Add files via upload

Update PYAS_Language.py

Driver/Install_Driver.bat

@@ -1,34 +0,0 @@
-@echo off
-setlocal
-
-:: Check for permissions
->nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
-
-if %errorlevel% NEQ 0 goto NoAdmin
-goto gotAdmin
-
-:NoAdmin
-    echo You do not have administrator rights, please run this script as administrator.
-    pause
-    exit /B
-
-:gotAdmin
-    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
-
-set "script_dir=%~dp0"
-set "script_dir=%script_dir:~0,-1%"
-
-bcdedit -debug on
-bcdedit /set testsigning on
-bcdedit /deletevalue {current} safeboot
-
-powershell.exe -ExecutionPolicy Bypass -Command ^
-"$endDate = (Get-Date).AddYears(100); ^
- $cert = New-SelfSignedCertificate -DnsName PYAS -CertStoreLocation cert:\LocalMachine\My -Type CodeSigning -NotAfter $endDate; ^
- $pwd = ConvertTo-SecureString -String 'PYAS' -Force -AsPlainText; ^
- Export-PfxCertificate -Cert $cert -FilePath '%script_dir%\PYAS.pfx' -Password $pwd;"
-"%script_dir%\signtool.exe" sign /f "%script_dir%\PYAS.pfx" /p PYAS "%script_dir%\PYAS_Driver.sys"
-sc create PYAS_Driver type= kernel start= demand binPath= "%script_dir%\PYAS_Driver.sys"
-
-shutdown -r -t 0
-endlocal

Driver/Uninstall_Driver.bat

@@ -1,25 +0,0 @@
-@echo off
-setlocal
-
-:: Check for permissions
->nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
-
-if %errorlevel% NEQ 0 goto NoAdmin
-goto gotAdmin
-
-:NoAdmin
-    echo You do not have administrator rights, please run this script as administrator.
-    pause
-    exit /B
-
-:gotAdmin
-    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
-
-sc stop PYAS_Driver
-sc delete PYAS_Driver
-
-bcdedit /set testsigning off
-bcdedit -debug off
-
-shutdown -r -t 0
-endlocal

Engine/Model/PYAS_Model.json

@@ -0,0 +1,11 @@
+{
+    "Suffix": [".com", ".exe", ".dll", ".sys", ".scr", ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], 
+
+    "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], 
+
+    "Detect": ["Pefile/General", "Script/General"],  
+
+    "Resize": [224, 224, 1, "nearest"], 
+
+    "Values": 95
+}

Engine/Rules/PYAS_Rules_A1.yar

@@ -1,8 +1,8 @@
 import "pe"
 
-rule PYAS_Rules_A_1 {
+rule General_1 {
    meta:
-      description = "PYAS_Rules_A_1"
+      description = "1"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -57,9 +57,9 @@ rule PYAS_Rules_A_1 {
       1 of ($x*) and 8 of them
 }
 
-rule PYAS_Rules_A_2 {
+rule General_2 {
    meta:
-      description = "PYAS_Rules_A_2"
+      description = "2"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -82,9 +82,9 @@ rule PYAS_Rules_A_2 {
       8 of them
 }
 
-rule PYAS_Rules_A_3 {
+rule General_3 {
    meta:
-      description = "PYAS_Rules_A_3"
+      description = "3"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -106,7 +106,7 @@ rule PYAS_Rules_A_3 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_4 {
+rule General_4 {
    meta:
       description = "PYAS_Rules_A4"
       author = "PYAS Security"
@@ -124,9 +124,9 @@ rule PYAS_Rules_A_4 {
       ($x1 and $x2) and 5 of them
 }
 
-rule PYAS_Rules_A_5 {
+rule General_5 {
    meta:
-      description = "PYAS_Rules_A_5"
+      description = "5"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -147,9 +147,9 @@ rule PYAS_Rules_A_5 {
       $x1 and 3 of them
 }
 
-rule PYAS_Rules_A_6 {
+rule General_6 {
    meta:
-      description = "PYAS_Rules_A_6"
+      description = "6"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -214,9 +214,9 @@ rule PYAS_Rules_A_6 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_7 {
+rule General_7 {
    meta:
-      description = "PYAS_Rules_A_462"
+      description = "7"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -247,9 +247,9 @@ rule PYAS_Rules_A_7 {
       10 of them
 }
 
-rule PYAS_Rules_A_8 {
+rule General_8 {
    meta:
-      description = "PYAS_Rules_A_8"
+      description = "8"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -278,9 +278,9 @@ rule PYAS_Rules_A_8 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_9 {
+rule General_9 {
    meta:
-      description = "PYAS_Rules_A_9"
+      description = "9"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -303,9 +303,9 @@ rule PYAS_Rules_A_9 {
       6 of them
 }
 
-rule PYAS_Rules_A_10 {
+rule General_10 {
    meta:
-      description = "PYAS_Rules_A_10"
+      description = "10"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -329,9 +329,9 @@ rule PYAS_Rules_A_10 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_11 {
+rule General_11 {
    meta:
-      description = "PYAS_Rules_A_11"
+      description = "11"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -349,9 +349,9 @@ rule PYAS_Rules_A_11 {
       6 of them
 }
 
-rule PYAS_Rules_A_12 {
+rule General_12 {
    meta:
-      description = "PYAS_Rules_A_12"
+      description = "12"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -376,9 +376,9 @@ rule PYAS_Rules_A_12 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_13 {
+rule General_13 {
    meta:
-      description = "PYAS_Rules_A_13"
+      description = "13"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -404,9 +404,9 @@ rule PYAS_Rules_A_13 {
       6 of them
 }
 
-rule PYAS_Rules_A_14 {
+rule General_14 {
    meta:
-      description = "PYAS_Rules_A_14"
+      description = "14"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -430,9 +430,9 @@ rule PYAS_Rules_A_14 {
       8 of them
 }
 
-rule PYAS_Rules_A_15 {
+rule General_15 {
    meta:
-      description = "PYAS_Rules_A_15"
+      description = "15"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -459,9 +459,9 @@ rule PYAS_Rules_A_15 {
       8 of them
 }
 
-rule PYAS_Rules_A_16 {
+rule General_16 {
    meta:
-      description = "PYAS_Rules_A_16"
+      description = "16"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -485,9 +485,9 @@ rule PYAS_Rules_A_16 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_17 {
+rule General_17 {
    meta:
-      description = "PYAS_Rules_A_17"
+      description = "17"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -508,9 +508,9 @@ rule PYAS_Rules_A_17 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_18 {
+rule General_18 {
    meta:
-      description = "PYAS_Rules_A_18"
+      description = "18"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -531,9 +531,9 @@ rule PYAS_Rules_A_18 {
       6 of them
 }
 
-rule PYAS_Rules_A_19 {
+rule General_19 {
    meta:
-      description = "PYAS_Rules_A_19"
+      description = "19"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -560,9 +560,9 @@ rule PYAS_Rules_A_19 {
       ($x1 and $x2) and 8 of them
 }
 
-rule PYAS_Rules_A_20 {
+rule General_20 {
    meta:
-      description = "PYAS_Rules_A_20"
+      description = "20"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -589,9 +589,9 @@ rule PYAS_Rules_A_20 {
       8 of them
 }
 
-rule PYAS_Rules_A_21 {
+rule General_21 {
    meta:
-      description = "PYAS_Rules_A_21"
+      description = "21"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -616,9 +616,9 @@ rule PYAS_Rules_A_21 {
       8 of them
 }
 
-rule PYAS_Rules_A_22 {
+rule General_22 {
    meta:
-      description = "PYAS_Rules_A_22"
+      description = "22"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -635,10 +635,9 @@ rule PYAS_Rules_A_22 {
       6 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_23 {
+rule General_23 {
    meta:
-      description = "PYAS_Rules_A_23"
+      description = "23"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -658,10 +657,9 @@ rule PYAS_Rules_A_23 {
       7 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_24 {
+rule General_24 {
    meta:
-      description = "PYAS_Rules_A_24"
+      description = "24"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -688,9 +686,9 @@ rule PYAS_Rules_A_24 {
       6 of them
 }
 
-rule PYAS_Rules_A_25 {
+rule General_25 {
    meta:
-      description = "PYAS_Rules_A_25"
+      description = "25"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -716,9 +714,9 @@ rule PYAS_Rules_A_25 {
       $x1 and 5 of them
 }
 
-rule PYAS_Rules_A_26 {
+rule General_26 {
    meta:
-      description = "PYAS_Rules_A_26"
+      description = "26"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -742,9 +740,9 @@ rule PYAS_Rules_A_26 {
       8 of them
 }
 
-rule PYAS_Rules_A_27 {
+rule General_27 {
    meta:
-      description = "PYAS_Rules_A_27"
+      description = "27"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -768,42 +766,37 @@ rule PYAS_Rules_A_27 {
       6 of them
 }
 
-rule PYAS_Rules_A_28 {
+rule General_28 {
    meta:
-      description = "PYAS_Rules_A_28"
+      description = "28"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
-      $s1 = "GNU C11 6.3.0" ascii
-      $s2 = "GCC: (MinGW.org GCC-6.3.0-1) 6.3.0" fullword ascii
-      $s3 = "___mingw_readdir" fullword ascii
-      $s4 = "___mingw_closedir" fullword ascii
-      $s5 = "___mingw_seekdir" fullword ascii
-      $s6 = "%d is not a prime number." fullword ascii
-      $s7 = "___mingw_rewinddir" fullword ascii
-      $s8 = "__mingw32_init_mainargs" fullword ascii
-      $s9 = "___mingw_telldir" fullword ascii
-      $s10 = "Enter an integer: " fullword ascii
-      $s11 = "___mingw_opendir" fullword ascii
-      $s12 = "/home/keith/" ascii
-      $s13 = "../../../src/gcc-6.3.0/libgcc" ascii
-      $s14 = "___mingw_dirname" fullword ascii
-      $s15 = "_isPrime`" fullword ascii
-      $s16 = "%d is a prime number." fullword ascii
-      $s17 = ".weak.__Jv_RegisterClasses.___EH_FRAME_BEGIN__" fullword ascii
-      $s18 = "-mtune=generic" ascii
-      $s19 = "-march=i586" ascii
-      $s20 = "-g -g -g -O2 -O2 -O2" ascii
-      $s21 = "-fbuilding-libgcc" ascii
-      $s22 = "-fno-stack-protector" ascii
+      $x1 = "schemas.microsoft.com" wide
+      $x2 = "Client Worker Thread" ascii
+      $s1 = "A6BFEA43-501F-456F-A845-983D3AD7B8F0" wide
+      $s2 = "upgrader" wide
+      $s3 = "rtvscan.exe" wide
+      $s4 = "Enable-WindowsOptionalFeature -FeatureName" wide
+      $s5 = "remupd.exe" fullword wide
+      $s6 = "Mcshield.exe" fullword wide
+      $s7 = "mssecess.exe" fullword wide
+      $s8 = "RavMonD.exe" fullword wide
+      $s9 = "KvMonXP.exe" fullword wide
+      $s10 = "baiduSafeTray.exe" fullword wide
+      $s11 = "Qavanijeb.exe" fullword wide
+      $s12 = "%s --> Error: %d, EC: %d" fullword ascii
+      $s13 = "wscript.exe //E:vbscript" wide
+      $s14 = "upgrader_64" wide
+      $s15 = "Process Data Error" fullword wide
    condition:
-      uint16(0) == 0x5a4d and filesize < 500KB and
-      8 of them
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      1 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_29 {
+rule General_29 {
    meta:
-      description = "PYAS_Rules_A_29"
+      description = "29"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -837,9 +830,9 @@ rule PYAS_Rules_A_29 {
       6 of them
 }
 
-rule PYAS_Rules_A_30 {
+rule General_30 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "30"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -858,9 +851,9 @@ rule PYAS_Rules_A_30 {
       6 of them
 }
 
-rule PYAS_Rules_A_31 {
+rule General_31 {
    meta:
-      description = "PYAS_Rules_A_31"
+      description = "31"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -878,9 +871,9 @@ rule PYAS_Rules_A_31 {
       6 of them
 }
 
-rule PYAS_Rules_A_32 {
+rule General_32 {
    meta:
-      description = "PYAS_Rules_A_32"
+      description = "32"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -909,9 +902,9 @@ rule PYAS_Rules_A_32 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_33 {
+rule General_33 {
    meta:
-      description = "PYAS_Rules_A_33"
+      description = "33"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -937,9 +930,9 @@ rule PYAS_Rules_A_33 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_34 {
+rule General_34 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "34"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -965,9 +958,9 @@ rule PYAS_Rules_A_34 {
       8 of them
 }
 
-rule PYAS_Rules_A_35 {
+rule General_35 {
    meta:
-      description = "PYAS_Rules_A_35"
+      description = "35"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -996,9 +989,9 @@ rule PYAS_Rules_A_35 {
       6 of them
 }
 
-rule PYAS_Rules_A_36 {
+rule General_36 {
    meta:
-      description = "PYAS_Rules_A_36"
+      description = "36"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1023,9 +1016,9 @@ rule PYAS_Rules_A_36 {
       6 of them
 }
 
-rule PYAS_Rules_A_37 {
+rule General_37 {
    meta:
-      description = "PYAS_Rules_A_37"
+      description = "37"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1053,9 +1046,9 @@ rule PYAS_Rules_A_37 {
       6 of them
 }
 
-rule PYAS_Rules_A_38 {
+rule General_38 {
    meta:
-      description = "PYAS_Rules_A_38"
+      description = "38"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1083,9 +1076,9 @@ rule PYAS_Rules_A_38 {
       6 of them
 }
 
-rule PYAS_Rules_A_39 {
+rule General_39 {
    meta:
-      description = "PYAS_Rules_A_39"
+      description = "39"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1104,9 +1097,9 @@ rule PYAS_Rules_A_39 {
       6 of them
 }
 
-rule PYAS_Rules_A_40 {
+rule General_40 {
    meta:
-      description = "PYAS_Rules_A_40"
+      description = "40"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1136,9 +1129,9 @@ rule PYAS_Rules_A_40 {
       8 of them
 }
 
-rule PYAS_Rules_A_41 {
+rule General_41 {
    meta:
-      description = "PYAS_Rules_A_41"
+      description = "41"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1160,9 +1153,9 @@ rule PYAS_Rules_A_41 {
       6 of them
 }
 
-rule PYAS_Rules_A_42 {
+rule General_42 {
    meta:
-      description = "PYAS_Rules_A_42"
+      description = "42"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1182,9 +1175,9 @@ rule PYAS_Rules_A_42 {
       6 of them
 }
 
-rule PYAS_Rules_A_43 {
+rule General_43 {
    meta:
-      description = "PYAS_Rules_A_43"
+      description = "43"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1209,9 +1202,9 @@ rule PYAS_Rules_A_43 {
       8 of them
 }
 
-rule PYAS_Rules_A_44 {
+rule General_44 {
    meta:
-      description = "PYAS_Rules_A_44"
+      description = "44"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1239,9 +1232,9 @@ rule PYAS_Rules_A_44 {
       8 of them
 }
 
-rule PYAS_Rules_A_45 {
+rule General_45 {
    meta:
-      description = "PYAS_Rules_A_45"
+      description = "45"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1268,9 +1261,9 @@ rule PYAS_Rules_A_45 {
       8 of them
 }
 
-rule PYAS_Rules_A_46 {
+rule General_46 {
    meta:
-      description = "PYAS_Rules_A_46"
+      description = "46"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1298,9 +1291,9 @@ rule PYAS_Rules_A_46 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_47 {
+rule General_47 {
    meta:
-      description = "PYAS_Rules_A_47"
+      description = "47"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1329,9 +1322,9 @@ rule PYAS_Rules_A_47 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_48 {
+rule General_48 {
    meta:
-      description = "PYAS_Rules_A_48"
+      description = "48"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1350,9 +1343,9 @@ rule PYAS_Rules_A_48 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_49 {
+rule General_49 {
    meta:
-      description = "PYAS_Rules_A_49"
+      description = "49"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1378,9 +1371,9 @@ rule PYAS_Rules_A_49 {
       3 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_50 {
+rule General_50 {
    meta:
-      description = "PYAS_Rules_A_50"
+      description = "50"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1400,9 +1393,9 @@ rule PYAS_Rules_A_50 {
       $x1 and 6 of them
 }
 
-rule PYAS_Rules_A_51 {
+rule General_51 {
    meta:
-      description = "PYAS_Rules_A_51"
+      description = "51"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1420,9 +1413,9 @@ rule PYAS_Rules_A_51 {
       1 of ($x*) and 4 of them
 }
 
-rule PYAS_Rules_A_52 {
+rule General_52 {
    meta:
-      description = "PYAS_Rules_A_52"
+      description = "52"
       author = "PYAS Security"
       date = "2024-06-13"
    strings:
@@ -1444,31 +1437,3 @@ rule PYAS_Rules_A_52 {
       uint16(0) == 0x5a4d and filesize < 2000KB and
       8 of them
 }
-
-rule PYAS_Rules_A_53 {
-   meta:
-      description = "PYAS_Rules_A_53"
-      author = "PYAS Security"
-      date = "2024-06-12"
-   strings:
-      $x1 = "schemas.microsoft.com" wide
-      $x2 = "Client Worker Thread" ascii
-      $s1 = "A6BFEA43-501F-456F-A845-983D3AD7B8F0" wide
-      $s2 = "upgrader" wide
-      $s3 = "rtvscan.exe" wide
-      $s4 = "Enable-WindowsOptionalFeature -FeatureName" wide
-      $s5 = "remupd.exe" fullword wide
-      $s6 = "Mcshield.exe" fullword wide
-      $s7 = "mssecess.exe" fullword wide
-      $s8 = "RavMonD.exe" fullword wide
-      $s9 = "KvMonXP.exe" fullword wide
-      $s10 = "baiduSafeTray.exe" fullword wide
-      $s11 = "Qavanijeb.exe" fullword wide
-      $s12 = "%s --> Error: %d, EC: %d" fullword ascii
-      $s13 = "wscript.exe //E:vbscript" wide
-      $s14 = "upgrader_64" wide
-      $s15 = "Process Data Error" fullword wide
-   condition:
-      uint16(0) == 0x5a4d and filesize < 1000KB and
-      1 of ($x*) and 6 of them
-}

Exten/Bitdefender/bdc.ini

@@ -1,15 +0,0 @@
-ExcludeXMD = 
-Extensions = exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;nws;
-ExcludeExtensions = 
-ConfigFile = bdc.ini
-HttpProxy = 
-InfectedFolder = Infected
-SuspectedFolder = Suspected
-LogMaxSize = 1024
-RenameExtension = vir
-PluginsPaths = Plugins
-LogName = bdc.log
-UpdateHttpLocation = http://upgrade.bitdefender.com/av32bit-eps
-XMD = *
-LastUpdate = Wed Feb 18 16:39:59 2009
-ProductID = {AAD1516D-28AB-4EB5-B7C8-DF54FE4442E9}

Exten/Bitdefender/plugins.htm

@@ -1,14 +0,0 @@
-<p>AVCORE v2.2 Windows/i386 11.0.1.21 (August 15, 2021)</p>
-<p>disp.xmd - Dispatcher (0.00) 0x1[997] (r)</p>
-<p>pyinstaller.xmd - PYInstaller unpacker (1.0) 0x8[12] (r)</p>
-<p>rar.xmd - RAR5 unpacker (0.5) 0xA[12] (r)</p>
-<p>thebat.xmd - TheBat Engine (0.03a) 0x4010[12] (r) +</p>
-<p>html.xmd - HTML Parser (1.0) 0x4008[11] (r) +</p>
-<p>mdx.xmd - Macro Defense Expert (3.57b) 0x1[11] 1[0] (r)</p>
-<p>cevakrnl.xmd - CEVA (0.03a) 0x1[10] (r)</p>
-<p>pdf.xmd - PDF Engine (2.0) 0x4009[10] (r) +</p>
-<p>imp.xmd - IMP (1.4.2) 0x2[9] (r)</p>
-<p>sfx.xmd - Sfx Engine (1.8.6) 0xA[9] (r)</p>
-<p>sdx.xmd - SDX () 0x1[5] 191729[0] (r)</p>
-<p>jpeg.xmd - JPEG Engine (0.05) 0x1[1] 14[1] (r)</p>
-<p>rtf.xmd - RTF (1.0) 0x4008[0] (r) +</p>

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020-2024 87owo (PYAS Security)
+Copyright (c) 2020-2025 87owo (PYAS Security)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Model/PYAS_Model.json

@@ -1 +0,0 @@
-{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 27853809242729492000984914092533936796891917926358854729439436487683423285261, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 60491018752293550079699763462944244393253888103551546202593483014975813742967, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 6759146298068049614085390992799666053918974602489525613718797088468975708017, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 5354562433688861244299028006341553420425390015040147574513776499404802540118, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 817984956081990458969224676381868506770627801582748844000835755782736667191, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 2916561284514958799877078174216081002558870786437593202464334407456915288119, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 14623491695050192413097067629676318500123044497134202517578785087180871258165, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 79047998258892679051555952202178856054614923426747250310189496005785954516966, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707Line truncated

PYAS_Config.py

@@ -0,0 +1,128 @@
+translate_dict = {
+    "traditional_switch": {"开启":"開啟","关闭":"關閉","On":"開啟","Off":"關閉"},
+
+    "simplified_switch": {"開啟":"开启","關閉":"关闭","On":"开启","Off":"关闭",
+              "錯誤":"错误","發現":"发现","關閉":"关闭","裝置":"设备","記憶體":"内存",
+              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
+              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
+              "位元":"字节","靈敏":"敏感","複製":"复制","開啟":"开启","靜態":"静态",
+              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
+              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
+              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
+              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
+              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
+              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
+              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
+              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
+              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
+              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
+              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","與":"与",
+              "異":"异","實":"实","時":"时","彈":"弹","窗":"窗","暫":"暂","訂":"订",
+              "資":"资","產":"产","金":"密","離":"离","規":"规","則":"则","來":"来",
+              "殼":"壳","碼":"码","線":"线",},
+
+    "english_switch": {"開啟":"On","關閉":"Off","开启":"On","关闭":"Off","，":", ",
+              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Official Website ",
+              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
+              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ","主要":"Main ",
+              "許可條款":"License Terms ","惡意":"Malicious", "開發":"Developers ",
+              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
+              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
+              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
+              "藍色主題":"Blue","綠色主題":"Green","自訂主題":"Custom","黑色主題":"Black",
+              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
+              "註冊":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
+              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
+              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
+              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
+              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
+              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
+              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
+              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
+              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
+              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"Can ",
+              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
+              "分區":"Partition ","設定":"Setting ","關於":"About","模式":"Mode ",
+              "提高":"Improve ","安全":"Security ","顯色":"Color ","顏色":"Color ",
+              "主題":"Theme ", "回收":"Collect ", "無用":"Useless ","導入":"Import ",
+              "風險":"Risk ","介面":"UI ","核心":"Core ","服務":"Services ",
+              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
+              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
+              "到":"To ","白名單":"White List ","軟體":"Software ","正在":"",
+              "增加":"Add ","移除":"Delete ","項目":"Items ","生成":"Create ","稱":"",
+              "複製":"Copy ","此":"This ","並":"And ","全盤":"Full ","最新":"Latest ",
+              "已存在":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Rule ",
+              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
+              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
+              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","列表":"List ",
+              "竄改":"Tamper ","第三方":"Other ","實時":"Real Time ","查看":"View ",
+              "指定":"Specify ","清空":"Empty ","資源回收桶":"Recycle Bin ", "無法":"Cannot ",
+              "與":"With ","當":"When ","功能":"Function ","異常":"Abnormal ", "來":"To ",
+              "重置":"Reset ","窗口":"Window ","暫存":"Temp ","自訂":"Custom ",
+              "不支持":"Not Support ","共":"Total ","秒":"Seconds ","耗時":"Takes ",
+              "沙箱":"Sandbox ", "虛擬":"Virtual ", "隔離":"Quarantine ", "時":"",
+              "建立":"Create ","環境":"Environment ","沙箱":"Sandbox ","化":"", "表":"",
+              "達":"Reached ", "上限":"Limit ", "區":"", "金鑰":"Key ", "產品":"Product ",
+              "托管":"CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Inject ",
+              "前往":"Go ","檢查":"Check ","可用":"Available ","靜態":"Static ", "  ":" "},
+
+    "white_switch": {
+        "_white": "_black",},
+    "red_switch": {
+        "235, 235, 235": "255, 235, 235",
+        "245, 245, 245": "255, 225, 225",
+        "255, 255, 255": "255, 245, 245",
+        "240, 240, 240": "255, 220, 220",
+        "250, 250, 250": "255, 210, 210",
+        "220, 255, 220": "255, 220, 220",
+        "210, 255, 210": "255, 210, 210",
+        "_white": "_black"
+    },
+    "yellow_switch": {
+        "235, 235, 235": "255, 255, 235",
+        "245, 245, 245": "255, 255, 225",
+        "255, 255, 255": "255, 255, 245",
+        "240, 240, 240": "255, 255, 220",
+        "250, 250, 250": "255, 255, 210",
+        "220, 255, 220": "255, 255, 220",
+        "210, 255, 210": "255, 255, 210",
+        "_white": "_black"
+    },
+    "green_switch": {
+        "235, 235, 235": "235, 255, 235",
+        "245, 245, 245": "225, 255, 225",
+        "255, 255, 255": "245, 255, 245",
+        "240, 240, 240": "220, 255, 220",
+        "250, 250, 250": "210, 255, 210",
+        "_white": "_black"
+    },
+    "blue_switch": {
+        "235, 235, 235": "235, 235, 255",
+        "245, 245, 245": "225, 225, 255",
+        "255, 255, 255": "245, 245, 255",
+        "240, 240, 240": "220, 220, 255",
+        "250, 250, 250": "210, 210, 255",
+        "220, 255, 220": "220, 220, 255",
+        "210, 255, 210": "210, 210, 255",
+        "_white": "_black"
+    },
+    "black_switch": {
+        "255, 255, 255": "55, 55, 55", 
+        "245, 245, 245": "75, 75, 75",
+        "235, 235, 235": "65, 65, 65", 
+        "240, 240, 240": "80, 80, 80",
+        "250, 250, 250": "90, 90, 90",
+        "220, 255, 220": "80, 80, 80",
+        "210, 255, 210": "90, 90, 90",
+        "0, 0, 0": "255, 255, 255",
+        "_black": "_white"
+    }
+}

PYAS_Engine.py

@@ -1,84 +1,150 @@
-import time, json, hashlib, numpy
-from collections import Counter
+import os, yara, numpy, locale, pefile, onnxruntime
+from PIL import Image
 
-class ListSimHash:
+class rule_scanner:
     def __init__(self):
-        self.model = {}
+        self.rules = {}
+        self.network = []
 
-    def save_model(self, file_name):
-        with open(file_name, 'w') as f:
-            json.dump(self.model, f)
-        print(f"\nModel Is Saved In {file_name}")
+    def load_path(self, path):
+        for root, _, files in os.walk(path):
+            for file in files:
+                self.load_file(os.path.join(root, file))
 
-    def load_model(self, model_data):
-        if isinstance(model_data, str):
-            with open(model_data, 'r') as f:
-                model_data = json.load(f)
-        self.model = model_data
+    def load_file(self, file):
+        ext = os.path.splitext(file)[1].lower()
+        try:
+            if ext in ('.yara', '.yar'):
+                self.rules[file] = yara.compile(file)
+            elif ext in ('.yc', '.yrc'):
+                self.rules[file] = yara.load(file)
+            elif ext in ('.ip', '.txt'):
+                with open(file, "r", encoding="utf-8", errors="ignore") as f:
+                    self.network.extend(line.strip() for line in f if line.strip())
+        except Exception:
+            return False
 
-    def get_model(self, label):
-        return self.model[label]
+    def yara_scan(self, file_path):
+        try:
+            data = open(file_path, "rb").read() if isinstance(file_path, str) else file_path
+            for rules in self.rules.values():
+                matches = rules.match(data=data)
+                if matches:
+                    rule_name = str(matches[0])
+                    label = rule_name.split("_")[0]
+                    level = rule_name.split("_")[-1]
+                    return f"Rules/{label}", level
+            return False, False
+        except Exception:
+            return False, False
 
-    def train_model(self, label, data):
-        start = time.time()
-        print(f"Convert {label}")
-        if label not in self.model:
-            self.model[label] = []
-        for i, x in enumerate(data, 1):
-            self.model[label].append(self.build_text(x))
-            used = "{0:.2f}".format(time.time()-start)
-            prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
-            self.progress_bar(i, len(data), prefix, suffix)
+class model_scanner:
+    SHELLS = {
+        "0","1","2","3","4","5","6","7","8","9","cry","tvm","dec","enc","vmp","upx","aes","lzma","press","pack",
+        "enigma","protect","secur","asmstub","base","bss","clr_uef","cursors","transit","trs_age","engine","fio",
+        "fothk","h~;","icapsec","malloc_h","miniex","mssmixer","ndr64","nsys_wr","obr","wow","wow64svc","wpp_sf",
+        "pad","pgae","poolmi","proxy","qihoo","retpol","uedbg","tracesup","rwexec","rygs","s:@","sanontcp","segm",
+        "test","res","wisevec","viahwaes","orpc","nep","ace","extjmp","no_bbt","data","page","hexpthk"}
 
-    def build_text(self, content):
-        sums, batch, count = [], [], 0
-        features = dict(Counter(sorted(content)))
-        for f, w in features.items():
-            count += w
-            batch.append(hashlib.sha256(json.dumps(f).encode('utf-8')).digest() * w)
-            if len(batch) >= 10000:
-                sums.append(self.sum_hashes(batch))
-                batch = []
-        if batch:
-            sums.append(self.sum_hashes(batch))
-        combined_sums = numpy.sum(sums, 0)
-        v = numpy.packbits(combined_sums > count / 2).tobytes()
-        return int.from_bytes(v, 'big')
+    def __init__(self):
+        self.models = {}
+        self.suffix = {".com", ".exe", ".dll", ".sys", ".scr", ".bat", ".cmd", ".ps1", ".vbs", ".wsf"}
+        self.labels = ["Pefile/White", "Script/White", "Pefile/General", "Script/General"]
+        self.detect = {"Pefile/General", "Script/General"}
+        self.resize = (224, 224)
 
-    def sum_hashes(self, digests):
-        bitarray = numpy.unpackbits(numpy.frombuffer(b''.join(digests), dtype='>B'))
-        return numpy.sum(numpy.reshape(bitarray, (-1, 256)), 0)
+    def load_path(self, path):
+        for root, _, files in os.walk(path):
+            for file in files:
+                self.load_file(os.path.join(root, file))
 
-    def progress_bar(self, items, total, prefix='', suffix='', length=50, fill='█'):
-        percent = min(100.0, max(0.0, 100 * (items / float(total))))
-        end_char = '\n' if percent >= 100 else '\r'
-        percent_string = "{0:.2f}".format(percent)
-        filled_length = int(length * items // total)
-        bar = fill * filled_length + ' ' * (length - filled_length)
-        print(f'\r{prefix: <15} |{bar}| {percent_string}% {suffix}', end=end_char)
+    def load_file(self, file):
+        if file.lower().endswith('.onnx'):
+            try:
+                self.models[file] = onnxruntime.InferenceSession(file)
+            except Exception:
+                return False
 
-    def predict_all(self, query):
-        label_similarities = {}
-        query_hash = self.build_text(query)
-        for label in self.model:
-            max_similarity = 0
-            for data_point in self.model[label]:
-                similarity = self.similar(data_point, query_hash)
-                if similarity > max_similarity:
-                    max_similarity = similarity
-            label_similarities[label] = max_similarity
-        return label_similarities
+    def is_valid_suffix(self, file_path):
+        return os.path.splitext(file_path)[-1].lower() in self.suffix
 
-    def predict(self, query):
-        max_similarity, max_label = 0, None
-        query_hash = self.build_text(query)
-        for label in self.model:
-            for data_point in self.model[label]:
-                similarity = self.similar(data_point, query_hash)
-                if similarity > max_similarity:
-                    max_similarity, max_label = similarity, label
-        return max_label, max_similarity
+    def model_scan(self, file_path):
+        try:
+            if not self.models or not self.is_valid_suffix(file_path):
+                return False, False
 
-    def similar(self, x, y):
-        hamming_distance = bin(x ^ y).count('1')
-        return 1 - hamming_distance / 256
+            model = next(iter(self.models.values()))
+            shape = model.get_inputs()[0].shape
+            channels = shape[-1] if shape[-1] in (1, 3) else (shape[1] if shape[1] in (1, 3) else 1)
+
+            file_sections = self.get_type(file_path)
+            if not file_sections:
+                return False, False
+
+            batch_images = [self.preprocess_image(data, self.resize, channels) for data in file_sections.values()]
+            arr = numpy.stack([numpy.asarray(img).astype('float32') / 255.0 for img in batch_images])
+            if arr.ndim == 3:
+                arr = arr[..., None]
+            if shape[-1] in (1, 3):
+                model_input = arr
+            elif shape[1] in (1, 3):
+                model_input = arr.transpose(0, 3, 1, 2)
+            else:
+                return False, False
+
+            input_name = model.get_inputs()[0].name
+            predictions = model.run(None, {input_name: model_input})[0]
+
+            label_scores = {label: [] for label in self.labels}
+            for pre_answers in predictions:
+                for k, score in enumerate(pre_answers):
+                    label_scores[self.labels[k]].append(score)
+            label_percentage = {label: (sum(scores)/len(scores))*100 for label, scores in label_scores.items() if scores}
+            if not label_percentage:
+                return False, False
+            best_label, best_conf = max(label_percentage.items(), key=lambda x: x[1])
+            if best_label in self.detect:
+                return best_label, int(best_conf)
+            return False, False
+        except Exception:
+            return False, False
+
+    def preprocess_image(self, file_data, size, channels=1):
+        width, height = size
+        wah = int(numpy.ceil(numpy.sqrt(len(file_data) / channels)))
+        arr = numpy.frombuffer(file_data, dtype=numpy.uint8)
+        img = numpy.zeros(wah*wah*channels, dtype=numpy.uint8)
+        img[:len(file_data)] = arr
+        if channels == 1:
+            image = Image.fromarray(img.reshape((wah, wah)), 'L')
+        else:
+            image = Image.fromarray(img.reshape((wah, wah, channels)), 'RGB')
+        return image.resize((width, height), Image.Resampling.NEAREST)
+
+    def is_text_file(self, content, sample_size=1024):
+        raw = content[:sample_size]
+        if not raw:
+            return False
+        text_char = set(range(32, 127)) | {9, 10, 13}
+        nontext = sum(b not in text_char for b in raw)
+        return nontext / len(raw) < 0.15
+
+    def get_type(self, file_path):
+        match_data = {}
+        if not self.is_valid_suffix(file_path):
+            return match_data
+        try:
+            with pefile.PE(file_path, fast_load=True) as pe:
+                sec = pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_SECURITY']]
+                if bool(sec.VirtualAddress and sec.Size):
+                    return {}
+                for section in pe.sections:
+                    name = section.Name.rstrip(b'\x00').decode('latin1').lower()
+                    if (section.Characteristics & 0x00000020) and name not in self.SHELLS:
+                        match_data[name] = section.get_data()
+        except pefile.PEFormatError:
+            with open(file_path, 'rb') as f:
+                file_content = f.read()
+            if self.is_text_file(file_content):
+                match_data[os.path.splitext(file_path)[-1].lower()] = file_content
+        return match_data

PYAS_Extension.py

@@ -1,24 +0,0 @@
-from subprocess import *
-import os, re, sys
-
-class ExtenRules:
-    def __init__(self):
-        self.exten = {}
-        self.pyas = sys.argv[0].replace("\\", "/")
-        self.dir = os.path.dirname(self.pyas)
-        self.exten = os.path.join(self.dir, "Exten")
-
-    def bdc_scan(self, file):
-        if self.exten.replace("\\", "/") not in file.replace("\\", "/"):
-            cmd = f'"{self.exten}\\Bitdefender\\bdc.exe" "{file}"'
-            p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True)
-            for matchs in re.finditer(r'(?P<filename>[^\s]+)\s+infected:\s+(?P<virusname>.+)', p.communicate()[0]):
-                return matchs
-        return False
-
-    def mem_scan(self, p):
-        if self.exten.replace("\\", "/") not in p.exe().replace("\\", "/"):
-            cmd = f'"{self.exten}\\hollows_hunter\\hollows_hunter.exe" /ofilter 2 /pid "{p.pid}"'
-            p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True)
-            return 'Detected' in p.communicate()[0]
-        return False

PYAS_Language.py

@@ -1,59 +0,0 @@
-translate_dict = {
-    "zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"已開啟","Off":"已關閉"},
-    "zh_CN": {"已開啟":"已开启","已關閉":"已关闭","On":"已开启","Off":"已关闭",
-              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
-              "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
-              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","開啟":"开启",
-              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
-              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
-              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
-              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
-              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
-              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
-              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
-              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
-              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
-              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
-              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
-              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","記憶體":"内存",},
-    "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
-              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website ",
-              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
-              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ",
-              "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
-              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
-              "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
-              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
-              "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
-              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
-              "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
-              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
-              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
-              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
-              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
-              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
-              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
-              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
-              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
-              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
-              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"To ",
-              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
-              "分區":"Partition ","設定":"Settings","關於":"About","模式":"Mode ",
-              "提高":"Improve ","安全":"Security ","顯色":"Color ","主題":"Themes ",
-              "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
-              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
-              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-              "增加到":"Add To ","白名單":"White List ","軟體":"Software ","正在":"Start ",
-              "增加":"Add ","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
-              "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
-              "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
-              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
-              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
-              "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
-              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
-              "擴展套件":"Extension Kit ","自動":"Auto ","上報":"Report ","與":"With ",
-              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
-              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","追蹤":"Tracking ",
-              "竄改":"Tamper ","  ":" "}}

PYAS_Suffixes.py

@@ -1,11 +0,0 @@
-slist = [".exe",".dll",".com",".msi",".scr",
-         ".js",".bat",".cmd",".ps1",".vbs"]
-
-alist = [".exe",".dll",".zip",".7z",".rar",
-         ".js",".bat",".cmd",".ps1",".vbs",
-         ".ppt",".pptx",".wps",".txt",".rtf",
-         ".pdf",".xls",".xlsx",".doc",".docx",
-         ".jpg",".jpeg",".png",".webp",".gif",
-         ".mp3",".wav",".aac",".ogg",".flac",
-         ".mp4",".avi",".mov",".wmv",".mkv",
-         ".aux",".cur",".mui",".ttf",".efi"]

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.4',
+version='3.3.2',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,176 +1,68 @@
-# PYAS (Python Antivirus Software)
+# PYAS
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+Python antivirus software uses deep learning and behavioral monitoring to block threats!
+
+![PYAS_UI](https://github.com/user-attachments/assets/68765836-7272-482f-b8cd-d8ba728d88ab)
 
 ## Readme Language
 
-[繁體中文](https://github.com/87owo/PYAS/blob/main/README_zh_TW.md) , 
-[简体中文](https://github.com/87owo/PYAS/blob/main/README_zh_CN.md)
+繁體中文 : https://github.com/87owo/PYAS/blob/main/README_zh_TW.md
 
-## File Information
-
-PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
-
-PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
-
-PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
-
-PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
-
-PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
-
-PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
-
-PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
-
-PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
-
-## Dir Information
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+简体中文 : https://github.com/87owo/PYAS/blob/main/README_zh_CN.md
 
 ## Requirements
 
-Use pip install requirements to install import module
+Python 3.10 is recommended. Other Python versions may require different pip commands.
 
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install numpy==1.26.4
+pip install onnxruntime==1.18.1
+pip install pefile==2023.2.7
+pip install Pillow==11.0.0
+pip install pyperclip==1.9.0
+pip install PySide6==6.9.1
+pip install requests==2.32.4
+pip install yara-python==4.5.4
 ```
 
-## Pefile Scanning
+## File Information
 
-Get the pefile file function import table for scanning
+The following lists the storage locations of all relevant code and other related documents.
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
+PYAS/
+├── Engine/
+│   ├── Models/              # Directory for ONNX AI models
+│   └── Rules/               # Directory for YARA and network rules
+│
+├── Plugins/
+│   └── Filter/              # Windows kernel driver for security protection
+│
+├── PYAS.py                  # Main application and GUI interface
+├── PYAS_Config.py           # Configuration handling and global parameters
+├── PYAS_Engine.py           # YARA and ONNX Scanning engine
+├── PYAS_Interface.py        # User interface definitions and widget logic
+├── PYAS_Resource.py         # Static resource management
+├── PYAS_Version.py          # Packaging and version info
+└── ...                      # Other supplementary folders and files
 ```
 
-## Process Detect
+## Packaged Releases
 
-Show the new process name, file path, cmd line, pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## File Detect
-
-Monitor file changes under the specified path
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
-```
-
-## Official Website
-
-https://pyantivirus.wixsite.com/pyas
-
-https://github.com/87owo/PYAS
-
-## PYAS Driver
-
-https://github.com/0sha0/PYAS_Protection
-
-## MIT license
-
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+Packaged Releases Download: https://github.com/87owo/PYAS/releases
 
 ## Support System
 
-Windows 8.1, 10, 11 (64-bit), Ram 500MB, Rom 200MB or higher
+| Config    | Permissions   | System version | Available memory | Available storage |
+|-----------|---------------|----------------|------------------|-------------------|
+| Minimum   | Administrator | Windows 8.1    | 200MB            | 100MB             |
+| Recommend | Administrator | Windows 10     | 300MB            | 200MB             |
+| Optimal   | Administrator | Windows 11     | 500MB            | 200MB             |
 
-Other systems may experience software malfunctions or crash
+## Official Website
 
-## Special Thanks
+https://github.com/87owo/PYAS
 
-Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+## Project License
 
-Copyright© 2020~2024 PYAS Security By 87owo
+https://github.com/87owo/PYAS/blob/main/LICENSE.md

README_zh_CN.md

@@ -1,147 +1,37 @@
 # PYAS (Python 杀毒软件)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
-
-## 文件信息
-
-PYAS.py -> PYAS主程式（包括动画、扫描、保护功能等）
-
-PYAS_Engine.py -> 转换资料库（用于相互转换资料库字典和清单）
-
-PYAS_Extension.py -> 副文件名（包括扫描文件副文件名和常用副文件名）
-
-PYAS_Model.* -> 病毒库（病毒库必须放在同一目录下）
-
-PYAS_Interface.py -> PyQt5界面（由QT设计师设计，必须与主程式相符）
-
-PYAS_Resource.py -> PyQt5资源（状态图片、图示包、按钮图示等）
-
-PYAS_Language.py -> 翻译字典（繁体中文、简体中文、英文）
-
-PYAS_Version.py -> Pyinstaller资讯（文件资讯、版本资讯、原名等）
-
-## 目录信息
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+![PYAS_UI](https://github.com/user-attachments/assets/68765836-7272-482f-b8cd-d8ba728d88ab)
 
 ## 安装要求
 
-使用 pip install requirements 来安装需要的模组
-
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install numpy==1.26.4
+pip install onnxruntime==1.18.1
+pip install pefile==2023.2.7
+pip install Pillow==11.0.0
+pip install pyperclip==1.9.0
+pip install PySide6==6.9.1
+pip install requests==2.32.4
+pip install yara-python==4.5.4
 ```
 
-## 文件扫描
-
-取得pefile文件函数导入表进行扫描
+## 文件信息
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 进程监控
-
-显示新进程名称、文件路径、cmd 行、pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 文件监控
-
-监控指定路径下的文件变化
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── PYAS.py                  # 主程序，提供 PySide6 视觉化操作介面
+├── PYAS_Config.py           # 设定档处理与全域参数管理
+├── PYAS_Engine.py           # 扫描引擎，整合 YARA 规则与 ONNX AI 模型
+├── PYAS_Interface.py        # UI 介面定义与元件交互
+├── PYAS_Resource.py         # 资源档与静态资源管理
+├── PYAS_Version.py          # 程式版本与打包资讯
+├── Engine/
+│   ├── Models/              # AI 模型（ONNX 格式）存放目录
+│   └── Rules/               # YARA 规则与网路规则存放目录
+├── Plugins/
+│   └── Filter/              # 驱动程式目录
+│       └── PYAS_Driver.sys  # Windows 驱动程式（系统保护用）
+└── ...                      # 其它辅助资料夹与档案
 ```
 
 ## 官方网页
@@ -150,22 +40,22 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
+## 微软运行库
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
 ## 开源协议
 
 https://github.com/87owo/PYAS/blob/main/LICENSE.md
 
-## 驱动程序
-
-https://github.com/0sha0/PYAS_Protection
-
 ## 支援系统
 
-Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
+Windows 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
 
 其他系统或版本可能会遇到软体功能故障或程序崩溃
 
 ## 特别感谢
 
-360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
-Copyright© 2020~2024 PYAS Security By 87owo
+Copyright© 2020~2025 PYAS Security By 87owo

README_zh_TW.md

@@ -1,145 +1,37 @@
 # PYAS (Python 防毒軟體)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
-
-## 檔案資訊
-
-PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
-
-PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
-
-PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
-
-PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
-
-PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
-
-PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
-
-PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
-
-PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
-
-## 目錄資訊
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+![PYAS_UI](https://github.com/user-attachments/assets/68765836-7272-482f-b8cd-d8ba728d88ab)
 
 ## 安裝要求
 
-使用 pip install requirements 來安裝需要的模組
-
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install numpy==1.26.4
+pip install onnxruntime==1.18.1
+pip install pefile==2023.2.7
+pip install Pillow==11.0.0
+pip install pyperclip==1.9.0
+pip install PySide6==6.9.1
+pip install requests==2.32.4
+pip install yara-python==4.5.4
 ```
 
-## 檔案掃描
-
-取得pefile檔案函數導入表進行掃描
+## 檔案資訊
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 進程監控
-
-顯示新進程名稱、檔案路徑、cmd 行、pid
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 檔案監控
-
-監控指定路徑下的檔案變化
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── PYAS.py                  # 主程式，提供 PySide6 視覺化操作介面
+├── PYAS_Config.py           # 設定檔處理與全域參數管理
+├── PYAS_Engine.py           # 掃描引擎，整合 YARA 規則與 ONNX AI 模型
+├── PYAS_Interface.py        # UI 介面定義與元件交互
+├── PYAS_Resource.py         # 資源檔與靜態資源管理
+├── PYAS_Version.py          # 程式版本與打包資訊
+├── Engine/
+│   ├── Models/              # AI 模型（ONNX 格式）存放目錄
+│   └── Rules/               # YARA 規則與網路規則存放目錄
+├── Plugins/
+│   └── Filter/              # 驅動程式目錄
+│       └── PYAS_Driver.sys  # Windows 驅動程式（系統保護用）
+└── ...                      # 其它輔助資料夾與檔案
 ```
 
 ## 官方網頁
@@ -148,22 +40,22 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
+## 微軟運行庫
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
 ## 開源協議
 
 https://github.com/87owo/PYAS/blob/main/LICENSE.md
 
-## 驅動程式
-
-https://github.com/0sha0/PYAS_Protection
-
 ## 支援系統
 
-Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
+Windows 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
 
 其他系統或版本可能會遇到軟體功能故障或程序崩潰
 
 ## 特別感謝
 
-Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
-Copyright© 2020~2024 PYAS Security By 87owo
+Copyright© 2020~2025 PYAS Security By 87owo