Add files via upload

Model/PYAS_Model.json

@@ -1,13 +1,12 @@
 {
-    "Suffix": [".exe", ".dll", ".sys", ".bat", ".cmd", ".ps1", ".vbs"], 
+    "Suffix": [".com", ".exe", ".dll", ".sys", ".scr",
+               ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], 
 
-    "Labels": ["White/Pefile", "White/Script", "Virus/Pefile", "Virus/Script"], 
+    "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], 
 
-    "Detect": ["Virus/Pefile", "Virus/Script"],  
+    "Detect": ["Pefile/General", "Script/General"],  
 
-    "Models": ["PYAS_Model_A1.onnx", "PYAS_Model_A2.onnx", "PYAS_Model_A3.onnx"], 
+    "Pixels": [224, 224], 
 
-    "Pixels": [300, 300], 
-
-    "Values": 95
+    "Values": 85
 }

PYAS.py

@@ -1,15 +1,48 @@
-import os, gc, sys, time, json, psutil
-import ctypes, msvcrt, pyperclip, win32file
-import win32gui, win32api, win32con
+import os, gc, sys, time, json
+import ctypes, ctypes.wintypes
+import struct, msvcrt, pyperclip
 from PYAS_Engine import YRScan, DLScan
 from PYAS_Suffixes import slist, alist
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
-from threading import Thread
 from PyQt5.QtWidgets import *
 from PyQt5.QtCore import *
 from PyQt5.QtGui import *
 from subprocess import *
+from threading import *
+
+class PROCESSENTRY32(ctypes.Structure):
+    _fields_ = [
+        ("dwSize", ctypes.wintypes.DWORD),
+        ("cntUsage", ctypes.wintypes.DWORD),
+        ("th32ProcessID", ctypes.wintypes.DWORD),
+        ("th32DefaultHeapID", ctypes.wintypes.LPVOID),
+        ("th32ModuleID", ctypes.wintypes.DWORD),
+        ("cntThreads", ctypes.wintypes.DWORD),
+        ("th32ParentProcessID", ctypes.wintypes.DWORD),
+        ("dwFlags", ctypes.wintypes.DWORD),
+        ("szExeFile", ctypes.wintypes.CHAR * 260)]
+
+class MIB_TCPROW_OWNER_PID(ctypes.Structure):
+    _fields_ = [
+        ("dwState", ctypes.wintypes.DWORD),
+        ("dwLocalAddr", ctypes.wintypes.DWORD),
+        ("dwLocalPort", ctypes.wintypes.DWORD),
+        ("dwRemoteAddr", ctypes.wintypes.DWORD),
+        ("dwRemotePort", ctypes.wintypes.DWORD),
+        ("dwOwningPid", ctypes.wintypes.DWORD)]
+
+class MIB_TCPTABLE_OWNER_PID(ctypes.Structure):
+    _fields_ = [
+        ("dwNumEntries", ctypes.wintypes.DWORD),
+        ("table", MIB_TCPROW_OWNER_PID * 1)]
+
+class FILE_NOTIFY_INFORMATION(ctypes.Structure):
+    _fields_ = [
+        ("NextEntryOffset", ctypes.wintypes.DWORD),
+        ("Action", ctypes.wintypes.DWORD),
+        ("FileNameLength", ctypes.wintypes.DWORD),
+        ("FileName", ctypes.wintypes.WCHAR * 1024)]
 
 class MainWindow_Controller(QMainWindow):
     def __init__(self):
@@ -19,10 +52,12 @@ class MainWindow_Controller(QMainWindow):
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.pyae_version = "AI Engine"
-        self.pyas_version = "3.1.7"
+        self.pyas_version = "3.2.4"
         self.first_startup = True
-        self.init_data_base()
         self.init_tray_icon()
+        self.init_data_base()
+        self.init_system_code()
+        self.init_define_func()
         self.init_config_qtui()
         self.init_config_read()
         self.init_config_boot()
@@ -30,6 +65,13 @@ class MainWindow_Controller(QMainWindow):
         self.init_threads()
         self.init_startup()
 
+    def init_system_code(self):
+        try:
+            self.enc = sys.getfilesystemencoding()
+            self.ene = sys.getfilesystemencodeerrors()
+        except Exception as e:
+            self.ene = "replace"
+
     def init_threads(self):
         self.protect_proc_init()
         self.protect_file_init()
@@ -37,6 +79,7 @@ class MainWindow_Controller(QMainWindow):
         self.protect_drv_init()
         self.protect_net_init()
         self.block_window_init()
+        self.gc_collect_init()
 
     def init_tray_icon(self):
         self.tray_icon = QSystemTrayIcon(self)
@@ -44,6 +87,16 @@ class MainWindow_Controller(QMainWindow):
         self.tray_icon.setIcon(QFileIconProvider().icon(QFileInfo(self.pyas)))
         self.tray_icon.show()
 
+    def init_define_func(self):
+        try:
+            self.ntdll = ctypes.WinDLL('ntdll', use_last_error=True)
+            self.psapi = ctypes.WinDLL('Psapi', use_last_error=True)
+            self.kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
+            self.advapi32 = ctypes.WinDLL('advapi32', use_last_error=True)
+            self.iphlpapi = ctypes.WinDLL('iphlpapi', use_last_error=True)
+        except Exception as e:
+            pass
+
     def init_startup(self):
         try:
             if len(sys.argv) > 1: 
@@ -93,9 +146,7 @@ class MainWindow_Controller(QMainWindow):
     def init_config_read(self):
         try:
             self.track_proc = None
-            self.exist_process = set()
-            for p in psutil.process_iter():
-                self.exist_process.add(p.pid)
+            self.exist_process = self.get_process_list()
             if not os.path.exists("C:/ProgramData/PYAS"): 
                 os.makedirs("C:/ProgramData/PYAS")
             if not os.path.exists("C:/ProgramData/PYAS/PYAS.json"): 
@@ -201,7 +252,7 @@ class MainWindow_Controller(QMainWindow):
         self.virus_lock = {}
         self.virus_list = []
         self.virus_list_ui = []
-        self.Process_quantity = []
+        self.Process_quantity = 0
         self.Process_list_all_pid = []
         self.Process_sim = QStringListModel()
         self.Process_Timer = QTimer()
@@ -613,6 +664,7 @@ class MainWindow_Controller(QMainWindow):
         if self.question_event("您確定要退出 PYAS 和所有防護嗎?"):
             Popen("sc stop PYAS_Driver", shell=True, stdout=PIPE, stderr=PIPE).wait()
             self.first_startup = True
+            self.gc_collect = False
             self.protect_proc_init()
             self.protect_file_init()
             self.protect_sys_init()
@@ -646,7 +698,8 @@ class MainWindow_Controller(QMainWindow):
             # question event message
             print(f"[Quest] > {text}")
             if self.first_startup != True:
-                return QMessageBox.question(self, "Quest", self.trans(str(text)),QMessageBox.Yes|QMessageBox.No) == 16384
+                return QMessageBox.question(self, "Quest",
+                self.trans(str(text)),QMessageBox.Yes|QMessageBox.No) == 16384
         except:
             return False
 
@@ -655,7 +708,8 @@ class MainWindow_Controller(QMainWindow):
             # send system notification
             now_time = time.strftime('%Y-%m-%d %H:%M:%S')
             print(f"[Notify] > [{now_time}] {text}")
-            QMetaObject.invokeMethod(self.ui.State_output, "append", Qt.QueuedConnection, Q_ARG(str, f"[{now_time}] {text}"))
+            QMetaObject.invokeMethod(self.ui.State_output, "append",
+            Qt.QueuedConnection, Q_ARG(str, f"[{now_time}] {text}"))
             if self.first_startup == False and notify_bar == True:
                 self.tray_icon.showMessage(now_time, text, 5000)
         except:
@@ -819,7 +873,6 @@ class MainWindow_Controller(QMainWindow):
                 item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
                 item.setCheckState(Qt.Checked)
                 self.ui.Virus_Scan_output.addItem(item)
-                self.send_notify(self.trans(f"發現病毒: ")+file, False)
         except:
             pass
 
