Add files via upload

Update PYAS_Language.py

Driver/Protect/Install_Driver.bat

@@ -0,0 +1,34 @@
+@echo off
+setlocal
+
+:: Check for permissions
+>nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
+
+if %errorlevel% NEQ 0 goto NoAdmin
+goto gotAdmin
+
+:NoAdmin
+    echo You do not have administrator rights, please run this script as administrator.
+    pause
+    exit /B
+
+:gotAdmin
+    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
+
+set "script_dir=%~dp0"
+set "script_dir=%script_dir:~0,-1%"
+
+bcdedit -debug on
+bcdedit /set testsigning on
+bcdedit /deletevalue {current} safeboot
+
+powershell.exe -ExecutionPolicy Bypass -Command ^
+"$endDate = (Get-Date).AddYears(100); ^
+ $cert = New-SelfSignedCertificate -DnsName PYAS -CertStoreLocation cert:\LocalMachine\My -Type CodeSigning -NotAfter $endDate; ^
+ $pwd = ConvertTo-SecureString -String 'PYAS' -Force -AsPlainText; ^
+ Export-PfxCertificate -Cert $cert -FilePath '%script_dir%\PYAS.pfx' -Password $pwd;"
+"%script_dir%\signtool.exe" sign /f "%script_dir%\PYAS.pfx" /p PYAS "%script_dir%\PYAS_Driver.sys"
+sc create PYAS_Driver type= kernel start= demand binPath= "%script_dir%\PYAS_Driver.sys"
+
+shutdown -r -t 0
+endlocal

Driver/Protect/Uninstall_Driver.bat

@@ -0,0 +1,25 @@
+@echo off
+setlocal
+
+:: Check for permissions
+>nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
+
+if %errorlevel% NEQ 0 goto NoAdmin
+goto gotAdmin
+
+:NoAdmin
+    echo You do not have administrator rights, please run this script as administrator.
+    pause
+    exit /B
+
+:gotAdmin
+    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
+
+sc stop PYAS_Driver
+sc delete PYAS_Driver
+
+bcdedit /set testsigning off
+bcdedit -debug off
+
+shutdown -r -t 0
+endlocal

Engine/Model/PYAS_Model.json

@@ -0,0 +1,11 @@
+{
+    "Suffix": [".com", ".exe", ".dll", ".sys", ".scr", ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], 
+
+    "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], 
+
+    "Detect": ["Pefile/General", "Script/General"],  
+
+    "Pixels": [224, 224], 
+
+    "Values": 90
+}

