Update README.md

Engine/Model/PYAS_Model.json

@@ -0,0 +1,12 @@
+{
+    "Suffix": [".com", ".exe", ".dll", ".sys", ".scr",
+               ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], 
+
+    "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], 
+
+    "Detect": ["Pefile/General", "Script/General"],  
+
+    "Pixels": [224, 224], 
+
+    "Values": 90
+}

Engine/Rules/PYAS_Rules_A1.yar

@@ -1,8 +1,8 @@
 import "pe"
 
-rule PYAS_Rules_A_1 {
+rule General_1 {
    meta:
-      description = "PYAS_Rules_A_1"
+      description = "1"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -57,9 +57,9 @@ rule PYAS_Rules_A_1 {
       1 of ($x*) and 8 of them
 }
 
-rule PYAS_Rules_A_2 {
+rule General_2 {
    meta:
-      description = "PYAS_Rules_A_2"
+      description = "2"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -82,9 +82,9 @@ rule PYAS_Rules_A_2 {
       8 of them
 }
 
-rule PYAS_Rules_A_3 {
+rule General_3 {
    meta:
-      description = "PYAS_Rules_A_3"
+      description = "3"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -106,7 +106,7 @@ rule PYAS_Rules_A_3 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_4 {
+rule General_4 {
    meta:
       description = "PYAS_Rules_A4"
       author = "PYAS Security"
@@ -124,9 +124,9 @@ rule PYAS_Rules_A_4 {
       ($x1 and $x2) and 5 of them
 }
 
-rule PYAS_Rules_A_5 {
+rule General_5 {
    meta:
-      description = "PYAS_Rules_A_5"
+      description = "5"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -147,9 +147,9 @@ rule PYAS_Rules_A_5 {
       $x1 and 3 of them
 }
 
-rule PYAS_Rules_A_6 {
+rule General_6 {
    meta:
-      description = "PYAS_Rules_A_6"
+      description = "6"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -214,9 +214,9 @@ rule PYAS_Rules_A_6 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_7 {
+rule General_7 {
    meta:
-      description = "PYAS_Rules_A_462"
+      description = "7"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -247,9 +247,9 @@ rule PYAS_Rules_A_7 {
       10 of them
 }
 
-rule PYAS_Rules_A_8 {
+rule General_8 {
    meta:
-      description = "PYAS_Rules_A_8"
+      description = "8"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -278,9 +278,9 @@ rule PYAS_Rules_A_8 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_9 {
+rule General_9 {
    meta:
-      description = "PYAS_Rules_A_9"
+      description = "9"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -303,9 +303,9 @@ rule PYAS_Rules_A_9 {
       6 of them
 }
 
-rule PYAS_Rules_A_10 {
+rule General_10 {
    meta:
-      description = "PYAS_Rules_A_10"
+      description = "10"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -329,9 +329,9 @@ rule PYAS_Rules_A_10 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_11 {
+rule General_11 {
    meta:
-      description = "PYAS_Rules_A_11"
+      description = "11"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -349,9 +349,9 @@ rule PYAS_Rules_A_11 {
       6 of them
 }
 
-rule PYAS_Rules_A_12 {
+rule General_12 {
    meta:
-      description = "PYAS_Rules_A_12"
+      description = "12"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -376,9 +376,9 @@ rule PYAS_Rules_A_12 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_13 {
+rule General_13 {
    meta:
-      description = "PYAS_Rules_A_13"
+      description = "13"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -404,9 +404,9 @@ rule PYAS_Rules_A_13 {
       6 of them
 }
 
-rule PYAS_Rules_A_14 {
+rule General_14 {
    meta:
-      description = "PYAS_Rules_A_14"
+      description = "14"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -430,9 +430,9 @@ rule PYAS_Rules_A_14 {
       8 of them
 }
 
-rule PYAS_Rules_A_15 {
+rule General_15 {
    meta:
-      description = "PYAS_Rules_A_15"
+      description = "15"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -459,9 +459,9 @@ rule PYAS_Rules_A_15 {
       8 of them
 }
 
-rule PYAS_Rules_A_16 {
+rule General_16 {
    meta:
-      description = "PYAS_Rules_A_16"
+      description = "16"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -485,9 +485,9 @@ rule PYAS_Rules_A_16 {
       ($x1 and $x2) and 6 of them
 }
 
-rule PYAS_Rules_A_17 {
+rule General_17 {
    meta:
-      description = "PYAS_Rules_A_17"
+      description = "17"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -508,9 +508,9 @@ rule PYAS_Rules_A_17 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_18 {
+rule General_18 {
    meta:
-      description = "PYAS_Rules_A_18"
+      description = "18"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -531,9 +531,9 @@ rule PYAS_Rules_A_18 {
       6 of them
 }
 
-rule PYAS_Rules_A_19 {
+rule General_19 {
    meta:
-      description = "PYAS_Rules_A_19"
+      description = "19"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -560,9 +560,9 @@ rule PYAS_Rules_A_19 {
       ($x1 and $x2) and 8 of them
 }
 
-rule PYAS_Rules_A_20 {
+rule General_20 {
    meta:
-      description = "PYAS_Rules_A_20"
+      description = "20"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -589,9 +589,9 @@ rule PYAS_Rules_A_20 {
       8 of them
 }
 
-rule PYAS_Rules_A_21 {
+rule General_21 {
    meta:
-      description = "PYAS_Rules_A_21"
+      description = "21"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -616,9 +616,9 @@ rule PYAS_Rules_A_21 {
       8 of them
 }
 
-rule PYAS_Rules_A_22 {
+rule General_22 {
    meta:
-      description = "PYAS_Rules_A_22"
+      description = "22"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -635,10 +635,9 @@ rule PYAS_Rules_A_22 {
       6 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_23 {
+rule General_23 {
    meta:
-      description = "PYAS_Rules_A_23"
+      description = "23"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -658,10 +657,9 @@ rule PYAS_Rules_A_23 {
       7 of them
 }
 
-import "pe"
-rule PYAS_Rules_A_24 {
+rule General_24 {
    meta:
-      description = "PYAS_Rules_A_24"
+      description = "24"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -688,9 +686,9 @@ rule PYAS_Rules_A_24 {
       6 of them
 }
 
-rule PYAS_Rules_A_25 {
+rule General_25 {
    meta:
-      description = "PYAS_Rules_A_25"
+      description = "25"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -716,9 +714,9 @@ rule PYAS_Rules_A_25 {
       $x1 and 5 of them
 }
 
-rule PYAS_Rules_A_26 {
+rule General_26 {
    meta:
-      description = "PYAS_Rules_A_26"
+      description = "26"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -742,9 +740,9 @@ rule PYAS_Rules_A_26 {
       8 of them
 }
 
-rule PYAS_Rules_A_27 {
+rule General_27 {
    meta:
-      description = "PYAS_Rules_A_27"
+      description = "27"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -768,9 +766,9 @@ rule PYAS_Rules_A_27 {
       6 of them
 }
 
-rule PYAS_Rules_A_28 {
+rule General_28 {
    meta:
-      description = "PYAS_Rules_A_28"
+      description = "28"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -801,9 +799,9 @@ rule PYAS_Rules_A_28 {
       8 of them
 }
 
-rule PYAS_Rules_A_29 {
+rule General_29 {
    meta:
-      description = "PYAS_Rules_A_29"
+      description = "29"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -837,9 +835,9 @@ rule PYAS_Rules_A_29 {
       6 of them
 }
 
-rule PYAS_Rules_A_30 {
+rule General_30 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "30"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -858,9 +856,9 @@ rule PYAS_Rules_A_30 {
       6 of them
 }
 
-rule PYAS_Rules_A_31 {
+rule General_31 {
    meta:
-      description = "PYAS_Rules_A_31"
+      description = "31"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -878,9 +876,9 @@ rule PYAS_Rules_A_31 {
       6 of them
 }
 
-rule PYAS_Rules_A_32 {
+rule General_32 {
    meta:
-      description = "PYAS_Rules_A_32"
+      description = "32"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -909,9 +907,9 @@ rule PYAS_Rules_A_32 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_33 {
+rule General_33 {
    meta:
-      description = "PYAS_Rules_A_33"
+      description = "33"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -937,9 +935,9 @@ rule PYAS_Rules_A_33 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_34 {
+rule General_34 {
    meta:
-      description = "PYAS_Rules_A_30"
+      description = "34"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -965,9 +963,9 @@ rule PYAS_Rules_A_34 {
       8 of them
 }
 
-rule PYAS_Rules_A_35 {
+rule General_35 {
    meta:
-      description = "PYAS_Rules_A_35"
+      description = "35"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -996,9 +994,9 @@ rule PYAS_Rules_A_35 {
       6 of them
 }
 
-rule PYAS_Rules_A_36 {
+rule General_36 {
    meta:
-      description = "PYAS_Rules_A_36"
+      description = "36"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1023,9 +1021,9 @@ rule PYAS_Rules_A_36 {
       6 of them
 }
 
-rule PYAS_Rules_A_37 {
+rule General_37 {
    meta:
-      description = "PYAS_Rules_A_37"
+      description = "37"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1053,9 +1051,9 @@ rule PYAS_Rules_A_37 {
       6 of them
 }
 
-rule PYAS_Rules_A_38 {
+rule General_38 {
    meta:
-      description = "PYAS_Rules_A_38"
+      description = "38"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1083,9 +1081,9 @@ rule PYAS_Rules_A_38 {
       6 of them
 }
 
-rule PYAS_Rules_A_39 {
+rule General_39 {
    meta:
-      description = "PYAS_Rules_A_39"
+      description = "39"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1104,9 +1102,9 @@ rule PYAS_Rules_A_39 {
       6 of them
 }
 
-rule PYAS_Rules_A_40 {
+rule General_40 {
    meta:
-      description = "PYAS_Rules_A_40"
+      description = "40"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1136,9 +1134,9 @@ rule PYAS_Rules_A_40 {
       8 of them
 }
 
-rule PYAS_Rules_A_41 {
+rule General_41 {
    meta:
-      description = "PYAS_Rules_A_41"
+      description = "41"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1160,9 +1158,9 @@ rule PYAS_Rules_A_41 {
       6 of them
 }
 
-rule PYAS_Rules_A_42 {
+rule General_42 {
    meta:
-      description = "PYAS_Rules_A_42"
+      description = "42"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1182,9 +1180,9 @@ rule PYAS_Rules_A_42 {
       6 of them
 }
 
-rule PYAS_Rules_A_43 {
+rule General_43 {
    meta:
-      description = "PYAS_Rules_A_43"
+      description = "43"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1209,9 +1207,9 @@ rule PYAS_Rules_A_43 {
       8 of them
 }
 
-rule PYAS_Rules_A_44 {
+rule General_44 {
    meta:
-      description = "PYAS_Rules_A_44"
+      description = "44"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1239,9 +1237,9 @@ rule PYAS_Rules_A_44 {
       8 of them
 }
 
-rule PYAS_Rules_A_45 {
+rule General_45 {
    meta:
-      description = "PYAS_Rules_A_45"
+      description = "45"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1268,9 +1266,9 @@ rule PYAS_Rules_A_45 {
       8 of them
 }
 
-rule PYAS_Rules_A_46 {
+rule General_46 {
    meta:
-      description = "PYAS_Rules_A_46"
+      description = "46"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1298,9 +1296,9 @@ rule PYAS_Rules_A_46 {
       $x1 and 8 of them
 }
 
-rule PYAS_Rules_A_47 {
+rule General_47 {
    meta:
-      description = "PYAS_Rules_A_47"
+      description = "47"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1329,9 +1327,9 @@ rule PYAS_Rules_A_47 {
       1 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_48 {
+rule General_48 {
    meta:
-      description = "PYAS_Rules_A_48"
+      description = "48"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1350,9 +1348,9 @@ rule PYAS_Rules_A_48 {
       2 of ($x*) and 6 of them
 }
 
-rule PYAS_Rules_A_49 {
+rule General_49 {
    meta:
-      description = "PYAS_Rules_A_49"
+      description = "49"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1378,9 +1376,9 @@ rule PYAS_Rules_A_49 {
       3 of ($x*) and 5 of them
 }
 
-rule PYAS_Rules_A_50 {
+rule General_50 {
    meta:
-      description = "PYAS_Rules_A_50"
+      description = "50"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1400,9 +1398,9 @@ rule PYAS_Rules_A_50 {
       $x1 and 6 of them
 }
 
-rule PYAS_Rules_A_51 {
+rule General_51 {
    meta:
-      description = "PYAS_Rules_A_51"
+      description = "51"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:
@@ -1420,9 +1418,9 @@ rule PYAS_Rules_A_51 {
       1 of ($x*) and 4 of them
 }
 
-rule PYAS_Rules_A_52 {
+rule General_52 {
    meta:
-      description = "PYAS_Rules_A_52"
+      description = "52"
       author = "PYAS Security"
       date = "2024-06-13"
    strings:
@@ -1445,9 +1443,9 @@ rule PYAS_Rules_A_52 {
       8 of them
 }
 
-rule PYAS_Rules_A_53 {
+rule General_53 {
    meta:
-      description = "PYAS_Rules_A_53"
+      description = "53"
       author = "PYAS Security"
       date = "2024-06-12"
    strings:

Extens/Repair/Repair_Regedit.reg

@@ -0,0 +1,117 @@
+Windows Registry Editor Version 5.00
+
+; Repair system restrictions
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MMC]
+; NoControlPanel
+"NoControlPanel"=dword:00000000
+; NoDrives
+"NoDrives"=dword:00000000
+; NoFileMenu
+"NoFileMenu"=dword:00000000
+; NoFind
+"NoFind"=dword:00000000
+; NoRealMode
+"NoRealMode"=dword:00000000
+; NoRecentDocsMenu
+"NoRecentDocsMenu"=dword:00000000
+; NoSetFolders
+"NoSetFolders"=dword:00000000
+; NoSetFolderOptions
+"NoSetFolderOptions"=dword:00000000
+; NoViewOnDrive
+"NoViewOnDrive"=dword:00000000
+; NoClose
+"NoClose"=dword:00000000
+; NoRun
+"NoRun"=dword:00000000
+; NoDesktop
+"NoDesktop"=dword:00000000
+; NoLogOff
+"NoLogOff"=dword:00000000
+; NoFolderOptions
+"NoFolderOptions"=dword:00000000
+; RestrictRun
+"RestrictRun"=dword:00000000
+; NoViewContextMenu
+"NoViewContexMenu"=dword:00000000
+; HideClock
+"HideClock"=dword:00000000
+; NoStartMenuMorePrograms
+"NoStartMenuMorePrograms"=dword:00000000
+; NoStartMenuMyGames
+"NoStartMenuMyGames"=dword:00000000
+; NoStartMenuMyMusic
+"NoStartMenuMyMusic"=dword:00000000
+; DisableCMD
+"DisableCMD"=dword:00000000
+; NoWinKeys
+"NoWinKeys"=dword:00000000
+; StartMenuLogOff
+"StartMenuLogOff"=dword:00000000
+; NoSimpleNetlDList
+"NoSimpleNetlDList"=dword:00000000
+; NoLowDiskSpaceChecks
+"NoLowDiskSpaceChecks"=dword:00000000
+; DisableLockWorkstation
+"DisableLockWorkstation"=dword:00000000
+; Restrict_Run
+"Restrict_Run"=dword:00000000
+; DisableTaskMgr
+"DisableTaskMgr"=dword:00000000
+; DisableRegistryTools
+"DisableRegistryTools"=dword:00000000
+; DisableChangePassword
+"DisableChangePassword"=dword:00000000
+; Wallpaper
+"Wallpaper"=dword:00000000
+; NoComponents
+"NoComponents"=dword:00000000
+; NoAddingComponents
+"NoAddingComponents"=dword:00000000
+; NoStartMenuPinnedList
+"NoStartMenuPinnedList"=dword:00000000
+; NoActiveDesktop
+"NoActiveDesktop"=dword:00000000
+; NoSetActiveDesktop
+"NoSetActiveDesktop"=dword:00000000
+; NoActiveDesktopChanges
+"NoActiveDesktopChanges"=dword:00000000
+; NoChangeStartMenu
+"NoChangeStartMenu"=dword:00000000
+; NoFavoritesMenu
+"NoFavoritesMenu"=dword:00000000
+; NoRecentDocsHistory
+"NoRecentDocsHistory"=dword:00000000
+; NoSetTaskbar
+"NoSetTaskbar"=dword:00000000
+; NoSMHelp
+"NoSMHelp"=dword:00000000
+; NoTrayContextMenu
+"NoTrayContextMenu"=dword:00000000
+; NoViewContextMenu
+"NoViewContextMenu"=dword:00000000
+; NoManageMyComputerVerb
+"NoManageMyComputerVerb"=dword:00000000
+; NoWindowsUpdate
+"NoWindowsUpdate"=dword:00000000
+; ClearRecentDocsOnExit
+"ClearRecentDocsOnExit"=dword:00000000
+; NoStartMenuNetworkPlaces
+"NoStartMenuNetworkPlaces"=dword:00000000
+
+; Repair Image File Execution Options
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
+; (Delete all subkeys here if necessary)
+
+; Repair executable file icon
+[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
+@="%1"
+[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon]
+@="%1"
+
+; Repair executable file type
+[HKEY_CLASSES_ROOT\.exe]
+@="exefile"
+[HKEY_CLASSES_ROOT\exefile\shell\open\command]
+@="\"%1\" %*"
+

Extens/Repair/Repair_System.bat

@@ -0,0 +1 @@
+sfc /scannow

Extens/Tools/Tools.txt

@@ -0,0 +1 @@
+None

Model/PYAS_Model.json

@@ -1,9 +0,0 @@
-{
-    "Labels": ["White/Pefile", "White/Script", "Virus/Pefile", "Virus/Script"], 
-
-    "Detect": ["Virus/Pefile", "Virus/Script"],  
-
-    "Pixels": [224, 224], 
-
-    "Values": 95
-}

PYAS.py

@@ -1,15 +1,48 @@
-import os, gc, sys, time, json, psutil
-import ctypes, struct, msvcrt, pyperclip
-import win32gui, win32api, win32con, win32file
+import os, gc, sys, time, json
+import ctypes, ctypes.wintypes
+import struct, msvcrt, pyperclip
 from PYAS_Engine import YRScan, DLScan
 from PYAS_Suffixes import slist, alist
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
-from threading import Thread
 from PyQt5.QtWidgets import *
 from PyQt5.QtCore import *
 from PyQt5.QtGui import *
 from subprocess import *
+from threading import *
+
+class PROCESSENTRY32(ctypes.Structure):
+    _fields_ = [
+        ("dwSize", ctypes.wintypes.DWORD),
+        ("cntUsage", ctypes.wintypes.DWORD),
+        ("th32ProcessID", ctypes.wintypes.DWORD),
+        ("th32DefaultHeapID", ctypes.wintypes.LPVOID),
+        ("th32ModuleID", ctypes.wintypes.DWORD),
+        ("cntThreads", ctypes.wintypes.DWORD),
+        ("th32ParentProcessID", ctypes.wintypes.DWORD),
+        ("dwFlags", ctypes.wintypes.DWORD),
+        ("szExeFile", ctypes.wintypes.CHAR * 260)]
+
+class MIB_TCPROW_OWNER_PID(ctypes.Structure):
+    _fields_ = [
+        ("dwState", ctypes.wintypes.DWORD),
+        ("dwLocalAddr", ctypes.wintypes.DWORD),
+        ("dwLocalPort", ctypes.wintypes.DWORD),
+        ("dwRemoteAddr", ctypes.wintypes.DWORD),
+        ("dwRemotePort", ctypes.wintypes.DWORD),
+        ("dwOwningPid", ctypes.wintypes.DWORD)]
+
+class MIB_TCPTABLE_OWNER_PID(ctypes.Structure):
+    _fields_ = [
+        ("dwNumEntries", ctypes.wintypes.DWORD),
+        ("table", MIB_TCPROW_OWNER_PID * 1)]
+
+class FILE_NOTIFY_INFORMATION(ctypes.Structure):
+    _fields_ = [
+        ("NextEntryOffset", ctypes.wintypes.DWORD),
+        ("Action", ctypes.wintypes.DWORD),
+        ("FileNameLength", ctypes.wintypes.DWORD),
+        ("FileName", ctypes.wintypes.WCHAR * 1024)]
 
 class MainWindow_Controller(QMainWindow):
     def __init__(self):
@@ -19,10 +52,12 @@ class MainWindow_Controller(QMainWindow):
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.pyae_version = "AI Engine"
-        self.pyas_version = "3.2.1"
+        self.pyas_version = "3.2.5"
         self.first_startup = True
-        self.init_data_base()
         self.init_tray_icon()
+        self.init_data_base()
+        self.init_system_code()
+        self.init_define_func()
         self.init_config_qtui()
         self.init_config_read()
         self.init_config_boot()
@@ -30,6 +65,13 @@ class MainWindow_Controller(QMainWindow):
         self.init_threads()
         self.init_startup()
 
+    def init_system_code(self):
+        try:
+            self.enc = sys.getfilesystemencoding()
+            self.ene = sys.getfilesystemencodeerrors()
+        except Exception as e:
+            self.ene = "replace"
+
     def init_threads(self):
         self.protect_proc_init()
         self.protect_file_init()
@@ -37,6 +79,7 @@ class MainWindow_Controller(QMainWindow):
         self.protect_drv_init()
         self.protect_net_init()
         self.block_window_init()
+        self.gc_collect_init()
 
     def init_tray_icon(self):
         self.tray_icon = QSystemTrayIcon(self)
@@ -44,6 +87,17 @@ class MainWindow_Controller(QMainWindow):
         self.tray_icon.setIcon(QFileIconProvider().icon(QFileInfo(self.pyas)))
         self.tray_icon.show()
 
+    def init_define_func(self):
+        try:
+            self.ntdll = ctypes.WinDLL('ntdll', use_last_error=True)
+            self.psapi = ctypes.WinDLL('Psapi', use_last_error=True)
+            self.user32 = ctypes.WinDLL('user32', use_last_error=True)
+            self.kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
+            self.advapi32 = ctypes.WinDLL('advapi32', use_last_error=True)
+            self.iphlpapi = ctypes.WinDLL('iphlpapi', use_last_error=True)
+        except Exception as e:
+            pass
+
     def init_startup(self):
         try:
             if len(sys.argv) > 1: 
@@ -59,13 +113,13 @@ class MainWindow_Controller(QMainWindow):
     def init_data_base(self):
         try:
             self.model = DLScan()
-            data_path = os.path.join(self.dir, "Model")
+            data_path = os.path.join(self.dir, "Engine/Model")
             for root, dirs, files in os.walk(data_path):
                 for file in files:
                     file_path = os.path.join(root, file)
                     self.model.load_model(file_path)
             self.rules = YRScan()
-            data_path = os.path.join(self.dir, "Rules") 
+            data_path = os.path.join(self.dir, "Engine/Rules") 
             for root, dirs, files in os.walk(data_path):
                 for file in files:
                     file_path = os.path.join(root, file)
@@ -93,9 +147,7 @@ class MainWindow_Controller(QMainWindow):
     def init_config_read(self):
         try:
             self.track_proc = None
-            self.exist_process = set()
-            for p in psutil.process_iter():
-                self.exist_process.add(p.pid)
+            self.exist_process = self.get_process_list()
             if not os.path.exists("C:/ProgramData/PYAS"): 
                 os.makedirs("C:/ProgramData/PYAS")
             if not os.path.exists("C:/ProgramData/PYAS/PYAS.json"): 
@@ -201,7 +253,7 @@ class MainWindow_Controller(QMainWindow):
         self.virus_lock = {}
         self.virus_list = []
         self.virus_list_ui = []
-        self.Process_quantity = []
+        self.Process_quantity = 0
         self.Process_list_all_pid = []
         self.Process_sim = QStringListModel()
         self.Process_Timer = QTimer()
@@ -358,7 +410,7 @@ class MainWindow_Controller(QMainWindow):
                 self.ui.Navigation_Bar.setStyleSheet("QWidget#Navigation_Bar {background-color:rgb(250,250,220);}")
             elif self.ui.Theme_Customize.isChecked():
                 if not os.path.exists(os.path.join(self.json["theme_color"],"Color.ini")):
-                    path = str(QFileDialog.getExistingDirectory(self,self.trans("自定主題"),"C:/"))
+                    path = str(QFileDialog.getExistingDirectory(self,self.trans("自定主題"),""))
                     if path and os.path.exists(os.path.join(path,"Color.ini")):
                         self.json["theme_color"] = path
                 with open(os.path.join(self.json["theme_color"],"Color.ini"), "r") as f:
@@ -613,6 +665,7 @@ class MainWindow_Controller(QMainWindow):
         if self.question_event("您確定要退出 PYAS 和所有防護嗎?"):
             Popen("sc stop PYAS_Driver", shell=True, stdout=PIPE, stderr=PIPE).wait()
             self.first_startup = True
+            self.gc_collect = False
             self.protect_proc_init()
             self.protect_file_init()
             self.protect_sys_init()
@@ -840,7 +893,6 @@ class MainWindow_Controller(QMainWindow):
             QMetaObject.invokeMethod(self.ui.Virus_Scan_text, "setText",
             Qt.QueuedConnection, Q_ARG(str, text))
             self.send_notify(text)
-            gc.collect()
         except Exception as e:
             self.bug_event(e)
 
@@ -862,8 +914,8 @@ class MainWindow_Controller(QMainWindow):
 
     def file_scan(self):
         try:
-            file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
-            if file and file not in self.whitelist and file != self.pyas:
+            file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"")[0])
+            if file and not self.check_whitelist(file):
                 self.init_scan()
                 self.scan_thread = Thread(target=self.write_scan,
                 args=(self.start_scan(file),file,), daemon=True)
@@ -877,8 +929,8 @@ class MainWindow_Controller(QMainWindow):
 
     def path_scan(self):
         try:
-            path = str(QFileDialog.getExistingDirectory(self,self.trans("病毒掃描"),"C:/"))
-            if path:
+            path = str(QFileDialog.getExistingDirectory(self,self.trans("病毒掃描"),""))
+            if path and not self.check_whitelist(path):
                 self.init_scan()
                 self.scan_thread = Thread(target=self.traverse_path, args=(path,), daemon=True)
                 self.scan_thread.start()
@@ -892,9 +944,9 @@ class MainWindow_Controller(QMainWindow):
     def disk_scan(self):
         try:
             self.init_scan()
-            for d in range(26):
-                if os.path.exists(f"{chr(65+d)}:/"):
-                    self.scan_thread = Thread(target=self.traverse_path, args=(f"{chr(65+d)}:/",), daemon=True)
+            for l in range(65, 91):
+                if os.path.exists(f"{chr(l)}:/"):
+                    self.scan_thread = Thread(target=self.traverse_path, args=(f"{chr(l)}:/",), daemon=True)
                     self.scan_thread.start()
                     while self.scan_thread.is_alive():
                         QApplication.processEvents()
@@ -911,13 +963,12 @@ class MainWindow_Controller(QMainWindow):
                     break
                 elif os.path.isdir(file):
                     self.traverse_path(file)
-                elif file != self.pyas and file not in self.whitelist:
+                elif not self.check_whitelist(file):
                     QMetaObject.invokeMethod(self.ui.Virus_Scan_title, "setText",
                     Qt.QueuedConnection, Q_ARG(str, self.trans("正在掃描")))
                     QMetaObject.invokeMethod(self.ui.Virus_Scan_text, "setText",
                     Qt.QueuedConnection, Q_ARG(str, file))
                     self.write_scan(self.start_scan(file),file)
-                gc.collect()
             except:
                 pass
 
@@ -927,15 +978,17 @@ class MainWindow_Controller(QMainWindow):
                 match_data = file
             elif os.path.exists(file):
                 match_data = self.model.get_type(file)
-            for ftype, data in match_data.items():
+            for section, data in match_data.items():
                 label, level = self.model.dl_scan(data)
                 if label and label in self.model.detect:
                     if self.json["high_sensitive"]:
-                        return label
+                        return f"{label}.{level}"
                     elif level >= self.model.values:
-                        return label
+                        return f"{label}.{level}"
             if self.json["extension_kits"]:
-                return self.rules.yr_scan(file)[0]
+                label, level = self.rules.yr_scan(file)
+                if label and isinstance(level, str):
+                    return f"{label}.{level}"
             return False
         except:
             return False
@@ -952,112 +1005,100 @@ class MainWindow_Controller(QMainWindow):
         except Exception as e:
             self.bug_event(e)
 
-    def repair_system_file_icon(self):
-        try:
-            key = win32api.RegOpenKey(win32con.HKEY_CLASSES_ROOT, 'exefile', 0, win32con.KEY_ALL_ACCESS)
-            win32api.RegSetValue(key, 'DefaultIcon', win32con.REG_SZ, '%1')
-        except:
-            pass
-        try:
-            key = win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE, r'SOFTWARE\Classes\exefile', 0, win32con.KEY_ALL_ACCESS)
-            win32api.RegSetValue(key, 'DefaultIcon', win32con.REG_SZ, '%1')
-        except:
-            pass
+    def open_registry_key(self, hkey, subkey, access=0xF003F):
+        key_handle = ctypes.wintypes.HANDLE()
+        if self.advapi32.RegOpenKeyExW(hkey, subkey, 0, access, ctypes.byref(key_handle)) == 0:
+            return key_handle
+        return None
+
+    def delete_registry_key(self, hkey, subkey):
+        if self.advapi32.RegDeleteKeyW(hkey, subkey) == 0 and self.track_proc:
+            self.kill_process("註冊表攔截", *self.track_proc)
+
+    def create_registry_keys(self, hkey, subkey):
+        key_handle = self.open_registry_key(hkey, subkey)
+        if key_handle:
+            self.advapi32.RegCreateKeyExW(hkey, subkey, 0, None, 0, 0xF003F, None, ctypes.byref(key_handle), None)
+        self.advapi32.RegCloseKey(key_handle)
+
+    def set_registry_value(self, hkey, subkey, value_name, value_data):
+        key_handle = self.open_registry_key(hkey, subkey)
+        if key_handle:
+            self.advapi32.RegSetValueExW(key_handle, value_name, 0, 1, value_data, (len(value_data) + 1) * 2)
+        self.advapi32.RegCloseKey(key_handle)
+
+    def delete_registry_value(self, hkey, subkey, value_name):
+        key_handle = self.open_registry_key(hkey, subkey)
+        if key_handle and self.advapi32.RegDeleteValueW(key_handle, value_name) == 0 and self.track_proc:
+            self.kill_process("註冊表攔截", *self.track_proc)
+        self.advapi32.RegCloseKey(key_handle)
+
+    def repair_system_restrict(self):
+        permissions = ["NoControlPanel", "NoDrives", "NoFileMenu", "NoFind", "NoRealMode", "NoRecentDocsMenu","NoSetFolders",
+        "NoSetFolderOptions", "NoViewOnDrive", "NoClose", "NoRun", "NoDesktop", "NoLogOff", "NoFolderOptions", "RestrictRun",
+        "NoViewContexMenu", "HideClock", "NoStartMenuMorePrograms", "NoStartMenuMyGames", "NoStartMenuMyMusic", "DisableCMD",
+        "NoWinKeys", "StartMenuLogOff", "NoSimpleNetlDList", "NoLowDiskSpaceChecks", "DisableLockWorkstation", "Restrict_Run", 
+        "DisableTaskMgr", "DisableRegistryTools", "DisableChangePassword", "Wallpaper", "NoComponents", "NoAddingComponents",
+        "NoStartMenuPinnedList", "NoActiveDesktop", "NoSetActiveDesktop", "NoActiveDesktopChanges", "NoChangeStartMenu",
+        "NoFavoritesMenu", "NoRecentDocsHistory", "NoSetTaskbar", "NoSMHelp", "NoTrayContextMenu", "NoViewContextMenu", 
+        "NoManageMyComputerVerb", "NoWindowsUpdate", "ClearRecentDocsOnExit", "NoStartMenuNetworkPlaces"]
+        keys_to_create = [(0x80000001, r"Software\Policies\Microsoft\MMC"),
+        (0x80000001, r"Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}"),
+        (0x80000001, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"),
+        (0x80000001, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"),
+        (0x80000001, r"SOFTWARE\Policies\Microsoft\Windows\System"),
+        (0x80000002, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"),
+        (0x80000002, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"),
+        (0x80000002, r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop"),
+        (0x80000002, r"SOFTWARE\Policies\Microsoft\Windows\System")]
+        for hkey, subkey in keys_to_create:
+            try:
+                self.create_registry_keys(hkey, subkey)
+                for value_name in permissions:
+                    self.delete_registry_value(hkey, subkey, value_name)
+            except:
+                print(e)
 
     def repair_system_image(self):
         try:
-            key = win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options',0,win32con.KEY_ALL_ACCESS | win32con.WRITE_OWNER)
-            count = win32api.RegQueryInfoKey(key)[0]
-            while count >= 0:
+            image_file = r'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'
+            key_handle = self.open_registry_key(0x80000002, image_file, 0xF003F)
+            count = ctypes.wintypes.DWORD()
+            self.advapi32.RegQueryInfoKeyW(key_handle, None, None, None,
+            ctypes.byref(count), None, None, None, None, None, None, None)
+            for i in range(count.value, -1, -1):
                 try:
-                    subKeyName = win32api.RegEnumKey(key, count)
-                    win32api.RegDeleteKey(key, subKeyName)
-                except:
-                    pass
-                count = count - 1
+                    subkey_name = ctypes.create_unicode_buffer(256)
+                    self.advapi32.RegEnumKeyW(key_handle, i, subkey_name, 256)
+                    self.delete_registry_key(key_handle, subkey_name.value)
+                except Exception as e:
+                    print(e)
+        except Exception as e:
+            pass
+
+    def repair_system_file_icon(self):
+        try:
+            self.set_registry_value(0x80000000, 'exefile', 'DefaultIcon', '%1')
+            self.set_registry_value(0x80000002, r'SOFTWARE\Classes\exefile', 'DefaultIcon', '%1')
         except:
             pass
 
     def repair_system_file_type(self):
-        try:
-            data = [('.exe', 'exefile'),('exefile', 'Application')]
-            key = win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE, r'SOFTWARE\Classes', 0, win32con.KEY_ALL_ACCESS)
-            for ext, value in data:
-                win32api.RegSetValue(key, ext, win32con.REG_SZ, value)
-            win32api.RegCloseKey(key)
-            key = win32api.RegOpenKey(win32con.HKEY_CURRENT_USER, r'SOFTWARE\Classes', 0, win32con.KEY_ALL_ACCESS)
-            for ext, value in data:
+        for hkey in [0x80000002, 0x80000001, 0x80000000]:
+            for ext, value in [('.exe', 'exefile'), ('exefile', 'Application')]:
                 try:
-                    win32api.RegSetValue(key, ext, win32con.REG_SZ, value)
-                    keyopen = win32api.RegOpenKey(key, ext + r'\shell\open', 0, win32con.KEY_ALL_ACCESS)
-                    win32api.RegSetValue(keyopen, 'command', win32con.REG_SZ, '"%1" %*')
-                    win32api.RegCloseKey(keyopen)
+                    self.set_registry_value(hkey, r'SOFTWARE\Classes', ext, value)
+                    self.set_registry_value(hkey, f'{ext}\\shell\\open\\command', '', '"%1" %*')
                 except:
                     pass
-            win32api.RegCloseKey(key)
-            key = win32api.RegOpenKey(win32con.HKEY_CURRENT_USER, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts', 0, win32con.KEY_ALL_ACCESS)
-            win32api.RegSetValue(key, '.exe', win32con.REG_SZ, '')
-            win32api.RegCloseKey(key)
-            key = win32api.RegOpenKey(win32con.HKEY_CLASSES_ROOT, None, 0, win32con.KEY_ALL_ACCESS)
-            for ext, value in data:
-                try:
-                    win32api.RegSetValue(key, ext, win32con.REG_SZ, value)
-                    keyopen = win32api.RegOpenKey(key, ext + r'\shell\open', 0, win32con.KEY_ALL_ACCESS)
-                    win32api.RegSetValue(keyopen, 'command', win32con.REG_SZ, '"%1" %*')
-                    win32api.RegCloseKey(keyopen)
-                except:
-                    pass
-            win32api.RegCloseKey(key)
-        except:
-            pass
-
-    def repair_system_restrict(self):
-        try:
-            Permission = ["NoControlPanel", "NoDrives", "NoFileMenu", "NoFind", "NoRealMode", "NoRecentDocsMenu","NoSetFolders",
-            "NoSetFolderOptions", "NoViewOnDrive", "NoClose", "NoRun", "NoDesktop", "NoLogOff", "NoFolderOptions", "RestrictRun","DisableCMD",
-            "NoViewContexMenu", "HideClock", "NoStartMenuMorePrograms", "NoStartMenuMyGames", "NoStartMenuMyMusic" "NoStartMenuNetworkPlaces",
-            "NoStartMenuPinnedList", "NoActiveDesktop", "NoSetActiveDesktop", "NoActiveDesktopChanges", "NoChangeStartMenu", "ClearRecentDocsOnExit",
-            "NoFavoritesMenu", "NoRecentDocsHistory", "NoSetTaskbar", "NoSMHelp", "NoTrayContextMenu", "NoViewContextMenu", "NoWindowsUpdate",
-            "NoWinKeys", "StartMenuLogOff", "NoSimpleNetlDList", "NoLowDiskSpaceChecks", "DisableLockWorkstation", "NoManageMyComputerVerb",
-            "DisableTaskMgr", "DisableRegistryTools", "DisableChangePassword", "Wallpaper", "NoComponents", "NoAddingComponents", "Restrict_Run"]
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"Explorer")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"Explorer")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",0,win32con.KEY_ALL_ACCESS),"ActiveDesktop")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Policies\Microsoft\Windows",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Policies\Microsoft\Windows",0,win32con.KEY_ALL_ACCESS),"System")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"Software\Policies\Microsoft",0,win32con.KEY_ALL_ACCESS),"MMC")
-            win32api.RegCreateKey(win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"Software\Policies\Microsoft\MMC",0,win32con.KEY_ALL_ACCESS),"{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}")
-            keys = [win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"SOFTWARE\Policies\Microsoft\Windows\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_LOCAL_MACHINE,r"SOFTWARE\Policies\Microsoft\Windows\System",0,win32con.KEY_ALL_ACCESS),
-            win32api.RegOpenKey(win32con.HKEY_CURRENT_USER,r"Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}",0,win32con.KEY_ALL_ACCESS)]
-            for key in keys:
-                for i in Permission:
-                    try:
-                        win32api.RegDeleteValue(key,i)
-                        name = self.track_proc.name()
-                        if "cmd.exe" not in name and "powershell" not in name:
-                            self.kill_process("註冊表攔截", *self.track_proc)
-                    except:
-                        pass
-                win32api.RegCloseKey(key)
-        except:
-            pass
 
     def repair_system_wallpaper(self):
         try:
-            key = win32api.RegOpenKeyEx(win32con.HKEY_CURRENT_USER, r"Control Panel\Desktop", 0, win32con.KEY_SET_VALUE)
-            win32api.RegSetValueEx(key, "Wallpaper", 0, win32con.REG_SZ, 'C:/Windows/web/wallpaper/windows/img0.jpg')
-            win32api.RegCloseKey(key)
-            win32gui.SystemParametersInfo(win32con.SPI_SETDESKWALLPAPER, 'C:/Windows/web/wallpaper/windows/img0.jpg', win32con.SPIF_SENDCHANGE)
-        except:
-            pass
+            wallpaper = "C:/Windows/web/wallpaper/windows/img0.jpg"
+            self.set_registry_value(0x80000001, "Wallpaper", ctypes.create_unicode_buffer(wallpaper), wallpaper)
+            self.user32.SystemParametersInfoW(20, 0, wallpaper, 2)
+        except Exception as e:
+            print(e)
 
     def clean_system(self):
         try:
@@ -1087,7 +1128,7 @@ class MainWindow_Controller(QMainWindow):
 
     def add_white_list(self):
         try:
-            file = str(QFileDialog.getOpenFileName(self,self.trans("增加到白名單"),"C:/")[0]).replace("\\", "/")
+            file = str(QFileDialog.getExistingDirectory(self,self.trans("增加到白名單"),"")).replace("\\", "/")
             if file and file not in self.whitelist:
                 if self.question_event("您確定要增加到白名單嗎?"):
                     self.whitelist.append(file)
@@ -1109,7 +1150,7 @@ class MainWindow_Controller(QMainWindow):
             if self.question_event("請選擇要攔截的軟體彈窗"):
                 while not self.block_window:
                     QApplication.processEvents()
-                    window_name = str(win32gui.GetWindowText(win32gui.GetForegroundWindow()))
+                    window_name = self.get_foreground_window_title()
                     if window_name not in ["","PYAS",self.trans("警告")]:
                         if window_name not in self.blocklist:
                             if self.question_event(f"您確定要攔截 {window_name} 嗎?"):
@@ -1126,19 +1167,34 @@ class MainWindow_Controller(QMainWindow):
                         self.block_window = True
             self.block_window_init()
         except Exception as e:
-            self.bug_event(e)
+            pass#self.bug_event(e)
 
     def block_window_init(self):
         self.block_window = True
         Thread(target=self.block_software_window, daemon=True).start()
 
+    def get_foreground_window_title(self):
+        hWnd = self.user32.GetForegroundWindow()
+        length = self.user32.GetWindowTextLengthW(hWnd)
+        title = ctypes.create_unicode_buffer(length + 1)
+        self.user32.GetWindowTextW(hWnd, title, length + 1)
+        return str(title.value)
+
+    def find_window_by_name(self, window_name):
+        return self.user32.FindWindowW(None, ctypes.create_unicode_buffer(window_name))
+
+    def post_close_message(self, hWnd):
+        self.user32.PostMessageW(hWnd, 274, 61536, 0)
+
     def block_software_window(self):
         while self.block_window:
             try:
                 time.sleep(0.2)
                 for window_name in self.blocklist:
-                    win32gui.PostMessage(win32gui.FindWindow(None, window_name), 274, 61536, 0)
-            except:
+                    hWnd = self.find_window_by_name(window_name)
+                    if hWnd != 0:
+                        self.post_close_message(hWnd)
+            except Exception as e:
                 pass
 
     def repair_network(self):
@@ -1157,38 +1213,41 @@ class MainWindow_Controller(QMainWindow):
     def process_list(self):
         try:
             self.Process_list_app = []
-            self.Process_list_app_pid = []
-            for p in psutil.process_iter():
-                try:
-                    self.Process_list_app.append(f"{p.name()} ({p.pid}) > {p.exe()}")
-                    self.Process_list_app_pid.append(p.pid)
-                    QApplication.processEvents()
-                except:
-                    pass
-            self.Process_list_all_pid = self.Process_list_app_pid
-            if len(self.Process_list_app_pid) != self.Process_quantity:
-                self.Process_quantity = len(self.Process_list_app_pid)
+            for pid in self.get_process_list():
+                QApplication.processEvents()
+                h_process = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+                exe_name = self.get_process_file(h_process).replace('\\', '/')
+                if exe_name:
+                    self.Process_list_app.append((pid, f"[{pid}] > {exe_name}"))
+            self.Process_list_app.sort(key=lambda x: x[0])
+            self.Process_list_all_pid = [pid for pid, _ in self.Process_list_app]
+            if len(self.Process_list_all_pid) != self.Process_quantity:
+                self.Process_quantity = len(self.Process_list_all_pid)
                 self.ui.Process_Total_View.setText(str(self.Process_quantity))
-                self.Process_sim.setStringList(self.Process_list_app)
+                process_display = [name for _, name in self.Process_list_app]
+                self.Process_sim.setStringList(process_display)
                 self.ui.Process_list.setModel(self.Process_sim)
         except Exception as e:
             self.bug_event(e)
 
-    def process_list_menu(self,pos):
+    def process_list_menu(self, pos):
         try:
             for i in self.ui.Process_list.selectedIndexes():
-                self.pid = self.Process_list_all_pid[i.row()]
+                selected_pid = self.Process_list_all_pid[i.row()]
             self.Process_popMenu = QMenu()
-            self.kill_Process = QAction(self.trans("結束進程"),self)
+            self.kill_Process = QAction(self.trans("結束進程"), self)
             self.Process_popMenu.addAction(self.kill_Process)
             if self.Process_popMenu.exec_(self.ui.Process_list.mapToGlobal(pos)) == self.kill_Process:
-                for p in psutil.process_iter():
-                    if p.pid == self.pid:
-                        file = p.exe().replace("\\", "/")
-                        if file == self.pyas:
-                            self.close()
-                        else:
-                            p.kill()
+                try:
+                    hProcess = self.kernel32.OpenProcess(0x1F0FFF, False, selected_pid)
+                    file_path = self.get_process_file(hProcess).replace('\\', '/')
+                    if file_path == self.pyas:
+                        self.close()
+                    else:
+                        self.kernel32.TerminateProcess(hProcess, 0)
+                    self.kernel32.CloseHandle(hProcess)
+                except:
+                    pass
         except:
             pass
 
@@ -1249,7 +1308,7 @@ class MainWindow_Controller(QMainWindow):
 
     def protect_drv_init(self):
         try:
-            file_path = os.path.join(self.dir, "Driver").replace("\\", "/")
+            file_path = os.path.join(self.dir, "Driver/Protect").replace("\\", "/")
             if os.path.exists(file_path):
                 if self.ui.Protection_switch_Button_4.text() == self.trans("已開啟"):
                     result = Popen("sc stop PYAS_Driver", shell=True, stdout=PIPE, stderr=PIPE).wait()
@@ -1301,166 +1360,129 @@ class MainWindow_Controller(QMainWindow):
         except Exception as e:
             self.bug_event(self.trans(f"網路防護開啟失敗: ")+str(e))
 
-    def protect_proc_thread(self):
-        while self.proc_protect:
-            time.sleep(0.01)
-            new_process = set()
-            for p in psutil.process_iter():
-                new_process.add(p.pid)
-            for pid in new_process - self.exist_process:
-                try:
-                    p = psutil.Process(pid)
-                    self.lock_process(p, True)
-                    self.handle_new_process(p)
-                    self.lock_process(p, False)
-                    gc.collect()
-                except:
-                    pass
-            self.exist_process = new_process
-        if self.ui.Protection_switch_Button.text() == self.trans("已開啟"):
-            self.send_notify(self.trans(f"竄改警告: self.proc_protect"), False)
-
-    def handle_new_process(self, p):
+    def gc_collect_init(self):
         try:
-            name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-            if file != self.pyas and file not in self.whitelist:
-                if "powershell" in name:
-                    file = str(cmd[-1].split("'")[-2]).replace("\\", "/")
-                elif "cmd.exe" in name:
-                    file = str(" ".join(cmd[2:])).replace("\\", "/")
-                elif ":/Windows" in file:
-                    file = str(cmd[-1]).replace("\\", "/")
-                if self.start_scan(file):
-                    self.kill_process("病毒攔截", p, file, False)
-                elif self.load_scan(p):
-                    self.kill_process("加載攔截", p, file, False)
-                elif self.memory_scan(p):
-                    self.kill_process("記憶體攔截", p, file, False)
-                elif ":/Windows" not in file and ":/Program" not in file:
-                    ftype = str(f".{file.split('.')[-1]}").lower()
-                    if os.path.exists(file) and ftype in slist:
-                        self.track_proc = p, file, True
+            self.gc_collect = True
+            Thread(target=self.gc_collect_thread, daemon=True).start()
         except:
             pass
 
-    def load_scan(self, p):
-        try:
-            for entry in p.memory_maps(grouped=True):
-                file = str(entry.path).replace("\\", "/")
-                if ":/Windows" not in file and file not in self.whitelist:
-                    ftype = str(f".{file.split('.')[-1]}").lower()
-                    if ftype not in [".exe"] and self.start_scan(file):
-                        return True
-            return False
-        except:
-            return False
+    def gc_collect_thread(self):
+        while self.gc_collect:
+            try:
+                time.sleep(0.2)
+                collected = gc.collect()
+            except:
+                pass
 
-    def get_module_base(self, p):
-        try:
-            for entry in p.memory_maps(grouped=False):
-                file = str(entry.path).replace("\\", "/")
-                ftype = str(f".{file.split('.')[-1]}").lower()
-                if ftype in [".exe"] and file not in self.whitelist:
-                    return int(entry.addr, 16)
-            return False
-        except:
-            return False
+    def protect_proc_thread(self):
+        while self.proc_protect:
+            try:
+                time.sleep(0.1)
+                new_process = self.get_process_list()
+                for pid in new_process - self.exist_process:
+                    self.handle_new_process(pid)
+                self.exist_process = new_process
+            except:
+                pass
 
-    def memory_scan(self, p):
+    def get_process_list(self):
         try:
-            match_data = {}
-            kernel32 = ctypes.windll.kernel32
-            base_address = self.get_module_base(p)
-            process_handle = kernel32.OpenProcess(0x1F0FFF, False, p.pid)
-            dos_header = ctypes.create_string_buffer(64)
-            kernel32.ReadProcessMemory(process_handle, ctypes.c_void_p(base_address), dos_header, 64, None)
-            nt_headers_offset = struct.unpack("<I", dos_header[0x3C:0x3C + 4])[0]
-            nt_headers = ctypes.create_string_buffer(248)
-            kernel32.ReadProcessMemory(process_handle,
-            ctypes.c_void_p(base_address + nt_headers_offset), nt_headers, 248, None)
-            number_of_sections = struct.unpack("<H", nt_headers[6:8])[0]
-            optional_header_size = struct.unpack("<H", nt_headers[20:22])[0]
-            section_headers_offset = nt_headers_offset + 24 + optional_header_size
-            for i in range(number_of_sections):
-                section_header = ctypes.create_string_buffer(40)
-                section_address = base_address + section_headers_offset + i * 40
-                kernel32.ReadProcessMemory(process_handle,
-                ctypes.c_void_p(section_address), section_header, 40, None)
-                section_name = section_header[:8].rstrip(b'\x00').decode('latin1')
-                virtual_size = struct.unpack("<I", section_header[8:12])[0]
-                virtual_address = struct.unpack("<I", section_header[12:16])[0]
-                characteristics = struct.unpack("<I", section_header[36:40])[0]
-                text_address = base_address + virtual_address
-                buffer = ctypes.create_string_buffer(virtual_size)
-                if kernel32.ReadProcessMemory(process_handle, ctypes.c_void_p(text_address), buffer,
-                    virtual_size, ctypes.byref(ctypes.c_size_t(0))) and characteristics & 0x00000020:
-                    if not any(shell in section_name.lower() for shell in self.model.shells):
-                        match_data[section_name] = buffer.raw
-            kernel32.CloseHandle(process_handle)
-            if self.start_scan(match_data):
+            exist_process, pe32 = set(), PROCESSENTRY32()
+            pe32.dwSize = ctypes.sizeof(PROCESSENTRY32)
+            hSnapshot = self.kernel32.CreateToolhelp32Snapshot(0x00000002, 0)
+            if self.kernel32.Process32First(hSnapshot, ctypes.byref(pe32)):
+                while self.kernel32.Process32Next(hSnapshot, ctypes.byref(pe32)):
+                    exist_process.add(pe32.th32ProcessID)
+            self.kernel32.CloseHandle(hSnapshot)
+            return exist_process
+        except:
+            return None
+
+    def handle_new_process(self, pid):
+        try:
+            h_process = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            file = self.get_process_file(h_process).replace("\\", "/")
+            if os.path.exists(file) and not self.check_whitelist(file):
+                self.lock_process(h_process, True)
+                if self.start_scan(file):
+                    self.kill_process("病毒攔截", h_process, file)
+                elif ":/Windows" not in file and ":/Program" not in file:
+                    self.track_proc = (h_process, file)
+            self.lock_process(h_process, False)
+        except:
+            self.lock_process(h_process, False)
+
+    def check_whitelist(self, file):
+        path = os.path.dirname(file)
+        for whitefile in self.whitelist:
+            if whitefile in path:
                 return True
-            return False
-        except:
-            return False
+        return False
 
-    def lock_process(self, p, lock):
-        if lock:
-            p.suspend()
-        else:
-            p.resume()
-
-    def kill_process(self, info, p, target, relation):
+    def kill_process(self, info, h_process, file):
         try:
-            target = target.replace("\\", "/")
-            if relation == False:
-                p.kill()
-            elif relation == True:
-                for p in psutil.process_iter():
-                    try:
-                        name, file, cmd = p.name(), p.exe(), p.cmdline()
-                        if "powershell" in name:
-                            file = str(cmd[-1].split("'")[-2])
-                        elif "cmd.exe" in name:
-                            file = str(" ".join(cmd[2:]))
-                        elif ":/Windows" in file.replace("\\", "/"):
-                            file = str(cmd[-1])
-                        if target == file.replace("\\", "/"):
-                            p.kill()
-                    except:
-                        pass
-            self.send_notify(self.trans(f"{info}: ")+target, True)
+            self.kernel32.TerminateProcess(h_process, 0)
+            self.kernel32.CloseHandle(h_process)
+            self.send_notify(self.trans(f"{info}: ")+file, True)
             self.track_proc = None
         except:
-            self.track_proc = None
+            pass
+
+    def lock_process(self, h_process, lock):
+        try:
+            if lock:
+                self.ntdll.NtSuspendProcess(h_process)
+            else:
+                self.ntdll.NtResumeProcess(h_process)
+        except:
+            pass
+
+    def get_process_file(self, h_process):
+        exe_path = ctypes.create_unicode_buffer(260)
+        self.psapi.GetProcessImageFileNameW(h_process, exe_path, ctypes.sizeof(exe_path) // 2)
+        full_path = exe_path.value
+        drives = [f"{chr(l)}:\\" for l in range(65, 91) if os.path.exists(f"{chr(l)}:\\")]
+        for drive in drives:
+            drive_letter = drive[0] + ":"
+            device_path = ctypes.create_unicode_buffer(260)
+            self.kernel32.QueryDosDeviceW(drive_letter, device_path, 260)
+            if full_path.startswith(device_path.value):
+                full_path = full_path.replace(device_path.value, drive, 1)
+                return full_path.replace("\\\\", "\\")
+        return full_path
 
     def protect_file_thread(self):
-        hDir = win32file.CreateFile("C:/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
         self.ransom_counts = 0
+        hDir = self.kernel32.CreateFileW("C:\\", 0x80000000, 0x00000001 | 0x00000002 | 0x00000004, None, 3, 0x02000000, None)
+        buffer = ctypes.create_string_buffer(2060)
         while self.file_protect:
-            for action, file in win32file.ReadDirectoryChangesW(hDir,10485760,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
-                try:
-                    fpath = str(f"C:/{file}").replace("\\", "/")
-                    ftype = str(f".{fpath.split('.')[-1]}").lower()
+            try:
+                bytesReturned = ctypes.wintypes.DWORD()
+                if self.kernel32.ReadDirectoryChangesW(hDir, buffer, ctypes.sizeof(buffer), True,
+                    0x00000001 | 0x00000002 | 0x00000004 | 0x00000008 | 0x00000010 | 0x00000100,
+                    ctypes.byref(bytesReturned), None, None):
+                    notify_info = FILE_NOTIFY_INFORMATION.from_buffer_copy(buffer[0:])
+                    raw_filename = notify_info.FileName[:notify_info.FileNameLength // 2]
+                    fpath = f"C:/{raw_filename}".replace("\\", "/")
+                    ftype = f".{fpath.split('.')[-1]}".lower()
                     if self.ransom_counts >= 5 and self.track_proc:
                         self.ransom_counts = 0
                         self.kill_process("勒索攔截", *self.track_proc)
                     elif ":/Windows" in fpath and "/Temp/" not in fpath:
-                        if action == 2 and ftype in alist:
-                            self.ransom_counts += 1
-                        elif action == 4 and ftype in alist:
+                        if notify_info.Action in [2, 4] and ftype in alist:
                             self.ransom_counts += 1
                     elif ":/Users" in fpath and "/AppData/" not in fpath:
-                        if action == 2 and ftype in alist:
-                            self.ransom_counts += 1
-                        elif action == 4 and ftype in alist:
+                        if notify_info.Action in [2, 4] and ftype in alist:
                             self.ransom_counts += 1
                     if ":/Windows" not in fpath and ftype in slist:
-                        if action == 3 and self.start_scan(fpath):
+                        if notify_info.Action == 3 and self.start_scan(fpath):
                             self.ransom_counts = 0
                             os.remove(fpath)
-                            self.send_notify(self.trans("病毒刪除: ")+fpath, True)
-                except:
-                    pass
+                            self.send_notify(self.trans("病毒刪除: ") + fpath, True)
+            except:
+                pass
+        self.kernel32.CloseHandle(hDir)
         if self.ui.Protection_switch_Button_2.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.file_protect"), False)
 
@@ -1493,15 +1515,29 @@ class MainWindow_Controller(QMainWindow):
         if self.ui.Protection_switch_Button_3.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.sys_protect (reg)"), False)
 
+    def get_tcp_connections(self):
+        size = ctypes.wintypes.DWORD()
+        self.iphlpapi.GetExtendedTcpTable(None, ctypes.byref(size), False, 2, 0, 0)
+        tcp_table = MIB_TCPTABLE_OWNER_PID()
+        tcp_table_size = size.value
+        tcp_table_pointer = ctypes.cast(ctypes.create_string_buffer(tcp_table_size), ctypes.POINTER(MIB_TCPTABLE_OWNER_PID))
+        tcp_table_pointer.contents.dwNumEntries = 0
+        if self.iphlpapi.GetExtendedTcpTable(tcp_table_pointer, ctypes.byref(size), False, 2, 0, 0) == 0:
+            tcp_entries = tcp_table_pointer.contents.table[:tcp_table_pointer.contents.dwNumEntries]
+            return tcp_entries
+        return []
+
     def protect_net_thread(self):
         while self.net_protect:
             try:
                 time.sleep(0.2)
-                for conn in self.track_proc[0].connections(kind='inet'):
-                    if conn.raddr.ip in self.rules.network:
+                for conn in self.get_tcp_connections():
+                    local_ip = f"{conn.dwLocalAddr & 0xFF}.{(conn.dwLocalAddr >> 8) & 0xFF}.{(conn.dwLocalAddr >> 16) & 0xFF}.{(conn.dwLocalAddr >> 24) & 0xFF}"
+                    remote_ip = f"{conn.dwRemoteAddr & 0xFF}.{(conn.dwRemoteAddr >> 8) & 0xFF}.{(conn.dwRemoteAddr >> 16) & 0xFF}.{(conn.dwRemoteAddr >> 24) & 0xFF}"
+                    if remote_ip in self.rules.network:
                         self.kill_process("網路攔截", *self.track_proc)
-            except:
-                pass
+            except Exception as e:
+                pass#print(e)
         if self.ui.Protection_switch_Button_5.text() == self.trans("已開啟"):
             self.send_notify(self.trans(f"竄改警告: self.net_protect"), False)
 

PYAS_Engine.py

@@ -1,6 +1,6 @@
-import os, io, sys, time, json, yara
+import os, sys, time, json, yara
 import numpy, pefile, onnxruntime
-from PIL import Image, ImageShow
+from PIL import Image
 
 class YRScan:
     def __init__(self):
@@ -17,8 +17,8 @@ class YRScan:
             elif ftype in [".ip", ".ips"]:
                 with open(file_path, "r") as f:
                     self.network += [l.strip() for l in f.readlines()]
-        except:
-            pass
+        except Exception as e:
+            print(e)
 
     def yr_scan(self, file_path):
         try:
@@ -28,9 +28,11 @@ class YRScan:
             for name, rules in self.rules.items():
                 matchs_rules = rules.match(data=file_path)
                 if matchs_rules:
-                    return "Virus/Rules", matchs_rules
+                    label = str(matchs_rules[0]).split("_")[0]
+                    level = str(matchs_rules[0]).split("_")[-1]
+                    return f"Rules/{label}", level
             return False, False
-        except:
+        except Exception as e:
             return False, False
 
 class DLScan:
@@ -44,7 +46,7 @@ class DLScan:
         'upx', 'tracesup', 'res', 'lzma', 'malloc_h', 'miniex', 'ndr64', 'be',
         'mssmixer', 'wow', 'press', 'fio', 'pad', 'hexpthk', 'h~;', 'icapsec',
         'sanontcp', 'secur', 'asmstub', 'nsys_wr', 'orpc', 'pack', 'wow64svc',
-        'uedbg', 'viahw', 'data', 'zk', 'fothk', 'qihoo']
+        'uedbg', 'viahw', 'data', 'zk', 'fothk', 'qihoo']#"""
 
     def load_model(self, file_path):
         try:
@@ -58,54 +60,50 @@ class DLScan:
             self.detect = self.class_names['Detect']
             self.pixels = self.class_names['Pixels']
             self.values = self.class_names['Values']
+            self.suffix = self.class_names['Suffix']
         except Exception as e:
             pass
 
     def dl_scan(self, file_data):
         try:
-            target_size, sim = tuple(self.pixels), {}
-            image = self.preprocess_image(file_data, target_size)
-            image_array = numpy.array(image).astype('float32') / 255.0
-            image_expand = numpy.expand_dims(image_array, axis=0)
+            label_similarities = {label: [] for label in self.labels}
+            image_data = self.preprocess_image(file_data, tuple(self.pixels))
+            image_array = numpy.asarray(image_data).astype('float32') / 255.0
+            image_expand = numpy.expand_dims(image_array, axis=(0, -1))
             for model_name, model in self.models.items():
                 input_name = model.get_inputs()[0].name
-                pre_answer = model.run(None, {input_name: image_expand})[0][0]
-                number = numpy.argmax(pre_answer)
-                label = self.labels[number].replace("\n", "")
-                sim[label] = sim.setdefault(label, 0) + pre_answer[number]
-            for local_label, sim_sum in sim.items():
-                if sim_sum > len(self.models) / 2:
-                    local_level = sim_sum / len(self.models)
-                    print(local_label, local_level * 100)
-                    return local_label, local_level * 100
-            return False, False
+                pre_answers = model.run(None, {input_name: image_expand})[0][0]
+                for k, score in enumerate(pre_answers):
+                    label_similarities[self.labels[k].strip()].append(score)
+            label_percentage = {label: (sum(similarities) / len(self.models)) * 100
+            for label, similarities in label_similarities.items()}
+            label, level = max(label_percentage.items(), key=lambda x: x[1])
+            return label, int(level)
         except Exception as e:
             return False, False
 
+    def preprocess_image(self, file_data, target_size):
+        wah = int(numpy.ceil(numpy.sqrt(len(file_data))))
+        file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
+        image_array = numpy.zeros((wah * wah,), dtype=numpy.uint8)
+        image_array[:len(file_data)] = file_data
+        image = Image.fromarray(image_array.reshape((wah, wah)), 'L')
+        return image.resize(target_size, Image.Resampling.NEAREST)
+
     def get_type(self, file_path):
-        try:
-            match_data = {}
-            ftype = str(f".{file_path.split('.')[-1]}").lower()
-            if ftype in [".exe", ".dll", ".sys", ".scr", ".com"]:
+        match_data = {}
+        ftype = str(f".{file_path.split('.')[-1]}").lower()
+        if ftype in self.suffix:
+            try:
                 with pefile.PE(file_path, fast_load=True) as pe:
                     for section in pe.sections:
                         section_name = section.Name.rstrip(b'\x00').decode('latin1')
                         if (section.Characteristics & 0x00000020 and not
                         any(shell in section_name.lower() for shell in self.shells)):
                             match_data[section_name] = section.get_data()
-            elif ftype in [".bat", ".vbs", ".ps1", ".cmd", ".js"]:
-                with open(file_path, 'rb') as file:
-                    match_data[ftype] = file.read()
-            return match_data
-        except:
-            return {}
-
-    def preprocess_image(self, file_data, target_size):
-        file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
-        data_count = len(file_data)
-        wah = int(numpy.ceil(numpy.sqrt((data_count + 2) // 3)))
-        image_array = numpy.zeros((wah * wah * 3,), dtype=numpy.uint8)
-        image_array[:data_count] = file_data
-        image_array = image_array.reshape((wah, wah, 3))
-        image = Image.fromarray(image_array)
-        return image.resize(target_size, Image.Resampling.LANCZOS)
+            except:
+                if ftype in [".bat", ".cmd", ".ps1", ".vbs", ".wsf", ".html", ".js", 
+                    ".txt", ".htm", ".hta", ".php", ".css", ".xml", ".json", ".wasm"]:
+                    with open(file_path, 'rb') as file:
+                        match_data[ftype] = file.read()
+        return match_data

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.2.1',
+version='3.2.5',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -11,11 +11,8 @@
 ## Requirements
 
 ```
-pip install psutil==5.9.5
 pip install pefile==2023.2.7
-pip install requests==2.31.0
 pip install pyperclip==1.8.2
-pip install pywin32==306
 pip install PyQt5==5.15.9
 pip install yara-python==4.5.1
 pip install numpy==2.1.1
@@ -27,26 +24,22 @@ pip install pillow==10.4.0
 
 ```
 PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys -------> Driver Protect (self protection driver for pyas by 0sha0)
+├── Driver/ (Protect driver and Microsoft runtime)
 │   └── ...
 │
-├── Model/
-│   ├── PYAS_Model.json -------> Virus Database (the database must be in the specified dir)
+├── Engine/ (Deep learn model and Yara database)
 │   └── ...
 │
-├── Rules/
-│   ├── Yara_Rules.yar ---------> Yara Rules (yara rules in plain text format)
-│   ├── Yara_Rules.yrc ---------> Compile Rules (yara rules in compiled format)
+├── Exten/ (Exten tools and System repair tools)
 │   └── ...
 │
-├── PYAS.py ---------------------> Main PYAS Program (including animation, scan, protect functions, ...)
-├── PYAS_Engine.py -------------> Conversion Database (used to transform profiles and forecast data)
-├── PYAS_Suffixes.py -----------> File Suffixes (including scanned file suffixes and common suffixes)
-├── PYAS_Interface.py ----------> PyQt5 Interface (use QT designer, must be matched with the main program)
-├── PYAS_Resource.py -----------> PyQt5 Resource (status pictures, icon packages, button icons, ...)
-├── PYAS_Language.py -----------> Translate Dict (Traditional Chinese, Simplified Chinese, English)
-├── PYAS_Version.py ------------> Pyinstaller (file information, version information, original name, ...)
+├── PYAS.py (Main PYAS program with qtui interaction and protect function)
+├── PYAS_Engine.py (Deep learning predict and yara rules file scanner)
+├── PYAS_Suffixes.py (including scan file suffixes and common suffixes)
+├── PYAS_Interface.py (Qt designer ui, must be matched with the main program)
+├── PYAS_Resource.py (status pictures, icon packages, and button icons)
+├── PYAS_Language.py (Traditional Chinese, Simplified Chinese and English)
+├── PYAS_Version.py (file information, version information, original name)
 └── ...
 ```
 
@@ -76,6 +69,6 @@ Other systems may experience software malfunctions or crash
 
 ## Special Thanks
 
-Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo

README_zh_CN.md

@@ -5,11 +5,8 @@
 ## 安装要求
 
 ```
-pip install psutil==5.9.5
 pip install pefile==2023.2.7
-pip install requests==2.31.0
 pip install pyperclip==1.8.2
-pip install pywin32==306
 pip install PyQt5==5.15.9
 pip install yara-python==4.5.1
 pip install numpy==2.1.1
@@ -21,26 +18,22 @@ pip install pillow==10.4.0
 
 ```
 PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys -------> 驱动程序 (0sha0 为 pyas 提供的自我保护驱动程序)
+├── Driver/ (驱动保护和微软运行库)
 │   └── ...
 │
-├── Model/
-│   ├── PYAS_Model.json -------> 病毒数据库 (数据库必须位于指定目录中)
+├── Engine/ (深度学习和规则数据库)
 │   └── ...
 │
-├── Rules/
-│   ├── Yara_Rules.yar ---------> Yara 规则 (纯文本格式的 yara 规则)
-│   ├── Yara_Rules.yrc ---------> 编译规则 (编译格式的 yara 规则)
+├── Exten/ (扩展功能与系统修复工具)
 │   └── ...
 │
-├── PYAS.py ---------------------> PYAS主程序（包含动画、扫描、保护等功能...）
-├── PYAS_Engine.py -------------> 转换数据库（用于转换剖面图和预报数据）
-├── PYAS_Suffixes.py -----------> 文件后缀（包含扫描文件后缀和常用后缀）
-├── PYAS_Interface.py ----------> PyQt5界面（使用QT设计器，需与主程序搭配使用）
-├── PYAS_Resource.py -----------> PyQt5资源（状态图片、图标包、按钮图标...）
-├── PYAS_Language.py -----------> 翻译词典（繁体中文、简体中文、英文）
-├── PYAS_Version.py ------------> 安裝信息（文件信息、版本信息、原名...）
+├── PYAS.py (PYAS主程序含界面交互与保护功能)
+├── PYAS_Engine.py (深度学习预测和规则扫描器)
+├── PYAS_Suffixes.py (获取扫描或事件文件的后缀)
+├── PYAS_Interface.py (搭配主程序的Qt设计介面)
+├── PYAS_Resource.py (状态图片和图标和按钮图片)
+├── PYAS_Language.py (繁体中文和简体中文和英文翻译)
+├── PYAS_Version.py (版本和讯息名称和打包文件名)
 └── ...
 ```
 
@@ -70,6 +63,6 @@ Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
 
 ## 特别感谢
 
-360, Wix, VirusShare, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo

README_zh_TW.md

@@ -5,11 +5,8 @@
 ## 安裝要求
 
 ```
-pip install psutil==5.9.5
 pip install pefile==2023.2.7
-pip install requests==2.31.0
 pip install pyperclip==1.8.2
-pip install pywin32==306
 pip install PyQt5==5.15.9
 pip install yara-python==4.5.1
 pip install numpy==2.1.1
@@ -21,26 +18,22 @@ pip install pillow==10.4.0
 
 ```
 PYAS/
-├── Driver/
-│   ├── PYAS_Driver.sys -------> 驅動程式 (0sha0 為 pyas 提供的自我保護驅動程式)
+├── Driver/ (驅動防護和微軟運行庫)
 │   └── ...
 │
-├── Model/
-│   ├── PYAS_Model.json -------> 病毒資料庫 (資料庫必須位於指定目錄)
+├── Engine/ (深度學習和規則數據庫)
 │   └── ...
 │
-├── Rules/
-│   ├── Yara_Rules.yar ---------> Yara 規則 (純文字格式的 yara 規則)
-│   ├── Yara_Rules.yrc ---------> 編譯規則 (編譯格式的 yara 規則)
+├── Exten/ (擴展功能與系統修復工具)
 │   └── ...
 │
-├── PYAS.py ---------------------> PYAS主程式（包含動畫、掃描、保護等功能...）
-├── PYAS_Engine.py -------------> 轉換資料庫（用於轉換剖面圖和預報資料）
-├── PYAS_Suffixes.py -----------> 文件後綴（包含掃描文件後綴和常用後綴）
-├── PYAS_Interface.py ----------> PyQt5介面（使用QT設計器，需與主程式搭配使用）
-├── PYAS_Resource.py -----------> PyQt5資源（狀態圖片、圖示包、按鈕圖示...）
-├── PYAS_Language.py -----------> 翻譯字典（繁體中文、簡體中文、英文）
-├── PYAS_Version.py ------------> 安裝資訊（檔案資訊、版本資訊、原名...）
+├── PYAS.py (PYAS主程序含介面交互與防護功能)
+├── PYAS_Engine.py (深度學習預測和規則掃描器)
+├── PYAS_Suffixes.py (獲取掃描或事件檔案的副檔名)
+├── PYAS_Interface.py (搭配主程序的Qt設計介面)
+├── PYAS_Resource.py (狀態圖片圖標和按鈕圖片)
+├── PYAS_Language.py (繁體中文和簡體中文和英文翻譯)
+├── PYAS_Version.py (檔案版本和訊息名稱和打包檔名)
 └── ...
 ```
 
@@ -70,6 +63,6 @@ Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
 
 ## 特別感謝
 
-Wix, 0sha0, mtkiao129, AV-T Team of LisectGroup
+Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
 
 Copyright© 2020~2024 PYAS Security By 87owo