@@ -839,7 +892,6 @@ class MainWindow_Controller(QMainWindow):
             QMetaObject.invokeMethod(self.ui.Virus_Scan_text, "setText",
             Qt.QueuedConnection, Q_ARG(str, text))
             self.send_notify(text)
-            gc.collect()
         except Exception as e:
             self.bug_event(e)
 
@@ -864,7 +916,8 @@ class MainWindow_Controller(QMainWindow):
             file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
             if file and file not in self.whitelist and file != self.pyas:
                 self.init_scan()
-                self.scan_thread = Thread(target=self.write_scan, args=(self.start_scan(file),file,), daemon=True)
+                self.scan_thread = Thread(target=self.write_scan,
+                args=(self.start_scan(file),file,), daemon=True)
                 self.scan_thread.start()
                 while self.scan_thread.is_alive():
                     QApplication.processEvents()
@@ -890,9 +943,9 @@ class MainWindow_Controller(QMainWindow):
     def disk_scan(self):
         try:
             self.init_scan()
-            for d in range(26):
-                if os.path.exists(f"{chr(65+d)}:/"):
-                    self.scan_thread = Thread(target=self.traverse_path, args=(f"{chr(65+d)}:/",), daemon=True)
+            for l in range(65, 91):
+                if os.path.exists(f"{chr(l)}:/"):
+                    self.scan_thread = Thread(target=self.traverse_path, args=(f"{chr(l)}:/",), daemon=True)
                     self.scan_thread.start()
                     while self.scan_thread.is_alive():
                         QApplication.processEvents()
@@ -915,23 +968,26 @@ class MainWindow_Controller(QMainWindow):
                     QMetaObject.invokeMethod(self.ui.Virus_Scan_text, "setText",
                     Qt.QueuedConnection, Q_ARG(str, file))
                     self.write_scan(self.start_scan(file),file)
-                gc.collect()
             except:
                 pass
 
     def start_scan(self, file):
         try:
-            if os.path.exists(file):
-                self.send_notify(self.trans(f"正在掃描: ")+file, False)
-            label, level = self.model.dl_scan(file)
-            if label and label in self.model.detect:
-                if self.json["high_sensitive"]:
-                    return label
-                elif level >= self.model.values:
-                    return label
+            if isinstance(file, dict):
+                match_data = file
+            elif os.path.exists(file):
+                match_data = self.model.get_type(file)
+            for section, data in match_data.items():
+                label, level = self.model.dl_scan(data)
+                if label and label in self.model.detect:
+                    if self.json["high_sensitive"]:
+                        return f"{label}.{level}"
+                    elif level >= self.model.values:
+                        return f"{label}.{level}"
             if self.json["extension_kits"]:
-                if self.rules.yr_scan(file):
-                    return "Virus/Rules"
+                label, level = self.rules.yr_scan(file)
+                if label and isinstance(level, str):
+                    return f"{label}.{level}"
             return False
         except:
             return False
@@ -948,111 +1004,120 @@ class MainWindow_Controller(QMainWindow):
         except Exception as e:
             self.bug_event(e)
 
-    def repair_system_file_icon(self):
+    def open_registry_key(self, hkey, subkey, access=0xF003F):
+        key_handle = ctypes.wintypes.HANDLE()
+        result = self.advapi32.RegOpenKeyExW(hkey, subkey, 0, access, ctypes.byref(key_handle))
+        return key_handle
+
+    def set_registry_value(self, hkey, subkey, value_name, value_type, value):
+        key_handle = self.open_registry_key(hkey, subkey)
+        self.advapi32.RegSetValueExW(key_handle, value_name, 0,
+        value_type, ctypes.create_unicode_buffer(value), len(value) * 2)
+        self.advapi32.RegCloseKey(key_handle)
+
+    def delete_registry_value(self, key_handle, value_name):
         try:
-            key = win32api.RegOpenKey(win32con.HKEY_CLASSES_ROOT, 'exefile', 0, win32con.KEY_ALL_ACCESS)
-            win32api.RegSetValue(key, 'DefaultIcon', win32con.REG_SZ, '%1')
+            result = self.advapi32.RegDeleteValueW(key_handle, value_name)
+            if result == 0 and self.track_proc:
+                self.kill_process("註冊表攔截", *self.track_proc)
+        except Exception as e:
+            pass
+
+    def delete_registry_key(self, hkey, subkey):
+        try:
+            result = self.advapi32.RegDeleteKeyW(hkey, subkey)
+            if result == 0 and self.track_proc:
+                self.kill_process("註冊表攔截", *self.track_proc)
+        except Exception as e:
+            pass
+
+    def create_registry_keys(self, keys):
+        for hkey, subkey in keys:
+            key_handle = ctypes.wintypes.HANDLE()
+            self.advapi32.RegCreateKeyExW(hkey, subkey, 0, None, 0, 0xF003F, None, ctypes.byref(key_handle), None)
+
+    def repair_system_restrict(self):
+        try:
+            permissions = ["NoControlPanel", "NoDrives", "NoFileMenu", "NoFind", "NoRealMode", "NoRecentDocsMenu","NoSetFolders",
+            "NoSetFolderOptions", "NoViewOnDrive", "NoClose", "NoRun", "NoDesktop", "NoLogOff", "NoFolderOptions", "RestrictRun",
+            "NoViewContexMenu", "HideClock", "NoStartMenuMorePrograms", "NoStartMenuMyGames", "NoStartMenuMyMusic", "DisableCMD",
+            "NoWinKeys", "StartMenuLogOff", "NoSimpleNetlDList", "NoLowDiskSpaceChecks", "DisableLockWorkstation", "Restrict_Run", 
+            "DisableTaskMgr", "DisableRegistryTools", "DisableChangePassword", "Wallpaper", "NoComponents", "NoAddingComponents",
+            "NoStartMenuPinnedList", "NoActiveDesktop", "NoSetActiveDesktop", "NoActiveDesktopChanges", "NoChangeStartMenu",
+            "NoFavoritesMenu", "NoRecentDocsHistory", "NoSetTaskbar", "NoSMHelp", "NoTrayContextMenu", "NoViewContextMenu", 
+            "NoManageMyComputerVerb", "NoWindowsUpdate", "ClearRecentDocsOnExit", "NoStartMenuNetworkPlaces"]
+            keys_to_create = [(0x80000001, r"Software\Policies\Microsoft\MMC"),
+            (0x80000001, r"Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}"),
+            (0x80000001, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"),
+            (0x80000001, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"),
+            (0x80000001, r"SOFTWARE\Policies\Microsoft\Windows\System"),
+            (0x80000002, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"),
+            (0x80000002, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"),
+            (0x80000002, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop"),
+            (0x80000002, r"SOFTWARE\Policies\Microsoft\Windows\System")]
+            self.create_registry_keys(keys_to_create)
+            for hkey, subkey in keys_to_create:
+                try:
+                    key_handle = self.open_registry_key(hkey, subkey)
+                    for perm in permissions:
+                        self.delete_registry_value(key_handle, perm)
+                    self.advapi32.RegCloseKey(key_handle)
+                except:
+                    pass
         except:
             pass
+
+    def repair_system_file_icon(self):
         try:
-            key = win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE, r'SOFTWARE\Classes\exefile', 0, win32con.KEY_ALL_ACCESS)
-            win32api.RegSetValue(key, 'DefaultIcon', win32con.REG_SZ, '%1')
-        except:
+            self.set_registry_value(0x80000000, 'exefile', 'DefaultIcon', 1, '%1')
+        except Exception as e:
+            pass
+        try:
+            self.set_registry_value(0x80000002, r'SOFTWARE\Classes\exefile', 'DefaultIcon', 1, '%1')
+        except Exception as e:
             pass
 