Extens/Repair/Repair_Regedit.reg

@@ -0,0 +1,117 @@
+Windows Registry Editor Version 5.00
+
+; Repair system restrictions
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MMC]
+; NoControlPanel
+"NoControlPanel"=dword:00000000
+; NoDrives
+"NoDrives"=dword:00000000
+; NoFileMenu
+"NoFileMenu"=dword:00000000
+; NoFind
+"NoFind"=dword:00000000
+; NoRealMode
+"NoRealMode"=dword:00000000
+; NoRecentDocsMenu
+"NoRecentDocsMenu"=dword:00000000
+; NoSetFolders
+"NoSetFolders"=dword:00000000
+; NoSetFolderOptions
+"NoSetFolderOptions"=dword:00000000
+; NoViewOnDrive
+"NoViewOnDrive"=dword:00000000
+; NoClose
+"NoClose"=dword:00000000
+; NoRun
+"NoRun"=dword:00000000
+; NoDesktop
+"NoDesktop"=dword:00000000
+; NoLogOff
+"NoLogOff"=dword:00000000
+; NoFolderOptions
+"NoFolderOptions"=dword:00000000
+; RestrictRun
+"RestrictRun"=dword:00000000
+; NoViewContextMenu
+"NoViewContexMenu"=dword:00000000
+; HideClock
+"HideClock"=dword:00000000
+; NoStartMenuMorePrograms
+"NoStartMenuMorePrograms"=dword:00000000
+; NoStartMenuMyGames
+"NoStartMenuMyGames"=dword:00000000
+; NoStartMenuMyMusic
+"NoStartMenuMyMusic"=dword:00000000
+; DisableCMD
+"DisableCMD"=dword:00000000
+; NoWinKeys
+"NoWinKeys"=dword:00000000
+; StartMenuLogOff
+"StartMenuLogOff"=dword:00000000
+; NoSimpleNetlDList
+"NoSimpleNetlDList"=dword:00000000
+; NoLowDiskSpaceChecks
+"NoLowDiskSpaceChecks"=dword:00000000
+; DisableLockWorkstation
+"DisableLockWorkstation"=dword:00000000
+; Restrict_Run
+"Restrict_Run"=dword:00000000
+; DisableTaskMgr
+"DisableTaskMgr"=dword:00000000
+; DisableRegistryTools
+"DisableRegistryTools"=dword:00000000
+; DisableChangePassword
+"DisableChangePassword"=dword:00000000
+; Wallpaper
+"Wallpaper"=dword:00000000
+; NoComponents
+"NoComponents"=dword:00000000
+; NoAddingComponents
+"NoAddingComponents"=dword:00000000
+; NoStartMenuPinnedList
+"NoStartMenuPinnedList"=dword:00000000
+; NoActiveDesktop
+"NoActiveDesktop"=dword:00000000
+; NoSetActiveDesktop
+"NoSetActiveDesktop"=dword:00000000
+; NoActiveDesktopChanges
+"NoActiveDesktopChanges"=dword:00000000
+; NoChangeStartMenu
+"NoChangeStartMenu"=dword:00000000
+; NoFavoritesMenu
+"NoFavoritesMenu"=dword:00000000
+; NoRecentDocsHistory
+"NoRecentDocsHistory"=dword:00000000
+; NoSetTaskbar
+"NoSetTaskbar"=dword:00000000
+; NoSMHelp
+"NoSMHelp"=dword:00000000
+; NoTrayContextMenu
+"NoTrayContextMenu"=dword:00000000
+; NoViewContextMenu
+"NoViewContextMenu"=dword:00000000
+; NoManageMyComputerVerb
+"NoManageMyComputerVerb"=dword:00000000
+; NoWindowsUpdate
+"NoWindowsUpdate"=dword:00000000
+; ClearRecentDocsOnExit
+"ClearRecentDocsOnExit"=dword:00000000
+; NoStartMenuNetworkPlaces
+"NoStartMenuNetworkPlaces"=dword:00000000
+
+; Repair Image File Execution Options
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
+; (Delete all subkeys here if necessary)
+
+; Repair executable file icon
+[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
+@="%1"
+[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon]
+@="%1"
+
+; Repair executable file type
+[HKEY_CLASSES_ROOT\.exe]
+@="exefile"
+[HKEY_CLASSES_ROOT\exefile\shell\open\command]
+@="\"%1\" %*"
+

Extens/Repair/Repair_System.bat

@@ -0,0 +1 @@
+sfc /scannow

Extens/Tools/Tools.txt

@@ -0,0 +1 @@
+None

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020-2024 87owo (PYAS Security)
+Copyright (c) 2020-2025 87owo (PYAS Security)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

PYAS_Engine.py

@@ -1,84 +1,109 @@
-import time, json, hashlib, numpy
-from collections import Counter
+import os, sys, time, json, yara
+import numpy, pefile, onnxruntime
+from PIL import Image
 
-class ListSimHash:
+class YRScan:
     def __init__(self):
-        self.model = {}
+        self.rules = {}
+        self.network = []
 
-    def save_model(self, file_name):
-        with open(file_name, 'w') as f:
-            json.dump(self.model, f)
-        print(f"\nModel Is Saved In {file_name}")
+    def load_rules(self, file_path):
+        try:
+            ftype = os.path.splitext(file_path)[-1].lower()
+            if ftype in [".yara", ".yar"]:
+                self.rules[file_path] = yara.compile(file_path)
+            elif ftype in [".yc", ".yrc"]:
+                self.rules[file_path] = yara.load(file_path)
+            elif ftype in [".ip", ".ips"]:
+                with open(file_path, "r") as f:
+                    self.network += [l.strip() for l in f.readlines()]
+        except Exception as e:
+            print(e)
 
-    def load_model(self, model_data):
-        if isinstance(model_data, str):
-            with open(model_data, 'r') as f:
-                model_data = json.load(f)
-        self.model = model_data
+    def yr_scan(self, file_path):
+        try:
+            if isinstance(file_path, str):
+                with open(file_path, "rb") as f:
+                    file_path = f.read()
+            for name, rules in self.rules.items():
+                matchs_rules = rules.match(data=file_path)
+                if matchs_rules:
+                    label = str(matchs_rules[0]).split("_")[0]
+                    level = str(matchs_rules[0]).split("_")[-1]
+                    return f"Rules/{label}", level
+            return False, False
+        except Exception as e:
+            return False, False
 
