Add files via upload

Model/PYAS_Model.json

@@ -3,9 +3,7 @@
 
     "Detect": ["Virus/Pefile", "Virus/Script"],  
 
-    "Models": ["PYAS_Model_A1.onnx"], 
-
-    "Pixels": [300, 300], 
+    "Pixels": [224, 224], 
 
     "Values": 95
 }

PYAS.py

@@ -19,7 +19,7 @@ class MainWindow_Controller(QMainWindow):
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.pyae_version = "AI Engine"
-        self.pyas_version = "3.1.8"
+        self.pyas_version = "3.2.0"
         self.first_startup = True
         self.init_data_base()
         self.init_tray_icon()
@@ -924,14 +924,12 @@ class MainWindow_Controller(QMainWindow):
             if os.path.exists(file):
                 self.send_notify(self.trans(f"正在掃描: ")+file, False)
             label, level = self.model.dl_scan(file)
-            if label and label in self.model.detect:
-                if self.json["high_sensitive"]:
-                    return label
-                elif level >= self.model.values:
-                    return label
+            if label and self.json["high_sensitive"]:
+                return label
+            elif label and level >= self.model.values:
+                return label
             if self.json["extension_kits"]:
-                if self.rules.yr_scan(file):
-                    return "Virus/Rules"
+                return self.rules.yr_scan(file)[0]
             return False
         except:
             return False
@@ -1299,7 +1297,7 @@ class MainWindow_Controller(QMainWindow):
 
     def protect_proc_thread(self):
         while self.proc_protect:
-            time.sleep(0.1)
+            time.sleep(0.01)
             new_process = set()
             for p in psutil.process_iter():
                 new_process.add(p.pid)
@@ -1333,7 +1331,8 @@ class MainWindow_Controller(QMainWindow):
                 elif self.memory_scan(p):
                     self.kill_process("記憶體攔截", p, file, False)
                 elif ":/Windows" not in file and ":/Program" not in file:
-                    if os.path.exists(file):
+                    ftype = str(f".{file.split('.')[-1]}").lower()
+                    if os.path.exists(file) and ftype in slist:
                         self.track_proc = p, file, True
         except:
             pass
@@ -1350,31 +1349,6 @@ class MainWindow_Controller(QMainWindow):
         except:
             return False
 
-    def get_executable_section(self, process_handle, base_address):
-        dos_header = ctypes.create_string_buffer(64)
-        ctypes.windll.kernel32.ReadProcessMemory(process_handle,
-        ctypes.c_void_p(base_address), dos_header, 64, None)
-        nt_headers_offset = struct.unpack("<I", dos_header[0x3C:0x3C + 4])[0]
-        nt_headers = ctypes.create_string_buffer(248)
-        ctypes.windll.kernel32.ReadProcessMemory(process_handle,
-        ctypes.c_void_p(base_address + nt_headers_offset), nt_headers, 248, None)
-        number_of_sections = struct.unpack("<H", nt_headers[6:8])[0]
-        optional_header_size = struct.unpack("<H", nt_headers[20:22])[0]
-        section_headers_offset = nt_headers_offset + 24 + optional_header_size
-        for i in range(number_of_sections):
-            section_header = ctypes.create_string_buffer(40)
-            section_address = base_address + section_headers_offset + i * 40
-            ctypes.windll.kernel32.ReadProcessMemory(process_handle,
-            ctypes.c_void_p(section_address), section_header, 40, None)
-            section_name = section_header[:8].rstrip(b'\x00').decode()
-            virtual_address = struct.unpack("<I", section_header[12:16])[0]
-            virtual_size = struct.unpack("<I", section_header[8:12])[0]
-            characteristics = struct.unpack("<I", section_header[36:40])[0]
-            if (characteristics & 0x20000000 and characteristics & 0x40000000 and
-                virtual_size > 0):
-                return base_address + virtual_address, virtual_size
-        return None, 0
-
     def get_module_base(self, p):
         try:
             for entry in p.memory_maps(grouped=False):
@@ -1390,12 +1364,32 @@ class MainWindow_Controller(QMainWindow):
         try:
             base_address = self.get_module_base(p)
             process_handle = ctypes.windll.kernel32.OpenProcess(0x1F0FFF, False, p.pid)
-            text_addr, text_size = self.get_executable_section(process_handle, base_address)
-            buffer = ctypes.create_string_buffer(text_size)
-            if ctypes.windll.kernel32.ReadProcessMemory(process_handle,
-            ctypes.c_void_p(text_addr), buffer, text_size, ctypes.byref(ctypes.c_size_t(0))):
-                if self.start_scan(buffer.raw):
-                    return True
+            dos_header = ctypes.create_string_buffer(64)
+            ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+            ctypes.c_void_p(base_address), dos_header, 64, None)
+            nt_headers_offset = struct.unpack("<I", dos_header[0x3C:0x3C + 4])[0]
+            nt_headers = ctypes.create_string_buffer(248)
+            ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+            ctypes.c_void_p(base_address + nt_headers_offset), nt_headers, 248, None)
+            number_of_sections = struct.unpack("<H", nt_headers[6:8])[0]
+            optional_header_size = struct.unpack("<H", nt_headers[20:22])[0]
+            section_headers_offset = nt_headers_offset + 24 + optional_header_size
+            for i in range(number_of_sections):
+                section_header = ctypes.create_string_buffer(40)
+                section_address = base_address + section_headers_offset + i * 40
+                ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+                ctypes.c_void_p(section_address), section_header, 40, None)
+                section_name = section_header[:8].rstrip(b'\x00').decode()
+                virtual_address = struct.unpack("<I", section_header[12:16])[0]
+                virtual_size = struct.unpack("<I", section_header[8:12])[0]
+                characteristics = struct.unpack("<I", section_header[36:40])[0]
+                text_address = base_address + virtual_address
+                buffer = ctypes.create_string_buffer(virtual_size)
+                if ctypes.windll.kernel32.ReadProcessMemory(process_handle, ctypes.c_void_p(text_address),
+                buffer, virtual_size, ctypes.byref(ctypes.c_size_t(0))) and characteristics & 0x20000000:
+                    if not any(shell in section_name.lower() for shell in self.model.shells):
+                        if self.start_scan(buffer.raw):
+                            return True
             ctypes.windll.kernel32.CloseHandle(process_handle)
             return False
         except:

PYAS_Engine.py

@@ -8,14 +8,17 @@ class YRScan:
         self.network = []
 
     def load_rules(self, file_path):
-        ftype = str(f".{file_path.split('.')[-1]}").lower()
-        if ftype in [".yara", ".yar"]:
-            self.rules[file_path] = yara.compile(file_path)
-        elif ftype in [".yc", ".yrc"]:
-            self.rules[file_path] = yara.load(file_path)
-        elif ftype in [".ip", ".ips"]:
-            with open(file_path, "r") as f:
-                self.network += [l.strip() for l in f.readlines()]
+        try:
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".yara", ".yar"]:
+                self.rules[file_path] = yara.compile(file_path)
+            elif ftype in [".yc", ".yrc"]:
+                self.rules[file_path] = yara.load(file_path)
+            elif ftype in [".ip", ".ips"]:
+                with open(file_path, "r") as f:
+                    self.network += [l.strip() for l in f.readlines()]
+        except:
+            pass
 
     def yr_scan(self, file_path):
         try:
@@ -23,17 +26,25 @@ class YRScan:
                 with open(file_path, "rb") as f:
                     file_path = f.read()
             for name, rules in self.rules.items():
-                if rules.match(data=file_path):
-                    return True
-            return False
+                matchs_rules = rules.match(data=file_path)
+                if matchs_rules:
+                    return "Virus/Rules", matchs_rules
+            return False, False
         except:
-            return False
+            return False, False
 
 class DLScan:
     def __init__(self):
         self.models = {}
         self.detect = []
         self.values = 100
+        self.shells = ['!o', '/4', '0a@', '?g_encry', '_test', 'ace', 'yg', 'obr', 'b1_',
+        'base', 'bss', 'clr_uef', 'cursors', 'trs_age', 'engine', 'enigma', 'extjmp',
+        'fio', 'fothk', 'hexpthk', 'h~;', 'icapsec', 'il2cpp', 'imageres', 'lzmadec',
+        'malloc_h', 'miniex', 'mpress', 'mssmixer', 'ndr64', 'nep', 'no_bbt', 'wpp_sf',
+        'nsys_wr', 'orpc', 'packer', 'pad', 'tvm', 'pgae', 'poolmi', 'proxy', 'segm',
+        'retpol', 'rt', 'rwexec', 'u7m', 'rygs', 's:@', 'sanontcp', 'secur', 'asmstub',
+        'tracesup', 'transit', 'upx', 'uedbg', 'viahw', 'vmp', 'wow64svc', 'be', 'zk']
 
     def load_model(self, file_path):
         try:
@@ -41,31 +52,15 @@ class DLScan:
             if ftype in [".json", ".txt"]:
                 with open(file_path, 'r') as f:
                     self.class_names = json.load(f)
+            elif ftype in [".onnx"]:
+                self.models[file_path] = onnxruntime.InferenceSession(file_path)
             self.values = self.class_names['Values']
             self.detect = self.class_names['Detect']
-            available_providers = onnxruntime.get_available_providers()
-            preferred_providers = [
-            'CUDAExecutionProvider', 'ROCmExecutionProvider',
-            'OpenVINOExecutionProvider', 'DirectMLExecutionProvider',
-            'AzureExecutionProvider', 'CPUExecutionProvider']
-            providers = [p for p in preferred_providers if p in available_providers]
-            for model in self.class_names['Models']:
-                model_path = os.path.join(os.path.dirname(file_path), model)
-                try:
-                    self.models[model] = onnxruntime.InferenceSession(
-                    model_path, providers=providers)
-                except Exception as e:
-                    self.models[model] = onnxruntime.InferenceSession(
-                    model_path, providers=['CPUExecutionProvider'])
-        except Exception as e:
+        except:
             pass
 
-    def dl_scan(self, file_path):
+    def predict(self, file_data):
         try:
-            if isinstance(file_path, str):
-                file_data = self.check_file_type(file_path)
-            else:
-                file_data = file_path
             target_size, sim = tuple(self.class_names['Pixels']), {}
             image = self.preprocess_image(file_data, target_size)
             image_array = numpy.array(image).astype('float32') / 255.0
@@ -81,25 +76,32 @@ class DLScan:
                     local_level = sim_sum / len(self.models)
                     return local_label, local_level * 100
             return False, False
-        except Exception as e:
+        except:
             return False, False
 
-    def check_file_type(self, file_path):
+    def dl_scan(self, file_path):
         try:
+            if isinstance(file_path, bytes):
+                label, level = self.predict(file_path)
+                if label and label in self.detect:
+                    return label, level
             ftype = str(f".{file_path.split('.')[-1]}").lower()
-            if ftype in [".exe", ".dll", ".sys", ".com"]:
+            if ftype in [".exe", ".dll", ".sys", ".scr", ".com"]:
                 with pefile.PE(file_path, fast_load=True) as pe:
-                    for section in pe.sections:
-                        if (section.Characteristics & pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_EXECUTE'] and
-                        section.Characteristics & pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_READ'] and
-                        section.SizeOfRawData > 0 and section.Name.decode().strip('\x00').lower() in [".text"]):
-                            return section.get_data()
-            elif ftype in [".bat", ".cmd", ".vbs", ".ps1"]:
-                with open(file_path, 'rb') as f:
-                    return f.read()
-            return False
-        except Exception as e:
-            return False
+                    match_data = [section.get_data() for section in pe.sections
+                    if section.Characteristics & 0x20000000 and not
+                    any(shell in section.Name.decode().strip('\x00').lower()
+                    for shell in self.shells)]
+            elif ftype in [".bat", ".vbs", ".ps1", ".cmd", ".js"]:
+                with open(file_path, 'rb') as file:
+                    match_data = [file.read()]
+            for file_data in match_data:
+                label, level = self.predict(file_data)
+                if label and label in self.detect:
+                    return label, level
+            return False, False
+        except:
+            return False, False
 
     def preprocess_image(self, file_data, target_size):
         file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)

PYAS_Suffixes.py

@@ -1,7 +1,8 @@
-slist = [".exe",".dll",".com",".msi",".scr",
-         ".js",".bat",".cmd",".ps1",".vbs"]
+slist = [".exe",".dll",".sys",".com",".scr",
+         ".bat",".ps1",".vbs",".cmd",".js"]
 
-alist = [".exe",".dll",".zip",".7z",".rar",
+alist = [".exe",".dll",".sys",".com",".scr",
+         ".zip",".7z",".rar",".tar",".gz",
          ".js",".bat",".cmd",".ps1",".vbs",
          ".ppt",".pptx",".wps",".txt",".rtf",
          ".pdf",".xls",".xlsx",".doc",".docx",

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.8',
+version='3.2.0',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",