     def repair_system_image(self):
         try:
-            key = win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options',0,win32con.KEY_ALL_ACCESS | win32con.WRITE_OWNER)
-            count = win32api.RegQueryInfoKey(key)[0]
-            while count >= 0:
+            key_handle = self.open_registry_key(0x80000002,
+            r'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options', 0xF003F)
+            count = ctypes.wintypes.DWORD()
+            self.advapi32.RegQueryInfoKeyW(key_handle, None, None, None,
+            ctypes.byref(count), None, None, None, None, None, None, None)
+            for i in range(count.value, -1, -1):
                 try:
-                    subKeyName = win32api.RegEnumKey(key, count)
-                    win32api.RegDeleteKey(key, subKeyName)
-                except:
+                    subkey_name = ctypes.create_unicode_buffer(256)
+                    self.advapi32.RegEnumKeyW(key_handle, i, subkey_name, 256)
+                    self.delete_registry_key(key_handle, subkey_name.value)
+                except Exception as e:
                     pass
-                count = count - 1
-        except:
+        except Exception as e:
             pass
 
     def repair_system_file_type(self):
         try:
-            data = [('.exe', 'exefile'),('exefile', 'Application')]
-            key = win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE, r'SOFTWARE\Classes', 0, win32con.KEY_ALL_ACCESS)
+            data = [('.exe', 'exefile'), ('exefile', 'Application')]
+            key_handle = self.open_registry_key(0x80000002, r'SOFTWARE\Classes', 0xF003F)
             for ext, value in data:
-                win32api.RegSetValue(key, ext, win32con.REG_SZ, value)
-            win32api.RegCloseKey(key)
-            key = win32api.RegOpenKey(win32con.HKEY_CURRENT_USER, r'SOFTWARE\Classes', 0, win32con.KEY_ALL_ACCESS)
+                self.set_registry_value(0x80000002, ext, '', 1, value)
+            self.advapi32.RegCloseKey(key_handle)
+            key_handle = self.open_registry_key(0x80000001, r'SOFTWARE\Classes', 0xF003F)
             for ext, value in data:
-                try:
-                    win32api.RegSetValue(key, ext, win32con.REG_SZ, value)
-                    keyopen = win32api.RegOpenKey(key, ext + r'\shell\open', 0, win32con.KEY_ALL_ACCESS)
-                    win32api.RegSetValue(keyopen, 'command', win32con.REG_SZ, '"%1" %*')
-                    win32api.RegCloseKey(keyopen)
-                except:
-                    pass
-            win32api.RegCloseKey(key)
-            key = win32api.RegOpenKey(win32con.HKEY_CURRENT_USER, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts', 0, win32con.KEY_ALL_ACCESS)
-            win32api.RegSetValue(key, '.exe', win32con.REG_SZ, '')
-            win32api.RegCloseKey(key)
-            key = win32api.RegOpenKey(win32con.HKEY_CLASSES_ROOT, None, 0, win32con.KEY_ALL_ACCESS)
-            for ext, value in data:
-                try:
-                    win32api.RegSetValue(key, ext, win32con.REG_SZ, value)
-                    keyopen = win32api.RegOpenKey(key, ext + r'\shell\open', 0, win32con.KEY_ALL_ACCESS)
-                    win32api.RegSetValue(keyopen, 'command', win32con.REG_SZ, '"%1" %*')
-                    win32api.RegCloseKey(keyopen)
-                except:
-                    pass
-            win32api.RegCloseKey(key)
-        except:
-            pass
-
-    def repair_system_restrict(self):
-        try:
-            Permission = ["NoControlPanel", "NoDrives", "NoFileMenu", "NoFind", "NoRealMode", "NoRecentDocsMenu","NoSetFolders",
-            "NoSetFolderOptions", "NoViewOnDrive", "NoClose", "NoRun", "NoDesktop", "NoLogOff", "NoFolderOptions", "RestrictRun","DisableCMD",
-            "NoViewContexMenu", "HideClock", "NoStartMenuMorePrograms", "NoStartMenuMyGames", "NoStartMenuMyMusic" "NoStartMenuNetworkPlaces",
-            "NoStartMenuPinnedList", "NoActiveDesktop", "NoSetActiveDesktop", "NoActiveDesktopChanges", "NoChangeStartMenu", "ClearRecentDocsOnExit",
-            "NoFavoritesMenu", "NoRecentDocsHistory", "NoSetTaskbar", "NoSMHelp", "NoTrayContextMenu", "NoViewContextMenu", "NoWindowsUpdate",
-            "NoWinKeys", "StartMenuLogOff", "NoSimpleNetlDList", "NoLowDiskSpaceChecks", "DisableLockWorkstation", "NoManageMyComputerVerb",
-            "DisableTaskMgr", "DisableRegistryTools", "DisableChangePassword", "Wallpaper", "NoComponents", "NoAddingComponents", "Restrict_Run"]
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"Explorer")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"Explorer")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"ActiveDesktop")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Policies\Microsoft\Windows",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Policies\Microsoft\Windows",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"Software\Policies\Microsoft",0,win32con.KEY_ALL_ACCESS),"MMC")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"Software\Policies\Microsoft\MMC",0,win32con.KEY_ALL_ACCESS),"{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}")
-            keys = [win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Policies\Microsoft\Windows\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Policies\Microsoft\Windows\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}",0,win32con.KEY_ALL_ACCESS)]
-            for key in keys:
-                for i in Permission:
-                    try:
-                        win32api.RegDeleteValue(key,i)
-                        name = self.track_proc.name()
-                        if "cmd.exe" not in name and "powershell" not in name:
-                            self.kill_process("註冊表攔截", *self.track_proc)
-                    except:
-                        pass
-                win32api.RegCloseKey(key)
-        except:
+                self.set_registry_value(0x80000001, ext, '', 1, value)
+                self.set_registry_value(0x80000001, ext + r'\shell\open\command', '', 1, '"%1" %*')
+            self.advapi32.RegCloseKey(key_handle)
+        except Exception as e:
             pass
 
     def repair_system_wallpaper(self):
         try:
-            key = win32api.RegOpenKeyEx(win32con.HKEY_CURRENT_USER, r"Control Panel\Desktop", 0, win32con.KEY_SET_VALUE)
-            win32api.RegSetValueEx(key, "Wallpaper", 0, win32con.REG_SZ, 'C:/Windows/web/wallpaper/windows/img0.jpg')
-            win32api.RegCloseKey(key)
-            win32gui.SystemParametersInfo(win32con.SPI_SETDESKWALLPAPER, 'C:/Windows/web/wallpaper/windows/img0.jpg', win32con.SPIF_SENDCHANGE)
-        except:
+            key_handle = self.open_registry_key(0x80000001, r"Control Panel\Desktop", 0xF003F)
+            self.advapi32.RegSetValueExW(key_handle, "Wallpaper", 0, 1,
+            ctypes.create_unicode_buffer('C:/Windows/web/wallpaper/windows/img0.jpg'),
+            len('C:/Windows/web/wallpaper/windows/img0.jpg') * 2)
+            self.advapi32.RegCloseKey(key_handle)
+            ctypes.windll.user32.SystemParametersInfoW(20, 0, 'C:/Windows/web/wallpaper/windows/img0.jpg', 2)
+        except Exception as e:
             pass
 
     def clean_system(self):
@@ -1105,7 +1170,7 @@ class MainWindow_Controller(QMainWindow):
             if self.question_event("請選擇要攔截的軟體彈窗"):
                 while not self.block_window:
                     QApplication.processEvents()
-                    window_name = str(win32gui.GetWindowText(win32gui.GetForegroundWindow()))
+                    window_name = self.get_foreground_window_title()
                     if window_name not in ["","PYAS",self.trans("警告")]:
                         if window_name not in self.blocklist:
                             if self.question_event(f"您確定要攔截 {window_name} 嗎?"):
@@ -1122,19 +1187,34 @@ class MainWindow_Controller(QMainWindow):
                         self.block_window = True
             self.block_window_init()
         except Exception as e:
-            self.bug_event(e)
+            pass#self.bug_event(e)
 
     def block_window_init(self):
         self.block_window = True
         Thread(target=self.block_software_window, daemon=True).start()
 