-    def get_model(self, label):
-        return self.model[label]
+class DLScan:
+    def __init__(self):
+        self.models = {}
+        self.shells = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '!o',
+        'cry', 'test', 'ace', 'yg', 'obr', 'tvm', 'dec', 'enc', 'b1_', 'base',
+        'bss', 'clr_uef', 'cursors', 'trs_age', 'engine', 'enigma', 'protect',
+        'nep', 'no_bbt', 'wpp_sf', 'retpol', 'rt', 'rwexec', 'rygs', 'poolmi',
+        's:@', 'pgae', 'proxy', 'wisevec', 'segm', 'transit', 'vmp', 'extjmp',
+        'upx', 'tracesup', 'res', 'lzma', 'malloc_h', 'miniex', 'ndr64', 'be',
+        'mssmixer', 'wow', 'press', 'fio', 'pad', 'hexpthk', 'h~;', 'icapsec',
+        'sanontcp', 'secur', 'asmstub', 'nsys_wr', 'orpc', 'pack', 'wow64svc',
+        'uedbg', 'viahw', 'data', 'zk', 'fothk', 'qihoo']#"""
 
-    def train_model(self, label, data):
-        start = time.time()
-        print(f"Convert {label}")
-        if label not in self.model:
-            self.model[label] = []
-        for i, x in enumerate(data, 1):
-            self.model[label].append(self.build_text(x))
-            used = "{0:.2f}".format(time.time()-start)
-            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
-            self.progress_bar(i, len(data), prefix, suffix)
+    def load_model(self, file_path):
+        try:
+            ftype = os.path.splitext(file_path)[-1].lower()
+            if ftype in [".json", ".txt"]:
+                with open(file_path, 'r') as f:
+                    self.class_names = json.load(f)
+            elif ftype in [".onnx"]:
+                self.models[file_path] = onnxruntime.InferenceSession(file_path)
+            self.labels = self.class_names['Labels']
+            self.detect = self.class_names['Detect']
+            self.pixels = self.class_names['Pixels']
+            self.values = self.class_names['Values']
+            self.suffix = self.class_names['Suffix']
+        except Exception as e:
+            pass
 
-    def build_text(self, content):
-        sums, batch, count = [], [], 0
-        features = dict(Counter(sorted(content)))
-        for f, w in features.items():
-            count += w
-            batch.append(hashlib.md5(json.dumps(f).encode('utf-8')).digest() * w)
-            if len(batch) >= 10000:
-                sums.append(self.sum_hashes(batch))
-                batch = []
-        if batch:
-            sums.append(self.sum_hashes(batch))
-        combined_sums = numpy.sum(sums, 0)
-        v = numpy.packbits(combined_sums > count / 2).tobytes()
-        return int.from_bytes(v, 'big')
+    def dl_scan(self, file_data):
+        try:
+            label_similarities = {label: [] for label in self.labels}
+            image_data = self.preprocess_image(file_data, tuple(self.pixels))
+            image_array = numpy.asarray(image_data).astype('float32') / 255.0
+            image_expand = numpy.expand_dims(image_array, axis=(0, -1))
+            for model_name, model in self.models.items():
+                input_name = model.get_inputs()[0].name
+                pre_answers = model.run(None, {input_name: image_expand})[0][0]
+                for k, score in enumerate(pre_answers):
+                    label_similarities[self.labels[k].strip()].append(score)
+            label_percentage = {label: (sum(similarities) / len(self.models)) * 100
+            for label, similarities in label_similarities.items()}
+            label, level = max(label_percentage.items(), key=lambda x: x[1])
+            return label, int(level)
+        except Exception as e:
+            return False, False
 
-    def sum_hashes(self, digests):
-        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
-        return numpy.sum(numpy.reshape(bitarray, (-1, 128)), 0)
+    def preprocess_image(self, file_data, target_size):
+        wah = int(numpy.ceil(numpy.sqrt(len(file_data))))
+        file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
+        image_array = numpy.zeros((wah * wah,), dtype=numpy.uint8)
+        image_array[:len(file_data)] = file_data
+        image = Image.fromarray(image_array.reshape((wah, wah)), 'L')
+        return image.resize(target_size, Image.Resampling.NEAREST)
 
