Add files via upload

Exten/Download_Link.txt

@@ -0,0 +1,11 @@
+[hollows_hunter]
+
+https://github.com/hasherezade/hollows_hunter/releases
+
+[pe_sieve]
+
+https://github.com/hasherezade/pe-sieve/releases
+
+[bitdefender]
+
+https://github.com/87owo/bdc/tree/main/bitdefender

Model/PYAS_Model.json

@@ -1 +1 @@
-{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 27853809242729492000984914092533936796891917926358854729439436487683423285261, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 60491018752293550079699763462944244393253888103551546202593483014975813742967, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 6759146298068049614085390992799666053918974602489525613718797088468975708017, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 5354562433688861244299028006341553420425390015040147574513776499404802540118, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 817984956081990458969224676381868506770627801582748844000835755782736667191, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 2916561284514958799877078174216081002558870786437593202464334407456915288119, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 14623491695050192413097067629676318500123044497134202517578785087180871258165, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 79047998258892679051555952202178856054614923426747250310189496005785954516966, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707Line truncated
+{"Unknown": [59361295766927921263572072001677546892988818127554310688483531901728654248638, 110146453841778647644166243240178520536267161301604245683743524756419353678059], "White": [37818885244835446256584092883046666135310645230383968345516924743398787357048, 10034220084157156036025657182253677958809969876761493145101084060869839222562, 30518116137695254451083185640456062095466770588446551409776635626107619414618, 32296846483328285395942578479721462990874016817205213442337788571183455371823, 7830743514133643609056906037298883461849915236781505447055526355864156291200, 66766369194849842633273514861399590319048611179974316399223444661664643713116, 18024800263813114636032380772014473234719112317372083568645028513107740333097, 74141606019826610219493597417961411759319222262715747781530975858236840023868, 74141606019826815907563358349687985248520689328534980167895213718026559231805, 84904953027467628079124577278247620589188804906104233927770018096001490752110, 8646406253524489099322407463506197113190436222475229989113834496391933123177, 14801368362037157341349744372212469879911751347796432685445396742546138510527, 15894490895528857350444326816435305421376809085313851765402083488609039987721, 37852894007605849489952583567731004955434986444474399453030571998864861533218, 16007569107674673947537681801726481062730991620317178346097127572834907239433, 102633388988062357389851477595292272698878804202828382582477913233599597957741, 17029311058216545115926699358460765117955315322529387410067408192737238368209, 39401039939065971500355367115014580663179206620663500436171381542235009920591, 39402615232602811526308130026613523510869149389568467968898508123483647642239, 57593384293411341144654776428448217689576185693893444758365608040444018144505, 63841662487000088869831851027369141702999289853288215195372474540672652085448, 100721919041136871706536474323993763361887751761059594887258624287814536108709, 12431907255329162502980182262719209577155616944639082427720737656418745431535, 16038275485812550557063681634389014806352822616164076985257408379680031643065, 68405324198120933521050931648638618947369327745692667495883448104257901548799, 3460329908515126754637554126738713109961637027606158804093048546688108127547, 16106981637946225230178918605857052277649628614369112854963742434861832205050, 8448811436767749824740074881636806461590780110247030409064405873065872770413, 62657160528879197025196349384429226461581551965396254612319502660762849907110, 37362668350600312578741767096565745429284532702326298726894669202918919902841, 97046915551360110482543666063995603342646642693483132604859660767038789191075, 37750578778823141127513876578977618263821979566798398805475475810686050547035, 8899077763068952446283397850676779377182951563966752995966724510608273388087, 1430788410790588948768223740715242946047023771808936478434300982280927461576, 43245632164876912500721802614250505089424972269458388051200703985150176517646, 26527792976855638931546424443043598748359981077520025569533358689339312846119, 10034220138179482424453837496189500567990928858614529504432172551818139334184, 75535532059353249758793259643426543087630044975480683666280772562494352167023, 12532294779822530931293583148085641907686342350743362041338935273017351016633, 8958249342307639770700867008480561646791855695021266630701977360245761685282, 75528466396530722925390012197706855368372892751585509291513494409511440650351, 9011044384631604789230921306476923910566615376824882388358022480957734033082, 45182323877874305146934038679574733861884144375370883472937974036860962247097, 23700234601492692370460015976854345996007097410933046970328742403104651126256, 56970414078810407267232512181524454646035403709151864648837102879926562472603, 59336812026319177033098081135706956314151111314270392143237555422332208264206, 36707091377963660336346311143415935299335610930952028052854530836452557240295, 10202126012237964170766432051989140199469409759127192355002576100131006440555, 72691028651131468636833670875287650881223005399741112439972503306595446550906, 7689046024044190685500958862986168840617876576117297404374223308117258686587, 9583067470336071575558967777508800030690386213881092335354663342137641199143, 15970718419268871463478468058858796238959885761999117728999272834817179322168, 37903470032839160921304992353748519593005839718701840574746932332397170697534, 10723799110029366222468551244518699011059498785302648324191607904247307866219, 1651465247876746049352538052494320238190633259932155654005236273442992146011, 37535310575907540138572260167287591050679295649847144262742970882242576643629, 107406046477759675380805009872206073473308094017534113788736360913659778137364, 8648260909849054742383860213694016683253742610217956634993385753930945566715, 91094487239729265765473251155982579898413742412111963107157224383047507474015, 45128834383092335423669974709008139367933699120247789381146368929605724538431, 21573189465171437665670533096295878202170520697880590329439115191190251349169, 776778Line truncated