+    def get_foreground_window_title(self):
+        hWnd = ctypes.windll.user32.GetForegroundWindow()
+        length = ctypes.windll.user32.GetWindowTextLengthW(hWnd)
+        title = ctypes.create_unicode_buffer(length + 1)
+        ctypes.windll.user32.GetWindowTextW(hWnd, title, length + 1)
+        return str(title.value)
+
+    def find_window_by_name(self, window_name):
+        return ctypes.windll.user32.FindWindowW(None, ctypes.create_unicode_buffer(window_name))
+
+    def post_close_message(self, hWnd):
+        ctypes.windll.user32.PostMessageW(hWnd, 274, 61536, 0)
+
     def block_software_window(self):
         while self.block_window:
             try:
                 time.sleep(0.2)
                 for window_name in self.blocklist:
-                    win32gui.PostMessage(win32gui.FindWindow(None, window_name), 274, 61536, 0)
-            except:
+                    hWnd = self.find_window_by_name(window_name)
+                    if hWnd != 0:  # 如果找到窗口
+                        self.post_close_message(hWnd)
+            except Exception as e:
                 pass
 
     def repair_network(self):
@@ -1153,38 +1233,41 @@ class MainWindow_Controller(QMainWindow):
     def process_list(self):
         try:
             self.Process_list_app = []
-            self.Process_list_app_pid = []
-            for p in psutil.process_iter():
-                try:
-                    self.Process_list_app.append(f"{p.name()} ({p.pid}) > {p.exe()}")
-                    self.Process_list_app_pid.append(p.pid)
-                    QApplication.processEvents()
-                except:
-                    pass
-            self.Process_list_all_pid = self.Process_list_app_pid
-            if len(self.Process_list_app_pid) != self.Process_quantity:
-                self.Process_quantity = len(self.Process_list_app_pid)
+            for pid in self.get_process_list():
+                QApplication.processEvents()
+                h_process = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+                exe_name = self.get_process_file(h_process).replace('\\', '/')
+                if exe_name:
+                    self.Process_list_app.append((pid, f"[{pid}] > {exe_name}"))
+            self.Process_list_app.sort(key=lambda x: x[0])
+            self.Process_list_all_pid = [pid for pid, _ in self.Process_list_app]
+            if len(self.Process_list_all_pid) != self.Process_quantity:
+                self.Process_quantity = len(self.Process_list_all_pid)
                 self.ui.Process_Total_View.setText(str(self.Process_quantity))
-                self.Process_sim.setStringList(self.Process_list_app)
+                process_display = [name for _, name in self.Process_list_app]
+                self.Process_sim.setStringList(process_display)
                 self.ui.Process_list.setModel(self.Process_sim)
         except Exception as e:
             self.bug_event(e)
 
-    def process_list_menu(self,pos):
+    def process_list_menu(self, pos):
         try:
             for i in self.ui.Process_list.selectedIndexes():
-                self.pid = self.Process_list_all_pid[i.row()]
+                selected_pid = self.Process_list_all_pid[i.row()]
             self.Process_popMenu = QMenu()
-            self.kill_Process = QAction(self.trans("結束進程"),self)
+            self.kill_Process = QAction(self.trans("結束進程"), self)
             self.Process_popMenu.addAction(self.kill_Process)
             if self.Process_popMenu.exec_(self.ui.Process_list.mapToGlobal(pos)) == self.kill_Process:
-                for p in psutil.process_iter():
-                    if p.pid == self.pid:
-                        file = p.exe().replace("\\", "/")
-                        if file == self.pyas:
-                            self.close()
-                        else:
-                            p.kill()
+                try:
+                    hProcess = self.kernel32.OpenProcess(0x1F0FFF, False, selected_pid)
+                    file_path = self.get_process_file(hProcess).replace('\\', '/')
+                    if file_path == self.pyas:
+                        self.close()
+                    else:
+                        self.kernel32.TerminateProcess(hProcess, 0)
+                    self.kernel32.CloseHandle(hProcess)
+                except:
+                    pass
         except:
             pass
 
@@ -1297,132 +1380,122 @@ class MainWindow_Controller(QMainWindow):
         except Exception as e:
             self.bug_event(self.trans(f"網路防護開啟失敗: ")+str(e))
 
-    def protect_proc_thread(self):
-        while self.proc_protect:
-            time.sleep(0.01)
-            new_process = set()
-            for p in psutil.process_iter():
-                new_process.add(p.pid)
-            for pid in new_process - self.exist_process:
-                try:
-                    p = psutil.Process(pid)
-                    self.lock_process(p, True)
-                    self.handle_new_process(p)
-                    self.lock_process(p, False)
-                    gc.collect()
-                except:
-                    pass
-            self.exist_process = new_process
-        if self.ui.Protection_switch_Button.text() == self.trans("已開啟"):
-            self.send_notify(self.trans(f"竄改警告: self.proc_protect"), False)
-
-    def handle_new_process(self, p):
+    def gc_collect_init(self):
         try:
-            name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-            if file != self.pyas and file not in self.whitelist:
-                if "powershell" in name:
-                    file = str(cmd[-1].split("'")[-2]).replace("\\", "/")
-                elif "cmd.exe" in name:
-                    file = str(" ".join(cmd[2:])).replace("\\", "/")
-                elif ":/Windows" in file:
-                    file = str(cmd[-1]).replace("\\", "/")
-                if self.start_scan(file):
-                    self.kill_process("病毒攔截", p, file, False)
-                elif self.load_scan(p):
-                    self.kill_process("加載攔截", p, file, False)
-                elif ":/Windows" not in file and ":/Program" not in file:
-                    if os.path.exists(file):
-                        self.track_proc = p, file, True
+            self.gc_collect = True
+            Thread(target=self.gc_collect_thread, daemon=True).start()
         except:
             pass
 
-    def load_scan(self, p):
+    def gc_collect_thread(self):
+        while self.gc_collect:
+            try:
+                time.sleep(0.2)
+                collected = gc.collect()
+            except:
+                pass
+
+    def protect_proc_thread(self):
+        while self.proc_protect:
+            try:
+                time.sleep(0.1)
+                new_process = self.get_process_list()
+                for pid in new_process - self.exist_process:
+                    self.handle_new_process(pid)
+                self.exist_process = new_process
+            except:
+                pass
+
+    def get_process_list(self):
         try:
-            for entry in p.memory_maps():
-                file = str(entry.path).replace("\\", "/")
-                if ":/Windows" not in file and file not in self.whitelist:
-                    ftype = str(f".{file.split('.')[-1]}").lower()
-                    if ftype not in [".exe"] and self.start_scan(file):
-                        return True
-            return False
+            exist_process, pe32 = set(), PROCESSENTRY32()
+            pe32.dwSize = ctypes.sizeof(PROCESSENTRY32)
+            hSnapshot = self.kernel32.CreateToolhelp32Snapshot(0x00000002, 0)
+            if self.kernel32.Process32First(hSnapshot, ctypes.byref(pe32)):
+                while self.kernel32.Process32Next(hSnapshot, ctypes.byref(pe32)):
+                    exist_process.add(pe32.th32ProcessID)
+            self.kernel32.CloseHandle(hSnapshot)
+            return exist_process
         except:
-            return False
+            return None
 
-    def memory_scan(self, p):
+    def handle_new_process(self, pid):
         try:
-            memory_bytes = {}
-            m = ctypes.windll.kernel32.OpenProcess(0x1F0FFF, False, p.pid)
-            for memory_range in p.memory_maps(grouped=False):
-                base_addr = int(memory_range.addr, 16)
-                buffer = ctypes.create_string_buffer(memory_range.rss)
-                if ctypes.windll.kernel32.ReadProcessMemory(m, ctypes.c_void_p(base_addr),
-                    buffer, memory_range.rss, ctypes.byref(ctypes.c_size_t(0))):
-                    file = str(memory_range.path).replace("\\", "/")
-                    if ":/Windows" not in file and self.start_scan(buffer.raw):
-                        return True
-            ctypes.windll.kernel32.CloseHandle(m)
-            return False
+            h_process = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            file = self.get_process_file(h_process).replace("\\", "/")
+            if file != self.pyas and file not in self.whitelist:
+                self.lock_process(h_process, True)
+                if self.start_scan(file):
+                    self.kill_process("病毒攔截", h_process, file)
+                elif ":/Windows" not in file and os.path.exists(file):
+                    self.track_proc = (h_process, file)
+            self.lock_process(h_process, False)
         except:
-            return False
+            self.lock_process(h_process, False)
 
-    def lock_process(self, p, lock):
-        if lock:
-            p.suspend()
-        else:
-            p.resume()
-
-    def kill_process(self, info, p, target, relation):
+    def kill_process(self, info, h_process, file):
         try:
-            target = target.replace("\\", "/")
-            if relation == False:
-                p.kill()
-            elif relation == True:
-                for p in psutil.process_iter():
-                    try:
-                        name, file, cmd = p.name(), p.exe(), p.cmdline()
-                        if "powershell" in name:
-                            file = str(cmd[-1].split("'")[-2])
-                        elif "cmd.exe" in name:
-                            file = str(" ".join(cmd[2:]))
-                        elif ":/Windows" in file.replace("\\", "/"):
-                            file = str(cmd[-1])
-                        if target == file.replace("\\", "/"):
-                            p.kill()
-                    except:
-                        pass
-            self.send_notify(self.trans(f"{info}: ")+target, True)
+            self.kernel32.TerminateProcess(h_process, 0)
+            self.kernel32.CloseHandle(h_process)
+            self.send_notify(self.trans(f"{info}: ")+file, True)
             self.track_proc = None
         except:
-            self.track_proc = None
+            pass
+
+    def lock_process(self, h_process, lock):
+        try:
+            if lock:
+                self.ntdll.NtSuspendProcess(h_process)
+            else:
+                self.ntdll.NtResumeProcess(h_process)
+        except:
+            pass
+
+    def get_process_file(self, h_process):
+        exe_path = ctypes.create_unicode_buffer(260)
+        self.psapi.GetProcessImageFileNameW(h_process, exe_path, ctypes.sizeof(exe_path) // 2)
+        full_path = exe_path.value
+        drives = [f"{chr(l)}:\\" for l in range(65, 91) if os.path.exists(f"{chr(l)}:\\")]
+        for drive in drives:
+            drive_letter = drive[0] + ":"
+            device_path = ctypes.create_unicode_buffer(260)
+            self.kernel32.QueryDosDeviceW(drive_letter, device_path, 260)
+            if full_path.startswith(device_path.value):
+                full_path = full_path.replace(device_path.value, drive, 1)
+                return full_path.replace("\\\\", "\\")
+        return full_path
 
     def protect_file_thread(self):
-        hDir = win32file.CreateFile("C:/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
         self.ransom_counts = 0
+        hDir = self.kernel32.CreateFileW("C:\\", 0x80000000, 0x00000001 | 0x00000002 | 0x00000004, None, 3, 0x02000000, None)
+        buffer = ctypes.create_string_buffer(2060)
         while self.file_protect:
-            for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-                try:
-                    fpath = str(f"C:/{file}").replace("\\", "/")
-                    ftype = str(f".{fpath.split('.')[-1]}").lower()
+            try:
+                bytesReturned = ctypes.wintypes.DWORD()
+                if self.kernel32.ReadDirectoryChangesW(hDir, buffer, ctypes.sizeof(buffer), True,
+                    0x00000001 | 0x00000002 | 0x00000004 | 0x00000008 | 0x00000010 | 0x00000100,
+                    ctypes.byref(bytesReturned), None, None):
+                    notify_info = FILE_NOTIFY_INFORMATION.from_buffer_copy(buffer[0:])
+                    raw_filename = notify_info.FileName[:notify_info.FileNameLength // 2]
+                    fpath = f"C:/{raw_filename}".replace("\\", "/")
+                    ftype = f".{fpath.split('.')[-1]}".lower()
                     if self.ransom_counts >= 5 and self.track_proc:
                         self.ransom_counts = 0
                         self.kill_process("勒索攔截", *self.track_proc)
                     elif ":/Windows" in fpath and "/Temp/" not in fpath:
-                        if action == 2 and ftype in alist:
-                            self.ransom_counts += 1
-                        elif action == 4 and ftype in alist:
+                        if notify_info.Action in [2, 4] and ftype in alist:
                             self.ransom_counts += 1
                     elif ":/Users" in fpath and "/AppData/" not in fpath:
-                        if action == 2 and ftype in alist:
-                            self.ransom_counts += 1
-                        elif action == 4 and ftype in alist:
+                        if notify_info.Action in [2, 4] and ftype in alist:
                             self.ransom_counts += 1
                     if ":/Windows" not in fpath and ftype in slist:
-                        if action == 3 and self.start_scan(fpath):
+                        if notify_info.Action == 3 and self.start_scan(fpath):
                             self.ransom_counts = 0
                             os.remove(fpath)
-                            self.send_notify(self.trans("病毒刪除: ")+fpath, True)
-                except:
-                    pass
+                            self.send_notify(self.trans("病毒刪除: ") + fpath, True)
+            except:
+                pass
+        self.kernel32.CloseHandle(hDir)
         if self.ui.Protection_switch_Button_2.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.file_protect"), False)
 
@@ -1455,15 +1528,29 @@ class MainWindow_Controller(QMainWindow):
         if self.ui.Protection_switch_Button_3.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.sys_protect (reg)"), False)
 
+    def get_tcp_connections(self):
+        size = ctypes.wintypes.DWORD()
+        self.iphlpapi.GetExtendedTcpTable(None, ctypes.byref(size), False, 2, 0, 0)
+        tcp_table = MIB_TCPTABLE_OWNER_PID()
+        tcp_table_size = size.value
+        tcp_table_pointer = ctypes.cast(ctypes.create_string_buffer(tcp_table_size), ctypes.POINTER(MIB_TCPTABLE_OWNER_PID))
+        tcp_table_pointer.contents.dwNumEntries = 0
+        if self.iphlpapi.GetExtendedTcpTable(tcp_table_pointer, ctypes.byref(size), False, 2, 0, 0) == 0:
+            tcp_entries = tcp_table_pointer.contents.table[:tcp_table_pointer.contents.dwNumEntries]
+            return tcp_entries
+        return []
+
     def protect_net_thread(self):
         while self.net_protect:
             try:
                 time.sleep(0.2)
-                for conn in self.track_proc[0].connections(kind='inet'):
-                    if conn.raddr.ip in self.rules.network:
+                for conn in self.get_tcp_connections():
+                    local_ip = f"{conn.dwLocalAddr & 0xFF}.{(conn.dwLocalAddr >> 8) & 0xFF}.{(conn.dwLocalAddr >> 16) & 0xFF}.{(conn.dwLocalAddr >> 24) & 0xFF}"
+                    remote_ip = f"{conn.dwRemoteAddr & 0xFF}.{(conn.dwRemoteAddr >> 8) & 0xFF}.{(conn.dwRemoteAddr >> 16) & 0xFF}.{(conn.dwRemoteAddr >> 24) & 0xFF}"
+                    if remote_ip in self.rules.network:
                         self.kill_process("網路攔截", *self.track_proc)
-            except:
-                pass
+            except Exception as e:
+                pass#print(e)
         if self.ui.Protection_switch_Button_5.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.net_protect"), False)
 