-    def progress_bar(self, iteration, total, prefix='', suffix='', length=50, fill='█'):
-        percent = min(100.0, max(0.0, 100 * (iteration / float(total))))
-        end_char = '\n' if percent >= 100 else '\r'
-        percent_string = "{0:.2f}".format(percent)
-        filled_length = int(length * iteration // total)
-        bar = fill * filled_length + ' ' * (length - filled_length)
-        print(f'\r    {prefix: <10} |{bar}| {percent_string}% {suffix}', end=end_char)
-
-    def predict_all(self, query):
-        label_similarities = {}
-        query_hash = self.build_text(query)
-        for label in self.model:
-            max_similarity = 0
-            for data_point in self.model[label]:
-                similarity = self.similar(data_point, query_hash)
-                if similarity > max_similarity:
-                    max_similarity = similarity
-            label_similarities[label] = max_similarity
-        return label_similarities
-
-    def predict(self, query):
-        max_similarity, max_label = 0, None
-        query_hash = self.build_text(query)
-        for label in self.model:
-            for data_point in self.model[label]:
-                similarity = self.similar(data_point, query_hash)
-                if similarity > max_similarity:
-                    max_similarity, max_label = similarity, label
-        return max_label, max_similarity
-
-    def similar(self, x, y):
-        hamming_distance = bin(x ^ y).count('1')
-        return 1 - hamming_distance / 128
+    def get_type(self, file_path):
+        match_data = {}
+        ftype = os.path.splitext(file_path)[-1].lower()
+        if ftype in self.suffix:
+            try:
+                with pefile.PE(file_path, fast_load=True) as pe:
+                    for section in pe.sections:
+                        section_name = section.Name.rstrip(b'\x00').decode('latin1')
+                        if (section.Characteristics & 0x00000020 and not
+                        any(shell in section_name.lower() for shell in self.shells)):
+                            match_data[section_name] = section.get_data()
+            except:
+                if ftype in [".bat", ".cmd", ".ps1", ".vbs", ".wsf", ".html", ".js", 
+                    ".txt", ".htm", ".hta", ".php", ".css", ".xml", ".json", ".wasm"]:
+                    with open(file_path, 'rb') as file:
+                        match_data[ftype] = file.read()
+        return match_data

PYAS_Extension.py

@@ -1,8 +0,0 @@
-slist = [".exe",".dll",".com",".msi",".scr",
-         ".js",".bat",".cmd",".ps1",".vbs"]
-
-alist = [".ppt",".pptx",".wps",".txt",".rtf",
-         ".pdf",".xls",".xlsx",".doc",".docx",
-         ".jpg",".jpeg",".png",".webp",".gif",
-         ".mp3",".wav",".aac",".ogg",".flac",
-         ".mp4",".avi",".mov",".wmv",".mkv"]

PYAS_Interface.py

@@ -1569,49 +1569,49 @@ class Ui_MainWindow(object):
         self.Language_illustrate.raise_()
         self.Language_Choose_widget.raise_()
         self.Language_title.raise_()
-        self.Show_cloud_services = QtWidgets.QWidget(self.Setting_widget)
-        self.Show_cloud_services.setGeometry(QtCore.QRect(30, 130, 781, 81))
-        self.Show_cloud_services.setAcceptDrops(False)
-        self.Show_cloud_services.setAutoFillBackground(False)
-        self.Show_cloud_services.setObjectName("Show_cloud_services")
-        self.cloud_services_title = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
+        self.Show_extension_kit = QtWidgets.QWidget(self.Setting_widget)
+        self.Show_extension_kit.setGeometry(QtCore.QRect(30, 130, 781, 81))
+        self.Show_extension_kit.setAcceptDrops(False)
+        self.Show_extension_kit.setAutoFillBackground(False)
+        self.Show_extension_kit.setObjectName("Show_extension_kit")
+        self.extension_kit_title = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(17)
         font.setBold(False)
         font.setWeight(50)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_title.setFont(font)
-        self.cloud_services_title.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_title.setObjectName("cloud_services_title")
-        self.cloud_services_illustrate = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
+        self.extension_kit_title.setFont(font)
+        self.extension_kit_title.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_title.setObjectName("extension_kit_title")
+        self.extension_kit_illustrate = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_illustrate.setFont(font)
-        self.cloud_services_illustrate.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_illustrate.setScaledContents(False)
-        self.cloud_services_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_illustrate.setWordWrap(True)
-        self.cloud_services_illustrate.setObjectName("cloud_services_illustrate")
-        self.cloud_services_switch_Button = QtWidgets.QPushButton(self.Show_cloud_services)
-        self.cloud_services_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
+        self.extension_kit_illustrate.setFont(font)
+        self.extension_kit_illustrate.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_illustrate.setScaledContents(False)
+        self.extension_kit_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_illustrate.setWordWrap(True)
+        self.extension_kit_illustrate.setObjectName("extension_kit_illustrate")
+        self.extension_kit_switch_Button = QtWidgets.QPushButton(self.Show_extension_kit)
+        self.extension_kit_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
         sizePolicy.setHorizontalStretch(0)
         sizePolicy.setVerticalStretch(0)
-        sizePolicy.setHeightForWidth(self.cloud_services_switch_Button.sizePolicy().hasHeightForWidth())
-        self.cloud_services_switch_Button.setSizePolicy(sizePolicy)
+        sizePolicy.setHeightForWidth(self.extension_kit_switch_Button.sizePolicy().hasHeightForWidth())
+        self.extension_kit_switch_Button.setSizePolicy(sizePolicy)
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_switch_Button.setFont(font)
-        self.cloud_services_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
-        self.cloud_services_switch_Button.setStyleSheet("QPushButton\n"
+        self.extension_kit_switch_Button.setFont(font)
+        self.extension_kit_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
+        self.extension_kit_switch_Button.setStyleSheet("QPushButton\n"
 "{\n"
 "    border:none;\n"
 "    background-color:rgb(230,230,230);\n"
@@ -1622,12 +1622,12 @@ class Ui_MainWindow(object):
 "    background-color:rgb(220,220,220);\n"
 "}\n"
 "")
-        self.cloud_services_switch_Button.setIconSize(QtCore.QSize(16, 16))
-        self.cloud_services_switch_Button.setCheckable(False)
-        self.cloud_services_switch_Button.setObjectName("cloud_services_switch_Button")
-        self.cloud_services_illustrate.raise_()
-        self.cloud_services_switch_Button.raise_()
-        self.cloud_services_title.raise_()
+        self.extension_kit_switch_Button.setIconSize(QtCore.QSize(16, 16))
+        self.extension_kit_switch_Button.setCheckable(False)
+        self.extension_kit_switch_Button.setObjectName("extension_kit_switch_Button")
+        self.extension_kit_illustrate.raise_()
+        self.extension_kit_switch_Button.raise_()
+        self.extension_kit_title.raise_()
         self.Setting_Back = QtWidgets.QPushButton(self.Setting_widget)
         self.Setting_Back.setGeometry(QtCore.QRect(25, 10, 101, 41))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
@@ -1885,9 +1885,9 @@ class Ui_MainWindow(object):
         self.Language_English.setText(_translate("MainWindow", "English"))
         self.Language_Traditional_Chinese.setText(_translate("MainWindow", "繁體中文"))
         self.Language_Simplified_Chinese.setText(_translate("MainWindow", "简体中文"))
-        self.cloud_services_title.setText(_translate("MainWindow", "雲端掃描服務"))
-        self.cloud_services_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
-        self.cloud_services_switch_Button.setText(_translate("MainWindow", "已關閉"))
+        self.extension_kit_title.setText(_translate("MainWindow", "雲端掃描服務"))
+        self.extension_kit_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
+        self.extension_kit_switch_Button.setText(_translate("MainWindow", "已關閉"))
         self.Setting_Back.setText(_translate("MainWindow", "返回"))
         self.Add_White_list_title.setText(_translate("MainWindow", "增加到白名單"))
         self.Add_White_list_illustrate.setText(_translate("MainWindow", "此選項可以選擇檔案並增加到白名單"))