PYAS_Engine.py

@@ -1,5 +1,4 @@
 import time, json, hashlib, numpy
-from collections import Counter
 
 class ListSimHash:
     def __init__(self):
@@ -19,30 +18,32 @@ class ListSimHash:
     def get_model(self, label):
         return self.model[label]
 
-    def train_model(self, label, data):
+    def train_model(self, label, data, batch_size=10000):
         start = time.time()
         print(f"Convert {label}")
         if label not in self.model:
             self.model[label] = []
         for i, x in enumerate(data, 1):
-            self.model[label].append(self.build_text(x))
+            build_text = self.build_text(x, batch_size)
+            self.model[label].append(build_text)
             used = "{0:.2f}".format(time.time()-start)
             prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
             self.progress_bar(i, len(data), prefix, suffix)
 
-    def build_text(self, content):
-        sums, batch, count = [], [], 0
-        features = dict(Counter(sorted(content)))
-        for f, w in features.items():
-            count += w
-            batch.append(hashlib.sha256(json.dumps(f).encode('utf-8')).digest() * w)
-            if len(batch) >= 10000:
+    def build_text(self, content, batch_size):
+        sums, batch, count = [], [], {}
+        for index, char in enumerate(content):
+            count[char] = count.setdefault(char, 0) + 1
+            combined_input = f"{count[char]}_{char}"
+            hashes = hashlib.sha256(combined_input.encode('utf-8'))
+            batch.append(hashes.digest())
+            if len(batch) >= batch_size:
                 sums.append(self.sum_hashes(batch))
                 batch = []
         if batch:
             sums.append(self.sum_hashes(batch))
-        combined_sums = numpy.sum(sums, 0)
-        v = numpy.packbits(combined_sums > count / 2).tobytes()
+        combined_sums = numpy.sum(sums, 0) > len(content) / 2
+        v = numpy.packbits(combined_sums).tobytes()
         return int.from_bytes(v, 'big')
 
     def sum_hashes(self, digests):
@@ -57,9 +58,9 @@ class ListSimHash:
         bar = fill * filled_length + ' ' * (length - filled_length)
         print(f'\r{prefix: <15} |{bar}| {percent_string}% {suffix}', end=end_char)
 
-    def predict_all(self, query):
+    def predict_all(self, query, batch_size=10000):
         label_similarities = {}
-        query_hash = self.build_text(query)
+        query_hash = self.build_text(query, batch_size)
         for label in self.model:
             max_similarity = 0
             for data_point in self.model[label]:
@@ -69,9 +70,9 @@ class ListSimHash:
             label_similarities[label] = max_similarity
         return label_similarities
 
-    def predict(self, query):
+    def predict(self, query, batch_size=10000):
         max_similarity, max_label = 0, None
-        query_hash = self.build_text(query)
+        query_hash = self.build_text(query, batch_size)
         for label in self.model:
             for data_point in self.model[label]:
                 similarity = self.similar(data_point, query_hash)

PYAS_Extension.py

@@ -1,8 +1,46 @@
-slist = [".exe",".dll",".com",".msi",".scr",
-         ".js",".bat",".cmd",".ps1",".vbs"]
+from subprocess import Popen, PIPE
+import os, re, sys
 
-alist = [".ppt",".pptx",".wps",".txt",".rtf",
-         ".pdf",".xls",".xlsx",".doc",".docx",
-         ".jpg",".jpeg",".png",".webp",".gif",
-         ".mp3",".wav",".aac",".ogg",".flac",
-         ".mp4",".avi",".mov",".wmv",".mkv"]
+class ExtenRules:
+    def __init__(self):
+        self.pyas = sys.argv[0].replace("\\", "/")
+        self.dir = os.path.dirname(self.pyas)
+        self.exten = os.path.join(self.dir, "Exten")
+
+    def bdc_scan(self, file):
+        try:
+            check_file = file.replace("\\", "/")
+            if ":/Windows" not in check_file and ":/Program" not in check_file:
+                cmd = f'"{self.exten}\\bitdefender\\bdc.exe" "{file}"'
+                p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True).wait()
+                for match in re.finditer(r'(?P<filename>[^\s]+)\s+infected:\s+(?P<virusname>.+)', p.communicate()[0]):
+                    return match.groupdict()
+            return False
+        except:
+            return False
+
+    def hollows_hunter(self, p):
+        try:
+            check_file = p.exe().replace("\\", "/")
+            if ":/Windows" not in check_file and ":/Program" not in check_file:
+                cmd = f'"{self.exten}\\hollows_hunter\\hollows_hunter.exe" /ofilter 2 /pid "{p.pid}"'
+                p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True).wait()
+                return 'Detected' in p.communicate()[0]
+            return False
+        except:
+            return False
+
+    def pe_sieve(self, p):
+        try:
+            check_file = p.exe().replace("\\", "/")
+            if ":/Windows" not in check_file and ":/Program" not in check_file:
+                cmd = f'"{self.exten}\\pe_sieve\\pe_sieve.exe" /ofilter 2 /pid "{p.pid}"'
+                p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True).wait()
+                output = p.communicate()[0]
+                for match in re.finditer(r'(\d+)', output):
+                    line = output[:match.start()].split('\n')[-1].strip().replace(':', '')
+                    if line in ["Implanted shc", "Replaced", "IAT Hooks"] and int(match.group(1)) > 0:
+                        return line
+            return False
+        except:
+            return False

PYAS_Interface.py

@@ -1569,49 +1569,49 @@ class Ui_MainWindow(object):
         self.Language_illustrate.raise_()
         self.Language_Choose_widget.raise_()
         self.Language_title.raise_()
-        self.Show_cloud_services = QtWidgets.QWidget(self.Setting_widget)
-        self.Show_cloud_services.setGeometry(QtCore.QRect(30, 130, 781, 81))
-        self.Show_cloud_services.setAcceptDrops(False)
-        self.Show_cloud_services.setAutoFillBackground(False)
-        self.Show_cloud_services.setObjectName("Show_cloud_services")
-        self.cloud_services_title = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
+        self.Show_extension_kit = QtWidgets.QWidget(self.Setting_widget)
+        self.Show_extension_kit.setGeometry(QtCore.QRect(30, 130, 781, 81))
+        self.Show_extension_kit.setAcceptDrops(False)
+        self.Show_extension_kit.setAutoFillBackground(False)
+        self.Show_extension_kit.setObjectName("Show_extension_kit")
+        self.extension_kit_title = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(17)
         font.setBold(False)
         font.setWeight(50)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_title.setFont(font)
-        self.cloud_services_title.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_title.setObjectName("cloud_services_title")
-        self.cloud_services_illustrate = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
+        self.extension_kit_title.setFont(font)
+        self.extension_kit_title.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_title.setObjectName("extension_kit_title")
+        self.extension_kit_illustrate = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_illustrate.setFont(font)
-        self.cloud_services_illustrate.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_illustrate.setScaledContents(False)
-        self.cloud_services_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_illustrate.setWordWrap(True)
-        self.cloud_services_illustrate.setObjectName("cloud_services_illustrate")
-        self.cloud_services_switch_Button = QtWidgets.QPushButton(self.Show_cloud_services)
-        self.cloud_services_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
+        self.extension_kit_illustrate.setFont(font)
+        self.extension_kit_illustrate.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_illustrate.setScaledContents(False)
+        self.extension_kit_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_illustrate.setWordWrap(True)
+        self.extension_kit_illustrate.setObjectName("extension_kit_illustrate")
+        self.extension_kit_switch_Button = QtWidgets.QPushButton(self.Show_extension_kit)
+        self.extension_kit_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
         sizePolicy.setHorizontalStretch(0)
         sizePolicy.setVerticalStretch(0)
-        sizePolicy.setHeightForWidth(self.cloud_services_switch_Button.sizePolicy().hasHeightForWidth())
-        self.cloud_services_switch_Button.setSizePolicy(sizePolicy)
+        sizePolicy.setHeightForWidth(self.extension_kit_switch_Button.sizePolicy().hasHeightForWidth())
+        self.extension_kit_switch_Button.setSizePolicy(sizePolicy)
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_switch_Button.setFont(font)
-        self.cloud_services_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
-        self.cloud_services_switch_Button.setStyleSheet("QPushButton\n"
+        self.extension_kit_switch_Button.setFont(font)
+        self.extension_kit_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
+        self.extension_kit_switch_Button.setStyleSheet("QPushButton\n"
 "{\n"
 "    border:none;\n"
 "    background-color:rgb(230,230,230);\n"
@@ -1622,12 +1622,12 @@ class Ui_MainWindow(object):
 "    background-color:rgb(220,220,220);\n"
 "}\n"
 "")
-        self.cloud_services_switch_Button.setIconSize(QtCore.QSize(16, 16))
-        self.cloud_services_switch_Button.setCheckable(False)
-        self.cloud_services_switch_Button.setObjectName("cloud_services_switch_Button")
-        self.cloud_services_illustrate.raise_()
-        self.cloud_services_switch_Button.raise_()
-        self.cloud_services_title.raise_()
+        self.extension_kit_switch_Button.setIconSize(QtCore.QSize(16, 16))
+        self.extension_kit_switch_Button.setCheckable(False)
+        self.extension_kit_switch_Button.setObjectName("extension_kit_switch_Button")
+        self.extension_kit_illustrate.raise_()
+        self.extension_kit_switch_Button.raise_()
+        self.extension_kit_title.raise_()
         self.Setting_Back = QtWidgets.QPushButton(self.Setting_widget)
         self.Setting_Back.setGeometry(QtCore.QRect(25, 10, 101, 41))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
@@ -1885,9 +1885,9 @@ class Ui_MainWindow(object):
         self.Language_English.setText(_translate("MainWindow", "English"))
         self.Language_Traditional_Chinese.setText(_translate("MainWindow", "繁體中文"))
         self.Language_Simplified_Chinese.setText(_translate("MainWindow", "简体中文"))
-        self.cloud_services_title.setText(_translate("MainWindow", "雲端掃描服務"))
-        self.cloud_services_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
-        self.cloud_services_switch_Button.setText(_translate("MainWindow", "已關閉"))
+        self.extension_kit_title.setText(_translate("MainWindow", "雲端掃描服務"))
+        self.extension_kit_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
+        self.extension_kit_switch_Button.setText(_translate("MainWindow", "已關閉"))
         self.Setting_Back.setText(_translate("MainWindow", "返回"))
         self.Add_White_list_title.setText(_translate("MainWindow", "增加到白名單"))
         self.Add_White_list_illustrate.setText(_translate("MainWindow", "此選項可以選擇檔案並增加到白名單"))

PYAS_Language.py

@@ -4,7 +4,7 @@ translate_dict = {
               "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
               "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
               "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","誤":"误","報":"报",
+              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","開啟":"开启",
               "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
               "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
               "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
@@ -14,25 +14,26 @@ translate_dict = {
               "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
               "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
               "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
-              "強":"强","驅":"驱","為":"为","腳":"脚","增":"增","單":"单","開":"开",
-              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别"},
+              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
+              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","記憶體":"内存",},
     "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
               "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website ",
-              "惡意檔案":"Virus ","惡意軟體":"Malware ","勒索行為":"Ransom ",
-              "惡意腳本":"Script ","惡意行為":"Behavior ","可疑軟體":"Suspicious ",
+              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
+              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ",
               "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
               "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
               "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
               "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
               "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
-              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Communication ",
+              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
               "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
               "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
               "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
               "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
               "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
-              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhanced ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
               "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
               "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
               "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
@@ -44,12 +45,15 @@ translate_dict = {
               "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
               "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
               "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-              "增加到":"Add File To ","白名單":"White List ","軟體":"Software ",
-              "增加":"Add","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
+              "增加到":"Add To ","白名單":"White List ","軟體":"Software ","正在":"Start ",
+              "增加":"Add ","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
               "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
               "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
               "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
-              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
               "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
               "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
-              "自動":"Auto ","上報":"Report ","分析":"Analysis ","  ":" "}}
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ","與":"With ",
+              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
+              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","追蹤":"Tracking ",
+              "竄改":"Tamper ","靈敏度":"Sensitivity ","第三方":"Other ","  ":" "}}

PYAS_Suffixes.py

@@ -0,0 +1,11 @@
+slist = [".exe",".dll",".com",".msi",".scr",
+         ".js",".bat",".cmd",".ps1",".vbs"]
+
+alist = [".exe",".dll",".zip",".7z",".rar",
+         ".js",".bat",".cmd",".ps1",".vbs",
+         ".ppt",".pptx",".wps",".txt",".rtf",
+         ".pdf",".xls",".xlsx",".doc",".docx",
+         ".jpg",".jpeg",".png",".webp",".gif",
+         ".mp3",".wav",".aac",".ogg",".flac",
+         ".mp4",".avi",".mov",".wmv",".mkv",
+         ".aux",".cur",".mui",".ttf",".efi"]

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.2',
+version='3.1.5',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -4,54 +4,12 @@
 
 ## Readme Language
 
-[繁體中文](https://github.com/87owo/PYAS/blob/main/README_zh_TW.md) , 
-[简体中文](https://github.com/87owo/PYAS/blob/main/README_zh_CN.md)
+繁體中文 : https://github.com/87owo/PYAS/blob/main/README_zh_TW.md
 
-## File Information
-
-PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
-
-PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
-
-PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
-
-PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
-
-PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
-
-PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
-
-PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
-
-PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
-
-## Dir Information
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+简体中文 : https://github.com/87owo/PYAS/blob/main/README_zh_CN.md
 
 ## Requirements
 
-Use pip install requirements to install import module
-
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -61,92 +19,37 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## Pefile Scanning
-
-Get the pefile file function import table for scanning
+## File Information
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## Process Detect
-
-Show the new process name, file path, cmd line, pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## File Detect
-
-Monitor file changes under the specified path
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys -------> Extension Kit (self protection driver for pyas by 0sha0)
+│   └── ...
+│
+├── Exten/
+│   ├── bitdefender/ ----------> Extension Kit (bitdefender windows console scan engine)
+│   ├── pe_sieve/ -------------> Extension Kit (pe sieve windows console memory engine)
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json -------> Virus Database (the database must be in the specified dir)
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar ---------> Yara Rules (yara rules in plain text format)
+│   ├── Yara_Rules.yrc ---------> Compile Rules (yara rules in compiled format)
+│   └── ...
+│
+├── PYAS.* ---------------------> Main PYAS Program (including animation, scan, protect functions, ...)
+├── PYAS_Engine.py -------------> Conversion Database (used to transform profiles and forecast data)
+├── PYAS_Suffixes.py -----------> File Suffixes (including scanned file suffixes and common suffixes)
+├── PYAS_Extension.py ----------> Extension Kit (extension scanners developed by other developers)
+├── PYAS_Interface.py ----------> PyQt5 Interface (use QT designer, must be matched with the main program)
+├── PYAS_Resource.py -----------> PyQt5 Resource (status pictures, icon packages, button icons, ...)
+├── PYAS_Language.py -----------> Translate Dict (Traditional Chinese, Simplified Chinese, English)
+├── PYAS_Version.py ------------> Pyinstaller (file information, version information, original name, ...)
+└── ...
 ```
 
 ## Official Website

README_zh_CN.md

@@ -2,51 +2,8 @@
 
 ![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
 
-## 文件信息
-
-PYAS.py -> PYAS主程式（包括动画、扫描、保护功能等）
-
-PYAS_Engine.py -> 转换资料库（用于相互转换资料库字典和清单）
-
-PYAS_Extension.py -> 副文件名（包括扫描文件副文件名和常用副文件名）
-
-PYAS_Model.* -> 病毒库（病毒库必须放在同一目录下）
-
-PYAS_Interface.py -> PyQt5界面（由QT设计师设计，必须与主程式相符）
-
-PYAS_Resource.py -> PyQt5资源（状态图片、图示包、按钮图示等）
-
-PYAS_Language.py -> 翻译字典（繁体中文、简体中文、英文）
-
-PYAS_Version.py -> Pyinstaller资讯（文件资讯、版本资讯、原名等）
-
-## 目录信息
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
-
 ## 安装要求
 
-使用 pip install requirements 来安装需要的模组
-
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -56,92 +13,37 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## 文件扫描
-
-取得pefile文件函数导入表进行扫描
+## 文件信息
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 进程监控
-
-显示新进程名称、文件路径、cmd 行、pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 文件监控
-
-监控指定路径下的文件变化
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys -------> 驱动程序 (0sha0 为 pyas 提供的自我保护驱动程序)
+│   └── ...
+│
+├── Exten/
+│   ├── bitdefender/ ----------> 扩展套件 (bitdefender windows 控制台扫描引擎)
+│   ├── pe_sieve/ -------------> 扩展套件 (pe sieve windows 控制台内存引擎)
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json -------> 病毒数据库 (数据库必须位于指定目录中)
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar ---------> Yara 规则 (纯文本格式的 yara 规则)
+│   ├── Yara_Rules.yrc ---------> 编译规则 (编译格式的 yara 规则)
+│   └── ...
+│
+├── PYAS.* ---------------------> PYAS主程序（包含动画、扫描、保护等功能...）
+├── PYAS_Engine.py -------------> 转换数据库（用于转换剖面图和预报数据）
+├── PYAS_Suffixes.py -----------> 文件后缀（包含扫描文件后缀和常用后缀）
+├── PYAS_Extension.py ----------> 扩展工具包（其他开发者开发的扩展扫描器）
+├── PYAS_Interface.py ----------> PyQt5界面（使用QT设计器，需与主程序搭配使用）
+├── PYAS_Resource.py -----------> PyQt5资源（状态图片、图标包、按钮图标...）
+├── PYAS_Language.py -----------> 翻译词典（繁体中文、简体中文、英文）
+├── PYAS_Version.py ------------> 安裝信息（文件信息、版本信息、原名，...）
+└── ...
 ```
 
 ## 官方网页

README_zh_TW.md

@@ -2,51 +2,8 @@
 
 ![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
 
-## 檔案資訊
-
-PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
-
-PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
-
-PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
-
-PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
-
-PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
-
-PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
-
-PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
-
-PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
-
-## 目錄資訊
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
-
 ## 安裝要求
 
-使用 pip install requirements 來安裝需要的模組
-
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -56,90 +13,37 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## 檔案掃描
-
-取得pefile檔案函數導入表進行掃描
+## 檔案資訊
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 進程監控
-
-顯示新進程名稱、檔案路徑、cmd 行、pid
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 檔案監控
-
-監控指定路徑下的檔案變化
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys -------> 驅動程式 (0sha0 為 pyas 提供的自我保護驅動程式)
+│   └── ...
+│
+├── Exten/
+│   ├── bitdefender/ ----------> 擴充套件 (bitdefender windows 控制台掃描引擎)
+│   ├── pe_sieve/ -------------> 擴充套件 (pe sieve windows 控制台記憶體引擎)
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json -------> 病毒資料庫 (資料庫必須位於指定目錄)
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar ---------> Yara 規則 (純文字格式的 yara 規則)
+│   ├── Yara_Rules.yrc ---------> 編譯規則 (編譯格式的 yara 規則)
+│   └── ...
+│
+├── PYAS.* ---------------------> PYAS主程式（包含動畫、掃描、保護等功能...）
+├── PYAS_Engine.py -------------> 轉換資料庫（用於轉換剖面圖和預報資料）
+├── PYAS_Suffixes.py -----------> 文件後綴（包含掃描文件後綴和常用後綴）
+├── PYAS_Extension.py ----------> 擴充工具包（其他開發者開發的擴充掃描器）
+├── PYAS_Interface.py ----------> PyQt5介面（使用QT設計器，需與主程式搭配使用）
+├── PYAS_Resource.py -----------> PyQt5資源（狀態圖片、圖示包、按鈕圖示...）
+├── PYAS_Language.py -----------> 翻譯字典（繁體中文、簡體中文、英文）
+├── PYAS_Version.py ------------> 安裝資訊（檔案資訊、版本資訊、原名，...）
+└── ...
 ```
 
 ## 官方網頁