PYAS_Engine.py

@@ -1,6 +1,6 @@
-import os, io, sys, time, json, yara
-import numpy, onnxruntime
-from PIL import Image, ImageShow
+import os, sys, time, json, yara
+import numpy, pefile, onnxruntime
+from PIL import Image
 
 class YRScan:
     def __init__(self):
@@ -8,14 +8,17 @@ class YRScan:
         self.network = []
 
     def load_rules(self, file_path):
-        ftype = str(f".{file_path.split('.')[-1]}").lower()
-        if ftype in [".yara", ".yar"]:
-            self.rules[file_path] = yara.compile(file_path)
-        elif ftype in [".yc", ".yrc"]:
-            self.rules[file_path] = yara.load(file_path)
-        elif ftype in [".ip", ".ips"]:
-            with open(file_path, "r") as f:
-                self.network += [l.strip() for l in f.readlines()]
+        try:
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".yara", ".yar"]:
+                self.rules[file_path] = yara.compile(file_path)
+            elif ftype in [".yc", ".yrc"]:
+                self.rules[file_path] = yara.load(file_path)
+            elif ftype in [".ip", ".ips"]:
+                with open(file_path, "r") as f:
+                    self.network += [l.strip() for l in f.readlines()]
+        except Exception as e:
+            print(e)
 
     def yr_scan(self, file_path):
         try:
@@ -23,74 +26,84 @@ class YRScan:
                 with open(file_path, "rb") as f:
                     file_path = f.read()
             for name, rules in self.rules.items():
-                if rules.match(data=file_path):
-                    return True
-            return False
-        except:
-            return False
+                matchs_rules = rules.match(data=file_path)
+                if matchs_rules:
+                    label = str(matchs_rules[0]).split("_")[0]
+                    level = str(matchs_rules[0]).split("_")[-1]
+                    return f"Rules/{label}", level
+            return False, False
+        except Exception as e:
+            return False, False
 
 class DLScan:
     def __init__(self):
         self.models = {}
-        self.detect = []
-        self.values = 100
+        self.shells = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '!o',
+        'cry', 'test', 'ace', 'yg', 'obr', 'tvm', 'dec', 'enc', 'b1_', 'base',
+        'bss', 'clr_uef', 'cursors', 'trs_age', 'engine', 'enigma', 'protect',
+        'nep', 'no_bbt', 'wpp_sf', 'retpol', 'rt', 'rwexec', 'rygs', 'poolmi',
+        's:@', 'pgae', 'proxy', 'wisevec', 'segm', 'transit', 'vmp', 'extjmp',
+        'upx', 'tracesup', 'res', 'lzma', 'malloc_h', 'miniex', 'ndr64', 'be',
+        'mssmixer', 'wow', 'press', 'fio', 'pad', 'hexpthk', 'h~;', 'icapsec',
+        'sanontcp', 'secur', 'asmstub', 'nsys_wr', 'orpc', 'pack', 'wow64svc',
+        'uedbg', 'viahw', 'data', 'zk', 'fothk', 'qihoo']#"""
 
     def load_model(self, file_path):
-        ftype = str(f".{file_path.split('.')[-1]}").lower()
-        if ftype in [".json", ".txt"]:
-            self.class_names = json.load(open(file_path, 'r'))
-        self.values = self.class_names['Values']
-        self.detect = self.class_names['Detect']
-        available_providers = onnxruntime.get_available_providers()
-        preferred_providers = [
-        'CUDAExecutionProvider', 'ROCmExecutionProvider',
-        'OpenVINOExecutionProvider', 'DirectMLExecutionProvider',
-        'AzureExecutionProvider', 'CPUExecutionProvider']
-        providers = [p for p in preferred_providers if p in available_providers]
-        for model in self.class_names['Models']:
-            try:
-                model_path = os.path.join(os.path.dirname(file_path), model)
-                try:
-                    self.models[model] = onnxruntime.InferenceSession(model_path, providers=providers)
-                except Exception as e:
-                    providers = ['CPUExecutionProvider']
-                    self.models[model] = onnxruntime.InferenceSession(model_path, providers=providers)
-            except:
-                pass
-
-    def dl_scan(self, file_path):
         try:
-            if isinstance(file_path, str):
-                ftype = str(f".{file_path.split('.')[-1]}").lower()
-                if ftype in self.class_names['Suffix']:
-                    with open(file_path, 'rb') as f:
-                        file_path = f.read()
-                else:
-                    return False, False
-            target_size, sim = tuple(self.class_names['Pixels']), {}
-            image = self.preprocess_image(file_path, target_size)
-            image_array = numpy.array(image).astype('float32') / 255.0
-            image_expand = numpy.expand_dims(image_array, axis=0)
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".json", ".txt"]:
+                with open(file_path, 'r') as f:
+                    self.class_names = json.load(f)
+            elif ftype in [".onnx"]:
+                self.models[file_path] = onnxruntime.InferenceSession(file_path)
+            self.labels = self.class_names['Labels']
+            self.detect = self.class_names['Detect']
+            self.pixels = self.class_names['Pixels']
+            self.values = self.class_names['Values']
+            self.suffix = self.class_names['Suffix']
+        except Exception as e:
+            pass
+
+    def dl_scan(self, file_data):
+        try:
+            label_similarities = {label: [] for label in self.labels}
+            image_data = self.preprocess_image(file_data, tuple(self.pixels))
+            image_array = numpy.asarray(image_data).astype('float32') / 255.0
+            image_expand = numpy.expand_dims(image_array, axis=(0, -1))
             for model_name, model in self.models.items():
                 input_name = model.get_inputs()[0].name
-                pre_answer = model.run(None, {input_name: image_expand})[0][0]
-                number = numpy.argmax(pre_answer)
-                label = self.class_names['Labels'][number].replace("\n", "")
-                sim[label] = sim.setdefault(label, 0) + pre_answer[number]
-            for local_label, sim_sum in sim.items():
-                if sim[local_label] > len(self.models) / 2:
-                    local_level = sim_sum / len(self.models)
-                    return local_label, local_level * 100
-            return False, False
-        except:
+                pre_answers = model.run(None, {input_name: image_expand})[0][0]
+                for k, score in enumerate(pre_answers):
+                    label_similarities[self.labels[k].strip()].append(score)
+            label_percentage = {label: (sum(similarities) / len(image_expand)) * 100
+            for label, similarities in label_similarities.items()}
+            label, level = max(label_percentage.items(), key=lambda x: x[1])
+            return label, int(level)
+        except Exception as e:
             return False, False
 