PYAS_Language.py

@@ -4,7 +4,7 @@ translate_dict = {
               "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
               "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
               "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","誤報":"误报","複製":"复制",
+              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","開啟":"开启",
               "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
               "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
               "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
@@ -14,25 +14,27 @@ translate_dict = {
               "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
               "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
               "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
-              "強":"强","驅":"驱","為":"为","腳":"脚","增":"增","單":"单","開":"开",
-              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败"},
+              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
+              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","與":"与","記憶體":"内存",},
     "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
-              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website",
-              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索行為":"Ransom ",
-              "惡意腳本":"Script ","惡意行為":"Behavior ","可疑軟體":"Suspicious ",
-              "許可條款":"License Terms","惡意":"Malicious","可疑":"Suspicious",
+              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website ",
+              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
+              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ",
+              "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
               "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
-              "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
+              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
               "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
               "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
-              "測試人員":"Testers","版本資訊":"Information","通訊":"Communication ",
+              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
               "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
               "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
               "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
               "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
               "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
-              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhanced ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
               "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
               "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
               "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
@@ -44,11 +46,15 @@ translate_dict = {
               "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
               "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
               "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-              "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
-              "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
+              "增加到":"Add To ","白名單":"White List ","軟體":"Software ","正在":"",
+              "增加":"Add ","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
               "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
-              "已經是":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
               "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
-              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
               "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
-              "密鑰":"Key ","檢測":"Detect ","製作":"Make","  ":" "}}
+              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
+              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
+              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ",
+              "竄改":"Tamper ","第三方":"Other ","與":"With ","  ":" "}}

