Add files via upload

Exten/Bitdefender/bdc.ini

@@ -1,15 +0,0 @@
-ExcludeXMD = 
-Extensions = exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;nws;
-ExcludeExtensions = 
-ConfigFile = bdc.ini
-HttpProxy = 
-InfectedFolder = Infected
-SuspectedFolder = Suspected
-LogMaxSize = 1024
-RenameExtension = vir
-PluginsPaths = Plugins
-LogName = bdc.log
-UpdateHttpLocation = http://upgrade.bitdefender.com/av32bit-eps
-XMD = *
-LastUpdate = Wed Feb 18 16:39:59 2009
-ProductID = {AAD1516D-28AB-4EB5-B7C8-DF54FE4442E9}

Exten/Bitdefender/plugins.htm

@@ -1,14 +0,0 @@
-<p>AVCORE v2.2 Windows/i386 11.0.1.21 (August 15, 2021)</p>
-<p>disp.xmd - Dispatcher (0.00) 0x1[997] (r)</p>
-<p>pyinstaller.xmd - PYInstaller unpacker (1.0) 0x8[12] (r)</p>
-<p>rar.xmd - RAR5 unpacker (0.5) 0xA[12] (r)</p>
-<p>thebat.xmd - TheBat Engine (0.03a) 0x4010[12] (r) +</p>
-<p>html.xmd - HTML Parser (1.0) 0x4008[11] (r) +</p>
-<p>mdx.xmd - Macro Defense Expert (3.57b) 0x1[11] 1[0] (r)</p>
-<p>cevakrnl.xmd - CEVA (0.03a) 0x1[10] (r)</p>
-<p>pdf.xmd - PDF Engine (2.0) 0x4009[10] (r) +</p>
-<p>imp.xmd - IMP (1.4.2) 0x2[9] (r)</p>
-<p>sfx.xmd - Sfx Engine (1.8.6) 0xA[9] (r)</p>
-<p>sdx.xmd - SDX () 0x1[5] 191729[0] (r)</p>
-<p>jpeg.xmd - JPEG Engine (0.05) 0x1[1] 14[1] (r)</p>
-<p>rtf.xmd - RTF (1.0) 0x4008[0] (r) +</p>

Exten/Download_Link.txt

@@ -0,0 +1,11 @@
+[hollows_hunter]
+
+https://github.com/hasherezade/hollows_hunter/releases
+
+[pe_sieve]
+
+https://github.com/hasherezade/pe-sieve/releases
+
+[bitdefender]
+
+https://github.com/87owo/bdc/tree/main/bitdefender

Model/PYAS_Model.json

@@ -1 +1 @@
-{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 27853809242729492000984914092533936796891917926358854729439436487683423285261, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 60491018752293550079699763462944244393253888103551546202593483014975813742967, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 6759146298068049614085390992799666053918974602489525613718797088468975708017, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 5354562433688861244299028006341553420425390015040147574513776499404802540118, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 817984956081990458969224676381868506770627801582748844000835755782736667191, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 2916561284514958799877078174216081002558870786437593202464334407456915288119, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 14623491695050192413097067629676318500123044497134202517578785087180871258165, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 79047998258892679051555952202178856054614923426747250310189496005785954516966, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707Line truncated
+{"Unknown": [59361295766927921263572072001677546892988818127554310688483531901728654248638, 110146453841778647644166243240178520536267161301604245683743524756419353678059], "White": [37818885244835446256584092883046666135310645230383968345516924743398787357048, 10034220084157156036025657182253677958809969876761493145101084060869839222562, 30518116137695254451083185640456062095466770588446551409776635626107619414618, 32296846483328285395942578479721462990874016817205213442337788571183455371823, 7830743514133643609056906037298883461849915236781505447055526355864156291200, 66766369194849842633273514861399590319048611179974316399223444661664643713116, 18024800263813114636032380772014473234719112317372083568645028513107740333097, 74141606019826610219493597417961411759319222262715747781530975858236840023868, 74141606019826815907563358349687985248520689328534980167895213718026559231805, 84904953027467628079124577278247620589188804906104233927770018096001490752110, 8646406253524489099322407463506197113190436222475229989113834496391933123177, 14801368362037157341349744372212469879911751347796432685445396742546138510527, 15894490895528857350444326816435305421376809085313851765402083488609039987721, 37852894007605849489952583567731004955434986444474399453030571998864861533218, 16007569107674673947537681801726481062730991620317178346097127572834907239433, 102633388988062357389851477595292272698878804202828382582477913233599597957741, 17029311058216545115926699358460765117955315322529387410067408192737238368209, 39401039939065971500355367115014580663179206620663500436171381542235009920591, 39402615232602811526308130026613523510869149389568467968898508123483647642239, 57593384293411341144654776428448217689576185693893444758365608040444018144505, 63841662487000088869831851027369141702999289853288215195372474540672652085448, 100721919041136871706536474323993763361887751761059594887258624287814536108709, 12431907255329162502980182262719209577155616944639082427720737656418745431535, 16038275485812550557063681634389014806352822616164076985257408379680031643065, 68405324198120933521050931648638618947369327745692667495883448104257901548799, 3460329908515126754637554126738713109961637027606158804093048546688108127547, 16106981637946225230178918605857052277649628614369112854963742434861832205050, 8448811436767749824740074881636806461590780110247030409064405873065872770413, 62657160528879197025196349384429226461581551965396254612319502660762849907110, 37362668350600312578741767096565745429284532702326298726894669202918919902841, 97046915551360110482543666063995603342646642693483132604859660767038789191075, 37750578778823141127513876578977618263821979566798398805475475810686050547035, 8899077763068952446283397850676779377182951563966752995966724510608273388087, 1430788410790588948768223740715242946047023771808936478434300982280927461576, 43245632164876912500721802614250505089424972269458388051200703985150176517646, 26527792976855638931546424443043598748359981077520025569533358689339312846119, 10034220138179482424453837496189500567990928858614529504432172551818139334184, 75535532059353249758793259643426543087630044975480683666280772562494352167023, 12532294779822530931293583148085641907686342350743362041338935273017351016633, 8958249342307639770700867008480561646791855695021266630701977360245761685282, 75528466396530722925390012197706855368372892751585509291513494409511440650351, 9011044384631604789230921306476923910566615376824882388358022480957734033082, 45182323877874305146934038679574733861884144375370883472937974036860962247097, 23700234601492692370460015976854345996007097410933046970328742403104651126256, 56970414078810407267232512181524454646035403709151864648837102879926562472603, 59336812026319177033098081135706956314151111314270392143237555422332208264206, 36707091377963660336346311143415935299335610930952028052854530836452557240295, 10202126012237964170766432051989140199469409759127192355002576100131006440555, 72691028651131468636833670875287650881223005399741112439972503306595446550906, 7689046024044190685500958862986168840617876576117297404374223308117258686587, 9583067470336071575558967777508800030690386213881092335354663342137641199143, 15970718419268871463478468058858796238959885761999117728999272834817179322168, 37903470032839160921304992353748519593005839718701840574746932332397170697534, 10723799110029366222468551244518699011059498785302648324191607904247307866219, 1651465247876746049352538052494320238190633259932155654005236273442992146011, 37535310575907540138572260167287591050679295649847144262742970882242576643629, 107406046477759675380805009872206073473308094017534113788736360913659778137364, 8648260909849054742383860213694016683253742610217956634993385753930945566715, 91094487239729265765473251155982579898413742412111963107157224383047507474015, 45128834383092335423669974709008139367933699120247789381146368929605724538431, 21573189465171437665670533096295878202170520697880590329439115191190251349169, 776778Line truncated