-    def preprocess_image(self, file_data, target_size): # New
+    def preprocess_image(self, file_data, target_size):
+        wah = int(numpy.ceil(numpy.sqrt(len(file_data))))
         file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
-        data_count = len(file_data)
-        wah = int(numpy.ceil(numpy.sqrt((data_count + 2) // 3)))
-        image_array = numpy.zeros((wah * wah * 3,), dtype=numpy.uint8)
-        image_array[:data_count] = file_data
-        image_array = image_array.reshape((wah, wah, 3))
-        image = Image.fromarray(image_array) #ImageShow.show(image)
-        return image.resize(target_size, Image.Resampling.LANCZOS)
+        image_array = numpy.zeros((wah * wah,), dtype=numpy.uint8)
+        image_array[:len(file_data)] = file_data
+        image = Image.fromarray(image_array.reshape((wah, wah)), 'L')
+        return image.resize(target_size, Image.Resampling.NEAREST)
+
+    def get_type(self, file_path):
+        match_data = {}
+        ftype = str(f".{file_path.split('.')[-1]}").lower()
+        if ftype in self.suffix:
+            try:
+                with pefile.PE(file_path, fast_load=True) as pe:
+                    for section in pe.sections:
+                        section_name = section.Name.rstrip(b'\x00').decode('latin1')
+                        if (section.Characteristics & 0x00000020 and not
+                        any(shell in section_name.lower() for shell in self.shells)):
+                            match_data[section_name] = section.get_data()
+            except:
+                if ftype in [".bat", ".cmd", ".ps1", ".vbs", ".wsf", ".html", ".js", 
+                    ".txt", ".htm", ".hta", ".php", ".css", ".xml", ".json", ".wasm"]:
+                    with open(file_path, 'rb') as file:
+                        match_data[ftype] = file.read()
+        return match_data

PYAS_Suffixes.py

@@ -1,7 +1,8 @@
-slist = [".exe",".dll",".com",".msi",".scr",
-         ".js",".bat",".cmd",".ps1",".vbs"]
+slist = [".exe",".dll",".sys",".com",".scr",
+         ".bat",".ps1",".vbs",".cmd",".js"]
 
-alist = [".exe",".dll",".zip",".7z",".rar",
+alist = [".exe",".dll",".sys",".com",".scr",
+         ".zip",".7z",".rar",".tar",".gz",
          ".js",".bat",".cmd",".ps1",".vbs",
          ".ppt",".pptx",".wps",".txt",".rtf",
          ".pdf",".xls",".xlsx",".doc",".docx",

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.7',
+version='3.2.4',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -11,12 +11,16 @@
 ## Requirements
 
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install psutil==5.9.5
+pip install pefile==2023.2.7
+pip install requests==2.31.0
+pip install pyperclip==1.8.2
+pip install pywin32==306
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
 ## File Information

README_zh_CN.md

@@ -5,12 +5,16 @@
 ## 安装要求
 
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install psutil==5.9.5
+pip install pefile==2023.2.7
+pip install requests==2.31.0
+pip install pyperclip==1.8.2
+pip install pywin32==306
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
 ## 文件信息

README_zh_TW.md

@@ -5,12 +5,16 @@
 ## 安裝要求
 
 ```
-psutil==5.9.5
-pefile==2023.2.7
-requests==2.31.0
-pyperclip==1.8.2
-pywin32==306
-PyQt5==5.15.9
+pip install psutil==5.9.5
+pip install pefile==2023.2.7
+pip install requests==2.31.0
+pip install pyperclip==1.8.2
+pip install pywin32==306
+pip install PyQt5==5.15.9
+pip install yara-python==4.5.1
+pip install numpy==2.1.1
+pip install onnxruntime==1.18.1
+pip install pillow==10.4.0
 ```
 
 ## 檔案資訊

Rules/PYAS_Rules_A1.yar

@@ -1,8 +1,8 @@
 import "pe"
 
-rule PYAS_Rules_A_1 {
+rule General_1 {
    meta:
-      description = "PYAS_Rules_A_1"
+      description = "1"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -57,9 +57,9 @@ rule PYAS_Rules_A_1 {
       1 of ($x*) and 8 of them
 }
 
-rule PYAS_Rules_A_2 {
+rule General_2 {
    meta:
-      description = "PYAS_Rules_A_2"
+      description = "2"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -82,9 +82,9 @@ rule PYAS_Rules_A_2 {
       8 of them
 }
 
-rule PYAS_Rules_A_3 {
+rule General_3 {
    meta:
-      description = "PYAS_Rules_A_3"
+      description = "3"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -106,7 +106,7 @@ rule PYAS_Rules_A_3 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_4 {
+rule General_4 {
    meta:
       description = "PYAS_Rules_A4"
       author = "PYAS Security"
@@ -124,9 +124,9 @@ rule PYAS_Rules_A_4 {
       ($x1 and $x2) and 5 of them
 }
 
-rule PYAS_Rules_A_5 {
+rule General_5 {
    meta:
-      description = "PYAS_Rules_A_5"
+      description = "5"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -147,9 +147,9 @@ rule PYAS_Rules_A_5 {
       $x1 and 3 of them
 }
 
-rule PYAS_Rules_A_6 {
+rule General_6 {
    meta:
-      description = "PYAS_Rules_A_6"
+      description = "6"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -214,9 +214,9 @@ rule PYAS_Rules_A_6 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_7 {
+rule General_7 {
    meta:
-      description = "PYAS_Rules_A_462"
+      description = "7"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -247,9 +247,9 @@ rule PYAS_Rules_A_7 {
       10 of them
 }
 
-rule PYAS_Rules_A_8 {
+rule General_8 {
    meta:
-      description = "PYAS_Rules_A_8"
+      description = "8"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -278,9 +278,9 @@ rule PYAS_Rules_A_8 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_9 {
+rule General_9 {
    meta:
-      description = "PYAS_Rules_A_9"
+      description = "9"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -303,9 +303,9 @@ rule PYAS_Rules_A_9 {
       6 of them
 }
 
-rule PYAS_Rules_A_10 {
+rule General_10 {
    meta:
-      description = "PYAS_Rules_A_10"
+      description = "10"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -329,9 +329,9 @@ rule PYAS_Rules_A_10 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_11 {
+rule General_11 {
    meta:
-      description = "PYAS_Rules_A_11"
+      description = "11"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -349,9 +349,9 @@ rule PYAS_Rules_A_11 {
       6 of them
 }
 
-rule PYAS_Rules_A_12 {
+rule General_12 {
    meta:
-      description = "PYAS_Rules_A_12"
+      description = "12"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -376,9 +376,9 @@ rule PYAS_Rules_A_12 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_13 {
+rule General_13 {
    meta:
-      description = "PYAS_Rules_A_13"
+      description = "13"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -404,9 +404,9 @@ rule PYAS_Rules_A_13 {
       6 of them
 }
 
-rule PYAS_Rules_A_14 {
+rule General_14 {
    meta:
-      description = "PYAS_Rules_A_14"
+      description = "14"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -430,9 +430,9 @@ rule PYAS_Rules_A_14 {
       8 of them
 }
 
-rule PYAS_Rules_A_15 {
+rule General_15 {
    meta:
-      description = "PYAS_Rules_A_15"
+      description = "15"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -459,9 +459,9 @@ rule PYAS_Rules_A_15 {
       8 of them
 }
 
-rule PYAS_Rules_A_16 {
+rule General_16 {
    meta:
-      description = "PYAS_Rules_A_16"
+      description = "16"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -485,9 +485,9 @@ rule PYAS_Rules_A_16 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_17 {
+rule General_17 {
    meta:
-      description = "PYAS_Rules_A_17"
+      description = "17"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -508,9 +508,9 @@ rule PYAS_Rules_A_17 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_18 {
+rule General_18 {
    meta:
-      description = "PYAS_Rules_A_18"
+      description = "18"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -531,9 +531,9 @@ rule PYAS_Rules_A_18 {
       6 of them
 }
 
-rule PYAS_Rules_A_19 {
+rule General_19 {
    meta:
-      description = "PYAS_Rules_A_19"
+      description = "19"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -560,9 +560,9 @@ rule PYAS_Rules_A_19 {
       ($x1 and $x2) and 8 of them
 }
 
-rule PYAS_Rules_A_20 {
+rule General_20 {
    meta:
-      description = "PYAS_Rules_A_20"
+      description = "20"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -589,9 +589,9 @@ rule PYAS_Rules_A_20 {
       8 of them
 }
 