PYAS_Model.json

@@ -1 +0,0 @@
-{"Virus": [261318414186602332274638176436767278092, 138027491891768042595443233665640385515, 110357087572968576943094470150101987119, 89628141614819275279501592421270658611, 9625936089192481713091234633207548145, 146573019333239184433892013297795962994, 264541877314875483358485439014616010241, 89378687258170412207570345845754816506, 295491687946453794463476073658069199320, 270110569967616684464025230399867156597, 317767290038007567692141082439138927345, 18885788501897915917239730749935859793, 95067756796967225976055101492886444145, 5340774248576581325353819949912031489, 127221069722257753511418504633757572348, 10415246439899713411029597770193411184, 95651985866123533435079044203969354868, 188173655331549916271106901837471791624, 115920025419090664908814181482465136245, 264555963058906459534362468816145940272, 95651985871075295954016225919772204788, 230418814927598623996991522865620895293, 307822865305226887780395456446154510073, 292376319578571219959135358926367053520, 894545638663197114170691953086909252, 307408049865722049855100904733744729280, 281395069059347277039468499503754758797, 10580035239361434345353152238353587444, 116667039230079911205687280113439840357, 105638824952820428052005376209508641704, 10159525814797641639514752130410024305, 799868415884320332536138129537778698, 22744055344958721368630687581251847176, 255349869106614732679810651086278546442, 315759149185061187179391478424305256898, 95315785306000038407304639293114375376, 110684881900941951709859261701564766961, 145716650028545025053236635988099140033, 95562399119788972561845288789790891122, 222253752239577871278657531622986138289, 94821380653995263056920242811808354032, 105453663146661214242864956330772860016, 133237106118017744142061791759548170883, 106285815540718769887458629487913147505, 171522714730243767599747450471850906780, 201783522381387157888199381457569830339, 95559052534575041823542189821460810608, 6803412338476848613694005563166320666, 105787286451833022929870383496648011249, 106280623246394143467097978838728292593, 94820584548412181705953186602301163257, 95563048166632561463187231032275512432, 108010814655804390841927389574188560953, 173324173206867137081876750353781475864, 95232708608642156662699453866682554993, 106285815540717561551934825217444224113, 95318319972117721345303221798918291186, 95559057605177442847140260259121040241, 305010456281757544171469123445447117681, 106198844586809641198104478887777078384, 179710050855676845982141937253360453053, 94818541689698630943530703193593974512, 105455042350511842344155948214062747248, 20881613063668797611160339818896853168, 31018193447326218505924275935240096368, 143088668467296939342778818474878950647, 110684892675972091428741019788518218489, 137521268273704145345759177480636558327, 106119662154515582210221674170892663408, 105949568716338471638768471668461534962, 89670460543521034706908097860639104624, 10332169700047182535948410013892054257, 95145598865408927095247444731707367024, 100629312664727978741143555078594927795, 148748393343889971317559945312215468786, 93989806751692355346109462915386284256, 107244620726926889373575057027717450762, 94987377598500779420569757831453449840, 100878647073583869926186814218125905113, 20215706740235798874506125693183790832, 110684912958381676190945511157408029425, 105949568706125465724368274041836011250, 300558662558418689647121992472167150144, 106201415362574605111426884001172884597, 110684882592911957008875737340312369917, 94987377577609631169063907051139341428, 105039010693725170460743583068113023705, 114380135952416886874949645426965728392, 124017012583193473160915936873388365506, 94662072863013290725024950240040430327, 143175020845977086618208175741834533027, 132011016412170201801452237305311191441, 10580035240599374384629243014119103732, 105576376886969565715901422869178687219, 172003113737697601641723035082316482624, 109023346904934388839803760995464461049, 10496943991486934504031035936730090609, 127216527016950104546694906326424083058, 336983008266790509743060629130917677774, 10248965448213412269216028810651597936, 79036768232931406417351794113275712068, 105532141803327881065557146349585635569, 100963036754215599502702416838888975610, 105787367661937540200783035652543688177, 95319034907171535697107975830043465952, 95150935027941497330695649661434404081, 31018193447326218505924275935240096368, 176177498613631404614794194516575496896, 136271405179532594000996159423307548914, 66833476002653370931812317778542555093, 9915421242395013439142248483403569396, 162357332045345094604141502928937491106, 95650044561417669529155573147468110960, 95065159985079431125978131216282192112, 18639272732092977493351497242647705306, 230570463661756059397447611038616439025, 95484514342568128463910419849540603504, 266025808443819672030174370144173223456, 47343025305025541868952332865095320248, 100968228555433537808235270915390512872, 105953482575652408268669106292717067508, 95311896151231050439910957073435270256, 105867687984072457600475937752904732400, 116Line truncated

PYAS_Suffixes.py

@@ -0,0 +1,10 @@
+file_types = [
+    ".exe",".dll",".sys",".com",".scr",
+    ".zip",".7z",".rar",".tar",".gz",
+    ".js",".bat",".cmd",".ps1",".vbs",
+    ".ppt",".pptx",".wps",".txt",".rtf",
+    ".pdf",".xls",".xlsx",".doc",".docx",
+    ".jpg",".jpeg",".png",".webp",".gif",
+    ".mp3",".wav",".aac",".ogg",".flac",
+    ".mp4",".avi",".mov",".wmv",".mkv",
+    ".aux",".cur",".mui",".ttf",".efi"]

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.0.7',
+version='3.2.7',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,157 +1,46 @@
 # PYAS (Python Antivirus Software)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## Readme Language
 
-[繁體中文](https://github.com/zackzheng1121/PYAS/blob/main/README_zh.md)
+繁體中文 : https://github.com/87owo/PYAS/blob/main/README_zh_TW.md
 
-## File Information
-
-PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
-
-PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
-
-PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
-
-PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
-
-PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
-
-PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
-
-PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
-
-PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
+简体中文 : https://github.com/87owo/PYAS/blob/main/README_zh_CN.md
 
 ## Requirements
 
-Use pip install requirements to install import module
-
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install pefile==2023.2.7
+pip install pyperclip==1.8.2
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
-## Hash Scanning
-
-Use Qihoo 360 cloud service to scan known malicious files
+## File Information
 
 ```
-import hashlib, requests
-import xml.etree.ElementTree as xmlet
-
-def hash_scan(file):
-    try:
-        with open(file, "rb") as f:
-            text = str(hashlib.md5(f.read()).hexdigest())
-        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
-        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
-        if response.status_code == 200:
-            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
-            if level > 50:
-                return "Virus"
-            elif level <= 10:
-                return "Safe"
-            return "Unknown"
-        return f"Error: {response.status_code}"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = hash_scan("path to file")
-print(info)
-```
-
-## Pefile Scanning
-
-Get the pefile file function import table for scanning
-
-```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## Process Detect
-
-Show the new process name, file path, cmd line, pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_processes = set()
-    for p in psutil.process_iter():
-        if p.pid not in existing_processes:
-            existing_processes.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        for p in psutil.process_iter():
-            try:
-                if p.pid not in existing_processes:
-                    existing_processes.add(p.pid)
-                    name, file, cmd = p.name(), p.exe(), p.cmdline()
-                    print(f"Name: {name}")
-                    print(f"File: {file}")
-                    print(f"Pid: {p.pid}")
-                    print(f"Cmd: {cmd}")
-                elif not psutil.pid_exists(p.pid):
-                    existing_processes.remove(p.pid)
-            except:
-                pass
-
-proc_detect()
-```
-
-## File Detect
-
-Monitor file changes under the specified path
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/ (Protect driver and Microsoft runtime)
+│   └── ...
+│
+├── Engine/ (Deep learn model and Yara database)
+│   └── ...
+│
+├── Exten/ (Exten tools and System repair tools)
+│   └── ...
+│
+├── PYAS.py (Main PYAS program with qtui interaction and protect function)
+├── PYAS_Engine.py (Deep learning predict and yara rules file scanner)
+├── PYAS_Suffixes.py (including scan file suffixes and common suffixes)
+├── PYAS_Interface.py (Qt designer ui, must be matched with the main program)
+├── PYAS_Resource.py (status pictures, icon packages, and button icons)
+├── PYAS_Language.py (Traditional Chinese, Simplified Chinese and English)
+├── PYAS_Version.py (file information, version information, original name)
+└── ...
 ```
 
 ## Official Website
@@ -160,17 +49,26 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
+## Microsoft Runtime
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
+## PYAS Driver
+
+https://github.com/0sha0/PYAS_Protection
+
 ## MIT license
 
 https://github.com/87owo/PYAS/blob/main/LICENSE.md
 
 ## Support System
 
-Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
+Windows 8.1, 10, 11 (64-bit), Ram 500MB, Rom 200MB or higher
 
 Other systems may experience software malfunctions or crash
 
 ## Special Thanks
-360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
 
-Copyright© 2020~2024 PYAS Security By 87owo
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
+
+Copyright© 2020~2025 PYAS Security By 87owo

README_zh.md

@@ -1,167 +0,0 @@
-# PYAS (Python 防毒軟體)
-
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/153bcad9-18ab-4c81-bcb6-186434d0ef1b)
-
-## 文件訊息
-
-PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
-
-PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
-
-PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
-
-PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
-
-PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
-
-PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
-
-PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
-
-PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
-
-## 要求
-
-使用 pip install requirements 來安裝需要的模組
-
-```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
-```
-
-## 哈希掃描
-
-使用奇虎360雲端服務掃描已知惡意文件
-
-```
-import hashlib, requests
-import xml.etree.ElementTree as xmlet
-
-def hash_scan(file):
-    try:
-        with open(file, "rb") as f:
-            text = str(hashlib.md5(f.read()).hexdigest())
-        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
-        response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
-        if response.status_code == 200:
-            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
-            if level > 50:
-                return "Virus"
-            elif level <= 10:
-                return "Safe"
-            return "Unknown"
-        return f"Error: {response.status_code}"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = hash_scan("path to file")
-print(info)
-```
-
-## 文件掃描
-
-取得pefile檔案函數導入表進行掃描
-
-```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 進程偵測
-
-顯示新進程名稱、檔案路徑、cmd 行、pid
-```
-import psutil, time
-
-def proc_detect():
-    existing_processes = set()
-    for p in psutil.process_iter():
-        if p.pid not in existing_processes:
-            existing_processes.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        for p in psutil.process_iter():
-            try:
-                if p.pid not in existing_processes:
-                    existing_processes.add(p.pid)
-                    name, file, cmd = p.name(), p.exe(), p.cmdline()
-                    print(f"Name: {name}")
-                    print(f"File: {file}")
-                    print(f"Pid: {p.pid}")
-                    print(f"Cmd: {cmd}")
-            except:
-                pass
-
-proc_detect()
-```
-
-## 檔案偵測
-
-監控指定路徑下的檔案變化
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
-```
-
-## 官方網頁
-
-https://pyantivirus.wixsite.com/pyas
-
-https://github.com/87owo/PYAS
-
-## 開源許可證
-
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
-
-## 支援的系統
-
-Windows 8.1, 10, 11 (64-bit),記憶體 1GB, 磁碟容量 1GB 或更高
-Other systems may experience software malfunctions or crash
-
-## Special Thanks
-360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
-
-Copyright© 2020~2024 PYAS Security By 87owo

README_zh_CN.md

@@ -0,0 +1,68 @@
+# PYAS (Python 杀毒软件)
+
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
+
+## 安装要求
+
+```
+pip install pefile==2023.2.7
+pip install pyperclip==1.8.2
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
+```
+
+## 文件信息
+
+```
+PYAS/
+├── Driver/ (驱动保护和微软运行库)
+│   └── ...
+│
+├── Engine/ (深度学习和规则数据库)
+│   └── ...
+│
+├── Exten/ (扩展功能与系统修复工具)
+│   └── ...
+│
+├── PYAS.py (PYAS主程序含界面交互与保护功能)
+├── PYAS_Engine.py (深度学习预测和规则扫描器)
+├── PYAS_Suffixes.py (获取扫描或事件文件的后缀)
+├── PYAS_Interface.py (搭配主程序的Qt设计介面)
+├── PYAS_Resource.py (状态图片和图标和按钮图片)
+├── PYAS_Language.py (繁体中文和简体中文和英文翻译)
+├── PYAS_Version.py (版本和讯息名称和打包文件名)
+└── ...
+```
+
+## 官方网页
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 微软运行库
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
+## 驱动程序
+
+https://github.com/0sha0/PYAS_Protection
+
+## 开源协议
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 支援系统
+
+Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
+
+其他系统或版本可能会遇到软体功能故障或程序崩溃
+
+## 特别感谢
+
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
+
+Copyright© 2020~2025 PYAS Security By 87owo

README_zh_TW.md

@@ -0,0 +1,68 @@
+# PYAS (Python 防毒軟體)
+
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
+
+## 安裝要求
+
+```
+pip install pefile==2023.2.7
+pip install pyperclip==1.8.2
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
+```
+
+## 檔案資訊
+
+```
+PYAS/
+├── Driver/ (驅動防護和微軟運行庫)
+│   └── ...
+│
+├── Engine/ (深度學習和規則數據庫)
+│   └── ...
+│
+├── Exten/ (擴展功能與系統修復工具)
+│   └── ...
+│
+├── PYAS.py (PYAS主程序含介面交互與防護功能)
+├── PYAS_Engine.py (深度學習預測和規則掃描器)
+├── PYAS_Suffixes.py (獲取掃描或事件檔案的副檔名)
+├── PYAS_Interface.py (搭配主程序的Qt設計介面)
+├── PYAS_Resource.py (狀態圖片圖標和按鈕圖片)
+├── PYAS_Language.py (繁體中文和簡體中文和英文翻譯)
+├── PYAS_Version.py (檔案版本和訊息名稱和打包檔名)
+└── ...
+```
+
+## 官方網頁
+
+https://pyantivirus.wixsite.com/pyas
+
+https://github.com/87owo/PYAS
+
+## 微軟運行庫
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
+## 驅動程式
+
+https://github.com/0sha0/PYAS_Protection
+
+## 開源協議
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
+## 支援系統
+
+Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
+
+其他系統或版本可能會遇到軟體功能故障或程序崩潰
+
+## 特別感謝
+
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
+
+Copyright© 2020~2025 PYAS Security By 87owo