -1327,15 +1318,13 @@ class MainWindow_Controller(QMainWindow):
                 time.sleep(0.2)
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
-                        self.kill_process(self.proc)
                         file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截", file)
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
-                        self.kill_process(self.proc)
                         file = self.proc.exe().replace("\\", "/")
-                        self.send_notify(self.trans("惡意行為攔截: ")+file)
+                        self.kill_process(self.proc, "惡意行為攔截", file)
             except:
                 pass
 
@@ -1357,10 +1346,9 @@ class MainWindow_Controller(QMainWindow):
                 local = socket.gethostbyname(socket.gethostname())
                 for conn in self.proc.connections():
                     file = self.proc.exe().replace("\\", "/")
-                    if ":/Windows" not in file and ":/Program" not in file:
+                    if "/AppData/" not in file and ":/Program" not in file:
                         if conn.laddr.ip == local:
-                            self.kill_process(self.proc)
-                            self.send_notify(self.trans("網路通訊攔截: ")+file)
+                            self.kill_process(self.proc, "網路通訊攔截", file)
             except:
                 pass
 

PYAS_Engine.py

@@ -1,5 +1,5 @@
-import re, time, json, hashlib, numpy
-from itertools import groupby
+import time, json, hashlib, numpy
+from collections import Counter
 
 class ListSimHash:
     def __init__(self):
@@ -19,38 +19,24 @@ class ListSimHash:
     def get_model(self, label):
         return self.model[label]
 
-    def train_model(self, ones, zero, feature=128, batch_size=1000):
-        self.model["ones"] = []
-        self.model["zero"] = []
-        self.model["feature"] = feature
-        self.model["batch_size"] = batch_size
+    def train_model(self, label, data):
         start = time.time()
-        print("Convert ones")
-        for i, x in enumerate(ones, 1):
-            self.model["ones"].append(self.build_text(x))
+        print(f"Convert {label}")
+        if label not in self.model:
+            self.model[label] = []
+        for i, x in enumerate(data, 1):
+            self.model[label].append(self.build_text(x))
             used = "{0:.2f}".format(time.time()-start)
-            self.progress_bar(i, len(ones), prefix=f'{i}/{len(ones)}:', suffix=f'{used}s')
-        start = time.time()
-        print("Convert zero")
-        for i, y in enumerate(zero, 1):
-            self.model["zero"].append(self.build_text(y))
-            used = "{0:.2f}".format(time.time()-start)
-            self.progress_bar(i, len(zero), prefix=f'{i}/{len(zero)}:', suffix=f'{used}s')
+            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
+            self.progress_bar(i, len(data), prefix, suffix)
 
-    def build_text(self, content, width=4):
+    def build_text(self, content):
         sums, batch, count = [], [], 0
-        if isinstance(content, list):
-            content = ' '.join(content)
-        elif isinstance(content, bytes):
-            content = content.decode('utf-8', errors='ignore')
-        content = ''.join(re.findall(r'[\w\u4e00-\u9fcc]+', content.lower()))
-        features = [content[i:i + width] for i in range(max(len(content) - width + 1, 1))]
-        features = {k: sum(1 for _ in g) for k, g in groupby(sorted(features))}
+        features = dict(Counter(sorted(content)))
         for f, w in features.items():
             count += w
-            h = hashlib.md5(f.encode('utf-8')).digest()
-            batch.append(h * w)
-            if len(batch) >= self.model["batch_size"]:
+            batch.append(hashlib.md5(json.dumps(f).encode('utf-8')).digest() * w)
+            if len(batch) >= 10000:
                 sums.append(self.sum_hashes(batch))
                 batch = []
         if batch:
@@ -61,7 +47,7 @@ class ListSimHash:
 
     def sum_hashes(self, digests):
         bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
-        return numpy.sum(numpy.reshape(bitarray, (-1, self.model["feature"])), 0)
+        return numpy.sum(numpy.reshape(bitarray, (-1, 128)), 0)
 
     def progress_bar(self, iteration, total, prefix='', suffix='', length=50, fill='█'):
         percent = min(100.0, max(0.0, 100 * (iteration / float(total))))
@@ -71,13 +57,28 @@ class ListSimHash:
         bar = fill * filled_length + ' ' * (length - filled_length)
         print(f'\r    {prefix: <10} |{bar}| {percent_string}% {suffix}', end=end_char)
 
-    def predict(self, query):
+    def predict_all(self, query):
+        label_similarities = {}
         query_hash = self.build_text(query)
-        max_ones = max(self.similar(x, query_hash) for x in self.model["ones"])
-        max_zero = max(self.similar(y, query_hash) for y in self.model["zero"])
-        return max_ones, max_zero
+        for label in self.model:
+            max_similarity = 0
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity = similarity
+            label_similarities[label] = max_similarity
+        return label_similarities
+
+    def predict(self, query):
+        max_similarity, max_label = 0, None
+        query_hash = self.build_text(query)
+        for label in self.model:
+            for data_point in self.model[label]:
+                similarity = self.similar(data_point, query_hash)
+                if similarity > max_similarity:
+                    max_similarity, max_label = similarity, label
+        return max_label, max_similarity
 
     def similar(self, x, y):
         hamming_distance = bin(x ^ y).count('1')
-        similarity = 1 - hamming_distance / self.model["feature"]
-        return similarity
+        return 1 - hamming_distance / 128

PYAS_Model.json

@@ -1 +1 @@
-{"ones": [138514579140422510314615591404235408110, 138884061479927293269157399561321625124, 106913533745562494950237068000717194857, 56400517596638244422894049797604820621, 57509758994800025148320631233619478382, 266907975564823269757642468520682218021, 268764573572222081482569414853338147421, 301824928671740406049708617676147983911, 216322613833371885512412681366080352834, 305869899604823982125728318036880769198, 139390375862009821188813492031092843045, 140636369840301821837859972310736757357, 93525514883026399429643965685843744494, 85423552611944120389541188728576853614, 212959202992585676402479957744392065258, 310175323171803986711996189701871919269, 267073946987621142567955636205481517613, 130213060982497483351391950606798445166, 309453635424025901100964431663839207981, 98595718339270037315648519699911042861, 804810740308425468096265735208257617, 308840950453806983092423514217084578476, 322017788596429201866715226549004966766, 96855081274446633945978062387702817317, 309443088174281869980853203902500569645, 145963460354456926129955518358155059877, 100726355023313678737270049805708838766, 163055950804159105041684713458861453642, 139400638929619405534171854486176686629, 314740690747489056417995540920077280813, 309174548517306493765742812127600992824, 42649730517016866640152470265639253071, 266991032348753532132223164567115948653, 310834785753961546009345771577019752617, 138794485055151379651410532066913608701, 131790595577365633473641510877883811372, 333214357055760258309229460312077263456, 266919150567781465017126522717174383268, 309443250354319958579894353439906751021, 314760122553781807187305329030403597869, 309526327094009133336072658832466510380, 140783818610473943253735333316647117357, 266908765191386477077819778373267636908, 141960523677151839211304480019230155437, 236708587517087268685876607084596151010, 147109497140790587393132625769962294828, 98101030488836797416915605797123547821, 309443006965336732125112839751851204645, 163777668652403995261587270005386479850, 96850943187510051473774485962306807341, 314740690747489056417995540920077280813, 266907874033546142647711315245141475885, 128087963732730699244600678440497496745, 122948904762874323200167759687292791479, 144623683762647410432822459404215795881, 175281760716791954210630508746562429745, 98185566304403225600012489980760220205, 312173101091522310981766359248219144333, 165719174729833763978390369816514151589, 130453416906105788293089319006359032458, 309459962424693681697118037040663257637, 312110631309585432258276350165909913633, 266898908365541525694120496365498163769, 301974605256105130746947982559953757414, 46088979409888770325991887802833783310, 98097114716132427630865195752911955500, 98179117726185629973687845690377904685, 128833381668692705604881271753964704076, 288187285762824132116353144464193487405, 440767454710337817086060213441032296, 308755229979748206303057066098374746633, 310789353473439559353693532556983984677, 309443331008521396576751777765001683629, 272224825421632604778319829685274829501, 314740690747489056417995540920077280813, 288162135445850533606754792760600323239, 266908765349823459293196338896727065260, 266919475084642627997330537792153215533, 118095062731544531316068994170817536096, 309460205972074921952248716662523977893, 138980104556989140895595181268125835917, 96753309757095605084115148461573554213, 96783566280022178361451345888136274605, 267006527672619154632784726463056593709, 268325411442133354907118265595969561133, 45423085047571636176304357087088791778, 140693602135645422745421550777944908460, 266908927450643968163503768535437820588, 139317724478784922140315175893335437861, 98075229203956313888405997203836658285, 139307136862901466424877793378792006181, 141949813792938456152307200983465099405, 266887023150038950813539942248450810413, 266907873517942888138024343981564256813, 309527625168214095599527134475951948333, 288176899901775619274666676430489666220, 132687201639749430771754766010675328697, 298809467903569967359434970965896200999, 266909251929602884051145652263806452396, 96856378081010667424655802311172842021, 334364013698977648789398548127408169731, 138478276465840759527093181786120602252, 309517280516176477337549624053815730737, 309532816881431070079891773455787762221, 267006688625182579765726710919333306917, 301342822028899395690309866891238953529, 140889247564697972421510238399255437956, 301704982992736118799149217975167423010, 123342205008290812825969949820881134509, 309444547834874662752143629118327890477, 120368316428277902366824346477250637709, 96608366161759132771693290653207750157, 309258884864988268167108821321512280229, 266887185302388558609052276779780547237, 120204759374330029658546372684809684013, 266750361825108195839408748923433296011, 309541905261615072912890344878225383465, 136838710717061085016646030313491257547, 139400638929619405533018932981569839653, 309535252305417442974606230157044113441, 96865343064503306525844664637493502501, 98091942701683498853848791423305786021, 12268668727495Line truncated
+{"Virus": [261318414186602332274638176436767278092, 138027491891768042595443233665640385515, 110357087572968576943094470150101987119, 89628141614819275279501592421270658611, 9625936089192481713091234633207548145, 146573019333239184433892013297795962994, 264541877314875483358485439014616010241, 89378687258170412207570345845754816506, 295491687946453794463476073658069199320, 270110569967616684464025230399867156597, 317767290038007567692141082439138927345, 18885788501897915917239730749935859793, 95067756796967225976055101492886444145, 5340774248576581325353819949912031489, 127221069722257753511418504633757572348, 10415246439899713411029597770193411184, 95651985866123533435079044203969354868, 188173655331549916271106901837471791624, 115920025419090664908814181482465136245, 264555963058906459534362468816145940272, 95651985871075295954016225919772204788, 230418814927598623996991522865620895293, 307822865305226887780395456446154510073, 292376319578571219959135358926367053520, 894545638663197114170691953086909252, 307408049865722049855100904733744729280, 281395069059347277039468499503754758797, 10580035239361434345353152238353587444, 116667039230079911205687280113439840357, 105638824952820428052005376209508641704, 10159525814797641639514752130410024305, 799868415884320332536138129537778698, 22744055344958721368630687581251847176, 255349869106614732679810651086278546442, 315759149185061187179391478424305256898, 95315785306000038407304639293114375376, 110684881900941951709859261701564766961, 145716650028545025053236635988099140033, 95562399119788972561845288789790891122, 222253752239577871278657531622986138289, 94821380653995263056920242811808354032, 105453663146661214242864956330772860016, 133237106118017744142061791759548170883, 106285815540718769887458629487913147505, 171522714730243767599747450471850906780, 201783522381387157888199381457569830339, 95559052534575041823542189821460810608, 6803412338476848613694005563166320666, 105787286451833022929870383496648011249, 106280623246394143467097978838728292593, 94820584548412181705953186602301163257, 95563048166632561463187231032275512432, 108010814655804390841927389574188560953, 173324173206867137081876750353781475864, 95232708608642156662699453866682554993, 106285815540717561551934825217444224113, 95318319972117721345303221798918291186, 95559057605177442847140260259121040241, 305010456281757544171469123445447117681, 106198844586809641198104478887777078384, 179710050855676845982141937253360453053, 94818541689698630943530703193593974512, 105455042350511842344155948214062747248, 20881613063668797611160339818896853168, 31018193447326218505924275935240096368, 143088668467296939342778818474878950647, 110684892675972091428741019788518218489, 137521268273704145345759177480636558327, 106119662154515582210221674170892663408, 105949568716338471638768471668461534962, 89670460543521034706908097860639104624, 10332169700047182535948410013892054257, 95145598865408927095247444731707367024, 100629312664727978741143555078594927795, 148748393343889971317559945312215468786, 93989806751692355346109462915386284256, 107244620726926889373575057027717450762, 94987377598500779420569757831453449840, 100878647073583869926186814218125905113, 20215706740235798874506125693183790832, 110684912958381676190945511157408029425, 105949568706125465724368274041836011250, 300558662558418689647121992472167150144, 106201415362574605111426884001172884597, 110684882592911957008875737340312369917, 94987377577609631169063907051139341428, 105039010693725170460743583068113023705, 114380135952416886874949645426965728392, 124017012583193473160915936873388365506, 94662072863013290725024950240040430327, 143175020845977086618208175741834533027, 132011016412170201801452237305311191441, 10580035240599374384629243014119103732, 105576376886969565715901422869178687219, 172003113737697601641723035082316482624, 109023346904934388839803760995464461049, 10496943991486934504031035936730090609, 127216527016950104546694906326424083058, 336983008266790509743060629130917677774, 10248965448213412269216028810651597936, 79036768232931406417351794113275712068, 105532141803327881065557146349585635569, 100963036754215599502702416838888975610, 105787367661937540200783035652543688177, 95319034907171535697107975830043465952, 95150935027941497330695649661434404081, 31018193447326218505924275935240096368, 176177498613631404614794194516575496896, 136271405179532594000996159423307548914, 66833476002653370931812317778542555093, 9915421242395013439142248483403569396, 162357332045345094604141502928937491106, 95650044561417669529155573147468110960, 95065159985079431125978131216282192112, 18639272732092977493351497242647705306, 230570463661756059397447611038616439025, 95484514342568128463910419849540603504, 266025808443819672030174370144173223456, 47343025305025541868952332865095320248, 100968228555433537808235270915390512872, 105953482575652408268669106292717067508, 95311896151231050439910957073435270256, 105867687984072457600475937752904732400, 116Line truncated

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.0.5',
+version='3.0.7',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,6 +1,10 @@
 # PYAS (Python Antivirus Software)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+
+## Readme Language
+
+[繁體中文](https://github.com/zackzheng1121/PYAS/blob/main/README_zh.md)
 
 ## File Information
 
@@ -113,6 +117,8 @@ def proc_detect():
                     print(f"File: {file}")
                     print(f"Pid: {p.pid}")
                     print(f"Cmd: {cmd}")
+                elif not psutil.pid_exists(p.pid):
+                    existing_processes.remove(p.pid)
             except:
                 pass
 

README_zh.md

@@ -0,0 +1,167 @@
+# PYAS (Python 防毒軟體)
+
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
+
+## 文件訊息
+
+PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
+
+PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
+
+PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
+
+PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
+
+PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
+
+PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
+
+PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
+
+PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
+
+## 要求
+
+使用 pip install requirements 來安裝需要的模組
+
+```
+psutil==5.9.5
+pefile==2023.2.7
+requests==2.31.0
+pyperclip==1.8.2
+pywin32==306
+PyQt5==5.15.9
+```
+
+## 哈希掃描
+
+使用奇虎360雲端服務掃描已知惡意文件
+
+```
+import hashlib, requests
+import xml.etree.ElementTree as xmlet
+
+def hash_scan(file):
+    try:
+        with open(file, "rb") as f:
+            text = str(hashlib.md5(f.read()).hexdigest())
+        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
+        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
+        if response.status_code == 200:
+            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
+            if level > 50:
+                return "Virus"
+            elif level <= 10:
+                return "Safe"
+            return "Unknown"
+        return f"Error: {response.status_code}"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = hash_scan("path to file")
+print(info)
+```
+
+## 文件掃描
+
+取得pefile檔案函數導入表進行掃描
+
+```
+import pefile
+
+def pe_scan(file):
+    try:
+        fn = []
+        with pefile.PE(file) as pe:
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                for func in entry.imports:
+                    try:
+                        fn.append(str(func.name, "utf-8"))
+                    except:
+                        pass
+            if fn in known_malicious_list:
+                return "Virus"
+            return "Safe"
+        return "Unknown"
+    except Exception as e:
+        return f"Error: {e}"
+
+info = pe_scan("path to file")
+print(info)
+```
+
+## 進程偵測
+
+顯示新進程名稱、檔案路徑、cmd 行、pid
+```
+import psutil, time
+
+def proc_detect():
+    existing_processes = set()
+    for p in psutil.process_iter():
+        if p.pid not in existing_processes:
+            existing_processes.add(p.pid)
+    while True:
+        time.sleep(0.1)
+        for p in psutil.process_iter():
+            try:
+                if p.pid not in existing_processes:
+                    existing_processes.add(p.pid)
+                    name, file, cmd = p.name(), p.exe(), p.cmdline()
+                    print(f"Name: {name}")
+                    print(f"File: {file}")
+                    print(f"Pid: {p.pid}")
+                    print(f"Cmd: {cmd}")
+            except:
+                pass
+
+proc_detect()
+```
+
+## 檔案偵測
+
+監控指定路徑下的檔案變化
+```
+import os, win32file, win32con
+
+def file_detect(path):
+    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
+    while True:
+        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            try:
+                fpath = os.path.join(path, file)
+                if action == 1:
+                    print(f"File Create: {fpath}")
+                elif action == 2:
+                    print(f"File Delete: {fpath}")
+                elif action == 3:
+                    print(f"File Modify: {fpath}")
+                elif action == 4:
+                    print(f"File Rename: {fpath}")
+                elif action == 5:
+                    print(f"File Rename: {fpath}")
+            except:
+                pass
+
+file_detect("path")
+```
+
+## 官方網頁
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 開源許可證
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 支援的系統
+
+Windows 8.1, 10, 11 (64-bit),記憶體 1GB, 磁碟容量 1GB 或更高
+Other systems may experience software malfunctions or crash
+
+## Special Thanks
+360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+
+Copyright© 2020~2024 PYAS Security By 87owo