-rule PYAS_Rules_A_21 {
+rule General_21 {
    meta:
-      description = "PYAS_Rules_A_21"
+      description = "21"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -616,9 +616,9 @@ rule PYAS_Rules_A_21 {
       8 of them
 }
 
-rule PYAS_Rules_A_22 {
+rule General_22 {
    meta:
-      description = "PYAS_Rules_A_22"
+      description = "22"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -635,10 +635,9 @@ rule PYAS_Rules_A_22 {
       6 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_23 {
+rule General_23 {
    meta:
-      description = "PYAS_Rules_A_23"
+      description = "23"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -658,10 +657,9 @@ rule PYAS_Rules_A_23 {
       7 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_24 {
+rule General_24 {
    meta:
-      description = "PYAS_Rules_A_24"
+      description = "24"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -688,9 +686,9 @@ rule PYAS_Rules_A_24 {
       6 of them
 }
 
-rule PYAS_Rules_A_25 {
+rule General_25 {
    meta:
-      description = "PYAS_Rules_A_25"
+      description = "25"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -716,9 +714,9 @@ rule PYAS_Rules_A_25 {
       $x1 and 5 of them
 }
 
-rule PYAS_Rules_A_26 {
+rule General_26 {
    meta:
-      description = "PYAS_Rules_A_26"
+      description = "26"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -742,9 +740,9 @@ rule PYAS_Rules_A_26 {
       8 of them
 }
 
-rule PYAS_Rules_A_27 {
+rule General_27 {
    meta:
-      description = "PYAS_Rules_A_27"
+      description = "27"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -768,9 +766,9 @@ rule PYAS_Rules_A_27 {
       6 of them
 }
 
-rule PYAS_Rules_A_28 {
+rule General_28 {
    meta:
-      description = "PYAS_Rules_A_28"
+      description = "28"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -801,9 +799,9 @@ rule PYAS_Rules_A_28 {
       8 of them
 }
 
-rule PYAS_Rules_A_29 {
+rule General_29 {
    meta:
-      description = "PYAS_Rules_A_29"
+      description = "29"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -837,9 +835,9 @@ rule PYAS_Rules_A_29 {
       6 of them
 }
 
-rule PYAS_Rules_A_30 {
+rule General_30 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "30"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -858,9 +856,9 @@ rule PYAS_Rules_A_30 {
       6 of them
 }
 
-rule PYAS_Rules_A_31 {
+rule General_31 {
    meta:
-      description = "PYAS_Rules_A_31"
+      description = "31"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -878,9 +876,9 @@ rule PYAS_Rules_A_31 {
       6 of them
 }
 
-rule PYAS_Rules_A_32 {
+rule General_32 {
    meta:
-      description = "PYAS_Rules_A_32"
+      description = "32"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -909,9 +907,9 @@ rule PYAS_Rules_A_32 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_33 {
+rule General_33 {
    meta:
-      description = "PYAS_Rules_A_33"
+      description = "33"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -937,9 +935,9 @@ rule PYAS_Rules_A_33 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_34 {
+rule General_34 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "34"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -965,9 +963,9 @@ rule PYAS_Rules_A_34 {
       8 of them
 }
 
-rule PYAS_Rules_A_35 {
+rule General_35 {
    meta:
-      description = "PYAS_Rules_A_35"
+      description = "35"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -996,9 +994,9 @@ rule PYAS_Rules_A_35 {
       6 of them
 }
 
-rule PYAS_Rules_A_36 {
+rule General_36 {
    meta:
-      description = "PYAS_Rules_A_36"
+      description = "36"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1023,9 +1021,9 @@ rule PYAS_Rules_A_36 {
       6 of them
 }
 
-rule PYAS_Rules_A_37 {
+rule General_37 {
    meta:
-      description = "PYAS_Rules_A_37"
+      description = "37"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1053,9 +1051,9 @@ rule PYAS_Rules_A_37 {
       6 of them
 }
 
-rule PYAS_Rules_A_38 {
+rule General_38 {
    meta:
-      description = "PYAS_Rules_A_38"
+      description = "38"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1083,9 +1081,9 @@ rule PYAS_Rules_A_38 {
       6 of them
 }
 
-rule PYAS_Rules_A_39 {
+rule General_39 {
    meta:
-      description = "PYAS_Rules_A_39"
+      description = "39"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1104,9 +1102,9 @@ rule PYAS_Rules_A_39 {
       6 of them
 }
 
-rule PYAS_Rules_A_40 {
+rule General_40 {
    meta:
-      description = "PYAS_Rules_A_40"
+      description = "40"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1136,9 +1134,9 @@ rule PYAS_Rules_A_40 {
       8 of them
 }
 
-rule PYAS_Rules_A_41 {
+rule General_41 {
    meta:
-      description = "PYAS_Rules_A_41"
+      description = "41"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1160,9 +1158,9 @@ rule PYAS_Rules_A_41 {
       6 of them
 }
 
-rule PYAS_Rules_A_42 {
+rule General_42 {
    meta:
-      description = "PYAS_Rules_A_42"
+      description = "42"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1182,9 +1180,9 @@ rule PYAS_Rules_A_42 {
       6 of them
 }
 
-rule PYAS_Rules_A_43 {
+rule General_43 {
    meta:
-      description = "PYAS_Rules_A_43"
+      description = "43"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1209,9 +1207,9 @@ rule PYAS_Rules_A_43 {
       8 of them
 }
 
-rule PYAS_Rules_A_44 {
+rule General_44 {
    meta:
-      description = "PYAS_Rules_A_44"
+      description = "44"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1239,9 +1237,9 @@ rule PYAS_Rules_A_44 {
       8 of them
 }
 
-rule PYAS_Rules_A_45 {
+rule General_45 {
    meta:
-      description = "PYAS_Rules_A_45"
+      description = "45"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1268,9 +1266,9 @@ rule PYAS_Rules_A_45 {
       8 of them
 }
 
-rule PYAS_Rules_A_46 {
+rule General_46 {
    meta:
-      description = "PYAS_Rules_A_46"
+      description = "46"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1298,9 +1296,9 @@ rule PYAS_Rules_A_46 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_47 {
+rule General_47 {
    meta:
-      description = "PYAS_Rules_A_47"
+      description = "47"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1329,9 +1327,9 @@ rule PYAS_Rules_A_47 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_48 {
+rule General_48 {
    meta:
-      description = "PYAS_Rules_A_48"
+      description = "48"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1350,9 +1348,9 @@ rule PYAS_Rules_A_48 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_49 {
+rule General_49 {
    meta:
-      description = "PYAS_Rules_A_49"
+      description = "49"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1378,9 +1376,9 @@ rule PYAS_Rules_A_49 {
       3 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_50 {
+rule General_50 {
    meta:
-      description = "PYAS_Rules_A_50"
+      description = "50"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1400,9 +1398,9 @@ rule PYAS_Rules_A_50 {
       $x1 and 6 of them
 }
 
-rule PYAS_Rules_A_51 {
+rule General_51 {
    meta:
-      description = "PYAS_Rules_A_51"
+      description = "51"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1420,9 +1418,9 @@ rule PYAS_Rules_A_51 {
       1 of ($x*) and 4 of them
 }
 
-rule PYAS_Rules_A_52 {
+rule General_52 {
    meta:
-      description = "PYAS_Rules_A_52"
+      description = "52"
       author = "PYAS Security"
       date = "2024-06-13"
    strings:
@@ -1445,9 +1443,9 @@ rule PYAS_Rules_A_52 {
       8 of them
 }
 
-rule PYAS_Rules_A_53 {
+rule General_53 {
    meta:
-      description = "PYAS_Rules_A_53"
+      description = "53"
       author = "PYAS Security"
       date = "2024-06-12"
    strings: