Update README.md

Engine/Model/PYAS_Model.json

@@ -0,0 +1,12 @@
+{
+    "Suffix": [".com", ".exe", ".dll", ".sys", ".scr",
+               ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], 
+
+    "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], 
+
+    "Detect": ["Pefile/General", "Script/General"],  
+
+    "Pixels": [224, 224], 
+
+    "Values": 90
+}

Engine/Rules/PYAS_Rules_A1.yar

@@ -1,8 +1,8 @@
 import "pe"
 
-rule PYAS_Rules_A_1 {
+rule General_1 {
    meta:
-      description = "PYAS_Rules_A_1"
+      description = "1"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -57,9 +57,9 @@ rule PYAS_Rules_A_1 {
       1 of ($x*) and 8 of them
 }
 
-rule PYAS_Rules_A_2 {
+rule General_2 {
    meta:
-      description = "PYAS_Rules_A_2"
+      description = "2"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -82,9 +82,9 @@ rule PYAS_Rules_A_2 {
       8 of them
 }
 
-rule PYAS_Rules_A_3 {
+rule General_3 {
    meta:
-      description = "PYAS_Rules_A_3"
+      description = "3"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -106,7 +106,7 @@ rule PYAS_Rules_A_3 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_4 {
+rule General_4 {
    meta:
       description = "PYAS_Rules_A4"
       author = "PYAS Security"
@@ -124,9 +124,9 @@ rule PYAS_Rules_A_4 {
       ($x1 and $x2) and 5 of them
 }
 
-rule PYAS_Rules_A_5 {
+rule General_5 {
    meta:
-      description = "PYAS_Rules_A_5"
+      description = "5"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -147,9 +147,9 @@ rule PYAS_Rules_A_5 {
       $x1 and 3 of them
 }
 
-rule PYAS_Rules_A_6 {
+rule General_6 {
    meta:
-      description = "PYAS_Rules_A_6"
+      description = "6"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -214,9 +214,9 @@ rule PYAS_Rules_A_6 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_7 {
+rule General_7 {
    meta:
-      description = "PYAS_Rules_A_462"
+      description = "7"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -247,9 +247,9 @@ rule PYAS_Rules_A_7 {
       10 of them
 }
 
-rule PYAS_Rules_A_8 {
+rule General_8 {
    meta:
-      description = "PYAS_Rules_A_8"
+      description = "8"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -278,9 +278,9 @@ rule PYAS_Rules_A_8 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_9 {
+rule General_9 {
    meta:
-      description = "PYAS_Rules_A_9"
+      description = "9"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -303,9 +303,9 @@ rule PYAS_Rules_A_9 {
       6 of them
 }
 
-rule PYAS_Rules_A_10 {
+rule General_10 {
    meta:
-      description = "PYAS_Rules_A_10"
+      description = "10"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -329,9 +329,9 @@ rule PYAS_Rules_A_10 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_11 {
+rule General_11 {
    meta:
-      description = "PYAS_Rules_A_11"
+      description = "11"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -349,9 +349,9 @@ rule PYAS_Rules_A_11 {
       6 of them
 }
 
-rule PYAS_Rules_A_12 {
+rule General_12 {
    meta:
-      description = "PYAS_Rules_A_12"
+      description = "12"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -376,9 +376,9 @@ rule PYAS_Rules_A_12 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_13 {
+rule General_13 {
    meta:
-      description = "PYAS_Rules_A_13"
+      description = "13"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -404,9 +404,9 @@ rule PYAS_Rules_A_13 {
       6 of them
 }
 
-rule PYAS_Rules_A_14 {
+rule General_14 {
    meta:
-      description = "PYAS_Rules_A_14"
+      description = "14"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -430,9 +430,9 @@ rule PYAS_Rules_A_14 {
       8 of them
 }
 
-rule PYAS_Rules_A_15 {
+rule General_15 {
    meta:
-      description = "PYAS_Rules_A_15"
+      description = "15"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -459,9 +459,9 @@ rule PYAS_Rules_A_15 {
       8 of them
 }
 
-rule PYAS_Rules_A_16 {
+rule General_16 {
    meta:
-      description = "PYAS_Rules_A_16"
+      description = "16"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -485,9 +485,9 @@ rule PYAS_Rules_A_16 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_17 {
+rule General_17 {
    meta:
-      description = "PYAS_Rules_A_17"
+      description = "17"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -508,9 +508,9 @@ rule PYAS_Rules_A_17 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_18 {
+rule General_18 {
    meta:
-      description = "PYAS_Rules_A_18"
+      description = "18"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -531,9 +531,9 @@ rule PYAS_Rules_A_18 {
       6 of them
 }
 
-rule PYAS_Rules_A_19 {
+rule General_19 {
    meta:
-      description = "PYAS_Rules_A_19"
+      description = "19"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -560,9 +560,9 @@ rule PYAS_Rules_A_19 {
       ($x1 and $x2) and 8 of them
 }
 
-rule PYAS_Rules_A_20 {
+rule General_20 {
    meta:
-      description = "PYAS_Rules_A_20"
+      description = "20"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -589,9 +589,9 @@ rule PYAS_Rules_A_20 {
       8 of them
 }
 
-rule PYAS_Rules_A_21 {
+rule General_21 {
    meta:
-      description = "PYAS_Rules_A_21"
+      description = "21"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -616,9 +616,9 @@ rule PYAS_Rules_A_21 {
       8 of them
 }
 