PYAS.py

@@ -13,8 +13,6 @@ from PyQt5.QtCore import *
 from PyQt5.QtGui import *
 from subprocess import *
 
-# experimental version 2024/07 PYAS Security
-
 class MainWindow_Controller(QMainWindow):
     def __init__(self):
         # init program window
@@ -25,10 +23,12 @@ class MainWindow_Controller(QMainWindow):
         # get self program path
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
+        exdir = os.path.join(self.dir, "Exten")
+        self.exdir = exdir.replace("\\", "/")
 
         # init self program version
         self.pyae_version = "Fusion Engine"
-        self.pyas_version = "3.1.4"
+        self.pyas_version = "3.1.5"
 
         # startup ui config
         self.first_startup = True
@@ -147,19 +147,20 @@ class MainWindow_Controller(QMainWindow):
             # check config file exists
             if not os.path.exists("C:/ProgramData/PYAS/PYAS.json"): 
                 self.write_config({"language":"en_US","theme_color":"White",
-                "high_sensitive":0,"cloud_services":"None"})
+                "high_sensitive":0,"extension_kits":0,"cloud_services":"None"})
             try:
                 # read config json data
                 with open("C:/ProgramData/PYAS/PYAS.json", "r") as f: 
                     self.json = json.load(f)
             except:
                 self.json = {"language":"en_US","theme_color":"White",
-                "high_sensitive":0,"cloud_services":"None"}
+                "high_sensitive":0,"extension_kits":0,"cloud_services":"None"}
 
             # default json config
             self.json["language"] = self.json.get("language", "en_US") 
             self.json["theme_color"] = self.json.get("theme_color", "White")
             self.json["high_sensitive"] = self.json.get("high_sensitive", 0)
+            self.json["extension_kits"] = self.json.get("extension_kits", 0)
             self.json["cloud_services"] = self.json.get("cloud_services", "None")
 
             # reflash high_sensitive ui text
@@ -169,6 +170,12 @@ class MainWindow_Controller(QMainWindow):
                 QPushButton{border:none;background-color:rgb(200, 250, 200);border-radius: 10px;}
                 QPushButton:hover{background-color:rgb(210, 250, 210);}""")
 
+            if self.json["extension_kits"] == 1:
+                self.ui.extension_kit_switch_Button.setText(self.trans("已開啟"))
+                self.ui.extension_kit_switch_Button.setStyleSheet("""
+                QPushButton{border:none;background-color:rgb(200, 250, 200);border-radius: 10px;}
+                QPushButton:hover{background-color:rgb(210, 250, 210);}""")
+
             # reflash language ui setChecked
             if self.json["language"] == "zh_TW":
                 self.ui.Language_Traditional_Chinese.setChecked(True)
@@ -246,7 +253,7 @@ class MainWindow_Controller(QMainWindow):
 
         # connect settings ui and function control
         self.ui.high_sensitivity_switch_Button.clicked.connect(self.change_sensitive)
-        self.ui.cloud_services_switch_Button.clicked.connect(self.cloud_service)
+        self.ui.extension_kit_switch_Button.clicked.connect(self.extension_kit)
         self.ui.Add_White_list_Button.clicked.connect(self.add_white_list)
         self.ui.Language_Traditional_Chinese.clicked.connect(self.init_change_lang)
         self.ui.Language_Simplified_Chinese.clicked.connect(self.init_change_lang)
@@ -384,11 +391,11 @@ class MainWindow_Controller(QMainWindow):
         self.ui.PYAS_URL_title.setText(self.trans("官方網站:"))
         self.ui.PYAS_URL.setText(self.trans("<html><head/><body><p><a href=\"https://github.com/87owo/PYAS\"><span style=\" text-decoration: underline; color:#000000;\">https://github.com/87owo/PYAS</span></a></p></body></html>"))
         self.ui.high_sensitivity_title.setText(self.trans("高靈敏度模式"))
-        self.ui.high_sensitivity_illustrate.setText(self.trans("啟用此選項可以提高引擎的靈敏度"))
+        self.ui.high_sensitivity_illustrate.setText(self.trans("啟用此選項可以提高掃描引擎靈敏度"))
         self.ui.high_sensitivity_switch_Button.setText(self.trans(self.ui.high_sensitivity_switch_Button.text()))
-        self.ui.cloud_services_title.setText(self.trans("雲端上報服務"))
-        self.ui.cloud_services_illustrate.setText(self.trans("此選項可以選擇檔案並上報雲端分析"))
-        self.ui.cloud_services_switch_Button.setText(self.trans("選擇"))
+        self.ui.extension_kit_title.setText(self.trans("擴展掃描引擎"))
+        self.ui.extension_kit_illustrate.setText(self.trans("啟用此選項可以使用第三方擴展套件"))
+        self.ui.extension_kit_switch_Button.setText(self.trans(self.ui.extension_kit_switch_Button.text()))
         self.ui.Add_White_list_title.setText(self.trans("增加到白名單"))
         self.ui.Add_White_list_illustrate.setText(self.trans("此選項可以選擇檔案並增加到白名單"))
         self.ui.Add_White_list_Button.setText(self.trans(self.ui.Add_White_list_Button.text()))
@@ -799,6 +806,24 @@ class MainWindow_Controller(QMainWindow):
             QPushButton:hover{background-color:rgb(210,250,210);}""")
         self.write_config(self.json)
 
+    def extension_kit(self):
+        sw_state = self.ui.extension_kit_switch_Button.text()
+        if sw_state == self.trans("已開啟"):
+            # close extension kit mode
+            self.json["extension_kits"] = 0
+            self.ui.extension_kit_switch_Button.setText(self.trans("已關閉"))
+            self.ui.extension_kit_switch_Button.setStyleSheet("""
+            QPushButton{border:none;background-color:rgb(230,230,230);border-radius: 10px;}
+            QPushButton:hover{background-color:rgb(220,220,220);}""")
+        else:
+            # open extension kit mode
+            self.json["extension_kits"] = 1
+            self.ui.extension_kit_switch_Button.setText(self.trans("已開啟"))
+            self.ui.extension_kit_switch_Button.setStyleSheet("""
+            QPushButton{border:none;background-color:rgb(200,250,200);border-radius: 10px;}
+            QPushButton:hover{background-color:rgb(210,250,210);}""")
+        self.write_config(self.json)
+
     def cloud_service(self):
         try:
             # cloud services config /ProgramData/PYAS.json
@@ -911,6 +936,7 @@ class MainWindow_Controller(QMainWindow):
             else:
                 self.virus_scan_break()
                 text = self.trans("當前未發現病毒")
+            self.scan_thread.join()
             self.ui.Virus_Scan_text.setText(text)
             self.send_notify(text)
             gc.collect()
@@ -936,9 +962,9 @@ class MainWindow_Controller(QMainWindow):
             file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
             if file and file not in self.whitelist and file != self.pyas:
                 self.init_scan()
-                thread = Thread(target=self.write_scan, args=(self.start_scan(file),file,), daemon=True)
-                thread.start()
-                while thread.is_alive():
+                self.scan_thread = Thread(target=self.write_scan, args=(self.start_scan(file),file,), daemon=True)
+                self.scan_thread.start()
+                while self.scan_thread.is_alive():
                     QApplication.processEvents()
                 self.answer_scan()
         except Exception as e:
@@ -950,9 +976,9 @@ class MainWindow_Controller(QMainWindow):
             path = str(QFileDialog.getExistingDirectory(self,self.trans("病毒掃描"),"C:/"))
             if path:
                 self.init_scan()
-                thread = Thread(target=self.traverse_path, args=(path,), daemon=True)
-                thread.start()
-                while thread.is_alive():
+                self.scan_thread = Thread(target=self.traverse_path, args=(path,), daemon=True)
+                self.scan_thread.start()
+                while self.scan_thread.is_alive():
                     QApplication.processEvents()
                 self.answer_scan()
         except Exception as e:
@@ -964,9 +990,9 @@ class MainWindow_Controller(QMainWindow):
             self.init_scan()
             for d in range(26):
                 if os.path.exists(f"{chr(65+d)}:/"):
-                    thread = Thread(target=self.traverse_path, args=(f"{chr(65+d)}:/",), daemon=True)
-                    thread.start()
-                    while thread.is_alive():
+                    self.scan_thread = Thread(target=self.traverse_path, args=(f"{chr(65+d)}:/",), daemon=True)
+                    self.scan_thread.start()
+                    while self.scan_thread.is_alive():
                         QApplication.processEvents()
             self.answer_scan()
         except Exception as e:
@@ -991,12 +1017,11 @@ class MainWindow_Controller(QMainWindow):
 
     def start_scan(self, file):
         try:
+            ftype = str(f".{file.split('.')[-1]}").lower()
             label, level = self.pe_scan(file)
             if label and "Unknown" == label:
                 if self.rule_scan(file):
                     return "Rules"
-                elif self.exten.bdc_scan(file):
-                    return "Exten"
             elif label and "White" != label:
                 if self.json["high_sensitive"]:
                     return label
@@ -1004,12 +1029,11 @@ class MainWindow_Controller(QMainWindow):
                     return label
                 elif self.rule_scan(file):
                     return "Rules"
-                elif self.exten.bdc_scan(file):
-                    return "Exten"
-            elif self.json["high_sensitive"]:
+            elif not label and ftype in slist:
                 if self.rule_scan(file):
                     return "Rules"
-                elif self.exten.bdc_scan(file):
+            if self.json["extension_kits"]:
+                if self.exten.bdc_scan(file):
                     return "Exten"
             return False
         except:
@@ -1156,7 +1180,7 @@ class MainWindow_Controller(QMainWindow):
                         win32api.RegDeleteValue(key,i)
                         name = self.track_proc.name()
                         if "cmd.exe" not in name and "powershell" not in name:
-                            self.kill_process(self.track_proc, "註冊表攔截", True)
+                            self.kill_process("註冊表攔截", *self.track_proc)
                     except:
                         pass
                 win32api.RegCloseKey(key)
@@ -1368,7 +1392,7 @@ class MainWindow_Controller(QMainWindow):
                     if not self.first_startup:
                         if result == 0 or result == 577:
                             if self.question_event("使用此選項需要重啟，您確定要重啟嗎?"):
-                                Popen(f'"{file_path}/Uninstall_Driver.bat"', shell=True, stdout=PIPE, stderr=PIPE).wait()
+                                Popen(f'"{file_path}/Uninstall_Driver.bat"', shell=True, stdout=PIPE, stderr=PIPE)
                             else:
                                 Popen("sc start PYAS_Driver", shell=True, stdout=PIPE, stderr=PIPE).wait()
                     if result == 1062 or result == 1060:
@@ -1382,7 +1406,7 @@ class MainWindow_Controller(QMainWindow):
                         if result == 1060 or result == 3 or result == 577:
                             if self.question_event("此選項可能會與其他軟體不兼容，您確定要開啟嗎?"):
                                 Popen("sc delete PYAS_Driver", shell=True, stdout=PIPE, stderr=PIPE).wait()
-                                Popen(f'"{file_path}/Install_Driver.bat"', shell=True, stdout=PIPE, stderr=PIPE).wait()
+                                Popen(f'"{file_path}/Install_Driver.bat"', shell=True, stdout=PIPE, stderr=PIPE)
                             else:
                                 Popen("sc stop PYAS_Driver", shell=True, stdout=PIPE, stderr=PIPE).wait()
                     if result == 0 or result == 1056:
@@ -1422,7 +1446,6 @@ class MainWindow_Controller(QMainWindow):
             for pid in new_process - self.exist_process:
                 try:
                     p = psutil.Process(pid)
-                    self.lock_process(p, True)
                     self.handle_new_process(p)
                     self.lock_process(p, False)
                     gc.collect()
@@ -1435,71 +1458,72 @@ class MainWindow_Controller(QMainWindow):
     def handle_new_process(self, p):
         try:
             name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-            if file != self.pyas and file not in self.whitelist:
+            if file != self.pyas and self.exdir not in file and file not in self.whitelist:
+                self.lock_process(p, True)
                 if "powershell" in name:
-                    file = str(cmd[-1].split("'")[-2]).replace("\\", "/")
-                    if os.path.exists(file) and self.start_scan(file):
-                        self.kill_process(p, "腳本攔截", False)
-                    elif ":/Windows" not in file and ":/Program" not in file:
-                        self.track_proc = p
+                    target = str(cmd[-1].split("'")[-2]).replace("\\", "/")
+                    if os.path.exists(target) and self.start_scan(target):
+                        self.kill_process("腳本攔截", p, target, False)
+                    elif os.path.exists(target) and ":/Windows" not in target:
+                        self.track_proc = p, target, True
                 elif "cmd.exe" in name:
-                    file = str(" ".join(cmd[2:])).replace("\\", "/")
-                    if os.path.exists(file) and self.start_scan(file):
-                        self.kill_process(p, "腳本攔截", False)
-                    elif ":/Windows" not in file and ":/Program" not in file:
-                        self.track_proc = p
+                    target = str(" ".join(cmd[2:])).replace("\\", "/")
+                    if os.path.exists(target) and self.start_scan(target):
+                        self.kill_process("腳本攔截", p, target, False)
+                    elif os.path.exists(target) and ":/Windows" not in target:
+                        self.track_proc = p, target, True
                 elif ":/Windows" in file:
-                    file = str(cmd[-1]).replace("\\", "/")
+                    target = str(cmd[-1]).replace("\\", "/")
+                    if os.path.exists(target) and self.start_scan(target):
+                        self.kill_process("鏈式攔截", p, target, False)
+                elif ":/Windows" not in file:
                     if os.path.exists(file) and self.start_scan(file):
-                        self.kill_process(p, "鏈式攔截", False)
-                elif not self.proc_scan(p):
-                    if ":/Windows" not in file and ":/Program" not in file:
-                        self.track_proc = p
-        except:
-            pass
-
-    def proc_scan(self, p):
-        try:
-            if self.start_scan(p.exe()):
-                self.kill_process(p, "進程攔截", False)
-                return True
-            for entry in p.memory_maps():
-                file = str(entry.path).replace("\\", "/")
-                if ":/Windows" not in file and self.start_scan(file):
-                    self.kill_process(p, "加載攔截", False)
-                    return True
+                        self.kill_process("進程攔截", p, file, False)
+                    elif self.json["extension_kits"] and self.exten.pe_sieve(p):
+                        self.kill_process("記憶體攔截", p, file, False)
+                    elif ":/Program" not in file and not self.load_scan(p):
+                        self.track_proc = p, file, True
             self.lock_process(p, False)
-            time.sleep(0.2)
-            if self.exten.mem_scan(p):
-                self.kill_process(p, "記憶體攔截", True)
+        except:
+            self.lock_process(p, False)
+
+    def load_scan(self, p):
+        try:
+            for entry in p.memory_maps():
+                target = str(entry.path).replace("\\", "/")
+                if ":/Windows" not in target and self.start_scan(target):
+                    self.kill_process("加載攔截", p, target, False)
+                    return True
             return False
         except:
             return False
 
     def lock_process(self, p, lock):
-        try:
-            if lock:
-                p.suspend()
-            else:
-                p.resume()
-        except:
-            pass
+        if lock:
+            p.suspend()
+        else:
+            p.resume()
 
-    def kill_process(self, p, info, relation=False):
+    def kill_process(self, info, p, target, relation=False):
         try:
-            file = p.exe().replace("\\", "/")
-            if relation == True:
-                kill_items = []
-                for p2 in psutil.process_iter():
+            target = target.replace("/", "\\")
+            if relation == False:
+                p.kill()
+            elif relation == True:
+                for p in psutil.process_iter():
                     try:
-                        if file == p2.exe().replace("\\", "/"):
-                            p2.kill()
+                        name, file, cmd = p.name(), p.exe(), p.cmdline()
+                        if "powershell" in name:
+                            file = str(cmd[-1].split("'")[-2])
+                        elif "cmd.exe" in name:
+                            file = str(" ".join(cmd[2:]))
+                        elif ":/Windows" in file:
+                            file = str(cmd[-1])
+                        if target == file.replace("\\", "/"):
+                            p.kill()
                     except:
                         pass
-                self.send_notify(self.trans(f"{info}: ")+file)
-            elif p.is_running():
-                p.kill()
-                self.send_notify(self.trans(f"{info}: ")+file)
+            self.send_notify(self.trans(f"{info}: ")+target)
             self.track_proc = None
         except:
             self.track_proc = None
@@ -1514,7 +1538,7 @@ class MainWindow_Controller(QMainWindow):
                     ftype = str(f".{fpath.split('.')[-1]}").lower()
                     if self.ransom_counts >= 5 and self.track_proc:
                         self.ransom_counts = 0
-                        self.kill_process(self.track_proc, "勒索攔截", False)
+                        self.kill_process("勒索攔截", *self.track_proc)
                     elif ":/Windows" in fpath and "/Temp/" not in fpath:
                         if action == 2 and ftype in alist:
                             self.ransom_counts += 1
@@ -1539,13 +1563,13 @@ class MainWindow_Controller(QMainWindow):
                 time.sleep(0.2)
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
-                        self.kill_process(self.track_proc, "引導攔截", True)
+                        self.kill_process("引導攔截", *self.track_proc)
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
-                        self.kill_process(self.track_proc, "引導攔截", True)
+                        self.kill_process("引導攔截", *self.track_proc)
             except:
-                self.kill_process(self.track_proc, "引導攔截", True)
+                self.kill_process("引導攔截", *self.track_proc)
         if self.ui.Protection_switch_Button_3.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.sys_protect (boot)"))
 
@@ -1570,7 +1594,7 @@ class MainWindow_Controller(QMainWindow):
                 for conn in self.track_proc.connections():
                     if ":/Windows" not in file and ":/Program" not in file:
                         if conn.laddr.ip == local:
-                            self.kill_process(self.track_proc, "網路攔截", True)
+                            self.kill_process("網路攔截", *self.track_proc)
             except:
                 pass
         if self.ui.Protection_switch_Button_5.text() == self.trans("已開啟"):

PYAS_Engine.py

@@ -1,5 +1,4 @@
 import time, json, hashlib, numpy
-from collections import Counter
 
 class ListSimHash:
     def __init__(self):
@@ -19,30 +18,32 @@ class ListSimHash:
     def get_model(self, label):
         return self.model[label]
 
-    def train_model(self, label, data):
+    def train_model(self, label, data, batch_size=10000):
         start = time.time()
         print(f"Convert {label}")
         if label not in self.model:
             self.model[label] = []
         for i, x in enumerate(data, 1):
-            self.model[label].append(self.build_text(x))
+            build_text = self.build_text(x, batch_size)
+            self.model[label].append(build_text)
             used = "{0:.2f}".format(time.time()-start)
             prefix, suffix = f'{i}/{len(data)}:', f'{used}s'
             self.progress_bar(i, len(data), prefix, suffix)
 
-    def build_text(self, content):
-        sums, batch, count = [], [], 0
-        features = dict(Counter(sorted(content)))
-        for f, w in features.items():
-            count += w
-            batch.append(hashlib.sha256(json.dumps(f).encode('utf-8')).digest() * w)
-            if len(batch) >= 10000:
+    def build_text(self, content, batch_size):
+        sums, batch, count = [], [], {}
+        for index, char in enumerate(content):
+            count[char] = count.setdefault(char, 0) + 1
+            combined_input = f"{count[char]}_{char}"
+            hashes = hashlib.sha256(combined_input.encode('utf-8'))
+            batch.append(hashes.digest())
+            if len(batch) >= batch_size:
                 sums.append(self.sum_hashes(batch))
                 batch = []
         if batch:
             sums.append(self.sum_hashes(batch))
-        combined_sums = numpy.sum(sums, 0)
-        v = numpy.packbits(combined_sums > count / 2).tobytes()
+        combined_sums = numpy.sum(sums, 0) > len(content) / 2
+        v = numpy.packbits(combined_sums).tobytes()
         return int.from_bytes(v, 'big')
 
     def sum_hashes(self, digests):
@@ -57,9 +58,9 @@ class ListSimHash:
         bar = fill * filled_length + ' ' * (length - filled_length)
         print(f'\r{prefix: <15} |{bar}| {percent_string}% {suffix}', end=end_char)
 
-    def predict_all(self, query):
+    def predict_all(self, query, batch_size=10000):
         label_similarities = {}
-        query_hash = self.build_text(query)
+        query_hash = self.build_text(query, batch_size)
         for label in self.model:
             max_similarity = 0
             for data_point in self.model[label]:
@@ -69,9 +70,9 @@ class ListSimHash:
             label_similarities[label] = max_similarity
         return label_similarities
 
-    def predict(self, query):
+    def predict(self, query, batch_size=10000):
         max_similarity, max_label = 0, None
-        query_hash = self.build_text(query)
+        query_hash = self.build_text(query, batch_size)
         for label in self.model:
             for data_point in self.model[label]:
                 similarity = self.similar(data_point, query_hash)

PYAS_Extension.py

@@ -1,24 +1,46 @@
-from subprocess import *
+from subprocess import Popen, PIPE
 import os, re, sys
 
 class ExtenRules:
     def __init__(self):
-        self.exten = {}
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.exten = os.path.join(self.dir, "Exten")
 
     def bdc_scan(self, file):
-        if self.exten.replace("\\", "/") not in file.replace("\\", "/"):
-            cmd = f'"{self.exten}\\Bitdefender\\bdc.exe" "{file}"'
-            p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True)
-            for matchs in re.finditer(r'(?P<filename>[^\s]+)\s+infected:\s+(?P<virusname>.+)', p.communicate()[0]):
-                return matchs
-        return False
+        try:
+            check_file = file.replace("\\", "/")
+            if ":/Windows" not in check_file and ":/Program" not in check_file:
+                cmd = f'"{self.exten}\\bitdefender\\bdc.exe" "{file}"'
+                p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True).wait()
+                for match in re.finditer(r'(?P<filename>[^\s]+)\s+infected:\s+(?P<virusname>.+)', p.communicate()[0]):
+                    return match.groupdict()
+            return False
+        except:
+            return False
 
-    def mem_scan(self, p):
-        if self.exten.replace("\\", "/") not in p.exe().replace("\\", "/"):
-            cmd = f'"{self.exten}\\hollows_hunter\\hollows_hunter.exe" /ofilter 2 /pid "{p.pid}"'
-            p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True)
-            return 'Detected' in p.communicate()[0]
-        return False
+    def hollows_hunter(self, p):
+        try:
+            check_file = p.exe().replace("\\", "/")
+            if ":/Windows" not in check_file and ":/Program" not in check_file:
+                cmd = f'"{self.exten}\\hollows_hunter\\hollows_hunter.exe" /ofilter 2 /pid "{p.pid}"'
+                p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True).wait()
+                return 'Detected' in p.communicate()[0]
+            return False
+        except:
+            return False
+
+    def pe_sieve(self, p):
+        try:
+            check_file = p.exe().replace("\\", "/")
+            if ":/Windows" not in check_file and ":/Program" not in check_file:
+                cmd = f'"{self.exten}\\pe_sieve\\pe_sieve.exe" /ofilter 2 /pid "{p.pid}"'
+                p = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True, universal_newlines=True).wait()
+                output = p.communicate()[0]
+                for match in re.finditer(r'(\d+)', output):
+                    line = output[:match.start()].split('\n')[-1].strip().replace(':', '')
+                    if line in ["Implanted shc", "Replaced", "IAT Hooks"] and int(match.group(1)) > 0:
+                        return line
+            return False
+        except:
+            return False

PYAS_Interface.py

@@ -1569,49 +1569,49 @@ class Ui_MainWindow(object):
         self.Language_illustrate.raise_()
         self.Language_Choose_widget.raise_()
         self.Language_title.raise_()
-        self.Show_cloud_services = QtWidgets.QWidget(self.Setting_widget)
-        self.Show_cloud_services.setGeometry(QtCore.QRect(30, 130, 781, 81))
-        self.Show_cloud_services.setAcceptDrops(False)
-        self.Show_cloud_services.setAutoFillBackground(False)
-        self.Show_cloud_services.setObjectName("Show_cloud_services")
-        self.cloud_services_title = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
+        self.Show_extension_kit = QtWidgets.QWidget(self.Setting_widget)
+        self.Show_extension_kit.setGeometry(QtCore.QRect(30, 130, 781, 81))
+        self.Show_extension_kit.setAcceptDrops(False)
+        self.Show_extension_kit.setAutoFillBackground(False)
+        self.Show_extension_kit.setObjectName("Show_extension_kit")
+        self.extension_kit_title = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_title.setGeometry(QtCore.QRect(20, 10, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(17)
         font.setBold(False)
         font.setWeight(50)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_title.setFont(font)
-        self.cloud_services_title.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_title.setObjectName("cloud_services_title")
-        self.cloud_services_illustrate = QtWidgets.QLabel(self.Show_cloud_services)
-        self.cloud_services_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
+        self.extension_kit_title.setFont(font)
+        self.extension_kit_title.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_title.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_title.setObjectName("extension_kit_title")
+        self.extension_kit_illustrate = QtWidgets.QLabel(self.Show_extension_kit)
+        self.extension_kit_illustrate.setGeometry(QtCore.QRect(20, 40, 451, 31))
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_illustrate.setFont(font)
-        self.cloud_services_illustrate.setStyleSheet("color: rgb(70,70,70);")
-        self.cloud_services_illustrate.setScaledContents(False)
-        self.cloud_services_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
-        self.cloud_services_illustrate.setWordWrap(True)
-        self.cloud_services_illustrate.setObjectName("cloud_services_illustrate")
-        self.cloud_services_switch_Button = QtWidgets.QPushButton(self.Show_cloud_services)
-        self.cloud_services_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
+        self.extension_kit_illustrate.setFont(font)
+        self.extension_kit_illustrate.setStyleSheet("color: rgb(70,70,70);")
+        self.extension_kit_illustrate.setScaledContents(False)
+        self.extension_kit_illustrate.setAlignment(QtCore.Qt.AlignLeading|QtCore.Qt.AlignLeft|QtCore.Qt.AlignVCenter)
+        self.extension_kit_illustrate.setWordWrap(True)
+        self.extension_kit_illustrate.setObjectName("extension_kit_illustrate")
+        self.extension_kit_switch_Button = QtWidgets.QPushButton(self.Show_extension_kit)
+        self.extension_kit_switch_Button.setGeometry(QtCore.QRect(660, 20, 91, 31))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
         sizePolicy.setHorizontalStretch(0)
         sizePolicy.setVerticalStretch(0)
-        sizePolicy.setHeightForWidth(self.cloud_services_switch_Button.sizePolicy().hasHeightForWidth())
-        self.cloud_services_switch_Button.setSizePolicy(sizePolicy)
+        sizePolicy.setHeightForWidth(self.extension_kit_switch_Button.sizePolicy().hasHeightForWidth())
+        self.extension_kit_switch_Button.setSizePolicy(sizePolicy)
         font = QtGui.QFont()
         font.setFamily("Microsoft YaHei")
         font.setPointSize(11)
         font.setStyleStrategy(QtGui.QFont.PreferAntialias)
-        self.cloud_services_switch_Button.setFont(font)
-        self.cloud_services_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
-        self.cloud_services_switch_Button.setStyleSheet("QPushButton\n"
+        self.extension_kit_switch_Button.setFont(font)
+        self.extension_kit_switch_Button.setFocusPolicy(QtCore.Qt.StrongFocus)
+        self.extension_kit_switch_Button.setStyleSheet("QPushButton\n"
 "{\n"
 "    border:none;\n"
 "    background-color:rgb(230,230,230);\n"
@@ -1622,12 +1622,12 @@ class Ui_MainWindow(object):
 "    background-color:rgb(220,220,220);\n"
 "}\n"
 "")
-        self.cloud_services_switch_Button.setIconSize(QtCore.QSize(16, 16))
-        self.cloud_services_switch_Button.setCheckable(False)
-        self.cloud_services_switch_Button.setObjectName("cloud_services_switch_Button")
-        self.cloud_services_illustrate.raise_()
-        self.cloud_services_switch_Button.raise_()
-        self.cloud_services_title.raise_()
+        self.extension_kit_switch_Button.setIconSize(QtCore.QSize(16, 16))
+        self.extension_kit_switch_Button.setCheckable(False)
+        self.extension_kit_switch_Button.setObjectName("extension_kit_switch_Button")
+        self.extension_kit_illustrate.raise_()
+        self.extension_kit_switch_Button.raise_()
+        self.extension_kit_title.raise_()
         self.Setting_Back = QtWidgets.QPushButton(self.Setting_widget)
         self.Setting_Back.setGeometry(QtCore.QRect(25, 10, 101, 41))
         sizePolicy = QtWidgets.QSizePolicy(QtWidgets.QSizePolicy.Minimum, QtWidgets.QSizePolicy.Minimum)
@@ -1885,9 +1885,9 @@ class Ui_MainWindow(object):
         self.Language_English.setText(_translate("MainWindow", "English"))
         self.Language_Traditional_Chinese.setText(_translate("MainWindow", "繁體中文"))
         self.Language_Simplified_Chinese.setText(_translate("MainWindow", "简体中文"))
-        self.cloud_services_title.setText(_translate("MainWindow", "雲端掃描服務"))
-        self.cloud_services_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
-        self.cloud_services_switch_Button.setText(_translate("MainWindow", "已關閉"))
+        self.extension_kit_title.setText(_translate("MainWindow", "雲端掃描服務"))
+        self.extension_kit_illustrate.setText(_translate("MainWindow", "啟用此選項可以連接雲端掃描服務"))
+        self.extension_kit_switch_Button.setText(_translate("MainWindow", "已關閉"))
         self.Setting_Back.setText(_translate("MainWindow", "返回"))
         self.Add_White_list_title.setText(_translate("MainWindow", "增加到白名單"))
         self.Add_White_list_illustrate.setText(_translate("MainWindow", "此選項可以選擇檔案並增加到白名單"))

PYAS_Language.py

@@ -24,7 +24,7 @@ translate_dict = {
               "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
               "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
               "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
-              "確定要":"Sure Want To ","靈敏度":"Sensitivity ","更新":"Update ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
               "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
               "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
               "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
@@ -53,7 +53,7 @@ translate_dict = {
               "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
               "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
               "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
-              "擴展套件":"Extension Kit ","自動":"Auto ","上報":"Report ","與":"With ",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ","與":"With ",
               "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
               "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","追蹤":"Tracking ",
-              "竄改":"Tamper ","  ":" "}}
+              "竄改":"Tamper ","靈敏度":"Sensitivity ","第三方":"Other ","  ":" "}}

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.4',
+version='3.1.5',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -4,54 +4,12 @@
 
 ## Readme Language
 
-[繁體中文](https://github.com/87owo/PYAS/blob/main/README_zh_TW.md) , 
-[简体中文](https://github.com/87owo/PYAS/blob/main/README_zh_CN.md)
+繁體中文 : https://github.com/87owo/PYAS/blob/main/README_zh_TW.md
 
-## File Information
-
-PYAS.py -> Main PYAS Program (including animation, scanning, protection functions, etc.)
-
-PYAS_Engine.py -> Conversion Database (used to convert database dict and list to and from each other)
-
-PYAS_Extension.py -> File Extension (including scanned file extensions and common file extensions)
-
-PYAS_Model.* -> Virus Database (the virus database must be placed in the same directory)
-
-PYAS_Interface.py -> PyQt5 Interface (designed by QT designer, must be matched with the main program)
-
-PYAS_Resource.py -> PyQt5 Resource (status pictures, icon packages, button icons, etc.)
-
-PYAS_Language.py -> Translate Dict (Traditional Chinese, Simplified Chinese, English)
-
-PYAS_Version.py -> Pyinstaller Info (file information, version information, original name, etc.)
-
-## Dir Information
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
+简体中文 : https://github.com/87owo/PYAS/blob/main/README_zh_CN.md
 
 ## Requirements
 
-Use pip install requirements to install import module
-
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -61,92 +19,37 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## Pefile Scanning
-
-Get the pefile file function import table for scanning
+## File Information
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## Process Detect
-
-Show the new process name, file path, cmd line, pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## File Detect
-
-Monitor file changes under the specified path
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys -------> Extension Kit (self protection driver for pyas by 0sha0)
+│   └── ...
+│
+├── Exten/
+│   ├── bitdefender/ ----------> Extension Kit (bitdefender windows console scan engine)
+│   ├── pe_sieve/ -------------> Extension Kit (pe sieve windows console memory engine)
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json -------> Virus Database (the database must be in the specified dir)
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar ---------> Yara Rules (yara rules in plain text format)
+│   ├── Yara_Rules.yrc ---------> Compile Rules (yara rules in compiled format)
+│   └── ...
+│
+├── PYAS.* ---------------------> Main PYAS Program (including animation, scan, protect functions, ...)
+├── PYAS_Engine.py -------------> Conversion Database (used to transform profiles and forecast data)
+├── PYAS_Suffixes.py -----------> File Suffixes (including scanned file suffixes and common suffixes)
+├── PYAS_Extension.py ----------> Extension Kit (extension scanners developed by other developers)
+├── PYAS_Interface.py ----------> PyQt5 Interface (use QT designer, must be matched with the main program)
+├── PYAS_Resource.py -----------> PyQt5 Resource (status pictures, icon packages, button icons, ...)
+├── PYAS_Language.py -----------> Translate Dict (Traditional Chinese, Simplified Chinese, English)
+├── PYAS_Version.py ------------> Pyinstaller (file information, version information, original name, ...)
+└── ...
 ```
 
 ## Official Website

README_zh_CN.md

@@ -2,51 +2,8 @@
 
 ![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
 
-## 文件信息
-
-PYAS.py -> PYAS主程式（包括动画、扫描、保护功能等）
-
-PYAS_Engine.py -> 转换资料库（用于相互转换资料库字典和清单）
-
-PYAS_Extension.py -> 副文件名（包括扫描文件副文件名和常用副文件名）
-
-PYAS_Model.* -> 病毒库（病毒库必须放在同一目录下）
-
-PYAS_Interface.py -> PyQt5界面（由QT设计师设计，必须与主程式相符）
-
-PYAS_Resource.py -> PyQt5资源（状态图片、图示包、按钮图示等）
-
-PYAS_Language.py -> 翻译字典（繁体中文、简体中文、英文）
-
-PYAS_Version.py -> Pyinstaller资讯（文件资讯、版本资讯、原名等）
-
-## 目录信息
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
-
 ## 安装要求
 
-使用 pip install requirements 来安装需要的模组
-
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -56,92 +13,37 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## 文件扫描
-
-取得pefile文件函数导入表进行扫描
+## 文件信息
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 进程监控
-
-显示新进程名称、文件路径、cmd 行、pid
-
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 文件监控
-
-监控指定路径下的文件变化
-
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys -------> 驱动程序 (0sha0 为 pyas 提供的自我保护驱动程序)
+│   └── ...
+│
+├── Exten/
+│   ├── bitdefender/ ----------> 扩展套件 (bitdefender windows 控制台扫描引擎)
+│   ├── pe_sieve/ -------------> 扩展套件 (pe sieve windows 控制台内存引擎)
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json -------> 病毒数据库 (数据库必须位于指定目录中)
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar ---------> Yara 规则 (纯文本格式的 yara 规则)
+│   ├── Yara_Rules.yrc ---------> 编译规则 (编译格式的 yara 规则)
+│   └── ...
+│
+├── PYAS.* ---------------------> PYAS主程序（包含动画、扫描、保护等功能...）
+├── PYAS_Engine.py -------------> 转换数据库（用于转换剖面图和预报数据）
+├── PYAS_Suffixes.py -----------> 文件后缀（包含扫描文件后缀和常用后缀）
+├── PYAS_Extension.py ----------> 扩展工具包（其他开发者开发的扩展扫描器）
+├── PYAS_Interface.py ----------> PyQt5界面（使用QT设计器，需与主程序搭配使用）
+├── PYAS_Resource.py -----------> PyQt5资源（状态图片、图标包、按钮图标...）
+├── PYAS_Language.py -----------> 翻译词典（繁体中文、简体中文、英文）
+├── PYAS_Version.py ------------> 安裝信息（文件信息、版本信息、原名，...）
+└── ...
 ```
 
 ## 官方网页

README_zh_TW.md

@@ -2,51 +2,8 @@
 
 ![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
 
-## 檔案資訊
-
-PYAS.py -> PYAS主程式（包括動畫、掃描、保護功能等）
-
-PYAS_Engine.py -> 轉換資料庫（用於相互轉換資料庫字典和清單）
-
-PYAS_Extension.py -> 檔案副檔名（包括掃描檔案副檔名和常用檔案副檔名）
-
-PYAS_Model.* -> 病毒庫（病毒庫必須放在同一目錄下）
-
-PYAS_Interface.py -> PyQt5 Interface（由QT設計師設計，必須與主程式相符）
-
-PYAS_Resource.py -> PyQt5資源（狀態圖片、圖示包、按鈕圖示等）
-
-PYAS_Language.py -> 翻譯字典（繁體中文、簡體中文、英文）
-
-PYAS_Version.py -> Pyinstaller Info（檔案資訊、版本資訊、原名等）
-
-## 目錄資訊
-
-```
-PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys
-│   └── ...
-│
-├── Model/
-│   ├── PYAS_Model.json
-│   ├── PYAS_Model.txt
-│   └── ...
-│
-├── Rules/
-│   ├── Yara_Rules.yar
-│   ├── Compile_Rules.yrc
-│   └── ...
-│
-├── PYAS.py
-├── PYAS_Engine.py
-└── ...
-```
-
 ## 安裝要求
 
-使用 pip install requirements 來安裝需要的模組
-
 ```
 psutil==5.9.5
 pefile==2023.2.7
@@ -56,90 +13,37 @@ pywin32==306
 PyQt5==5.15.9
 ```
 
-## 檔案掃描
-
-取得pefile檔案函數導入表進行掃描
+## 檔案資訊
 
 ```
-import pefile
-
-def pe_scan(file):
-    try:
-        fn = []
-        with pefile.PE(file) as pe:
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in known_malicious_list:
-                return "Virus"
-            return "Safe"
-        return "Unknown"
-    except Exception as e:
-        return f"Error: {e}"
-
-info = pe_scan("path to file")
-print(info)
-```
-
-## 進程監控
-
-顯示新進程名稱、檔案路徑、cmd 行、pid
-```
-import psutil, time
-
-def proc_detect():
-    existing_process = set()
-    for p in psutil.process_iter():
-        existing_process.add(p.pid)
-    while True:
-        time.sleep(0.1)
-        new_process = set()
-        for p in psutil.process_iter():
-            new_process.add(p.pid)
-        for pid in new_process - existing_process:
-            try:
-                p = psutil.Process(pid)
-                name, file, cmd = p.name(), p.exe(), p.cmdline()
-                print(f"Name: {name}")
-                print(f"File: {file}")
-                print(f"Pid: {p.pid}")
-                print(f"Cmd: {cmd}")
-            except Exception as e:
-                print(f"Error: {e}")
-        existing_process = new_process
-
-proc_detect()
-```
-
-## 檔案監控
-
-監控指定路徑下的檔案變化
-```
-import os, win32file, win32con
-
-def file_detect(path):
-    hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-    while True:
-        for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-            try:
-                fpath = os.path.join(path, file)
-                if action == 1:
-                    print(f"File Create: {fpath}")
-                elif action == 2:
-                    print(f"File Delete: {fpath}")
-                elif action == 3:
-                    print(f"File Modify: {fpath}")
-                elif action == 4:
-                    print(f"File Rename: {fpath}")
-                elif action == 5:
-                    print(f"File Rename: {fpath}")
-            except:
-                pass
-
-file_detect("path")
+PYAS/
+├── Driver/
+│   ├── PYAS_Driver.sys -------> 驅動程式 (0sha0 為 pyas 提供的自我保護驅動程式)
+│   └── ...
+│
+├── Exten/
+│   ├── bitdefender/ ----------> 擴充套件 (bitdefender windows 控制台掃描引擎)
+│   ├── pe_sieve/ -------------> 擴充套件 (pe sieve windows 控制台記憶體引擎)
+│   └── ...
+│
+├── Model/
+│   ├── PYAS_Model.json -------> 病毒資料庫 (資料庫必須位於指定目錄)
+│   └── ...
+│
+├── Rules/
+│   ├── Yara_Rules.yar ---------> Yara 規則 (純文字格式的 yara 規則)
+│   ├── Yara_Rules.yrc ---------> 編譯規則 (編譯格式的 yara 規則)
+│   └── ...
+│
+├── PYAS.* ---------------------> PYAS主程式（包含動畫、掃描、保護等功能...）
+├── PYAS_Engine.py -------------> 轉換資料庫（用於轉換剖面圖和預報資料）
+├── PYAS_Suffixes.py -----------> 文件後綴（包含掃描文件後綴和常用後綴）
+├── PYAS_Extension.py ----------> 擴充工具包（其他開發者開發的擴充掃描器）
+├── PYAS_Interface.py ----------> PyQt5介面（使用QT設計器，需與主程式搭配使用）
+├── PYAS_Resource.py -----------> PyQt5資源（狀態圖片、圖示包、按鈕圖示...）
+├── PYAS_Language.py -----------> 翻譯字典（繁體中文、簡體中文、英文）
+├── PYAS_Version.py ------------> 安裝資訊（檔案資訊、版本資訊、原名，...）
+└── ...
 ```
 
 ## 官方網頁