-rule PYAS_Rules_A_22 {
+rule General_22 {
    meta:
-      description = "PYAS_Rules_A_22"
+      description = "22"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -635,10 +635,9 @@ rule PYAS_Rules_A_22 {
       6 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_23 {
+rule General_23 {
    meta:
-      description = "PYAS_Rules_A_23"
+      description = "23"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -658,10 +657,9 @@ rule PYAS_Rules_A_23 {
       7 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_24 {
+rule General_24 {
    meta:
-      description = "PYAS_Rules_A_24"
+      description = "24"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -688,9 +686,9 @@ rule PYAS_Rules_A_24 {
       6 of them
 }
 
-rule PYAS_Rules_A_25 {
+rule General_25 {
    meta:
-      description = "PYAS_Rules_A_25"
+      description = "25"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -716,9 +714,9 @@ rule PYAS_Rules_A_25 {
       $x1 and 5 of them
 }
 
-rule PYAS_Rules_A_26 {
+rule General_26 {
    meta:
-      description = "PYAS_Rules_A_26"
+      description = "26"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -742,9 +740,9 @@ rule PYAS_Rules_A_26 {
       8 of them
 }
 
-rule PYAS_Rules_A_27 {
+rule General_27 {
    meta:
-      description = "PYAS_Rules_A_27"
+      description = "27"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -768,9 +766,9 @@ rule PYAS_Rules_A_27 {
       6 of them
 }
 
-rule PYAS_Rules_A_28 {
+rule General_28 {
    meta:
-      description = "PYAS_Rules_A_28"
+      description = "28"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -801,9 +799,9 @@ rule PYAS_Rules_A_28 {
       8 of them
 }
 
-rule PYAS_Rules_A_29 {
+rule General_29 {
    meta:
-      description = "PYAS_Rules_A_29"
+      description = "29"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -837,9 +835,9 @@ rule PYAS_Rules_A_29 {
       6 of them
 }
 
-rule PYAS_Rules_A_30 {
+rule General_30 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "30"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -858,9 +856,9 @@ rule PYAS_Rules_A_30 {
       6 of them
 }
 
-rule PYAS_Rules_A_31 {
+rule General_31 {
    meta:
-      description = "PYAS_Rules_A_31"
+      description = "31"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -878,9 +876,9 @@ rule PYAS_Rules_A_31 {
       6 of them
 }
 
-rule PYAS_Rules_A_32 {
+rule General_32 {
    meta:
-      description = "PYAS_Rules_A_32"
+      description = "32"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -909,9 +907,9 @@ rule PYAS_Rules_A_32 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_33 {
+rule General_33 {
    meta:
-      description = "PYAS_Rules_A_33"
+      description = "33"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -937,9 +935,9 @@ rule PYAS_Rules_A_33 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_34 {
+rule General_34 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "34"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -965,9 +963,9 @@ rule PYAS_Rules_A_34 {
       8 of them
 }
 
-rule PYAS_Rules_A_35 {
+rule General_35 {
    meta:
-      description = "PYAS_Rules_A_35"
+      description = "35"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -996,9 +994,9 @@ rule PYAS_Rules_A_35 {
       6 of them
 }
 
-rule PYAS_Rules_A_36 {
+rule General_36 {
    meta:
-      description = "PYAS_Rules_A_36"
+      description = "36"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1023,9 +1021,9 @@ rule PYAS_Rules_A_36 {
       6 of them
 }
 
-rule PYAS_Rules_A_37 {
+rule General_37 {
    meta:
-      description = "PYAS_Rules_A_37"
+      description = "37"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1053,9 +1051,9 @@ rule PYAS_Rules_A_37 {
       6 of them
 }
 
-rule PYAS_Rules_A_38 {
+rule General_38 {
    meta:
-      description = "PYAS_Rules_A_38"
+      description = "38"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1083,9 +1081,9 @@ rule PYAS_Rules_A_38 {
       6 of them
 }
 
-rule PYAS_Rules_A_39 {
+rule General_39 {
    meta:
-      description = "PYAS_Rules_A_39"
+      description = "39"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1104,9 +1102,9 @@ rule PYAS_Rules_A_39 {
       6 of them
 }
 
-rule PYAS_Rules_A_40 {
+rule General_40 {
    meta:
-      description = "PYAS_Rules_A_40"
+      description = "40"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1136,9 +1134,9 @@ rule PYAS_Rules_A_40 {
       8 of them
 }
 
-rule PYAS_Rules_A_41 {
+rule General_41 {
    meta:
-      description = "PYAS_Rules_A_41"
+      description = "41"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1160,9 +1158,9 @@ rule PYAS_Rules_A_41 {
       6 of them
 }
 
-rule PYAS_Rules_A_42 {
+rule General_42 {
    meta:
-      description = "PYAS_Rules_A_42"
+      description = "42"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1182,9 +1180,9 @@ rule PYAS_Rules_A_42 {
       6 of them
 }
 
-rule PYAS_Rules_A_43 {
+rule General_43 {
    meta:
-      description = "PYAS_Rules_A_43"
+      description = "43"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1209,9 +1207,9 @@ rule PYAS_Rules_A_43 {
       8 of them
 }
 
-rule PYAS_Rules_A_44 {
+rule General_44 {
    meta:
-      description = "PYAS_Rules_A_44"
+      description = "44"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1239,9 +1237,9 @@ rule PYAS_Rules_A_44 {
       8 of them
 }
 
-rule PYAS_Rules_A_45 {
+rule General_45 {
    meta:
-      description = "PYAS_Rules_A_45"
+      description = "45"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1268,9 +1266,9 @@ rule PYAS_Rules_A_45 {
       8 of them
 }
 
-rule PYAS_Rules_A_46 {
+rule General_46 {
    meta:
-      description = "PYAS_Rules_A_46"
+      description = "46"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1298,9 +1296,9 @@ rule PYAS_Rules_A_46 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_47 {
+rule General_47 {
    meta:
-      description = "PYAS_Rules_A_47"
+      description = "47"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1329,9 +1327,9 @@ rule PYAS_Rules_A_47 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_48 {
+rule General_48 {
    meta:
-      description = "PYAS_Rules_A_48"
+      description = "48"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1350,9 +1348,9 @@ rule PYAS_Rules_A_48 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_49 {
+rule General_49 {
    meta:
-      description = "PYAS_Rules_A_49"
+      description = "49"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1378,9 +1376,9 @@ rule PYAS_Rules_A_49 {
       3 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_50 {
+rule General_50 {
    meta:
-      description = "PYAS_Rules_A_50"
+      description = "50"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1400,9 +1398,9 @@ rule PYAS_Rules_A_50 {
       $x1 and 6 of them
 }
 
-rule PYAS_Rules_A_51 {
+rule General_51 {
    meta:
-      description = "PYAS_Rules_A_51"
+      description = "51"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1420,9 +1418,9 @@ rule PYAS_Rules_A_51 {
       1 of ($x*) and 4 of them
 }
 
-rule PYAS_Rules_A_52 {
+rule General_52 {
    meta:
-      description = "PYAS_Rules_A_52"
+      description = "52"
       author = "PYAS Security"
       date = "2024-06-13"
    strings:
@@ -1445,9 +1443,9 @@ rule PYAS_Rules_A_52 {
       8 of them
 }
 
-rule PYAS_Rules_A_53 {
+rule General_53 {
    meta:
-      description = "PYAS_Rules_A_53"
+      description = "53"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:

Exten/Bitdefender/bdc.ini

@@ -1,15 +0,0 @@
-ExcludeXMD = 
-Extensions = exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;nws;
-ExcludeExtensions = 
-ConfigFile = bdc.ini
-HttpProxy = 
-InfectedFolder = Infected
-SuspectedFolder = Suspected
-LogMaxSize = 1024
-RenameExtension = vir
-PluginsPaths = Plugins
-LogName = bdc.log
-UpdateHttpLocation = http://upgrade.bitdefender.com/av32bit-eps
-XMD = *
-LastUpdate = Wed Feb 18 16:39:59 2009
-ProductID = {AAD1516D-28AB-4EB5-B7C8-DF54FE4442E9}

Exten/Bitdefender/plugins.htm

@@ -1,14 +0,0 @@
-<p>AVCORE v2.2 Windows/i386 11.0.1.21 (August 15, 2021)</p>
-<p>disp.xmd - Dispatcher (0.00) 0x1[997] (r)</p>
-<p>pyinstaller.xmd - PYInstaller unpacker (1.0) 0x8[12] (r)</p>
-<p>rar.xmd - RAR5 unpacker (0.5) 0xA[12] (r)</p>
-<p>thebat.xmd - TheBat Engine (0.03a) 0x4010[12] (r) +</p>
-<p>html.xmd - HTML Parser (1.0) 0x4008[11] (r) +</p>
-<p>mdx.xmd - Macro Defense Expert (3.57b) 0x1[11] 1[0] (r)</p>
-<p>cevakrnl.xmd - CEVA (0.03a) 0x1[10] (r)</p>
-<p>pdf.xmd - PDF Engine (2.0) 0x4009[10] (r) +</p>
-<p>imp.xmd - IMP (1.4.2) 0x2[9] (r)</p>
-<p>sfx.xmd - Sfx Engine (1.8.6) 0xA[9] (r)</p>
-<p>sdx.xmd - SDX () 0x1[5] 191729[0] (r)</p>
-<p>jpeg.xmd - JPEG Engine (0.05) 0x1[1] 14[1] (r)</p>
-<p>rtf.xmd - RTF (1.0) 0x4008[0] (r) +</p>

Extens/Repair/Repair_Regedit.reg

@@ -0,0 +1,117 @@
+Windows Registry Editor Version 5.00
+
+; Repair system restrictions
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MMC]
+; NoControlPanel
+"NoControlPanel"=dword:00000000
+; NoDrives
+"NoDrives"=dword:00000000
+; NoFileMenu
+"NoFileMenu"=dword:00000000
+; NoFind
+"NoFind"=dword:00000000
+; NoRealMode
+"NoRealMode"=dword:00000000
+; NoRecentDocsMenu
+"NoRecentDocsMenu"=dword:00000000
+; NoSetFolders
+"NoSetFolders"=dword:00000000
+; NoSetFolderOptions
+"NoSetFolderOptions"=dword:00000000
+; NoViewOnDrive
+"NoViewOnDrive"=dword:00000000
+; NoClose
+"NoClose"=dword:00000000
+; NoRun
+"NoRun"=dword:00000000
+; NoDesktop
+"NoDesktop"=dword:00000000
+; NoLogOff
+"NoLogOff"=dword:00000000
+; NoFolderOptions
+"NoFolderOptions"=dword:00000000
+; RestrictRun
+"RestrictRun"=dword:00000000
+; NoViewContextMenu
+"NoViewContexMenu"=dword:00000000
+; HideClock
+"HideClock"=dword:00000000
+; NoStartMenuMorePrograms
+"NoStartMenuMorePrograms"=dword:00000000
+; NoStartMenuMyGames
+"NoStartMenuMyGames"=dword:00000000
+; NoStartMenuMyMusic
+"NoStartMenuMyMusic"=dword:00000000
+; DisableCMD
+"DisableCMD"=dword:00000000
+; NoWinKeys
+"NoWinKeys"=dword:00000000
+; StartMenuLogOff
+"StartMenuLogOff"=dword:00000000
+; NoSimpleNetlDList
+"NoSimpleNetlDList"=dword:00000000
+; NoLowDiskSpaceChecks
+"NoLowDiskSpaceChecks"=dword:00000000
+; DisableLockWorkstation
+"DisableLockWorkstation"=dword:00000000
+; Restrict_Run
+"Restrict_Run"=dword:00000000
+; DisableTaskMgr
+"DisableTaskMgr"=dword:00000000
+; DisableRegistryTools
+"DisableRegistryTools"=dword:00000000
+; DisableChangePassword
+"DisableChangePassword"=dword:00000000
+; Wallpaper
+"Wallpaper"=dword:00000000
+; NoComponents
+"NoComponents"=dword:00000000
+; NoAddingComponents
+"NoAddingComponents"=dword:00000000
+; NoStartMenuPinnedList
+"NoStartMenuPinnedList"=dword:00000000
+; NoActiveDesktop
+"NoActiveDesktop"=dword:00000000
+; NoSetActiveDesktop
+"NoSetActiveDesktop"=dword:00000000
+; NoActiveDesktopChanges
+"NoActiveDesktopChanges"=dword:00000000
+; NoChangeStartMenu
+"NoChangeStartMenu"=dword:00000000
+; NoFavoritesMenu
+"NoFavoritesMenu"=dword:00000000
+; NoRecentDocsHistory
+"NoRecentDocsHistory"=dword:00000000
+; NoSetTaskbar
+"NoSetTaskbar"=dword:00000000
+; NoSMHelp
+"NoSMHelp"=dword:00000000
+; NoTrayContextMenu
+"NoTrayContextMenu"=dword:00000000
+; NoViewContextMenu
+"NoViewContextMenu"=dword:00000000
+; NoManageMyComputerVerb
+"NoManageMyComputerVerb"=dword:00000000
+; NoWindowsUpdate
+"NoWindowsUpdate"=dword:00000000
+; ClearRecentDocsOnExit
+"ClearRecentDocsOnExit"=dword:00000000
+; NoStartMenuNetworkPlaces
+"NoStartMenuNetworkPlaces"=dword:00000000
+
+; Repair Image File Execution Options
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
+; (Delete all subkeys here if necessary)
+
+; Repair executable file icon
+[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
+@="%1"
+[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon]
+@="%1"
+
+; Repair executable file type
+[HKEY_CLASSES_ROOT\.exe]
+@="exefile"
+[HKEY_CLASSES_ROOT\exefile\shell\open\command]
+@="\"%1\" %*"
+

Extens/Repair/Repair_System.bat

@@ -0,0 +1 @@
+sfc /scannow

Extens/Tools/Tools.txt

@@ -0,0 +1 @@
+None

PYAS_Engine.py

@@ -1,84 +1,109 @@
-import time, json, hashlib, numpy
-from collections import Counter
+import os, sys, time, json, yara
+import numpy, pefile, onnxruntime
+from PIL import Image
 
-class ListSimHash:
+class YRScan:
     def __init__(self):
-        self.model = {}
+        self.rules = {}
+        self.network = []
 
-    def save_model(self, file_name):
-        with open(file_name, 'w') as f:
-            json.dump(self.model, f)
-        print(f"\nModel Is Saved In {file_name}")
+    def load_rules(self, file_path):
+        try:
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".yara", ".yar"]:
+                self.rules[file_path] = yara.compile(file_path)
+            elif ftype in [".yc", ".yrc"]:
+                self.rules[file_path] = yara.load(file_path)
+            elif ftype in [".ip", ".ips"]:
+                with open(file_path, "r") as f:
+                    self.network += [l.strip() for l in f.readlines()]
+        except Exception as e:
+            print(e)
 
-    def load_model(self, model_data):
-        if isinstance(model_data, str):
-            with open(model_data, 'r') as f:
-                model_data = json.load(f)
-        self.model = model_data
+    def yr_scan(self, file_path):
+        try:
+            if isinstance(file_path, str):
+                with open(file_path, "rb") as f:
+                    file_path = f.read()
+            for name, rules in self.rules.items():
+                matchs_rules = rules.match(data=file_path)
+                if matchs_rules:
+                    label = str(matchs_rules[0]).split("_")[0]
+                    level = str(matchs_rules[0]).split("_")[-1]
+                    return f"Rules/{label}", level
+            return False, False
+        except Exception as e:
+            return False, False
 
-    def get_model(self, label):
-        return self.model[label]
+class DLScan:
+    def __init__(self):
+        self.models = {}
+        self.shells = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '!o',
+        'cry', 'test', 'ace', 'yg', 'obr', 'tvm', 'dec', 'enc', 'b1_', 'base',
+        'bss', 'clr_uef', 'cursors', 'trs_age', 'engine', 'enigma', 'protect',
+        'nep', 'no_bbt', 'wpp_sf', 'retpol', 'rt', 'rwexec', 'rygs', 'poolmi',
+        's:@', 'pgae', 'proxy', 'wisevec', 'segm', 'transit', 'vmp', 'extjmp',
+        'upx', 'tracesup', 'res', 'lzma', 'malloc_h', 'miniex', 'ndr64', 'be',
+        'mssmixer', 'wow', 'press', 'fio', 'pad', 'hexpthk', 'h~;', 'icapsec',
+        'sanontcp', 'secur', 'asmstub', 'nsys_wr', 'orpc', 'pack', 'wow64svc',
+        'uedbg', 'viahw', 'data', 'zk', 'fothk', 'qihoo']#"""
 
-    def train_model(self, label, data):
-        start = time.time()
-        print(f"Convert {label}")
-        if label not in self.model:
-            self.model[label] = []
-        for i, x in enumerate(data, 1):
-            self.model[label].append(self.build_text(x))
-            used = "{0:.2f}".format(time.time()-start)
-            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
-            self.progress_bar(i, len(data), prefix, suffix)
+    def load_model(self, file_path):
+        try:
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".json", ".txt"]:
+                with open(file_path, 'r') as f:
+                    self.class_names = json.load(f)
+            elif ftype in [".onnx"]:
+                self.models[file_path] = onnxruntime.InferenceSession(file_path)
+            self.labels = self.class_names['Labels']
+            self.detect = self.class_names['Detect']
+            self.pixels = self.class_names['Pixels']
+            self.values = self.class_names['Values']
+            self.suffix = self.class_names['Suffix']
+        except Exception as e:
+            pass
 
-    def build_text(self, content):
-        sums, batch, count = [], [], 0
-        features = dict(Counter(sorted(content)))
-        for f, w in features.items():
-            count += w
-            batch.append(hashlib.sha256(json.dumps(f).encode('utf-8')).digest() * w)
-            if len(batch) >= 10000:
-                sums.append(self.sum_hashes(batch))
-                batch = []
-        if batch:
-            sums.append(self.sum_hashes(batch))
-        combined_sums = numpy.sum(sums, 0)
-        v = numpy.packbits(combined_sums > count / 2).tobytes()
-        return int.from_bytes(v, 'big')
+    def dl_scan(self, file_data):
+        try:
+            label_similarities = {label: [] for label in self.labels}
+            image_data = self.preprocess_image(file_data, tuple(self.pixels))
+            image_array = numpy.asarray(image_data).astype('float32') / 255.0
+            image_expand = numpy.expand_dims(image_array, axis=(0, -1))
+            for model_name, model in self.models.items():
+                input_name = model.get_inputs()[0].name
+                pre_answers = model.run(None, {input_name: image_expand})[0][0]
+                for k, score in enumerate(pre_answers):
+                    label_similarities[self.labels[k].strip()].append(score)
+            label_percentage = {label: (sum(similarities) / len(self.models)) * 100
+            for label, similarities in label_similarities.items()}
+            label, level = max(label_percentage.items(), key=lambda x: x[1])
+            return label, int(level)
+        except Exception as e:
+            return False, False
 
-    def sum_hashes(self, digests):
-        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
-        return numpy.sum(numpy.reshape(bitarray, (-1, 256)), 0)
+    def preprocess_image(self, file_data, target_size):
+        wah = int(numpy.ceil(numpy.sqrt(len(file_data))))
+        file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
+        image_array = numpy.zeros((wah * wah,), dtype=numpy.uint8)
+        image_array[:len(file_data)] = file_data
+        image = Image.fromarray(image_array.reshape((wah, wah)), 'L')
+        return image.resize(target_size, Image.Resampling.NEAREST)
 
-    def progress_bar(self, items, total, prefix='', suffix='', length=50, fill='█'):
-        percent = min(100.0, max(0.0, 100 * (items / float(total))))
-        end_char = '\n' if percent >= 100 else '\r'
-        percent_string = "{0:.2f}".format(percent)
-        filled_length = int(length * items // total)
-        bar = fill * filled_length + ' ' * (length - filled_length)
-        print(f'\r{prefix: <15} |{bar}| {percent_string}% {suffix}', end=end_char)
-
-    def predict_all(self, query):
-        label_similarities = {}
-        query_hash = self.build_text(query)
-        for label in self.model:
-            max_similarity = 0
-            for data_point in self.model[label]:
-                similarity = self.similar(data_point, query_hash)
-                if similarity > max_similarity:
-                    max_similarity = similarity
-            label_similarities[label] = max_similarity
-        return label_similarities
-
-    def predict(self, query):
-        max_similarity, max_label = 0, None
-        query_hash = self.build_text(query)
-        for label in self.model:
-            for data_point in self.model[label]:
-                similarity = self.similar(data_point, query_hash)
-                if similarity > max_similarity:
-                    max_similarity, max_label = similarity, label
-        return max_label, max_similarity
-
-    def similar(self, x, y):
-        hamming_distance = bin(x ^ y).count('1')
-        return 1 - hamming_distance / 256
+    def get_type(self, file_path):
+        match_data = {}
+        ftype = str(f".{file_path.split('.')[-1]}").lower()
+        if ftype in self.suffix:
+            try:
+                with pefile.PE(file_path, fast_load=True) as pe:
+                    for section in pe.sections:
+                        section_name = section.Name.rstrip(b'\x00').decode('latin1')
+                        if (section.Characteristics & 0x00000020 and not
+                        any(shell in section_name.lower() for shell in self.shells)):
+                            match_data[section_name] = section.get_data()
+            except:
+                if ftype in [".bat", ".cmd", ".ps1", ".vbs", ".wsf", ".html", ".js", 
+                    ".txt", ".htm", ".hta", ".php", ".css", ".xml", ".json", ".wasm"]:
+                    with open(file_path, 'rb') as file:
+                        match_data[ftype] = file.read()
+        return match_data

PYAS_Extension.py

@@ -1,24 +0,0 @@
-from subprocess import *
-import os, re, sys
-
-class ExtenRules:
-    def __init__(self):
-        self.exten = {}
-        self.pyas = sys.argv[0].replace("\\", "/")
-        self.dir = os.path.dirname(self.pyas)
-        self.exten = os.path.join(self.dir, "Exten")
-
-    def bdc_scan(self, file):
-        if self.exten.replace("\\", "/") not in file.replace("\\", "/"):
-            cmd = f'"{self.exten}\\Bitdefender\\bdc.exe" "{file}"'
-            p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True)
-            for matchs in re.finditer(r'(?P<filename>[^\s]+)\s+infected:\s+(?P<virusname>.+)', p.communicate()[0]):
-                return matchs
-        return False
-
-    def mem_scan(self, p):
-        if self.exten.replace("\\", "/") not in p.exe().replace("\\", "/"):
-            cmd = f'"{self.exten}\\hollows_hunter\\hollows_hunter.exe" /ofilter 2 /pid "{p.pid}"'
-            p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True)
-            return 'Detected' in p.communicate()[0]
-        return False

PYAS_Interface.py

@@ -1569,49 +1569,49 @@ class Ui_MainWindow(object):
         self.Language_illustrate.raise_()
         self.Language_Choose_widget.raise_()
         self.Language_title.raise_()
-        self.Show_cloud_services = QtWidgets.QWidget(self.Setting_widget)
-        self.Show_cloud_services.setGeometry(QtCore.QRect(30, 130, 781, 81))
-        self.Show_cloud_services.setAcceptDrops(False)
-        self.Show_cloud_services.setAutoFillBackground(False)
-        self.Show_cloud_services.setObjectName("Show_cloud_services")
-        self.cloud_services_title = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
+        self.Show_extension_kit = QtWidgets.QWidget(self.Setting_widget)
+        self.Show_extension_kit.setGeometry(QtCore.QRect(30, 130, 781, 81))
+        self.Show_extension_kit.setAcceptDrops(False)
+        self.Show_extension_kit.setAutoFillBackground(False)
+        self.Show_extension_kit.setObjectName("Show_extension_kit")
+        self.extension_kit_title = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(17)
         font.setBold(False)
         font.setWeight(50)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_title.setFont(font)
-        self.cloud_services_title.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_title.setObjectName("cloud_services_title")
-        self.cloud_services_illustrate = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
+        self.extension_kit_title.setFont(font)
+        self.extension_kit_title.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_title.setObjectName("extension_kit_title")
+        self.extension_kit_illustrate = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_illustrate.setFont(font)
-        self.cloud_services_illustrate.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_illustrate.setScaledContents(False)
-        self.cloud_services_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_illustrate.setWordWrap(True)
-        self.cloud_services_illustrate.setObjectName("cloud_services_illustrate")
-        self.cloud_services_switch_Button = QtWidgets.QPushButton(self.Show_cloud_services)
-        self.cloud_services_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
+        self.extension_kit_illustrate.setFont(font)
+        self.extension_kit_illustrate.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_illustrate.setScaledContents(False)
+        self.extension_kit_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_illustrate.setWordWrap(True)
+        self.extension_kit_illustrate.setObjectName("extension_kit_illustrate")
+        self.extension_kit_switch_Button = QtWidgets.QPushButton(self.Show_extension_kit)
+        self.extension_kit_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
         sizePolicy.setHorizontalStretch(0)
         sizePolicy.setVerticalStretch(0)
-        sizePolicy.setHeightForWidth(self.cloud_services_switch_Button.sizePolicy().hasHeightForWidth())
-        self.cloud_services_switch_Button.setSizePolicy(sizePolicy)
+        sizePolicy.setHeightForWidth(self.extension_kit_switch_Button.sizePolicy().hasHeightForWidth())
+        self.extension_kit_switch_Button.setSizePolicy(sizePolicy)
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_switch_Button.setFont(font)
-        self.cloud_services_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
-        self.cloud_services_switch_Button.setStyleSheet("QPushButton\n"
+        self.extension_kit_switch_Button.setFont(font)
+        self.extension_kit_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
+        self.extension_kit_switch_Button.setStyleSheet("QPushButton\n"
 "{\n"
 "    border:none;\n"
 "    background-color:rgb(230,230,230);\n"
@@ -1622,12 +1622,12 @@ class Ui_MainWindow(object):
 "    background-color:rgb(220,220,220);\n"
 "}\n"
 "")
-        self.cloud_services_switch_Button.setIconSize(QtCore.QSize(16, 16))
-        self.cloud_services_switch_Button.setCheckable(False)
-        self.cloud_services_switch_Button.setObjectName("cloud_services_switch_Button")
-        self.cloud_services_illustrate.raise_()
-        self.cloud_services_switch_Button.raise_()
-        self.cloud_services_title.raise_()
+        self.extension_kit_switch_Button.setIconSize(QtCore.QSize(16, 16))
+        self.extension_kit_switch_Button.setCheckable(False)
+        self.extension_kit_switch_Button.setObjectName("extension_kit_switch_Button")
+        self.extension_kit_illustrate.raise_()
+        self.extension_kit_switch_Button.raise_()
+        self.extension_kit_title.raise_()
         self.Setting_Back = QtWidgets.QPushButton(self.Setting_widget)
         self.Setting_Back.setGeometry(QtCore.QRect(25, 10, 101, 41))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
@@ -1885,9 +1885,9 @@ class Ui_MainWindow(object):
         self.Language_English.setText(_translate("MainWindow", "English"))
         self.Language_Traditional_Chinese.setText(_translate("MainWindow", "繁體中文"))
         self.Language_Simplified_Chinese.setText(_translate("MainWindow", "简体中文"))
-        self.cloud_services_title.setText(_translate("MainWindow", "雲端掃描服務"))
-        self.cloud_services_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
-        self.cloud_services_switch_Button.setText(_translate("MainWindow", "已關閉"))
+        self.extension_kit_title.setText(_translate("MainWindow", "雲端掃描服務"))
+        self.extension_kit_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
+        self.extension_kit_switch_Button.setText(_translate("MainWindow", "已關閉"))
         self.Setting_Back.setText(_translate("MainWindow", "返回"))
         self.Add_White_list_title.setText(_translate("MainWindow", "增加到白名單"))
         self.Add_White_list_illustrate.setText(_translate("MainWindow", "此選項可以選擇檔案並增加到白名單"))

PYAS_Language.py

@@ -16,15 +16,16 @@ translate_dict = {
               "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
               "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
               "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
-              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","記憶體":"内存",},
+              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","記憶體":"内存",},
     "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
               "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website ",
               "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
               "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ",
               "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
               "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
-              "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
+              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
               "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
               "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
               "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
@@ -45,7 +46,7 @@ translate_dict = {
               "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
               "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
               "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-              "增加到":"Add To ","白名單":"White List ","軟體":"Software ","正在":"Start ",
+              "增加到":"Add To ","白名單":"White List ","軟體":"Software ","正在":"",
               "增加":"Add ","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
               "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
               "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
@@ -53,7 +54,7 @@ translate_dict = {
               "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
               "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
               "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
-              "擴展套件":"Extension Kit ","自動":"Auto ","上報":"Report ","與":"With ",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
               "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
-              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","追蹤":"Tracking ",
-              "竄改":"Tamper ","  ":" "}}
+              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ",
+              "竄改":"Tamper ","第三方":"Other ","與":"With ","  ":" "}}

PYAS_Suffixes.py

@@ -1,7 +1,8 @@
-slist = [".exe",".dll",".com",".msi",".scr",
-         ".js",".bat",".cmd",".ps1",".vbs"]
+slist = [".exe",".dll",".sys",".com",".scr",
+         ".bat",".ps1",".vbs",".cmd",".js"]
 
-alist = [".exe",".dll",".zip",".7z",".rar",
+alist = [".exe",".dll",".sys",".com",".scr",
+         ".zip",".7z",".rar",".tar",".gz",
          ".js",".bat",".cmd",".ps1",".vbs",
          ".ppt",".pptx",".wps",".txt",".rtf",
          ".pdf",".xls",".xlsx",".doc",".docx",

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.4',
+version='3.2.5',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,152 +1,46 @@
 # PYAS (Python Antivirus Software)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## Readme Language
 
-[繁體中文](https://github.com/87owo/PYAS/blob/main/README_zh_TW.md) , 
-[简体中文](https://github.com/87owo/PYAS/blob/main/README_zh_CN.md)
+繁體中文 : https://github.com/87owo/PYAS/blob/main/README_zh_TW.md
 
-## File Information
-
-PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
-
-PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
-
-PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
-
-PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
-
-PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
-
-PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
-
-PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
-
-PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
-
-## Dir Information
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+简体中文 : https://github.com/87owo/PYAS/blob/main/README_zh_CN.md
 
 ## Requirements
 
-Use pip install requirements to install import module
-
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install pefile==2023.2.7
+pip install pyperclip==1.8.2
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
-## Pefile Scanning
-
-Get the pefile file function import table for scanning
+## File Information
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## Process Detect
-
-Show the new process name, file path, cmd line, pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## File Detect
-
-Monitor file changes under the specified path
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/ (Protect driver and Microsoft runtime)
+│   └── ...
+│
+├── Engine/ (Deep learn model and Yara database)
+│   └── ...
+│
+├── Exten/ (Exten tools and System repair tools)
+│   └── ...
+│
+├── PYAS.py (Main PYAS program with qtui interaction and protect function)
+├── PYAS_Engine.py (Deep learning predict and yara rules file scanner)
+├── PYAS_Suffixes.py (including scan file suffixes and common suffixes)
+├── PYAS_Interface.py (Qt designer ui, must be matched with the main program)
+├── PYAS_Resource.py (status pictures, icon packages, and button icons)
+├── PYAS_Language.py (Traditional Chinese, Simplified Chinese and English)
+├── PYAS_Version.py (file information, version information, original name)
+└── ...
 ```
 
 ## Official Website
@@ -155,6 +49,10 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
+## Microsoft Runtime
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
 ## PYAS Driver
 
 https://github.com/0sha0/PYAS_Protection
@@ -171,6 +69,6 @@ Other systems may experience software malfunctions or crash
 
 ## Special Thanks
 
-Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo

README_zh_CN.md

@@ -1,147 +1,40 @@
 # PYAS (Python 杀毒软件)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
-
-## 文件信息
-
-PYAS.py -> PYAS主程式（包括动画、扫描、保护功能等）
-
-PYAS_Engine.py -> 转换资料库（用于相互转换资料库字典和清单）
-
-PYAS_Extension.py -> 副文件名（包括扫描文件副文件名和常用副文件名）
-
-PYAS_Model.* -> 病毒库（病毒库必须放在同一目录下）
-
-PYAS_Interface.py -> PyQt5界面（由QT设计师设计，必须与主程式相符）
-
-PYAS_Resource.py -> PyQt5资源（状态图片、图示包、按钮图示等）
-
-PYAS_Language.py -> 翻译字典（繁体中文、简体中文、英文）
-
-PYAS_Version.py -> Pyinstaller资讯（文件资讯、版本资讯、原名等）
-
-## 目录信息
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## 安装要求
 
-使用 pip install requirements 来安装需要的模组
-
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install pefile==2023.2.7
+pip install pyperclip==1.8.2
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
-## 文件扫描
-
-取得pefile文件函数导入表进行扫描
+## 文件信息
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 进程监控
-
-显示新进程名称、文件路径、cmd 行、pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 文件监控
-
-监控指定路径下的文件变化
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/ (驱动保护和微软运行库)
+│   └── ...
+│
+├── Engine/ (深度学习和规则数据库)
+│   └── ...
+│
+├── Exten/ (扩展功能与系统修复工具)
+│   └── ...
+│
+├── PYAS.py (PYAS主程序含界面交互与保护功能)
+├── PYAS_Engine.py (深度学习预测和规则扫描器)
+├── PYAS_Suffixes.py (获取扫描或事件文件的后缀)
+├── PYAS_Interface.py (搭配主程序的Qt设计介面)
+├── PYAS_Resource.py (状态图片和图标和按钮图片)
+├── PYAS_Language.py (繁体中文和简体中文和英文翻译)
+├── PYAS_Version.py (版本和讯息名称和打包文件名)
+└── ...
 ```
 
 ## 官方网页
@@ -150,14 +43,18 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
-## 开源协议
+## 微软运行库
 
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+https://github.com/87owo/Microsoft_Runtime/releases
 
 ## 驱动程序
 
 https://github.com/0sha0/PYAS_Protection
 
+## 开源协议
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
 ## 支援系统
 
 Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
@@ -166,6 +63,6 @@ Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
 
 ## 特别感谢
 
-360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo

README_zh_TW.md

@@ -1,145 +1,40 @@
 # PYAS (Python 防毒軟體)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
-
-## 檔案資訊
-
-PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
-
-PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
-
-PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
-
-PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
-
-PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
-
-PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
-
-PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
-
-PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
-
-## 目錄資訊
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## 安裝要求
 
-使用 pip install requirements 來安裝需要的模組
-
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install pefile==2023.2.7
+pip install pyperclip==1.8.2
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
-## 檔案掃描
-
-取得pefile檔案函數導入表進行掃描
+## 檔案資訊
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 進程監控
-
-顯示新進程名稱、檔案路徑、cmd 行、pid
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 檔案監控
-
-監控指定路徑下的檔案變化
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/ (驅動防護和微軟運行庫)
+│   └── ...
+│
+├── Engine/ (深度學習和規則數據庫)
+│   └── ...
+│
+├── Exten/ (擴展功能與系統修復工具)
+│   └── ...
+│
+├── PYAS.py (PYAS主程序含介面交互與防護功能)
+├── PYAS_Engine.py (深度學習預測和規則掃描器)
+├── PYAS_Suffixes.py (獲取掃描或事件檔案的副檔名)
+├── PYAS_Interface.py (搭配主程序的Qt設計介面)
+├── PYAS_Resource.py (狀態圖片圖標和按鈕圖片)
+├── PYAS_Language.py (繁體中文和簡體中文和英文翻譯)
+├── PYAS_Version.py (檔案版本和訊息名稱和打包檔名)
+└── ...
 ```
 
 ## 官方網頁
@@ -148,14 +43,18 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
-## 開源協議
+## 微軟運行庫
 
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+https://github.com/87owo/Microsoft_Runtime/releases
 
 ## 驅動程式
 
 https://github.com/0sha0/PYAS_Protection
 
+## 開源協議
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
 ## 支援系統
 
 Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
@@ -164,6 +63,6 @@ Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
 
 ## 特別感謝
 
-Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo