Update and rename convert_full.py to convert.py

Delete Engine/Model/convert.py
Add files via upload
2026-01-04 22:34:35 +08:00 · 2026-01-04 20:45:08 +08:00 · 2026-01-04 20:17:23 +08:00 · 2026-01-04 18:55:43 +08:00 · 2026-01-04 18:55:04 +08:00 · 2026-01-04 13:41:45 +08:00
40 changed files with 33386 additions and 13849 deletions
@@ -1,34 +0,0 @@
-@echo off
-setlocal
-
-:: Check for permissions
->nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
-
-if %errorlevel% NEQ 0 goto NoAdmin
-goto gotAdmin
-
-:NoAdmin
-    echo You do not have administrator rights, please run this script as administrator.
-    pause
-    exit /B
-
-:gotAdmin
-    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
-
-set "script_dir=%~dp0"
-set "script_dir=%script_dir:~0,-1%"
-
-bcdedit -debug on
-bcdedit /set testsigning on
-bcdedit /deletevalue {current} safeboot
-
-powershell.exe -ExecutionPolicy Bypass -Command ^
-"$endDate = (Get-Date).AddYears(100); ^
- $cert = New-SelfSignedCertificate -DnsName PYAS -CertStoreLocation cert:\LocalMachine\My -Type CodeSigning -NotAfter $endDate; ^
- $pwd = ConvertTo-SecureString -String 'PYAS' -Force -AsPlainText; ^
- Export-PfxCertificate -Cert $cert -FilePath '%script_dir%\PYAS.pfx' -Password $pwd;"
-"%script_dir%\signtool.exe" sign /f "%script_dir%\PYAS.pfx" /p PYAS "%script_dir%\PYAS_Driver.sys"
-sc create PYAS_Driver type= kernel start= demand binPath= "%script_dir%\PYAS_Driver.sys"
-
-shutdown -r -t 0
-endlocal
@@ -1,25 +0,0 @@
-@echo off
-setlocal
-
-:: Check for permissions
->nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system"
-
-if %errorlevel% NEQ 0 goto NoAdmin
-goto gotAdmin
-
-:NoAdmin
-    echo You do not have administrator rights, please run this script as administrator.
-    pause
-    exit /B
-
-:gotAdmin
-    if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
-
-sc stop PYAS_Driver
-sc delete PYAS_Driver
-
-bcdedit /set testsigning off
-bcdedit -debug off
-
-shutdown -r -t 0
-endlocal
@@ -1,11 +0,0 @@
-{
-    "Suffix": [".com", ".exe", ".dll", ".sys", ".scr", ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], 
-
-    "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], 
-
-    "Detect": ["Pefile/General", "Script/General"],  
-
-    "Pixels": [224, 224], 
-
-    "Values": 90
-}
@@ -0,0 +1,55 @@
+from PIL import Image
+import numpy, pefile, os
+
+####################################################################################################
+
+def preprocess_image(file_data, size, channels=1):
+    width, height = size
+    wah = int(numpy.ceil(numpy.sqrt(len(file_data) / channels)))
+    arr = numpy.frombuffer(file_data, dtype=numpy.uint8)
+    img = numpy.zeros(wah*wah*channels, dtype=numpy.uint8)
+    img[:len(file_data)] = arr
+    image = Image.fromarray(img.reshape((wah, wah)), 'L')
+    return image.resize((width, height), Image.Resampling.NEAREST)
+
+####################################################################################################
+
+def get_type(file_path):
+    suffix = {".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui", ".cpl"}
+    try:
+        file_content = None
+        if not os.path.splitext(file_path)[-1].lower() in suffix:
+            return file_content
+        with open(file_path, 'rb') as f:
+            file_content = f.read()
+    except:
+        pass
+    return file_content
+
+####################################################################################################
+
+def file_to_images(input_dir, output_dir):
+    for root, dirs, files in os.walk(input_dir):
+        for file in files:
+            try:
+                file_path = os.path.join(root, file)
+                file_content = get_type(file_path)
+                if file_content:
+                    print(file_path)
+                    relative_path = os.path.relpath(root, input_dir)
+                    output_path_dir = os.path.join(output_dir, relative_path)
+
+                    if not os.path.exists(output_path_dir):
+                        os.makedirs(output_path_dir)
+                    image = preprocess_image(file_content, (224, 224))
+                    safe_name = os.path.basename(file_path).replace('/', '_').replace('\\', '_')
+                    image.save(os.path.join(output_path_dir, f"{safe_name}.png"))
+            except Exception as e:
+                print(e)
+
+####################################################################################################
+
+input_directory = input('Enter the folder path: ')
+output_directory = "./Image_Output"
+file_to_images(input_directory, output_directory)
+input('Conversion Complete')
@@ -0,0 +1,34 @@
+import os, hashlib
+
+####################################################################################################
+
+def calc_sha256(path):
+    with open(path, "rb") as f:
+        return hashlib.sha256(f.read()).digest()
+
+def dedup_realtime(root):
+    seen = set()
+    deleted = 0
+    for dirpath, _, files in os.walk(root):
+        for name in files:
+            p = os.path.join(dirpath, name)
+            try:
+                h = calc_sha256(p)
+            except Exception:
+                continue
+            if h in seen:
+                try:
+                    os.remove(p)
+                    print(p)
+                    deleted += 1
+                except Exception:
+                    pass
+            else:
+                seen.add(h)
+    print(f"deleted {deleted}")
+
+####################################################################################################
+
+if __name__ == "__main__":
+    dedup_realtime(input("Input file path: "))
+input('Deduplicate Complete')
@@ -0,0 +1,163 @@
+import tensorflow as tf
+import os, tf2onnx, numpy, random
+from PIL import Image
+from tensorflow.keras import *
+from collections import Counter
+
+####################################################################################################
+
+Image.MAX_IMAGE_PIXELS = None
+tf.keras.mixed_precision.set_global_policy('mixed_float16')
+
+####################################################################################################
+
+def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=256, color_mode="grayscale"):
+    channels = 1 if color_mode == "grayscale" else 3
+    file_paths, labels, class_indices = get_file_list(data_dir)
+    
+    combined = list(zip(file_paths, labels))
+    random.shuffle(combined)
+    file_paths[:], labels[:] = zip(*combined)
+
+    num_val = int(val_split * len(file_paths))
+    train_files = file_paths[num_val:]
+    train_labels = labels[num_val:]
+    val_files = file_paths[:num_val]
+    val_labels = labels[:num_val]
+    num_classes = len(class_indices)
+
+    train_ds = tf.data.Dataset.from_tensor_slices((train_files, train_labels))
+    train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    train_ds = train_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
+
+    val_ds = tf.data.Dataset.from_tensor_slices((val_files, val_labels))
+    val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    val_ds = val_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
+
+    train_ds.class_indices = class_indices
+    return train_ds, val_ds
+
+####################################################################################################
+
+def parse_fn(filename, label, image_size, channels, num_classes):
+    img = tf.io.read_file(filename)
+    img = tf.image.decode_image(img, channels=channels, expand_animations=False)
+    img = tf.cond(tf.reduce_all(tf.equal(tf.shape(img)[:2], image_size)), lambda: tf.cast(img, tf.float32), lambda: tf.image.resize(img, image_size))
+    img = tf.cast(img, tf.float32) / 255.0
+    label = tf.one_hot(label, depth=num_classes)
+    return img, label
+
+def get_file_list(directory):
+    file_paths, labels, class_indices = [], [], {}
+    for i, cls in enumerate(sorted([d for d in os.listdir(directory) if os.path.isdir(os.path.join(directory, d))])):
+        class_indices[cls] = i
+        cls_dir = os.path.join(directory, cls)
+
+        for root, _, files in os.walk(cls_dir):
+            for file in files:
+                if file.lower().endswith(('.jpg', '.jpeg', '.png', '.bmp', '.gif')):
+                    file_paths.append(os.path.join(root, file))
+                    labels.append(i)
+    return file_paths, labels, class_indices
+
+####################################################################################################
+
+def multi_conv(x, strides):
+    convs = []
+    for k in [(1, 7), (1, 1), (3, 3), (5, 5)]:
+        c = layers.DepthwiseConv2D(kernel_size=k, strides=strides, padding='same', activation='gelu')(x)
+        convs.append(c)
+
+    x = layers.Concatenate()(convs)
+    x = layers.BatchNormalization()(x)
+    return layers.Activation('gelu')(x)
+
+def gated_conv(x, strides):
+    c = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='gelu')(x)
+    g = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='sigmoid')(x)
+    return layers.Multiply()([c, g])
+
+def coordinate_attention(x, reduction):
+    input_shape = tf.shape(x)
+    h, w = input_shape[1], input_shape[2]
+    filters = x.shape[-1]
+    mip = max(8, filters // reduction)
+
+    x_h = layers.Lambda(lambda t: tf.reduce_mean(t, axis=2, keepdims=True))(x)
+    x_w = layers.Lambda(lambda t: tf.reduce_mean(t, axis=1, keepdims=True))(x)
+    x_w_t = layers.Permute((2, 1, 3))(x_w)
+
+    x_cat = layers.Concatenate(axis=1)([x_h, x_w_t])
+    x_cat = layers.Conv2D(mip, 1, padding='valid', use_bias=False)(x_cat)
+    x_cat = layers.BatchNormalization()(x_cat)
+    x_cat = layers.Activation('gelu')(x_cat)
+
+    x_cat_h, x_cat_w = layers.Lambda(lambda t: tf.split(t[0], [t[1], t[2]], axis=1))([x_cat, h, w])
+    x_h_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_h)
+    x_cat_w = layers.Permute((2, 1, 3))(x_cat_w)
+    x_w_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_w)
+
+    return layers.Multiply()([x, x_h_sigmoid, x_w_sigmoid])
+
+def build_model(input_shape, num_classes):
+    i = layers.Input(shape=input_shape)
+    x = multi_conv(i, strides=1)
+    x = gated_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+    x = multi_conv(x, strides=2)
+
+    x = coordinate_attention(x, reduction=4)
+    x = layers.GlobalMaxPooling2D()(x)
+
+    x = layers.Dense(x.shape[-1] // 2, activation='gelu', dtype='float32')(x)
+    o = layers.Dense(num_classes, activation='softmax', dtype='float32')(x)
+    return models.Model(i, o)
+
+####################################################################################################
+
+def calculate_lr_cosine_sq(epoch, total_epochs=30, lr_start=5e-4, lr_end=5e-7):
+    cos_val = 0.5 * (1 + numpy.cos(epoch / total_epochs * numpy.pi))
+    return lr_end + (lr_start - lr_end) * (cos_val ** 2)
+
+def lr_scheduler(epoch):
+    return calculate_lr_cosine_sq(epoch)
+
+def categorical_focal_loss(gamma=2.0, alpha=0.25):
+    def focal_loss(y_true, y_pred):
+        y_pred = tf.clip_by_value(y_pred, tf.keras.backend.epsilon(), 1.0 - tf.keras.backend.epsilon())
+        cross_entropy = -y_true * tf.math.log(y_pred)
+        loss = alpha * tf.math.pow(1.0 - y_pred, gamma) * cross_entropy
+        return tf.reduce_sum(loss, axis=-1)
+    return focal_loss
+
+class CustomModelCheckpoint(callbacks.Callback):
+    def on_epoch_end(self, epoch, logs=False):
+        models.save_model(self.model, f"PYAS_Model_Epoch_{epoch + 1}.h5")
+        spec = (tf.TensorSpec((None,) + train_ds.image_shape, tf.float32),)
+        model_proto, _ = tf2onnx.convert.from_keras(self.model, input_signature=spec, opset=17)
+        with open(f"PYAS_Model_Epoch_{epoch + 1}.onnx", "wb") as f:
+            f.write(model_proto.SerializeToString())
+
+####################################################################################################
+
+train_ds, val_ds = load_dataset(r'.\Image_Full_Pefile')
+for imgs, _ in train_ds.take(1):
+    train_ds.image_shape = imgs.shape[1:]
+    break
+
+try:
+    model = models.load_model('PYAS_Model_Epoch_0.h5')
+    print("Load model from disk")
+except:
+    print("Creating a new model")
+    model = build_model(train_ds.image_shape, len(train_ds.class_indices))
+
+print(f"Total parameters: {model.count_params()}")
+model.compile(optimizer='adam', loss=categorical_focal_loss(gamma=2.0, alpha=0.25), 
+    metrics=['accuracy', metrics.Precision(name='precision'), metrics.Recall(name='recall'),
+    metrics.FalsePositives(name='fp'), metrics.TrueNegatives(name='tn')])
+
+model.fit(train_ds, epochs=30, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds)
+input('Training Complete')
@@ -772,31 +772,26 @@ rule General_28 {
      author = "PYAS Security"
      date = "2024-06-12"
   strings:
-      $s1 = "GNU C11 6.3.0" ascii
-      $s2 = "GCC: (MinGW.org GCC-6.3.0-1) 6.3.0" fullword ascii
-      $s3 = "___mingw_readdir" fullword ascii
-      $s4 = "___mingw_closedir" fullword ascii
-      $s5 = "___mingw_seekdir" fullword ascii
-      $s6 = "%d is not a prime number." fullword ascii
-      $s7 = "___mingw_rewinddir" fullword ascii
-      $s8 = "__mingw32_init_mainargs" fullword ascii
-      $s9 = "___mingw_telldir" fullword ascii
-      $s10 = "Enter an integer: " fullword ascii
-      $s11 = "___mingw_opendir" fullword ascii
-      $s12 = "/home/keith/" ascii
-      $s13 = "../../../src/gcc-6.3.0/libgcc" ascii
-      $s14 = "___mingw_dirname" fullword ascii
-      $s15 = "_isPrime`" fullword ascii
-      $s16 = "%d is a prime number." fullword ascii
-      $s17 = ".weak.__Jv_RegisterClasses.___EH_FRAME_BEGIN__" fullword ascii
-      $s18 = "-mtune=generic" ascii
-      $s19 = "-march=i586" ascii
-      $s20 = "-g -g -g -O2 -O2 -O2" ascii
-      $s21 = "-fbuilding-libgcc" ascii
-      $s22 = "-fno-stack-protector" ascii
+      $x1 = "schemas.microsoft.com" wide
+      $x2 = "Client Worker Thread" ascii
+      $s1 = "A6BFEA43-501F-456F-A845-983D3AD7B8F0" wide
+      $s2 = "upgrader" wide
+      $s3 = "rtvscan.exe" wide
+      $s4 = "Enable-WindowsOptionalFeature -FeatureName" wide
+      $s5 = "remupd.exe" fullword wide
+      $s6 = "Mcshield.exe" fullword wide
+      $s7 = "mssecess.exe" fullword wide
+      $s8 = "RavMonD.exe" fullword wide
+      $s9 = "KvMonXP.exe" fullword wide
+      $s10 = "baiduSafeTray.exe" fullword wide
+      $s11 = "Qavanijeb.exe" fullword wide
+      $s12 = "%s --> Error: %d, EC: %d" fullword ascii
+      $s13 = "wscript.exe //E:vbscript" wide
+      $s14 = "upgrader_64" wide
+      $s15 = "Process Data Error" fullword wide
   condition:
-      uint16(0) == 0x5a4d and filesize < 500KB and
-      8 of them
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      1 of ($x*) and 6 of them
 }

 rule General_29 {
@@ -1442,31 +1437,3 @@ rule General_52 {
      uint16(0) == 0x5a4d and filesize < 2000KB and
      8 of them
 }
-
-rule General_53 {
-   meta:
-      description = "53"
-      author = "PYAS Security"
-      date = "2024-06-12"
-   strings:
-      $x1 = "schemas.microsoft.com" wide
-      $x2 = "Client Worker Thread" ascii
-      $s1 = "A6BFEA43-501F-456F-A845-983D3AD7B8F0" wide
-      $s2 = "upgrader" wide
-      $s3 = "rtvscan.exe" wide
-      $s4 = "Enable-WindowsOptionalFeature -FeatureName" wide
-      $s5 = "remupd.exe" fullword wide
-      $s6 = "Mcshield.exe" fullword wide
-      $s7 = "mssecess.exe" fullword wide
-      $s8 = "RavMonD.exe" fullword wide
-      $s9 = "KvMonXP.exe" fullword wide
-      $s10 = "baiduSafeTray.exe" fullword wide
-      $s11 = "Qavanijeb.exe" fullword wide
-      $s12 = "%s --> Error: %d, EC: %d" fullword ascii
-      $s13 = "wscript.exe //E:vbscript" wide
-      $s14 = "upgrader_64" wide
-      $s15 = "Process Data Error" fullword wide
-   condition:
-      uint16(0) == 0x5a4d and filesize < 1000KB and
-      1 of ($x*) and 6 of them
-}
@@ -1,117 +0,0 @@
-Windows Registry Editor Version 5.00
-
-; Repair system restrictions
-[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MMC]
-; NoControlPanel
-"NoControlPanel"=dword:00000000
-; NoDrives
-"NoDrives"=dword:00000000
-; NoFileMenu
-"NoFileMenu"=dword:00000000
-; NoFind
-"NoFind"=dword:00000000
-; NoRealMode
-"NoRealMode"=dword:00000000
-; NoRecentDocsMenu
-"NoRecentDocsMenu"=dword:00000000
-; NoSetFolders
-"NoSetFolders"=dword:00000000
-; NoSetFolderOptions
-"NoSetFolderOptions"=dword:00000000
-; NoViewOnDrive
-"NoViewOnDrive"=dword:00000000
-; NoClose
-"NoClose"=dword:00000000
-; NoRun
-"NoRun"=dword:00000000
-; NoDesktop
-"NoDesktop"=dword:00000000
-; NoLogOff
-"NoLogOff"=dword:00000000
-; NoFolderOptions
-"NoFolderOptions"=dword:00000000
-; RestrictRun
-"RestrictRun"=dword:00000000
-; NoViewContextMenu
-"NoViewContexMenu"=dword:00000000
-; HideClock
-"HideClock"=dword:00000000
-; NoStartMenuMorePrograms
-"NoStartMenuMorePrograms"=dword:00000000
-; NoStartMenuMyGames
-"NoStartMenuMyGames"=dword:00000000
-; NoStartMenuMyMusic
-"NoStartMenuMyMusic"=dword:00000000
-; DisableCMD
-"DisableCMD"=dword:00000000
-; NoWinKeys
-"NoWinKeys"=dword:00000000
-; StartMenuLogOff
-"StartMenuLogOff"=dword:00000000
-; NoSimpleNetlDList
-"NoSimpleNetlDList"=dword:00000000
-; NoLowDiskSpaceChecks
-"NoLowDiskSpaceChecks"=dword:00000000
-; DisableLockWorkstation
-"DisableLockWorkstation"=dword:00000000
-; Restrict_Run
-"Restrict_Run"=dword:00000000
-; DisableTaskMgr
-"DisableTaskMgr"=dword:00000000
-; DisableRegistryTools
-"DisableRegistryTools"=dword:00000000
-; DisableChangePassword
-"DisableChangePassword"=dword:00000000
-; Wallpaper
-"Wallpaper"=dword:00000000
-; NoComponents
-"NoComponents"=dword:00000000
-; NoAddingComponents
-"NoAddingComponents"=dword:00000000
-; NoStartMenuPinnedList
-"NoStartMenuPinnedList"=dword:00000000
-; NoActiveDesktop
-"NoActiveDesktop"=dword:00000000
-; NoSetActiveDesktop
-"NoSetActiveDesktop"=dword:00000000
-; NoActiveDesktopChanges
-"NoActiveDesktopChanges"=dword:00000000
-; NoChangeStartMenu
-"NoChangeStartMenu"=dword:00000000
-; NoFavoritesMenu
-"NoFavoritesMenu"=dword:00000000
-; NoRecentDocsHistory
-"NoRecentDocsHistory"=dword:00000000
-; NoSetTaskbar
-"NoSetTaskbar"=dword:00000000
-; NoSMHelp
-"NoSMHelp"=dword:00000000
-; NoTrayContextMenu
-"NoTrayContextMenu"=dword:00000000
-; NoViewContextMenu
-"NoViewContextMenu"=dword:00000000
-; NoManageMyComputerVerb
-"NoManageMyComputerVerb"=dword:00000000
-; NoWindowsUpdate
-"NoWindowsUpdate"=dword:00000000
-; ClearRecentDocsOnExit
-"ClearRecentDocsOnExit"=dword:00000000
-; NoStartMenuNetworkPlaces
-"NoStartMenuNetworkPlaces"=dword:00000000
-
-; Repair Image File Execution Options
-[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
-; (Delete all subkeys here if necessary)
-
-; Repair executable file icon
-[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
-@="%1"
-[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon]
-@="%1"
-
-; Repair executable file type
-[HKEY_CLASSES_ROOT\.exe]
-@="exefile"
-[HKEY_CLASSES_ROOT\exefile\shell\open\command]
-@="\"%1\" %*"
-
@@ -1 +0,0 @@
-sfc /scannow
@@ -1 +0,0 @@
-None
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2020-2025 87owo (PYAS Security)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
@@ -0,0 +1,31 @@
+87owo Publicly Available Source Code License Agreement
+Last updated: 2025-12-19
+
+1. License and Ownership
+   - This software and its source code are source available for public view.
+   - Access or execution of certain features may require an activation key.
+   - 87owo reserves all legal rights, no intellectual property is transferred.
+   - All project archives, source code, and binaries remain fully proprietary.
+
+2. Use and Prohibitions
+   - You may view, download, and modify the code for local and personal use.
+   - Redistribution of any original or modified code requires prior consent.
+   - Commercial hosting or SaaS deployment is prohibited without permission.
+   - Reverse engineering, license removal, or illegal use is strictly barred.
+
+3. Data and Privacy
+   - This project may collect operational data for optimization and analysis.
+   - All collected data is strictly anonymized to ensure the user's privacy.
+   - Transmission of information is encrypted to prevent unauthorized access.
+
+4. Updates and Terms
+   - New releases may include critical patches, enhancements, or UI changes.
+   - Continued use of these services constitutes acceptance of updated terms.
+   - The author reserves the right to modify these license terms at any time.
+
+5. Warranty and Liability
+   - All services and assets are provided "as is" without any form of warranty.
+   - 87owo is not liable for any direct or indirect damages from software use.
+   - Users assume all risks regarding performance, data, and system integrity.
+
+© 2020-2026 87owo (PYAS Security). All rights reserved.
@@ -0,0 +1,130 @@
+translate_dict = {
+    "traditional_switch": {"开启":"開啟","关闭":"關閉","On":"開啟","Off":"關閉"},
+
+    "simplified_switch": {"開啟":"开启","關閉":"关闭","On":"开启","Off":"关闭",
+              "錯誤":"错误","發現":"发现","關閉":"关闭","裝置":"设备","記憶體":"内存",
+              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
+              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
+              "位元":"字节","靈敏":"敏感","複製":"复制","開啟":"开启","靜態":"静态",
+              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
+              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
+              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
+              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
+              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
+              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
+              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
+              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
+              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
+              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
+              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
+              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","與":"与",
+              "異":"异","實":"实","時":"时","彈":"弹","窗":"窗","暫":"暂","訂":"订",
+              "資":"资","產":"产","金":"密","離":"离","規":"规","則":"则","來":"来",
+              "殼":"壳","碼":"码","線":"线","餘":"余",},
+
+    "english_switch": {"開啟":"On","關閉":"Off","开启":"On","关闭":"Off","，":", ",
+              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Official Website ",
+              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","正在加載":"Loading ","加載":"Load ",
+              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ","主要":"Main ",
+              "許可條款":"License Terms ","惡意":"Malicious", "開發":"Developers ",
+              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
+              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
+              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
+              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
+              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
+              "藍色主題":"Blue","綠色主題":"Green","自訂主題":"Custom","黑色主題":"Black",
+              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
+              "註冊":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
+              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
+              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
+              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
+              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
+              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
+              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
+              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
+              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
+              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
+              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"Can ",
+              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
+              "分區":"Partition ","設定":"Setting ","關於":"About","模式":"Mode ",
+              "提高":"Improve ","安全":"Security ","顯色":"Color ","顏色":"Color ",
+              "主題":"Theme ", "回收":"Collect ", "無用":"Useless ","導入":"Import ",
+              "風險":"Risk ","介面":"UI ","核心":"Core ","服務":"Services ",
+              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
+              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
+              "到":"To ","白名單":"White List ","軟體":"Software ","正在":"",
+              "增加":"Add ","移除":"Delete ","項目":"Items ","生成":"Create ","稱":"",
+              "複製":"Copy ","此":"This ","並":"And ","全盤":"Full ","最新":"Latest ",
+              "已存在":"Already ","數據庫":"Database ","誤報":"False Positive ",
+              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
+              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Rule ",
+              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
+              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
+              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","列表":"List ",
+              "竄改":"Tamper ","第三方":"Other ","實時":"Real Time ","查看":"View ",
+              "指定":"Specify ","清空":"Empty ","資源回收桶":"Recycle Bin ", "無法":"Cannot ",
+              "與":"With ","當":"When ","功能":"Function ","異常":"Abnormal ", "來":"To ",
+              "重置":"Reset ","窗口":"Window ","暫存":"Temp ","自訂":"Custom ",
+              "不支持":"Not Support ","共":"Total ","秒":"Seconds ","耗時":"Takes ",
+              "沙箱":"Sandbox ", "虛擬":"Virtual ", "隔離":"Quarantine ", "時":"",
+              "建立":"Create ","環境":"Environment ","沙箱":"Sandbox ","化":"", "表":"",
+              "達":"Reached ", "上限":"Limit ", "區":"", "金鑰":"Key ", "產品":"Product ",
+              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Inject ",
+              "前往":"Go ","檢查":"Check ","可用":"Available ","靜態":"Static ",
+              "版本":"Version ","是":"","剩餘":"Remain ","遠控":"Remote ","監控":"Monitor ",
+              "  ":" "},
+
+    "white_switch": {
+        "_white": "_black",},
+    "red_switch": {
+        "235, 235, 235": "255, 235, 235",
+        "245, 245, 245": "255, 225, 225",
+        "255, 255, 255": "255, 245, 245",
+        "240, 240, 240": "255, 220, 220",
+        "250, 250, 250": "255, 210, 210",
+        "220, 255, 220": "255, 220, 220",
+        "210, 255, 210": "255, 210, 210",
+        "_white": "_black"
+    },
+    "yellow_switch": {
+        "235, 235, 235": "255, 255, 235",
+        "245, 245, 245": "255, 255, 225",
+        "255, 255, 255": "255, 255, 245",
+        "240, 240, 240": "255, 255, 220",
+        "250, 250, 250": "255, 255, 210",
+        "220, 255, 220": "255, 255, 220",
+        "210, 255, 210": "255, 255, 210",
+        "_white": "_black"
+    },
+    "green_switch": {
+        "235, 235, 235": "235, 255, 235",
+        "245, 245, 245": "225, 255, 225",
+        "255, 255, 255": "245, 255, 245",
+        "240, 240, 240": "220, 255, 220",
+        "250, 250, 250": "210, 255, 210",
+        "_white": "_black"
+    },
+    "blue_switch": {
+        "235, 235, 235": "235, 235, 255",
+        "245, 245, 245": "225, 225, 255",
+        "255, 255, 255": "245, 245, 255",
+        "240, 240, 240": "220, 220, 255",
+        "250, 250, 250": "210, 210, 255",
+        "220, 255, 220": "220, 220, 255",
+        "210, 255, 210": "210, 210, 255",
+        "_white": "_black"
+    },
+    "black_switch": {
+        "255, 255, 255": "20, 20, 20", 
+        "245, 245, 245": "40, 40, 40",
+        "235, 235, 235": "30, 30, 30", 
+        "240, 240, 240": "70, 70, 70",
+        "250, 250, 250": "80, 80, 80",
+        "220, 255, 220": "70, 70, 70",
+        "210, 255, 210": "80, 80, 80",
+        "0, 0, 0": "255, 255, 255",
+        "_black": "_white"
+    }
+}
@@ -1,109 +1,322 @@
-import os, sys, time, json, yara
-import numpy, pefile, onnxruntime
+import os, yara, time, numpy, base64, requests
+import ctypes, ctypes.wintypes, hashlib, onnxruntime
+
 from PIL import Image
+from io import BytesIO

-class YRScan:
+####################################################################################################
+
+class GUID(ctypes.Structure):
+    _fields_ = [
+        ("Data1", ctypes.wintypes.DWORD),
+        ("Data2", ctypes.wintypes.WORD),
+        ("Data3", ctypes.wintypes.WORD),
+        ("Data4", ctypes.c_ubyte * 8)]
+
+class WINTRUST_FILE_INFO(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
+        ("hFile", ctypes.wintypes.HANDLE),
+        ("pgKnownSubject", ctypes.wintypes.LPVOID)]
+
+class WINTRUST_DATA(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pPolicyCallbackData", ctypes.wintypes.LPVOID),
+        ("pSIPClientData", ctypes.wintypes.LPVOID),
+        ("dwUIChoice", ctypes.wintypes.DWORD),
+        ("fdwRevocationChecks", ctypes.wintypes.DWORD),
+        ("dwUnionChoice", ctypes.wintypes.DWORD),
+        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("dwStateAction", ctypes.wintypes.DWORD),
+        ("hWVTStateData", ctypes.wintypes.HANDLE),
+        ("pwszURLReference", ctypes.wintypes.LPCWSTR),
+        ("dwProvFlags", ctypes.wintypes.DWORD),
+        ("dwUIContext", ctypes.wintypes.DWORD),
+        ("pSignatureSettings", ctypes.wintypes.LPVOID)]
+
+####################################################################################################
+
+class sign_scanner:
    def __init__(self):
-        self.rules = {}
-        self.network = []
+        self.verify = GUID(0x00AAC56B, 0xCD44, 0x11D0, (0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
+
+    def init_windll(self, path):
+        for name in path:
+            try:
+                setattr(self, name.lower(), ctypes.WinDLL(name, use_last_error=True))
+            except Exception:
+                pass

-    def load_rules(self, file_path):
        try:
-            ftype = os.path.splitext(file_path)[-1].lower()
-            if ftype in [".yara", ".yar"]:
-                self.rules[file_path] = yara.compile(file_path)
-            elif ftype in [".yc", ".yrc"]:
-                self.rules[file_path] = yara.load(file_path)
-            elif ftype in [".ip", ".ips"]:
-                with open(file_path, "r") as f:
-                    self.network += [l.strip() for l in f.readlines()]
-        except Exception as e:
-            print(e)
-
-    def yr_scan(self, file_path):
-        try:
-            if isinstance(file_path, str):
-                with open(file_path, "rb") as f:
-                    file_path = f.read()
-            for name, rules in self.rules.items():
-                matchs_rules = rules.match(data=file_path)
-                if matchs_rules:
-                    label = str(matchs_rules[0]).split("_")[0]
-                    level = str(matchs_rules[0]).split("_")[-1]
-                    return f"Rules/{label}", level
-            return False, False
-        except Exception as e:
-            return False, False
-
-class DLScan:
-    def __init__(self):
-        self.models = {}
-        self.shells = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '!o',
-        'cry', 'test', 'ace', 'yg', 'obr', 'tvm', 'dec', 'enc', 'b1_', 'base',
-        'bss', 'clr_uef', 'cursors', 'trs_age', 'engine', 'enigma', 'protect',
-        'nep', 'no_bbt', 'wpp_sf', 'retpol', 'rt', 'rwexec', 'rygs', 'poolmi',
-        's:@', 'pgae', 'proxy', 'wisevec', 'segm', 'transit', 'vmp', 'extjmp',
-        'upx', 'tracesup', 'res', 'lzma', 'malloc_h', 'miniex', 'ndr64', 'be',
-        'mssmixer', 'wow', 'press', 'fio', 'pad', 'hexpthk', 'h~;', 'icapsec',
-        'sanontcp', 'secur', 'asmstub', 'nsys_wr', 'orpc', 'pack', 'wow64svc',
-        'uedbg', 'viahw', 'data', 'zk', 'fothk', 'qihoo']#"""
-
-    def load_model(self, file_path):
-        try:
-            ftype = os.path.splitext(file_path)[-1].lower()
-            if ftype in [".json", ".txt"]:
-                with open(file_path, 'r') as f:
-                    self.class_names = json.load(f)
-            elif ftype in [".onnx"]:
-                self.models[file_path] = onnxruntime.InferenceSession(file_path)
-            self.labels = self.class_names['Labels']
-            self.detect = self.class_names['Detect']
-            self.pixels = self.class_names['Pixels']
-            self.values = self.class_names['Values']
-            self.suffix = self.class_names['Suffix']
-        except Exception as e:
+            self.WinVerifyTrust = self.wintrust.WinVerifyTrust
+            self.WinVerifyTrust.restype = ctypes.wintypes.LONG
+            self.WinVerifyTrust.argtypes = [ctypes.wintypes.HWND, ctypes.POINTER(GUID), ctypes.c_void_p]
+        except Exception:
            pass

-    def dl_scan(self, file_data):
+    def sign_verify(self, file_path):
        try:
-            label_similarities = {label: [] for label in self.labels}
-            image_data = self.preprocess_image(file_data, tuple(self.pixels))
-            image_array = numpy.asarray(image_data).astype('float32') / 255.0
-            image_expand = numpy.expand_dims(image_array, axis=(0, -1))
-            for model_name, model in self.models.items():
-                input_name = model.get_inputs()[0].name
-                pre_answers = model.run(None, {input_name: image_expand})[0][0]
-                for k, score in enumerate(pre_answers):
-                    label_similarities[self.labels[k].strip()].append(score)
-            label_percentage = {label: (sum(similarities) / len(self.models)) * 100
-            for label, similarities in label_similarities.items()}
-            label, level = max(label_percentage.items(), key=lambda x: x[1])
-            return label, int(level)
-        except Exception as e:
+            fi = WINTRUST_FILE_INFO(ctypes.sizeof(WINTRUST_FILE_INFO), file_path, None, None)
+            data = WINTRUST_DATA(ctypes.sizeof(WINTRUST_DATA), None, None, 2, 0, 1,
+                ctypes.pointer(fi), 1, None, None, 0, 0, None)
+            s = self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
+            data.dwStateAction = 2
+            self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
+            return s == 0
+        except Exception:
+            return False
+
+####################################################################################################
+
+class rule_scanner:
+    def __init__(self):
+        self.rules = None
+        self.network = []
+
+    def load_path(self, path, callback=None):
+        yara_files = {}
+        for root, _, files in os.walk(path):
+            for file in files:
+                full_path = os.path.join(root, file)
+                if callback:
+                    callback(full_path)
+                ext = os.path.splitext(file)[1].lower()
+                if ext in ('.yara', '.yar'):
+                    namespace = os.path.relpath(full_path, path).replace(os.sep, '_')
+                    yara_files[namespace] = full_path
+                elif ext in ('.yc', '.yrc'):
+                    self.load_compiled_rule(full_path)
+                elif ext in ('.ip', '.txt'):
+                    self.load_network_list(full_path)
+
+        if yara_files:
+            self.compile_all_rules(yara_files)
+
+    def load_compiled_rule(self, file):
+        try:
+            self.rules = yara.load(file)
+        except Exception:
+            pass
+
+    def load_network_list(self, file):
+        try:
+            with open(file, "r", encoding="utf-8", errors="ignore") as f:
+                self.network.extend(line.strip() for line in f if line.strip())
+        except Exception:
+            pass
+
+    def compile_all_rules(self, file_map):
+        try:
+            self.rules = yara.compile(filepaths=file_map)
+        except Exception:
+            pass
+
+    def yara_scan(self, file_path):
+        try:
+            if not self.rules:
+                return False, False
+
+            matches = self.rules.match(filepath=file_path)
+            if matches:
+                rule_name = str(matches[0])
+                types = rule_name.split("_")[0]
+                label = rule_name.split("_")[1]
+                level = rule_name.split("_")[2]
+                return f"{types}/{label}", level
+            return False, False
+        except Exception:
            return False, False

-    def preprocess_image(self, file_data, target_size):
-        wah = int(numpy.ceil(numpy.sqrt(len(file_data))))
-        file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
-        image_array = numpy.zeros((wah * wah,), dtype=numpy.uint8)
-        image_array[:len(file_data)] = file_data
-        image = Image.fromarray(image_array.reshape((wah, wah)), 'L')
-        return image.resize(target_size, Image.Resampling.NEAREST)
+####################################################################################################

-    def get_type(self, file_path):
-        match_data = {}
-        ftype = os.path.splitext(file_path)[-1].lower()
-        if ftype in self.suffix:
+class model_scanner:
+    def __init__(self):
+        self.models = []
+        self.labels = ["Pefile/White", "Pefile/General"]
+        self.detect_set = {"Pefile/General"}
+        self.resize = (224, 224)
+
+    def load_path(self, path, callback=None):
+        for root, _, files in os.walk(path):
+            for file in files:
+                full_path = os.path.join(root, file)
+                if callback:
+                    callback(full_path)
+                self.load_file(full_path)
+
+    def load_file(self, file):
+        if file.lower().endswith('.onnx'):
            try:
-                with pefile.PE(file_path, fast_load=True) as pe:
-                    for section in pe.sections:
-                        section_name = section.Name.rstrip(b'\x00').decode('latin1')
-                        if (section.Characteristics & 0x00000020 and not
-                        any(shell in section_name.lower() for shell in self.shells)):
-                            match_data[section_name] = section.get_data()
-            except:
-                if ftype in [".bat", ".cmd", ".ps1", ".vbs", ".wsf", ".html", ".js", 
-                    ".txt", ".htm", ".hta", ".php", ".css", ".xml", ".json", ".wasm"]:
-                    with open(file_path, 'rb') as file:
-                        match_data[ftype] = file.read()
-        return match_data
+                session = onnxruntime.InferenceSession(file)
+                self.models.append(session)
+            except Exception:
+                return False
+
+    def model_scan(self, file_path, full_output=False):
+        if not self.models:
+            return (False, False) if not full_output else ([], str(file_path), None)
+
+        data = self.get_data(file_path)
+        if not data:
+            return (False, False) if not full_output else ([], str(file_path), None)
+
+        image = self.preprocess_image(data, self.resize)
+        if not image:
+            return (False, False) if not full_output else ([], str(file_path), None)
+
+        arr = numpy.asarray(image).astype('float32') / 255.0
+        arr = numpy.expand_dims(arr, axis=0)
+        if arr.ndim == 3:
+            arr = numpy.expand_dims(arr, axis=-1)
+
+        results = []
+        best_malicious = None
+
+        for model in self.models:
+            input_meta = model.get_inputs()[0]
+            input_name = input_meta.name
+            input_shape = input_meta.shape
+            
+            curr_arr = arr.copy()
+            if len(input_shape) == 4:
+                if input_shape[1] in (1, 3) and input_shape[3] not in (1, 3):
+                    curr_arr = curr_arr.transpose(0, 3, 1, 2)
+            
+            try:
+                probs = model.run(None, {input_name: curr_arr})[0]
+                pred = probs[0]
+            except Exception:
+                continue
+
+            idx = int(numpy.argmax(pred))
+            label = self.labels[idx] if idx < len(self.labels) else f"Class_{idx}"
+            conf = round(float(pred[idx]) * 100, 2)
+
+            if full_output:
+                results.append(("Whole File", label, conf, self.pil_to_base64(image)))
+            
+            if label in self.detect_set:
+                if best_malicious is None or conf > best_malicious[1]:
+                    best_malicious = (label, int(conf))
+
+        if full_output:
+            results.sort(key=lambda x: (x[1] not in self.detect_set, -x[2]))
+            malicious_count = sum(1 for _, lbl, _, _ in results if lbl in self.detect_set)
+            total = len(results)
+            return results, str(file_path), f"{malicious_count}/{total}"
+
+        return best_malicious if best_malicious else (False, False)
+
+    def pil_to_base64(self, img):
+        buf = BytesIO()
+        img.save(buf, format='PNG')
+        return base64.b64encode(buf.getvalue()).decode()
+
+    def preprocess_image(self, data, size, channels=1):
+        width, height = size
+        wah = int(numpy.ceil(numpy.sqrt(len(data) / channels)))
+        arr = numpy.frombuffer(data, dtype=numpy.uint8)
+        imgbuf = numpy.zeros(wah * wah * channels, dtype=numpy.uint8)
+        imgbuf[:len(arr)] = arr
+        image = Image.fromarray(imgbuf.reshape((wah, wah)), 'L')
+        return image.resize((width, height), Image.Resampling.NEAREST)
+
+    def get_data(self, file_path):
+        try:
+            with open(file_path, 'rb') as f:
+                return f.read()
+        except Exception:
+            return None
+
+####################################################################################################
+
+class cloud_scanner:
+    def __init__(self):
+        pass
+
+    def calc_hash(self, file_path, block_size=65536):
+        try:
+            h = hashlib.sha256()
+            with open(file_path, "rb") as f:
+                for chunk in iter(lambda: f.read(block_size), b""):
+                    h.update(chunk)
+            return h.hexdigest()
+        except Exception:
+            return ""
+
+    def upload_file(self, file_path, api_host, api_key):
+        try:
+            sha256 = self.calc_hash(file_path)
+            if not sha256:
+                return False, None
+
+            base = api_host.rstrip('/')
+            base_headers = {"X-API-Key": api_key, "User-Agent": "PYAS-Client/1.0"}
+
+            def _req(m, ep, files=None, **k):
+                try:
+                    return requests.request(m, f"{base}{ep}", headers=base_headers, files=files, timeout=120, **k)
+                except:
+                    return None
+
+            r = _req("GET", f"/api/processing_status/{sha256}")
+            status = r.json().get('status') if r and r.status_code == 200 else 'missing'
+            if status in ['failed', 'error']:
+                status = 'missing'
+
+            if status == 'missing':
+                with open(file_path, 'rb') as f:
+                    r = _req("POST", "/api/upload", files={'file': f})
+                    if not r or r.status_code != 200:
+                        return False, sha256
+
+            return True, sha256
+        except Exception:
+            return False, None
+
+    def get_result(self, sha256, api_host, api_key):
+        try:
+            if not sha256:
+                return False
+
+            base = api_host.rstrip('/')
+            headers = {"X-API-Key": api_key, "User-Agent": "PYAS-Client/1.0"}
+
+            def _req(m, ep, **k):
+                try:
+                    return requests.request(m, f"{base}{ep}", headers=headers, timeout=10, **k)
+                except:
+                    return None
+
+            for _ in range(30):
+                r = _req("GET", f"/api/processing_status/{sha256}")
+                st = r.json().get('status') if r else 'error'
+                if st == 'done':
+                    break
+                if st in ['error', 'failed']:
+                    return False
+                time.sleep(1)
+
+            r = _req("GET", f"/api/report/{sha256}")
+            if r and r.status_code == 200:
+                data = r.json().get('data', {})
+                res = data.get('detection', {}).get('results', {}).get('PYAS', {})
+                label = res.get('label', 'Unsupport')
+                sims = data.get('similar', [])
+
+                is_malicious = 'General' in label
+                sim_malicious_count = 0
+                valid_sim_count = 0
+                for s in sims:
+                    if s.get('similarity', 0) > 80:
+                        valid_sim_count += 1
+                        if "General" in s.get('label'):
+                            sim_malicious_count += 1
+
+                if is_malicious and (valid_sim_count == 0 or sim_malicious_count == valid_sim_count):
+                    return True
+        except Exception:
+            pass
+        return False
@@ -1,60 +0,0 @@
-translate_dict = {
-    "zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"已開啟","Off":"已關閉"},
-    "zh_CN": {"已開啟":"已开启","已關閉":"已关闭","On":"已开启","Off":"已关闭",
-              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
-              "錯誤":"错误","實時":"实时","發現":"发现","關閉":"关闭","裝置":"设备",
-              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-              "位元":"字节","彈窗":"弹窗","靈敏":"敏感","複製":"复制","開啟":"开启",
-              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
-              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
-              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
-              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
-              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
-              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
-              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
-              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
-              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
-              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
-              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
-              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","與":"与","記憶體":"内存",},
-    "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
-              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website ",
-              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","加載":"Load ",
-              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ",
-              "許可條款":"License Terms ","惡意":"Malicious","可疑":"Suspicious",
-              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
-              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
-              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
-              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
-              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
-              "藍色主題":"Blue","綠色主題":"Green","自定主題":"Custom","最新":"Latest ",
-              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
-              "註冊表":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
-              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
-              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
-              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
-              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
-              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
-              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
-              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
-              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
-              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
-              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"To ",
-              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
-              "分區":"Partition ","設定":"Settings","關於":"About","模式":"Mode ",
-              "提高":"Improve ","安全":"Security ","顯色":"Color ","主題":"Themes ",
-              "風險":"Risk ","介面":"GUI ","核心":"Core ","服務":"Services ",
-              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
-              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-              "增加到":"Add To ","白名單":"White List ","軟體":"Software ","正在":"",
-              "增加":"Add ","移除":"Delete","項目":"Items ","生成":"Create ","稱":"",
-              "複製":"Copy ","開啟":"Open ","此":"This ","並":"And ","全盤":"Full ",
-              "已經在":"Already ","數據庫":"Database ","誤報":"False Positive ",
-              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
-              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
-              "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","立即":"",
-              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
-              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
-              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
-              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ",
-              "竄改":"Tamper ","第三方":"Other ","與":"With ","  ":" "}}
@@ -1,10 +0,0 @@
-file_types = [
-    ".exe",".dll",".sys",".com",".scr",
-    ".zip",".7z",".rar",".tar",".gz",
-    ".js",".bat",".cmd",".ps1",".vbs",
-    ".ppt",".pptx",".wps",".txt",".rtf",
-    ".pdf",".xls",".xlsx",".doc",".docx",
-    ".jpg",".jpeg",".png",".webp",".gif",
-    ".mp3",".wav",".aac",".ogg",".flac",
-    ".mp4",".avi",".mov",".wmv",".mkv",
-    ".aux",".cur",".mui",".ttf",".efi"]
@@ -2,7 +2,7 @@ import pyinstaller_versionfile

 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.2.7',
+version='3.3.8',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",
@@ -0,0 +1,142 @@
+#pragma once
+#include <fltKernel.h>
+#include <ntddk.h>      
+#include <ntdddisk.h>   
+#include <ntddscsi.h> 
+#include <ntstrsafe.h>
+
+constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
+constexpr auto MAX_PATH_LEN = 1024;
+constexpr auto PYAS_POOL_TAG = 'SAYP';
+
+#ifndef PROCESS_TERMINATE
+#define PROCESS_TERMINATE                  (0x0001)
+#endif
+#ifndef PROCESS_CREATE_THREAD
+#define PROCESS_CREATE_THREAD              (0x0002)
+#endif
+#ifndef PROCESS_VM_OPERATION
+#define PROCESS_VM_OPERATION               (0x0008)
+#endif
+#ifndef PROCESS_VM_READ
+#define PROCESS_VM_READ                    (0x0010)
+#endif
+#ifndef PROCESS_VM_WRITE
+#define PROCESS_VM_WRITE                   (0x0020)
+#endif
+#ifndef PROCESS_DUP_HANDLE
+#define PROCESS_DUP_HANDLE                 (0x0040)
+#endif
+#ifndef PROCESS_CREATE_PROCESS
+#define PROCESS_CREATE_PROCESS             (0x0080)
+#endif
+#ifndef PROCESS_SET_INFORMATION
+#define PROCESS_SET_INFORMATION            (0x0200)
+#endif
+#ifndef PROCESS_QUERY_INFORMATION
+#define PROCESS_QUERY_INFORMATION          (0x0400)
+#endif
+#ifndef PROCESS_SUSPEND_RESUME
+#define PROCESS_SUSPEND_RESUME             (0x0800)
+#endif
+#ifndef PROCESS_QUERY_LIMITED_INFORMATION
+#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
+#endif
+#ifndef PROCESS_SET_QUOTA
+#define PROCESS_SET_QUOTA (0x0100)
+#endif
+
+#ifndef POOL_FLAG_NON_PAGED
+#define POOL_FLAG_NON_PAGED 0x0000000000000040UI64
+#endif
+
+#ifndef FSCTL_MANAGE_BYPASS_IO
+#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+typedef enum _FS_BPIO_OPERATIONS {
+    FS_BPIO_OP_ENABLE = 1,
+    FS_BPIO_OP_DISABLE = 2,
+    FS_BPIO_OP_QUERY = 3,
+    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
+    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
+    FS_BPIO_OP_STREAM_PAUSE = 6,
+    FS_BPIO_OP_STREAM_RESUME = 7,
+    FS_BPIO_OP_GET_INFO = 8
+} FS_BPIO_OPERATIONS;
+
+typedef struct _FS_BPIO_INPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG InFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
+
+typedef struct _FS_BPIO_OUTPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG OutFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+    NTSTATUS Status;
+} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
+
+#endif
+
+typedef struct _PYAS_MESSAGE {
+    ULONG MessageCode;
+    ULONG ProcessId;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_MESSAGE, * PPYAS_MESSAGE;
+
+typedef struct _DRIVER_DATA {
+    PDRIVER_OBJECT DriverObject;
+    PFLT_FILTER FilterHandle;
+    PFLT_PORT ServerPort;
+    PFLT_PORT ClientPort;
+    PEPROCESS PyasProcess;
+    ULONG PyasPid;
+    LARGE_INTEGER Cookie;
+    FAST_MUTEX PortMutex;
+    FAST_MUTEX TrackerMutex;
+    EX_RUNDOWN_REF PortRundown;
+} DRIVER_DATA, * PDRIVER_DATA;
+
+extern DRIVER_DATA GlobalData;
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+
+NTSTATUS InitializeProcessProtection();
+VOID UninitializeProcessProtection();
+NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
+VOID UninitializeRegistryProtection();
+
+VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
+
+BOOLEAN IsProcessTrusted(HANDLE ProcessId);
+BOOLEAN IsTargetProtected(HANDLE ProcessId);
+BOOLEAN IsInstallerProcess(HANDLE ProcessId);
+BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
+
+BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);
+BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName);
+BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName);
+BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Buffer, ULONG Length, BOOLEAN IsWrite);
+
+NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
+
+FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
+#if (NTDDI_VERSION >= NTDDI_WIN10_VB)
+    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
+#else
+    PVOID Buffer = ExAllocatePoolWithTag(NonPagedPoolNx, Size, PYAS_POOL_TAG);
+    if (Buffer) RtlZeroMemory(Buffer, Size);
+    return Buffer;
+#endif
+}
+
+FORCEINLINE VOID PyasFree(PVOID Ptr) {
+    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
+}
@@ -0,0 +1,141 @@
+#include "DriverCommon.h"
+
+DRIVER_DATA GlobalData;
+
+static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    UNREFERENCED_PARAMETER(VolumeDeviceType);
+    UNREFERENCED_PARAMETER(VolumeFilesystemType);
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS InstanceQueryTeardown(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    return STATUS_SUCCESS;
+}
+
+static VOID InstanceTeardownStart(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(Flags);
+
+    PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+    UninitializeRegistryProtection();
+    UninitializeProcessProtection();
+
+    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
+
+    if (GlobalData.ServerPort) {
+        FltCloseCommunicationPort(GlobalData.ServerPort);
+    }
+    if (GlobalData.FilterHandle) {
+        FltUnregisterFilter(GlobalData.FilterHandle);
+    }
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID* ConnectionPortCookie) {
+    UNREFERENCED_PARAMETER(ServerPortCookie);
+    UNREFERENCED_PARAMETER(ConnectionContext);
+    UNREFERENCED_PARAMETER(SizeOfContext);
+    UNREFERENCED_PARAMETER(ConnectionPortCookie);
+
+    ExAcquireFastMutex(&GlobalData.PortMutex);
+
+    GlobalData.ClientPort = ClientPort;
+    GlobalData.PyasPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
+    GlobalData.PyasProcess = PsGetCurrentProcess();
+
+    ExReInitializeRundownProtection(&GlobalData.PortRundown);
+
+    ExReleaseFastMutex(&GlobalData.PortMutex);
+
+    return STATUS_SUCCESS;
+}
+
+static VOID PortDisconnect(PVOID ConnectionCookie) {
+    UNREFERENCED_PARAMETER(ConnectionCookie);
+
+    ExAcquireFastMutex(&GlobalData.PortMutex);
+    GlobalData.ClientPort = NULL;
+    GlobalData.PyasPid = 0;
+    if (GlobalData.PyasProcess) {
+        GlobalData.PyasProcess = NULL;
+    }
+    ExReleaseFastMutex(&GlobalData.PortMutex);
+
+    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
+}
+
+CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
+    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
+    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
+    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
+    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
+    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
+    { IRP_MJ_OPERATION_END }
+};
+
+CONST FLT_REGISTRATION FilterRegistration = {
+    sizeof(FLT_REGISTRATION),
+    FLT_REGISTRATION_VERSION,
+    0,
+    NULL,
+    Callbacks,
+    DriverUnload,
+    InstanceSetup,
+    InstanceQueryTeardown,
+    InstanceTeardownStart,
+    InstanceTeardownComplete,
+    NULL,
+    NULL,
+    NULL
+};
+
+extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
+    UNREFERENCED_PARAMETER(RegistryPath);
+
+    NTSTATUS status = STATUS_SUCCESS;
+    PSECURITY_DESCRIPTOR sd = NULL;
+    OBJECT_ATTRIBUTES oa = { 0 };
+    UNICODE_STRING name = { 0 };
+
+    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
+    GlobalData.DriverObject = DriverObject;
+    ExInitializeFastMutex(&GlobalData.PortMutex);
+    ExInitializeFastMutex(&GlobalData.TrackerMutex);
+
+    ExInitializeRundownProtection(&GlobalData.PortRundown);
+
+    status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
+    if (!NT_SUCCESS(status)) return status;
+
+    status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
+    if (NT_SUCCESS(status)) {
+        RtlInitUnicodeString(&name, PYAS_PORT_NAME);
+        InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, sd);
+        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, NULL, 1);
+        FltFreeSecurityDescriptor(sd);
+    }
+
+    if (!NT_SUCCESS(status)) {
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        return status;
+    }
+
+    InitializeProcessProtection();
+    InitializeRegistryProtection(DriverObject);
+    PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+
+    return FltStartFiltering(GlobalData.FilterHandle);
+}
@@ -0,0 +1,52 @@
+[Version]
+Signature   = "$WINDOWS NT$"
+Class       = ActivityMonitor
+ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}
+Provider    = %ManufacturerName%
+DriverVer   = 12/29/2025,1.0.0.0
+CatalogFile = PYAS_Driver.cat
+PnpLockdown = 1
+
+[DestinationDirs]
+DefaultDestDir          = 12
+PYAS_Driver.DriverFiles = 12
+
+[SourceDisksNames]
+1 = %DiskName%,,,""
+
+[SourceDisksFiles]
+PYAS_Driver.sys = 1,,
+
+[DefaultInstall.NTamd64]
+OptionDesc = %ServiceDescription%
+CopyFiles  = PYAS_Driver.DriverFiles
+
+[DefaultInstall.NTamd64.Services]
+AddService = %ServiceName%,,PYAS_Driver.Service
+
+[PYAS_Driver.DriverFiles]
+PYAS_Driver.sys
+
+[PYAS_Driver.Service]
+DisplayName      = %ServiceName%
+Description      = %ServiceDescription%
+ServiceBinary    = %12%\PYAS_Driver.sys
+Dependencies     = FltMgr
+ServiceType      = 2
+StartType        = 3
+ErrorControl     = 1
+LoadOrderGroup   = "FSFilter Activity Monitor"
+AddReg           = PYAS_Driver.AddReg
+
+[PYAS_Driver.AddReg]
+HKR,"Parameters","DebugFlags",0x00010001,0x0
+HKR,"Parameters","SupportedFeatures",0x00010001,0x3
+HKR,"Parameters\Instances","DefaultInstance",0x00000000,"PYAS Instance"
+HKR,"Parameters\Instances\PYAS Instance","Altitude",0x00000000,"320000"
+HKR,"Parameters\Instances\PYAS Instance","Flags",0x00010001,0x0
+
+[Strings]
+ManufacturerName   = "PYAS Security"
+DiskName           = "PYAS_Driver Source Disk"
+ServiceName        = "PYAS_Driver"
+ServiceDescription = "PYAS Security Driver"
@@ -0,0 +1,35 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.14.36518.9 d17.14
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PYAS_Driver", "PYAS_Driver.vcxproj", "{699C79A8-A904-1976-F72A-CDD7E811CFD2}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|ARM64 = Debug|ARM64
+		Debug|x64 = Debug|x64
+		Release|ARM64 = Release|ARM64
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Debug|ARM64.ActiveCfg = Debug|ARM64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Debug|ARM64.Build.0 = Debug|ARM64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Debug|ARM64.Deploy.0 = Debug|ARM64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Debug|x64.ActiveCfg = Debug|x64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Debug|x64.Build.0 = Debug|x64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Debug|x64.Deploy.0 = Debug|x64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Release|ARM64.ActiveCfg = Release|ARM64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Release|ARM64.Build.0 = Release|ARM64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Release|ARM64.Deploy.0 = Release|ARM64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Release|x64.ActiveCfg = Release|x64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Release|x64.Build.0 = Release|x64
+		{699C79A8-A904-1976-F72A-CDD7E811CFD2}.Release|x64.Deploy.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {D166699A-50D5-470E-9559-39B8E842528D}
+	EndGlobalSection
+EndGlobal
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|ARM64">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM64">
+      <Configuration>Release</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{699C79A8-A904-1976-F72A-CDD7E811CFD2}</ProjectGuid>
+    <TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
+    <Configuration>Debug</Configuration>
+    <Platform Condition="'$(Platform)' == ''">x64</Platform>
+    <RootNamespace>PYAS_Driver</RootNamespace>
+    <WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+    <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+    <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+    <EnableInf2cat>false</EnableInf2cat>
+    <Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+    <Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <DriverSign>
+      <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
+    </DriverSign>
+    <ClCompile>
+      <LanguageStandard>stdcpp20</LanguageStandard>
+      <TreatWarningAsError>false</TreatWarningAsError>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>$(DDK_LIB_PATH)fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <DriverSign>
+      <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
+    </DriverSign>
+    <ClCompile>
+      <TreatWarningAsError>false</TreatWarningAsError>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>$(DDK_LIB_PATH)fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <Inf Include="PYAS_Driver.inf" />
+  </ItemGroup>
+  <ItemGroup>
+    <FilesToPackage Include="$(TargetPath)" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="DriverCommon.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="DriverEntry.cpp" />
+    <ClCompile Include="ProtectBoot.cpp" />
+    <ClCompile Include="ProtectFile.cpp" />
+    <ClCompile Include="ProtectProcess.cpp" />
+    <ClCompile Include="ProtectRegistry.cpp" />
+    <ClCompile Include="ProtectRules.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+    <Filter Include="Driver Files">
+      <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
+      <Extensions>inf;inv;inx;mof;mc;</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <Inf Include="PYAS_Driver.inf">
+      <Filter>Driver Files</Filter>
+    </Inf>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="DriverCommon.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="ProtectRules.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="ProtectFile.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="ProtectBoot.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="ProtectRegistry.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="ProtectProcess.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="DriverEntry.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,34 @@
+#include "DriverCommon.h"
+
+#ifndef IOCTL_DISK_FORMAT_TRACKS
+#define IOCTL_DISK_FORMAT_TRACKS        CTL_CODE(IOCTL_DISK_BASE, 0x0006, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#endif
+#ifndef IOCTL_DISK_FORMAT_TRACKS_EX
+#define IOCTL_DISK_FORMAT_TRACKS_EX     CTL_CODE(IOCTL_DISK_BASE, 0x000b, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#endif
+
+FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+
+    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    ULONG IoControlCode = Data->Iopb->Parameters.DeviceIoControl.Common.IoControlCode;
+
+    if (IoControlCode == IOCTL_DISK_SET_DRIVE_LAYOUT_EX ||
+        IoControlCode == IOCTL_SCSI_PASS_THROUGH_DIRECT ||
+        IoControlCode == IOCTL_DISK_FORMAT_TRACKS ||
+        IoControlCode == IOCTL_DISK_FORMAT_TRACKS_EX) {
+
+        HANDLE Pid = PsGetCurrentProcessId();
+        if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+            UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
+            SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
+            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+            return FLT_PREOP_COMPLETE;
+        }
+    }
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
@@ -0,0 +1,236 @@
+#include "DriverCommon.h"
+
+static BOOLEAN IsHoneyToken(PUNICODE_STRING Path) {
+    if (!Path || !Path->Buffer) return FALSE;
+    if (WildcardMatch(L"*PYAS_Honey*", Path->Buffer, Path->Length) ||
+        WildcardMatch(L"*Backup_Secret*", Path->Buffer, Path->Length)) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+
+    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
+    UNICODE_STRING FileName = { 0 };
+    NTSTATUS status = STATUS_SUCCESS;
+    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+    if (!NT_SUCCESS(status) || !nameInfo) {
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    status = FltParseFileNameInformation(nameInfo);
+    if (!NT_SUCCESS(status)) {
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    FileName = nameInfo->Name;
+    if (!FileName.Buffer || FileName.Length == 0) {
+        goto cleanup;
+    }
+
+    HANDLE Pid = PsGetCurrentProcessId();
+    BOOLEAN Trusted = IsProcessTrusted(Pid);
+
+    if (IsHoneyToken(&FileName)) {
+        if (!Trusted) {
+            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE)) {
+                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                callbackStatus = FLT_PREOP_COMPLETE;
+                goto cleanup;
+            }
+        }
+    }
+
+    if (WildcardMatch(L"\\Device\\PhysicalDrive*", FileName.Buffer, FileName.Length) ||
+        (WildcardMatch(L"\\Device\\Harddisk*", FileName.Buffer, FileName.Length) && !WildcardMatch(L"*Volume*", FileName.Buffer, FileName.Length))) {
+
+        if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
+            (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE | WRITE_DAC | WRITE_OWNER)) {
+
+            if (!Trusted && !IsInstallerProcess(Pid)) {
+                UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
+                SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                callbackStatus = FLT_PREOP_COMPLETE;
+                goto cleanup;
+            }
+        }
+    }
+
+    if (CheckProtectedPathRule(&FileName)) {
+        if (!Trusted) {
+            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE | WRITE_DAC | GENERIC_WRITE)) {
+                SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                callbackStatus = FLT_PREOP_COMPLETE;
+                goto cleanup;
+            }
+        }
+    }
+
+    if (CheckFileExtensionRule(&FileName)) {
+        if (!Trusted) {
+            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (DELETE | FILE_DELETE_CHILD)) {
+                if (CheckRansomActivity(Pid, &FileName, NULL, 0, FALSE)) {
+                    SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
+                    Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                    callbackStatus = FLT_PREOP_COMPLETE;
+                    goto cleanup;
+                }
+            }
+        }
+    }
+
+cleanup:
+    if (nameInfo) {
+        FltReleaseFileNameInformation(nameInfo);
+    }
+    return callbackStatus;
+}
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+
+    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    FILE_INFORMATION_CLASS infoClass = Data->Iopb->Parameters.SetFileInformation.FileInformationClass;
+
+    if (infoClass != FileDispositionInformation &&
+        infoClass != FileRenameInformation &&
+        infoClass != FileRenameInformationEx) {
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
+    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+
+    if (!NT_SUCCESS(status) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    status = FltParseFileNameInformation(nameInfo);
+    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) {
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    HANDLE Pid = PsGetCurrentProcessId();
+    if (!IsProcessTrusted(Pid)) {
+        if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
+            if (CheckRansomActivity(Pid, &nameInfo->Name, NULL, 0, FALSE)) {
+                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                FltReleaseFileNameInformation(nameInfo);
+                return FLT_PREOP_COMPLETE;
+            }
+        }
+    }
+
+    if (nameInfo) {
+        FltReleaseFileNameInformation(nameInfo);
+    }
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+
+    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) {
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    ULONG WriteLength = Data->Iopb->Parameters.Write.Length;
+    if (WriteLength == 0) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
+    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+
+    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    if (NT_SUCCESS(status) && nameInfo) {
+        status = FltParseFileNameInformation(nameInfo);
+        if (NT_SUCCESS(status) && nameInfo->Name.Buffer) {
+
+            if (CheckFileExtensionRule(&nameInfo->Name)) {
+                HANDLE Pid = PsGetCurrentProcessId();
+
+                if (!IsProcessTrusted(Pid)) {
+
+                    PVOID SystemBuffer = NULL;
+                    PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
+
+                    if (!Mdl) {
+                        if (Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) {
+                            if (NT_SUCCESS(FltLockUserBuffer(Data))) {
+                                Mdl = Data->Iopb->Parameters.Write.MdlAddress;
+                            }
+                        }
+                    }
+
+                    if (Mdl) {
+                        SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
+                    }
+
+                    if (SystemBuffer) {
+                        if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
+                            if (!IsInstallerProcess(Pid)) {
+                                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                                callbackStatus = FLT_PREOP_COMPLETE;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        FltReleaseFileNameInformation(nameInfo);
+    }
+    return callbackStatus;
+}
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+
+    if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode != FSCTL_MANAGE_BYPASS_IO) {
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    PFS_BPIO_INPUT InputBuffer = (PFS_BPIO_INPUT)Data->Iopb->Parameters.FileSystemControl.Neither.InputBuffer;
+    if (!InputBuffer) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    __try {
+        if (InputBuffer->Operation == FS_BPIO_OP_ENABLE) {
+            PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
+            if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) {
+                if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) {
+                    if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
+
+                        Data->IoStatus.Status = STATUS_NOT_SUPPORTED;
+                        FltReleaseFileNameInformation(nameInfo);
+                        return FLT_PREOP_COMPLETE;
+                    }
+                }
+                FltReleaseFileNameInformation(nameInfo);
+            }
+        }
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
@@ -0,0 +1,137 @@
+#include "DriverCommon.h"
+
+PVOID ObRegistrationHandle = NULL;
+OB_CALLBACK_REGISTRATION ObRegistration;
+OB_OPERATION_REGISTRATION ObCallbacks[1];
+
+static BOOLEAN IsSystemImage(PUNICODE_STRING FullImageName) {
+    if (!FullImageName || !FullImageName->Buffer) return FALSE;
+
+    if (WildcardMatch(L"*\\Windows\\System32\\*", FullImageName->Buffer, FullImageName->Length) ||
+        WildcardMatch(L"*\\Windows\\SysWOW64\\*", FullImageName->Buffer, FullImageName->Length) ||
+        WildcardMatch(L"*\\Windows\\WinSxS\\*", FullImageName->Buffer, FullImageName->Length)) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo) {
+    UNREFERENCED_PARAMETER(ImageInfo);
+
+    if (KeGetCurrentIrql() > APC_LEVEL) return;
+    if (!FullImageName || !FullImageName->Buffer) return;
+    if (ProcessId == (HANDLE)0) return;
+
+    if (IsSystemImage(FullImageName)) return;
+
+    if (IsTargetProtected(ProcessId)) {
+        if (CheckFileExtensionRule(FullImageName)) {
+            SendMessageToUser(6001, (ULONG)(ULONG_PTR)ProcessId, FullImageName->Buffer, FullImageName->Length);
+        }
+    }
+}
+
+static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
+    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
+    NTSTATUS status;
+    BOOLEAN isBlacklisted = FALSE;
+    PEPROCESS Process = NULL;
+    PUNICODE_STRING imageFileName = NULL;
+
+    status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(status)) return FALSE;
+
+    status = SeLocateProcessImageName(Process, &imageFileName);
+
+    if (NT_SUCCESS(status) && imageFileName) {
+        if (imageFileName->Buffer) {
+            if (WildcardMatch(L"*Taskmgr.exe", imageFileName->Buffer, imageFileName->Length) ||
+                WildcardMatch(L"*taskkill.exe", imageFileName->Buffer, imageFileName->Length) ||
+                WildcardMatch(L"*ProcessHacker.exe", imageFileName->Buffer, imageFileName->Length) ||
+                WildcardMatch(L"*procmon.exe", imageFileName->Buffer, imageFileName->Length)) {
+                isBlacklisted = TRUE;
+            }
+        }
+        ExFreePool(imageFileName);
+    }
+
+    ObDereferenceObject(Process);
+    return isBlacklisted;
+}
+
+static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    UNREFERENCED_PARAMETER(RegistrationContext);
+
+    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
+
+    PEPROCESS TargetProcess = (PEPROCESS)OperationInformation->Object;
+    if (!TargetProcess) return OB_PREOP_SUCCESS;
+
+    HANDLE TargetPid = PsGetProcessId(TargetProcess);
+    HANDLE SourcePid = PsGetCurrentProcessId();
+
+    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
+
+    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
+    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
+
+    BOOLEAN bProtected = IsTargetProtected(TargetPid);
+
+    if (bProtected) {
+        BOOLEAN bIsInstaller = IsInstallerProcess(SourcePid);
+
+        if (bIsInstaller) {
+            if (IsBlacklistedAdminTool(SourcePid)) {
+                bIsInstaller = FALSE;
+            }
+        }
+
+        if (bIsInstaller) return OB_PREOP_SUCCESS;
+
+        ACCESS_MASK DenyMask = PROCESS_TERMINATE |
+            PROCESS_VM_OPERATION |
+            PROCESS_VM_WRITE |
+            PROCESS_CREATE_THREAD |
+            PROCESS_VM_READ |
+            PROCESS_DUP_HANDLE |
+            PROCESS_SUSPEND_RESUME |
+            PROCESS_SET_INFORMATION |
+            PROCESS_SET_QUOTA;
+
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess &= ~DenyMask;
+
+        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess &= ~DenyMask;
+        }
+    }
+
+    return OB_PREOP_SUCCESS;
+}
+
+NTSTATUS InitializeProcessProtection() {
+    static UNICODE_STRING Altitude = { 0 };
+    RtlInitUnicodeString(&Altitude, L"320000");
+
+    ObCallbacks[0].ObjectType = PsProcessType;
+    ObCallbacks[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    ObCallbacks[0].PreOperation = PreOpenProcess;
+    ObCallbacks[0].PostOperation = NULL;
+
+    ObRegistration.Version = OB_FLT_REGISTRATION_VERSION;
+    ObRegistration.OperationRegistrationCount = 1;
+    ObRegistration.Altitude = Altitude;
+    ObRegistration.RegistrationContext = NULL;
+    ObRegistration.OperationRegistration = ObCallbacks;
+
+    return ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+}
+
+VOID UninitializeProcessProtection() {
+    if (ObRegistrationHandle) {
+        ObUnRegisterCallbacks(ObRegistrationHandle);
+        ObRegistrationHandle = NULL;
+    }
+}
@@ -0,0 +1,51 @@
+#include "DriverCommon.h"
+
+LARGE_INTEGER Cookie;
+
+static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID Argument2) {
+    UNREFERENCED_PARAMETER(CallbackContext);
+
+    if (KeGetCurrentIrql() > APC_LEVEL) return STATUS_SUCCESS;
+
+    REG_NOTIFY_CLASS Class = (REG_NOTIFY_CLASS)(ULONG_PTR)Argument1;
+
+    if (Class == RegNtPreSetValueKey || Class == RegNtPreDeleteKey || Class == RegNtPreCreateKey) {
+        REG_SET_VALUE_KEY_INFORMATION* Info = (REG_SET_VALUE_KEY_INFORMATION*)Argument2;
+        PCUNICODE_STRING KeyName = NULL;
+
+        if (!NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
+            return STATUS_SUCCESS;
+        }
+
+        if (KeyName && KeyName->Buffer) {
+            if (CheckRegistryRule(KeyName)) {
+                HANDLE Pid = PsGetCurrentProcessId();
+                if (!IsProcessTrusted(Pid)) {
+                    if (!IsInstallerProcess(Pid)) {
+                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
+                        CmCallbackReleaseKeyObjectIDEx(KeyName);
+                        return STATUS_ACCESS_DENIED;
+                    }
+                }
+            }
+        }
+
+        if (KeyName) {
+            CmCallbackReleaseKeyObjectIDEx(KeyName);
+        }
+    }
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject) {
+    UNICODE_STRING Altitude;
+    RtlInitUnicodeString(&Altitude, L"320000");
+    return CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+}
+
+VOID UninitializeRegistryProtection() {
+    if (Cookie.QuadPart != 0) {
+        CmUnRegisterCallback(Cookie);
+        Cookie.QuadPart = 0;
+    }
+}
@@ -0,0 +1,487 @@
+#include "DriverCommon.h"
+
+constexpr auto MAX_TRACKERS = 64;
+constexpr auto RANSOM_TIME_WINDOW_MS = 3000;
+constexpr auto RANSOM_COUNT_THRESHOLD = 5;
+constexpr auto HIGH_ENTROPY_THRESHOLD = 15;
+
+typedef struct _RANSOM_TRACKER {
+    HANDLE ProcessId;
+    ULONG ActivityCount;
+    LARGE_INTEGER LastActivityTime;
+} RANSOM_TRACKER, * PRANSOM_TRACKER;
+
+RANSOM_TRACKER RansomTrackers[MAX_TRACKERS];
+
+static BOOLEAN HasSuffix(PCUNICODE_STRING String, PCWSTR Suffix) {
+    if (!String || !String->Buffer || !Suffix) return FALSE;
+
+    SIZE_T SuffixLenBytes = 0;
+    while (Suffix[SuffixLenBytes / sizeof(WCHAR)] != L'\0') {
+        SuffixLenBytes += sizeof(WCHAR);
+    }
+
+    if (String->Length < SuffixLenBytes) return FALSE;
+
+    UNICODE_STRING SuffixPart{};
+    SuffixPart.Buffer = (PWCH)((PUCHAR)String->Buffer + String->Length - SuffixLenBytes);
+    SuffixPart.Length = (USHORT)SuffixLenBytes;
+    SuffixPart.MaximumLength = (USHORT)SuffixLenBytes;
+
+    UNICODE_STRING TargetSuffix;
+    RtlInitUnicodeString(&TargetSuffix, Suffix);
+
+    return RtlEqualUnicodeString(&SuffixPart, &TargetSuffix, TRUE);
+}
+
+BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
+    if (!Pattern || !String) return FALSE;
+
+    PCWSTR mp = NULL;
+    PCWSTR cp = NULL;
+    PCWSTR StringEnd = (PCWSTR)((PUCHAR)String + StringLengthBytes);
+
+    while ((PUCHAR)String < (PUCHAR)StringEnd) {
+        WCHAR pChar = *Pattern;
+        WCHAR sChar = *String;
+
+        if (pChar == L'*') {
+            if (!*++Pattern) return TRUE;
+            mp = Pattern;
+            cp = String + 1;
+        }
+        else if ((RtlDowncaseUnicodeChar(pChar) == RtlDowncaseUnicodeChar(sChar)) || pChar == L'?') {
+            Pattern++;
+            String++;
+        }
+        else if (mp) {
+            Pattern = mp;
+            String = cp++;
+        }
+        else {
+            return FALSE;
+        }
+    }
+
+    while (*Pattern == L'*') Pattern++;
+    return !*Pattern && ((PUCHAR)String >= (PUCHAR)StringEnd);
+}
+
+const PCWSTR RegistryBlockList[] = {
+    L"\\REGISTRY\\MACHINE\\BCD00000000\\*",
+    L"\\REGISTRY\\MACHINE\\SAM\\*",
+    L"\\REGISTRY\\MACHINE\\SECURITY\\*",
+    L"\\REGISTRY\\USER\\*_Classes\\*\\shell\\open\\command\\*",
+    L"\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\NetWire\\*",
+    L"\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\Remcos*\\*",
+    L"\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\DC3_FEXEC\\*",
+    L"*\\DisableAntiSpyware",
+    L"*\\DisableWindowsUpdateAccess",
+    L"*\\EnableLUA",
+    L"*\\ConsentPromptBehaviorAdmin",
+    L"*\\NoControlPanel",
+    L"*\\NoDrives",
+    L"*\\NoFileMenu",
+    L"*\\NoFind",
+    L"*\\NoStartMenuPinnedList",
+    L"*\\NoSetFolders",
+    L"*\\NoSetFolderOptions",
+    L"*\\NoViewOnDrive",
+    L"*\\NoClose",
+    L"*\\NoDesktop",
+    L"*\\NoLogoff",
+    L"*\\NoFolderOptions",
+    L"*\\RestrictRun",
+    L"*\\NoViewContextMenu",
+    L"*\\HideClock",
+    L"*\\NoStartMenuMyGames",
+    L"*\\NoStartMenuMyMusic",
+    L"*\\DisableCMD",
+    L"*\\NoAddingComponents",
+    L"*\\NoWinKeys",
+    L"*\\NoStartMenuLogOff",
+    L"*\\NoSimpleNetIDList",
+    L"*\\NoLowDiskSpaceChecks",
+    L"*\\DisableLockWorkstation",
+    L"*\\Restrict_Run",
+    L"*\\DisableTaskMgr",
+    L"*\\DisableRegistryTools",
+    L"*\\DisableChangePassword",
+    L"*\\Wallpaper",
+    L"*\\NoComponents",
+    L"*\\NoStartMenuMorePrograms",
+    L"*\\NoActiveDesktop",
+    L"*\\NoSetActiveDesktop",
+    L"*\\NoRecentDocsMenu",
+    L"*\\NoWindowsUpdate",
+    L"*\\NoChangeStartMenu",
+    L"*\\NoFavoritesMenu",
+    L"*\\NoRecentDocsHistory",
+    L"*\\NoSetTaskbar",
+    L"*\\NoSMHelp",
+    L"*\\NoTrayContextMenu",
+    L"*\\NoManageMyComputerVerb",
+    L"*\\NoRealMode",
+    L"*\\NoRun",
+    L"*\\ClearRecentDocsOnExit",
+    L"*\\NoActiveDesktopChanges",
+    L"*\\NoStartMenuNetworkPlaces",
+    L"*\\NoLockScreen",
+    L"*\\HideFastUserSwitching",
+    L"*\\ConsentPromptBehaviorUser",
+    L"*\\EnableSecureUIAPaths",
+    L"*\\NoSRM",
+    L"*\\NoInteractiveServices",
+    L"*\\ShutdownWithoutLogon",
+    L"*\\AutoAdminLogon",
+    L"*\\ImagePath",
+    L"*\\BootExecute",
+    L"*\\SubSystems",
+    L"*\\FirmwareBootDevice",
+    L"*\\BootDriverFlags",
+    L"*\\SystemStartOptions",
+    L"*\\CrashDumpEnabled",
+    L"*\\DisableAutomaticRestartOnFailure",
+    L"*\\SystemBiosVersion",
+    L"*\\NoTheme",
+    L"*\\PendingFileRenameOperations",
+    L"*\\SystemSetupInProgress",
+    L"*\\CmdLine",
+    L"*\\SetupType",
+    L"*\\AutoReboot",
+    L"*\\Userinit",
+    L"*\\UIHost",
+    L"*\\Debugger",
+    L"*\\DefaultUserName",
+    L"*\\DefaultPassword",
+    L"*\\AltDefaultUserName",
+    L"*\\AltDefaultPassword",
+    L"*\\DisableCAD",
+    L"*\\LegalNoticeCaption",
+    L"*\\LegalNoticeText",
+    L"*\\Run",
+    L"*\\RunOnce",
+    L"*\\Image File Execution Options\\*"
+};
+
+const PCWSTR DangerousExtensions[] = {
+    L".exe", L".dll", L".sys", L".com", L".scr",
+    L".zip", L".7z", L".rar", L".tar", L".gz",
+    L".js", L".bat", L".cmd", L".ps1", L".vbs",
+    L".ppt", L".pptx", L".wps", L".txt", L".rtf",
+    L".pdf", L".xls", L".xlsx", L".doc", L".docx",
+    L".jpg", L".jpeg", L".png", L".webp", L".gif",
+    L".mp3", L".wav", L".aac", L".ogg", L".flac",
+    L".mp4", L".avi", L".mov", L".wmv", L".mkv",
+    L".aux", L".cur", L".mui", L".ttf", L".efi"
+};
+
+const PCWSTR NaturallyCompressedExtensions[] = {
+    L".zip", L".7z", L".rar", L".tar", L".gz",
+    L".jpg", L".jpeg", L".png", L".webp", L".gif",
+    L".mp3", L".wav", L".aac", L".ogg", L".flac",
+    L".mp4", L".avi", L".mov", L".wmv", L".mkv",
+    L".exe", L".dll", L".sys", L".mui",
+    L".docx", L".xlsx", L".pptx", L".odt", L".ods"
+};
+
+const PCWSTR ProtectedPaths[] = {
+    L"*\\System32\\drivers\\etc\\hosts",
+    L"*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+    L"\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\System32\\*.dll",
+    L"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
+    L"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.dll",
+    L"\\Device\\HarddiskVolume*\\bootmgr",
+    L"\\Device\\HarddiskVolume*\\EFI\\*",
+    L"*\\PYAS.exe",
+    L"*\\PYAS_Driver.sys"
+};
+
+const PCWSTR TrustedInstallerPatterns[] = {
+    L"*setup*",
+    L"*install*",
+    L"*update*",
+    L"*unins*",
+    L"*patch*",
+    L"*msiexec*",
+    L"*tiworker*",
+    L"*trustedinstaller*",
+    L"*dism*",
+    L"*pkgmgr*",
+    L"*wuauclt*",
+    L"*svchost*",
+    L"*taskhost*",
+    L"*googleupdate*",
+    L"*steam*",
+    L"*origin*",
+    L"*battle.net*",
+    L"*avast*",
+    L"*avg*"
+};
+
+BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
+    if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
+    if (ProcessId == (HANDLE)4) return TRUE;
+    return FALSE;
+}
+
+BOOLEAN IsTargetProtected(HANDLE ProcessId) {
+    if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
+    return FALSE;
+}
+BOOLEAN IsInstallerProcess(HANDLE ProcessId) {
+    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
+    NTSTATUS status;
+    BOOLEAN isTrusted = FALSE;
+    PEPROCESS Process = NULL;
+    PUNICODE_STRING imageFileName = NULL;
+
+    status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(status)) return FALSE;
+
+    status = SeLocateProcessImageName(Process, &imageFileName);
+
+    if (NT_SUCCESS(status) && imageFileName) {
+        if (imageFileName->Buffer) {
+            for (int i = 0; i < sizeof(TrustedInstallerPatterns) / sizeof(TrustedInstallerPatterns[0]); i++) {
+                if (WildcardMatch(TrustedInstallerPatterns[i], imageFileName->Buffer, imageFileName->Length)) {
+                    isTrusted = TRUE;
+                    break;
+                }
+            }
+        }
+        ExFreePool(imageFileName);
+    }
+
+    ObDereferenceObject(Process);
+    return isTrusted;
+}
+
+BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName) {
+    if (!KeyName || !KeyName->Buffer) return FALSE;
+    for (int i = 0; i < sizeof(RegistryBlockList) / sizeof(RegistryBlockList[0]); i++) {
+        if (WildcardMatch(RegistryBlockList[i], KeyName->Buffer, KeyName->Length)) return TRUE;
+    }
+    return FALSE;
+}
+
+BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName) {
+    if (!FileName || !FileName->Buffer) return FALSE;
+
+    for (int i = 0; i < sizeof(DangerousExtensions) / sizeof(DangerousExtensions[0]); i++) {
+        if (HasSuffix(FileName, DangerousExtensions[i])) {
+            return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName) {
+    if (!FileName || !FileName->Buffer) return FALSE;
+
+    for (int i = 0; i < sizeof(ProtectedPaths) / sizeof(ProtectedPaths[0]); i++) {
+        if (WildcardMatch(ProtectedPaths[i], FileName->Buffer, FileName->Length)) return TRUE;
+    }
+    return FALSE;
+}
+
+static BOOLEAN IsHighEntropy(PVOID Buffer, ULONG Length) {
+    if (!Buffer || Length < 256) return FALSE;
+
+    ULONG Histogram[256] = { 0 };
+    PUCHAR Ptr = (PUCHAR)Buffer;
+    ULONG ScanLen = (Length > 1024) ? 1024 : Length;
+
+    __try {
+        for (ULONG i = 0; i < ScanLen; i++) {
+            Histogram[Ptr[i]]++;
+        }
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        return FALSE;
+    }
+
+    ULONG MaxFreq = 0;
+    for (int i = 0; i < 256; i++) {
+        if (Histogram[i] > MaxFreq) MaxFreq = Histogram[i];
+    }
+
+    ULONG ExpectedAvg = ScanLen / 256;
+    if (MaxFreq < (ExpectedAvg + HIGH_ENTROPY_THRESHOLD)) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+static BOOLEAN IsNaturallyCompressed(PCUNICODE_STRING FileName) {
+    if (!FileName || !FileName->Buffer) return FALSE;
+
+    for (int i = 0; i < sizeof(NaturallyCompressedExtensions) / sizeof(NaturallyCompressedExtensions[0]); i++) {
+        if (HasSuffix(FileName, NaturallyCompressedExtensions[i])) {
+            return TRUE;
+        }
+    }
+    return FALSE;
+}
+
+static BOOLEAN IsNoisyRansomPath(PCUNICODE_STRING FileName) {
+    if (!FileName || !FileName->Buffer) return FALSE;
+
+    if (WildcardMatch(L"*\\Windows\\Temp\\*", FileName->Buffer, FileName->Length) ||
+        WildcardMatch(L"*\\AppData\\Local\\*", FileName->Buffer, FileName->Length) ||
+        WildcardMatch(L"*\\Windows\\SystemTemp\\*", FileName->Buffer, FileName->Length) ||
+        WildcardMatch(L"*\\Program Files*\\*\\Temp\\*", FileName->Buffer, FileName->Length) ||
+        WildcardMatch(L"*$Recycle.Bin*", FileName->Buffer, FileName->Length)) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+static BOOLEAN IsExplorerProcess(HANDLE ProcessId) {
+    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
+    NTSTATUS status;
+    BOOLEAN isExplorer = FALSE;
+    PEPROCESS Process = NULL;
+    PUNICODE_STRING imageFileName = NULL;
+
+    status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(status)) return FALSE;
+
+    status = SeLocateProcessImageName(Process, &imageFileName);
+
+    if (NT_SUCCESS(status) && imageFileName) {
+        if (imageFileName->Buffer) {
+            if (HasSuffix(imageFileName, L"explorer.exe")) {
+                isExplorer = TRUE;
+            }
+        }
+        ExFreePool(imageFileName);
+    }
+
+    ObDereferenceObject(Process);
+    return isExplorer;
+}
+
+BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Buffer, ULONG Length, BOOLEAN IsWrite) {
+    if (IsNoisyRansomPath(FileName)) return FALSE;
+
+    if (!IsWrite) {
+        if (IsExplorerProcess(ProcessId)) {
+            return FALSE;
+        }
+    }
+
+    LARGE_INTEGER Now = { 0 };
+    KeQuerySystemTime(&Now);
+    BOOLEAN Result = FALSE;
+    BOOLEAN SuspiciousWrite = FALSE;
+
+    if (IsWrite && Buffer && Length > 0) {
+        if (!IsNaturallyCompressed(FileName) && IsHighEntropy(Buffer, Length)) {
+            SuspiciousWrite = TRUE;
+        }
+    }
+
+    ExAcquireFastMutex(&GlobalData.TrackerMutex);
+
+    if (IsWrite && !SuspiciousWrite) {
+        ExReleaseFastMutex(&GlobalData.TrackerMutex);
+        return FALSE;
+    }
+
+    PRANSOM_TRACKER Tracker = NULL;
+    PRANSOM_TRACKER EmptySlot = NULL;
+
+    for (int i = 0; i < MAX_TRACKERS; i++) {
+        if (RansomTrackers[i].ProcessId == ProcessId) {
+            Tracker = &RansomTrackers[i];
+            break;
+        }
+        if (RansomTrackers[i].ProcessId == NULL && !EmptySlot) {
+            EmptySlot = &RansomTrackers[i];
+        }
+    }
+
+    if (!Tracker) {
+        if (EmptySlot) {
+            Tracker = EmptySlot;
+            Tracker->ProcessId = ProcessId;
+            Tracker->ActivityCount = 0;
+            Tracker->LastActivityTime = Now;
+        }
+        else {
+            ExReleaseFastMutex(&GlobalData.TrackerMutex);
+            return FALSE;
+        }
+    }
+
+    LARGE_INTEGER Diff = { 0 };
+    Diff.QuadPart = Now.QuadPart - Tracker->LastActivityTime.QuadPart;
+
+    if (Diff.QuadPart > (RANSOM_TIME_WINDOW_MS * 10000LL)) {
+        Tracker->ActivityCount = 0;
+        Tracker->LastActivityTime = Now;
+    }
+
+    ULONG Weight = 1;
+    if (IsWrite) {
+        Weight = SuspiciousWrite ? 2 : 1;
+    }
+
+    Tracker->ActivityCount += Weight;
+
+    if (Tracker->ActivityCount >= RANSOM_COUNT_THRESHOLD) {
+        Result = TRUE;
+    }
+
+    ExReleaseFastMutex(&GlobalData.TrackerMutex);
+    return Result;
+}
+
+NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize) {
+    if (KeGetCurrentIrql() > APC_LEVEL) return STATUS_UNSUCCESSFUL;
+
+    PYAS_MESSAGE msg;
+    RtlZeroMemory(&msg, sizeof(msg));
+    msg.MessageCode = Code;
+    msg.ProcessId = Pid;
+
+    if (Path && PathSize > 0) {
+        size_t MaxSize = sizeof(msg.Path) - sizeof(WCHAR);
+        size_t BytesToCopy = PathSize;
+        if (BytesToCopy > MaxSize) {
+            BytesToCopy = MaxSize;
+        }
+
+        __try {
+            RtlCopyMemory(msg.Path, Path, BytesToCopy);
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            return STATUS_ACCESS_VIOLATION;
+        }
+        msg.Path[BytesToCopy / sizeof(WCHAR)] = L'\0';
+    }
+
+    if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
+        return STATUS_PORT_DISCONNECTED;
+    }
+
+    NTSTATUS status = STATUS_SUCCESS;
+
+    if (GlobalData.ClientPort) {
+        LARGE_INTEGER timeout{};
+        timeout.QuadPart = -(5 * 10000);
+        PFLT_PORT Port = GlobalData.ClientPort;
+
+        status = FltSendMessage(GlobalData.FilterHandle, &Port, &msg, sizeof(msg), NULL, NULL, &timeout);
+    }
+    else {
+        status = STATUS_PORT_DISCONNECTED;
+    }
+
+    ExReleaseRundownProtection(&GlobalData.PortRundown);
+    return status;
+}
@@ -1,74 +1,194 @@
-# PYAS (Python Antivirus Software)
+# PYAS

-![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
+Antivirus software written in Python and C++ that blocks threats through deep learning and behavioral monitoring!

-## Readme Language
-
-繁體中文 : https://github.com/87owo/PYAS/blob/main/README_zh_TW.md
-
-简体中文 : https://github.com/87owo/PYAS/blob/main/README_zh_CN.md
+<img width="2245" height="1477" alt="PYAS_UI" src="https://github.com/user-attachments/assets/87d40261-7655-49ad-a19c-1ffcca60584f" />

 ## Requirements

+Python 3.10 is recommended. Other Python versions may require different pip commands.
+
 ```
-pip install pefile==2023.2.7
-pip install pyperclip==1.8.2
-pip install PyQt5==5.15.9
-pip install yara-python==4.5.1
-pip install numpy==2.1.1
+pip install numpy==1.26.4
 pip install onnxruntime==1.18.1
-pip install pillow==10.4.0
+pip install pefile==2023.2.7
+pip install Pillow==11.0.0
+pip install pyperclip==1.9.0
+pip install PySide6==6.9.1
+pip install requests==2.32.4
+pip install yara-python==4.5.4
 ```

 ## File Information

+The following lists the storage locations of all relevant code and other related documents.
+
 ```
 PYAS/
-├── Driver/ (Protect driver and Microsoft runtime)
-│   └── ...
+├── Engine/
+│   ├── Models/
+│   │   ├── convert.py               # Convert executable files or other files to images
+│   │   ├── train.py                 # TensorFlow CNN model training complete code
+│   │   └── ...                      # Other models folders and files
+│   │
+│   └── Rules/
+│       ├── rules.yar                # Yara virus signature rule matching
+│       ├── rules.ips                # IP network address rule matching
+│       └── ...                      # Other rules folders and files
 │
-├── Engine/ (Deep learn model and Yara database)
-│   └── ...
+├── Plugins/
+│   └── Filter/
+│       ├── DriverEntry.cpp          # Main driver entry and initialization logic
+│       ├── DriverCommon.h           # Global driver definitions, constants, and functions
+│       ├── ProtectBoot.cpp          # Disk boot sector write protection
+│       ├── ProtectRegistry.cpp      # Registry modification protection
+│       ├── ProtectRules.cpp         # White, block list, and matching logic for files registry
+│       └── ...                      # Other driver folders and files
 │
-├── Exten/ (Exten tools and System repair tools)
-│   └── ...
-│
-├── PYAS.py (Main PYAS program with qtui interaction and protect function)
-├── PYAS_Engine.py (Deep learning predict and yara rules file scanner)
-├── PYAS_Suffixes.py (including scan file suffixes and common suffixes)
-├── PYAS_Interface.py (Qt designer ui, must be matched with the main program)
-├── PYAS_Resource.py (status pictures, icon packages, and button icons)
-├── PYAS_Language.py (Traditional Chinese, Simplified Chinese and English)
-├── PYAS_Version.py (file information, version information, original name)
-└── ...
+├── PYAS.py                          # Main application entry point and UI to engine interface
+├── PYAS_Config.py                   # Configuration loading, saving, and global parameters
+├── PYAS_Engine.py                   # Core scanning engine: YARA, IP, ONNX model execution
+├── PYAS_Interface.py                # User interface components and event handling
+├── PYAS_Resource.py                 # Static image and icon resource management
+├── PYAS_Version.py                  # Version metadata for packaging and updates
+└── ...                              # Other supplementary folders and files
 ```

-## Official Website
+## Architecture diagram

-https://pyantivirus.wixsite.com/pyas
+PYAS Security antivirus software general architecture diagram.

-https://github.com/87owo/PYAS
+```mermaid
+graph TD
+    %% Global Styles
+    classDef ui fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
+    classDef logic fill:#fff9c4,stroke:#fbc02d,stroke-width:2px;
+    classDef engine fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px;
+    classDef thread fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px;
+    classDef kernel fill:#ffebee,stroke:#c62828,stroke-width:2px;
+    classDef data fill:#eceff1,stroke:#455a64,stroke-width:2px,stroke-dasharray: 5 5;

-## Microsoft Runtime
+    User((User))

-https://github.com/87owo/Microsoft_Runtime/releases
+    subgraph Presentation_Layer ["Presentation Layer (View)"]
+        direction TB
+        UI_Static["PYAS_Interface.py<br/>(Ui_main_window Class)"]:::ui
+        UI_Controller["PYAS.py<br/>(MainWindow_Controller Class)"]:::ui
+        TrayIcon["System Tray Icon"]:::ui
+        
+        User <--> UI_Controller
+        UI_Static --- UI_Controller
+        UI_Controller --- TrayIcon
+    end

-## PYAS Driver
+    subgraph Core_Logic_Layer ["Core Logic & Controller"]
+        direction TB
+        Init_Env["Initialization<br/>(init_environ, init_variable,<br/>init_windll)"]:::logic
+        Config_Mgr["Configuration Manager<br/>(load_config, save_config)"]:::logic
+        
+        subgraph System_Tools ["System Tools"]
+            Sys_Repair["System Repair<br/>(repair_system_mbr,<br/>repair_system_image, etc.)"]:::logic
+            Sys_Clean["System Cleaner<br/>(clean_button, traverse_temp)"]:::logic
+            Proc_Mgr["Process Manager<br/>(list_process, kill_process)"]:::logic
+            List_Mgr["List Manager<br/>(manage_named_list:<br/>Whitelist/Quarantine)"]:::logic
+        end

-https://github.com/0sha0/PYAS_Protection
+        UI_Controller --> Init_Env
+        Init_Env --> Config_Mgr
+        UI_Controller --> System_Tools
+    end

-## MIT license
+    subgraph Protection_Layer ["Real-time Protection Threads (Daemons)"]
+        direction TB
+        Thread_Proc["Process Guard Thread<br/>(protect_proc_thread)<br/>[WMI/Snapshot]"]:::thread
+        Thread_File["File Guard Thread<br/>(protect_file_thread)<br/>[ReadDirectoryChangesW]"]:::thread
+        Thread_Net["Network Guard Thread<br/>(protect_net_thread)<br/>[GetExtendedTcpTable]"]:::thread
+        Thread_Sys["System Guard Thread<br/>(protect_system_thread)<br/>[Reg/MBR Check]"]:::thread
+        Thread_Popup["Popup Blocker Thread<br/>(popup_intercept_thread)<br/>[EnumWindows]"]:::thread
+        Thread_Pipe["Driver IPC Thread<br/>(pipe_server_thread)<br/>[NamedPipe Server]"]:::thread

-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+        Init_Env --> Thread_Proc
+        Init_Env --> Thread_File
+        Init_Env --> Thread_Net
+        Init_Env --> Thread_Sys
+        Init_Env --> Thread_Popup
+        Init_Env --> Thread_Pipe
+    end
+
+    subgraph Engine_Layer ["Detection Engine (PYAS_Engine.py)"]
+        direction TB
+        Scan_Worker["Scan Worker<br/>(scan_worker / scan_engine)"]:::engine
+        
+        subgraph Scanners
+            Sign_Check["Signature Scanner<br/>(sign_scanner)<br/>[WinVerifyTrust]"]:::engine
+            AI_Model["AI Model Scanner<br/>(model_scanner)<br/>[ONNX/ResNet]"]:::engine
+            Yara_Rules["Rule Scanner<br/>(rule_scanner)<br/>[Yara/IP Lists]"]:::engine
+        end
+
+        Thread_Proc --> Scan_Worker
+        Thread_File --> Scan_Worker
+        Thread_Net --> Scan_Worker
+        UI_Controller -->|Manual Scan| Scan_Worker
+
+        Scan_Worker --> Sign_Check
+        Scan_Worker --> AI_Model
+        Scan_Worker --> Yara_Rules
+    end
+
+    subgraph Kernel_OS_Layer ["Windows Kernel & Driver"]
+        direction TB
+        WinAPI["Windows API (ctypes)<br/>(kernel32, user32, ntdll,<br/>advapi32, iphlpapi, psapi)"]:::kernel
+        Driver_Sys["Kernel Driver<br/>(PYAS_Driver.sys)"]:::kernel
+        OS_FS["File System (NTFS)"]:::kernel
+        OS_Net["Network Stack"]:::kernel
+
+        Init_Env -- Load DLLs --> WinAPI
+        Thread_File -- Monitor --> OS_FS
+        Thread_Net -- Monitor --> OS_Net
+        Thread_Proc -- Suspend/Kill --> WinAPI
+        
+        Thread_Pipe <==>|"Named Pipe IPC<br/>(\\.\pipe\PYAS_Output_Pipe)"| Driver_Sys
+        Driver_Sys -- Callback/Block --> WinAPI
+    end
+
+    subgraph Data_Persistence ["Data & Resources"]
+        Config_File[("Config.json")]:::data
+        Model_Files[("Model Files<br/>(.onnx)")]:::data
+        Rule_Files[("Rule Files<br/>(.yar)")]:::data
+        Quarantine_Dir[("/Quarantine/")]:::data
+
+        Config_Mgr <--> Config_File
+        AI_Model <--> Model_Files
+        Yara_Rules <--> Rule_Files
+        List_Mgr <--> Quarantine_Dir
+    end
+```

 ## Support System

-Windows 8.1, 10, 11 (64-bit), Ram 500MB, Rom 200MB or higher
+| Config    | Permissions   | System version       | Processor | Memory | Storage |
+|-----------|---------------|----------------------|-----------|--------|---------|
+| Minimum   | Administrator | >= Windows 10 (20H1) | 1 GHz     | 200MB  | 100MB   |
+| Recommend | Administrator | >= Windows 10 (21H2) | 3 GHz     | 500MB  | 200MB   |

-Other systems may experience software malfunctions or crash
+## Packaged Releases

-## Special Thanks
+Download the installer. If it is incompatible with your system, you can repackage it yourself.

-Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
+Packaged Download: https://github.com/87owo/PYAS/releases

-Copyright© 2020~2025 PYAS Security By 87owo
+## Official Website
+
+If you are interested in this project, you can visit the website to see other related content.
+
+Source Available : https://github.com/87owo/PYAS
+
+Official Website : https://pyas-security.com/antivirus
+
+## Project License
+
+For any questions, needs, or bug feedback, please contact us through the following website.
+
+Source Issues : https://github.com/87owo/PYAS/issues
+
+Official Email : mailto:service.pyas@gmail.com
@@ -1,68 +0,0 @@
-# PYAS (Python 杀毒软件)
-
-![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
-
-## 安装要求
-
-```
-pip install pefile==2023.2.7
-pip install pyperclip==1.8.2
-pip install PyQt5==5.15.9
-pip install yara-python==4.5.1
-pip install numpy==2.1.1
-pip install onnxruntime==1.18.1
-pip install pillow==10.4.0
-```
-
-## 文件信息
-
-```
-PYAS/
-├── Driver/ (驱动保护和微软运行库)
-│   └── ...
-│
-├── Engine/ (深度学习和规则数据库)
-│   └── ...
-│
-├── Exten/ (扩展功能与系统修复工具)
-│   └── ...
-│
-├── PYAS.py (PYAS主程序含界面交互与保护功能)
-├── PYAS_Engine.py (深度学习预测和规则扫描器)
-├── PYAS_Suffixes.py (获取扫描或事件文件的后缀)
-├── PYAS_Interface.py (搭配主程序的Qt设计介面)
-├── PYAS_Resource.py (状态图片和图标和按钮图片)
-├── PYAS_Language.py (繁体中文和简体中文和英文翻译)
-├── PYAS_Version.py (版本和讯息名称和打包文件名)
-└── ...
-```
-
-## 官方网页
-
-https://pyantivirus.wixsite.com/pyas
-
-https://github.com/87owo/PYAS
-
-## 微软运行库
-
-https://github.com/87owo/Microsoft_Runtime/releases
-
-## 驱动程序
-
-https://github.com/0sha0/PYAS_Protection
-
-## 开源协议
-
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
-
-## 支援系统
-
-Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高
-
-其他系统或版本可能会遇到软体功能故障或程序崩溃
-
-## 特别感谢
-
-Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
-
-Copyright© 2020~2025 PYAS Security By 87owo
@@ -1,68 +0,0 @@
-# PYAS (Python 防毒軟體)
-
-![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
-
-## 安裝要求
-
-```
-pip install pefile==2023.2.7
-pip install pyperclip==1.8.2
-pip install PyQt5==5.15.9
-pip install yara-python==4.5.1
-pip install numpy==2.1.1
-pip install onnxruntime==1.18.1
-pip install pillow==10.4.0
-```
-
-## 檔案資訊
-
-```
-PYAS/
-├── Driver/ (驅動防護和微軟運行庫)
-│   └── ...
-│
-├── Engine/ (深度學習和規則數據庫)
-│   └── ...
-│
-├── Exten/ (擴展功能與系統修復工具)
-│   └── ...
-│
-├── PYAS.py (PYAS主程序含介面交互與防護功能)
-├── PYAS_Engine.py (深度學習預測和規則掃描器)
-├── PYAS_Suffixes.py (獲取掃描或事件檔案的副檔名)
-├── PYAS_Interface.py (搭配主程序的Qt設計介面)
-├── PYAS_Resource.py (狀態圖片圖標和按鈕圖片)
-├── PYAS_Language.py (繁體中文和簡體中文和英文翻譯)
-├── PYAS_Version.py (檔案版本和訊息名稱和打包檔名)
-└── ...
-```
-
-## 官方網頁
-
-https://pyantivirus.wixsite.com/pyas
-
-https://github.com/87owo/PYAS
-
-## 微軟運行庫
-
-https://github.com/87owo/Microsoft_Runtime/releases
-
-## 驅動程式
-
-https://github.com/0sha0/PYAS_Protection
-
-## 開源協議
-
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
-
-## 支援系統
-
-Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高
-
-其他系統或版本可能會遇到軟體功能故障或程序崩潰
-
-## 特別感謝
-
-Wix, mtkiao129, 0sha0, AV-T Team of LisectGroup
-
-Copyright© 2020~2025 PYAS Security By 87owo
Author	SHA1	Message	Date
87owo	c14957afff	Update and rename convert_full.py to convert.py	2026-01-04 22:34:35 +08:00
87owo	843a4998f1	Delete Engine/Model/convert.py	2026-01-04 20:45:08 +08:00
87owo	9637e74edc	Add files via upload	2026-01-04 20:17:23 +08:00
87owo	b1bdf4f671	Add files via upload	2026-01-04 18:55:43 +08:00
87owo	238ed8e364	Add files via upload	2026-01-04 18:55:04 +08:00
87owo	8aa1509863	Add files via upload	2026-01-04 13:41:45 +08:00
87owo	aac182e30b	Add files via upload	2026-01-04 13:40:19 +08:00
87owo	ac7e953acc	Add files via upload	2026-01-04 12:28:25 +08:00
87owo	6ae0f27e05	Add files via upload	2026-01-04 11:46:45 +08:00
87owo	f6e5a92400	Add files via upload	2026-01-02 22:27:59 +08:00
87owo	5e5ff3428c	Add files via upload	2026-01-02 22:26:42 +08:00
87owo	1cdbb9c402	Add files via upload	2026-01-02 22:25:22 +08:00
87owo	8caacd1870	Update README.md	2026-01-01 21:38:30 +08:00
87owo	cfbc4c9c20	Update README.md	2026-01-01 21:29:21 +08:00
87owo	76dbf1c5d0	Add files via upload	2026-01-01 20:38:03 +08:00
87owo	c0e7c4afa5	Add files via upload	2026-01-01 18:31:39 +08:00
87owo	9da0970d85	Delete ProtectRules.cpp	2026-01-01 18:31:01 +08:00
87owo	d6f2ad32a7	Delete ProtectRegistry.cpp	2026-01-01 18:30:54 +08:00
87owo	8dbc87a331	Delete ProtectProcess.cpp	2026-01-01 18:30:45 +08:00
87owo	77eb1ce44e	Delete ProtectFile.cpp	2026-01-01 18:30:37 +08:00
87owo	e12f4ae61a	Delete ProtectBoot.cpp	2026-01-01 18:30:29 +08:00
87owo	c23a73625f	Delete DriverEntry.cpp	2026-01-01 18:30:20 +08:00
87owo	3a66946686	Delete DriverCommon.h	2026-01-01 18:30:13 +08:00
87owo	7fef43701f	Add files via upload	2026-01-01 18:29:52 +08:00
87owo	7f5eb34ac6	Add files via upload	2026-01-01 17:41:40 +08:00
87owo	ba4369f829	Add files via upload	2026-01-01 03:39:49 +08:00
87owo	81af2e51fc	Delete Plugins/Filter/ProtectScreen.c	2026-01-01 03:37:53 +08:00
87owo	dff09064c8	Delete Plugins/Filter/ProtectRules.h	2026-01-01 03:37:45 +08:00
87owo	ee0bb32cce	Delete Plugins/Filter/ProtectRules.c	2026-01-01 03:37:35 +08:00
87owo	4a215c308b	Delete Plugins/Filter/ProtectRegistry.c	2026-01-01 03:37:18 +08:00
87owo	79493a96ea	Delete Plugins/Filter/ProtectRemote.c	2026-01-01 03:37:07 +08:00
87owo	3cca1c4671	Delete Plugins/Filter/ProtectProcess.c	2026-01-01 03:36:54 +08:00
87owo	72e9923d08	Delete Plugins/Filter/ProtectMatch.h	2026-01-01 03:36:43 +08:00
87owo	406e152891	Delete Plugins/Filter/ProtectMatch.c	2026-01-01 03:36:27 +08:00
87owo	e9eb569d50	Delete Plugins/Filter/ProtectInject.c	2026-01-01 03:36:17 +08:00
87owo	640b389e44	Delete Plugins/Filter/ProtectImage.c	2026-01-01 03:36:07 +08:00
87owo	314e3349d6	Delete Plugins/Filter/ProtectFile.c	2026-01-01 03:35:56 +08:00
87owo	0ae4d72bc9	Delete Plugins/Filter/ProtectBoot.c	2026-01-01 03:35:45 +08:00
87owo	8920a5fb21	Delete Plugins/Filter/DriverPipe.c	2026-01-01 03:35:34 +08:00
87owo	b338ff5dd9	Delete Plugins/Filter/DriverEntry.h	2026-01-01 03:35:25 +08:00
87owo	87e2fcb37c	Delete Plugins/Filter/DriverEntry.c	2026-01-01 03:35:05 +08:00
87owo	bab43e3b17	Add files via upload	2026-01-01 03:34:44 +08:00
87owo	e602088330	Add files via upload	2025-12-29 20:14:49 +08:00
87owo	2f6db92077	Add files via upload	2025-12-29 20:14:14 +08:00
87owo	cee33c0f77	Add files via upload	2025-12-28 14:58:49 +08:00
87owo	4fcdaa10b6	Add files via upload	2025-12-28 14:54:52 +08:00
87owo	949f74ab04	Add files via upload	2025-12-28 14:21:07 +08:00
87owo	ef68a89b45	Add files via upload	2025-12-28 14:20:35 +08:00
87owo	10ecb35cca	Add files via upload	2025-12-28 14:12:29 +08:00
87owo	696ac22f77	Add files via upload	2025-12-27 15:17:13 +08:00
87owo	8d13f98030	Add files via upload	2025-12-27 02:09:29 +08:00
87owo	1dddf13a9d	Add files via upload	2025-12-27 02:08:10 +08:00
87owo	855472239a	Delete Engine/Model/train_torch.py	2025-12-27 01:42:33 +08:00
87owo	dc5d317623	Delete Engine/Model/train_tensorflow.py	2025-12-27 01:42:24 +08:00
87owo	91011e9e2a	Add files via upload	2025-12-27 01:42:07 +08:00
87owo	bb09b75d3b	Add files via upload	2025-12-27 01:41:45 +08:00
87owo	b2f9adad66	Add files via upload	2025-12-27 01:41:03 +08:00
87owo	0c2c84d2a9	Add files via upload	2025-12-26 15:13:42 +08:00
87owo	1733e7cc86	Add files via upload	2025-12-25 23:49:05 +08:00
87owo	831d9a9895	Add files via upload	2025-12-25 18:53:53 +08:00
87owo	70ba3a629d	Update README.md	2025-12-25 03:14:28 +08:00
87owo	29e9702d21	Update README.md	2025-12-25 03:12:28 +08:00
87owo	f8ef756bd4	Add files via upload	2025-12-25 01:23:41 +08:00
87owo	233b28e8a5	Add files via upload	2025-12-24 22:34:19 +08:00
87owo	da77c17be5	Add files via upload	2025-12-24 14:33:17 +08:00
87owo	8dfa76822e	Delete Engine/Model/train.py	2025-12-24 14:32:38 +08:00
87owo	4163991b66	Add files via upload	2025-12-24 14:32:18 +08:00
87owo	78323c9a08	Add files via upload	2025-12-24 14:31:06 +08:00
87owo	eb517e86f3	Add files via upload	2025-12-24 14:30:13 +08:00
87owo	e24f3823cb	Add files via upload	2025-12-24 11:15:31 +08:00
87owo	fd3e8ee28a	Update README.md	2025-12-21 23:27:08 +08:00
87owo	a980ea7bd6	Update README.md	2025-12-21 23:26:00 +08:00
87owo	20ce73c54f	Update README.md	2025-12-21 23:17:32 +08:00
87owo	d8f22f7f28	Update README.md	2025-12-21 23:16:03 +08:00
87owo	591055edaf	Update README.md	2025-12-21 23:13:09 +08:00
87owo	fbf0e06c04	Update LICENSE.txt	2025-12-19 22:46:40 +08:00
87owo	9daf327e80	Update README.md	2025-12-19 22:42:21 +08:00
87owo	4441978e10	Update LICENSE.txt	2025-12-19 22:38:14 +08:00
87owo	d8eb770735	Update LICENSE.txt	2025-12-18 20:12:03 +08:00
87owo	cefbf79c6e	Update LICENSE.txt	2025-12-11 20:01:08 +08:00
87owo	fc8762094e	Update LICENSE.txt	2025-12-11 20:00:42 +08:00
87owo	801c3aadcc	Update LICENSE.txt	2025-12-09 11:43:08 +08:00
87owo	4296f1ec43	Add files via upload	2025-11-27 15:28:31 +08:00
87owo	a7f469747c	Add files via upload	2025-11-27 14:57:17 +08:00
87owo	68d0352343	Add files via upload	2025-11-27 14:56:17 +08:00
87owo	01e6d09f7c	Update train.py	2025-11-26 17:56:08 +08:00
87owo	6582abfd4a	Update train.py	2025-11-26 17:26:31 +08:00
87owo	f8f4b303d7	Update LICENSE.txt	2025-11-01 17:08:11 +08:00
87owo	79f05a23a8	Add files via upload	2025-10-08 11:51:18 +08:00
87owo	95845c5c85	Add files via upload	2025-10-08 11:05:43 +08:00
87owo	cd1a24290e	Add files via upload	2025-10-07 23:08:14 +08:00
87owo	21261bfb17	Add files via upload	2025-10-07 22:48:17 +08:00
87owo	79abf51cb8	Add files via upload	2025-10-07 22:25:51 +08:00
87owo	e538b837d5	Add files via upload	2025-10-07 21:53:12 +08:00
87owo	7b995e1223	Add files via upload	2025-09-16 20:12:31 +08:00
87owo	c7826b58a3	Add files via upload	2025-09-16 20:04:32 +08:00
87owo	5786dbdb75	Add files via upload	2025-09-16 20:03:15 +08:00
87owo	0f42c19ec7	Delete README_zh_TW.md	2025-09-10 13:43:50 +08:00
87owo	87d44a64f3	Delete README_zh_CN.md	2025-09-10 13:43:40 +08:00
87owo	77dd4ace33	Update README.md	2025-09-10 13:43:14 +08:00
87owo	0907d71957	Update README.md	2025-09-10 13:36:40 +08:00
87owo	e7a30646e3	Update README.md	2025-09-10 13:35:25 +08:00
87owo	98d21b3391	Update LICENSE.txt	2025-09-09 09:45:56 +08:00
87owo	35d9203b9c	Update LICENSE.txt	2025-09-09 09:32:39 +08:00
87owo	e6e384a7f7	Rename LICENSE.md to LICENSE.txt	2025-09-09 08:45:38 +08:00
87owo	7d954c14ae	Rename LICENSE.txt to LICENSE.md	2025-09-09 08:45:19 +08:00
PYDT	41388962e2	Add files via upload	2025-08-29 17:59:44 +08:00
PYDT	6d51f6b6a9	Add files via upload	2025-08-29 16:42:14 +08:00
PYDT	c7af9a3702	Add files via upload	2025-08-29 16:41:38 +08:00
PYDT	da7c61202c	Add files via upload	2025-08-28 13:36:16 +08:00
PYDT	c24e872a33	Add files via upload	2025-08-28 10:28:15 +08:00
PYDT	d0809ec313	Add files via upload	2025-08-28 08:58:42 +08:00
PYDT	c1a796da38	Add files via upload	2025-08-27 17:53:10 +08:00
PYDT	98c27800e0	Add files via upload	2025-08-26 10:11:36 +08:00
PYDT	7a18eadd13	Add files via upload	2025-08-25 23:50:38 +08:00
PYDT	b07adb7b30	Add files via upload	2025-08-25 23:23:42 +08:00
PYDT	4d7c3cce4d	Add files via upload	2025-08-25 20:28:36 +08:00
PYDT	4ff0ab9cd8	Add files via upload	2025-08-25 09:42:51 +08:00
PYDT	264dd50969	Add files via upload	2025-08-25 08:49:53 +08:00
PYDT	26d0ad1a6e	Add files via upload	2025-08-24 22:06:31 +08:00
PYDT	90284018e5	Add files via upload	2025-08-24 22:06:02 +08:00
PYDT	46eeec16d4	Add files via upload	2025-08-24 22:05:30 +08:00
PYDT	083fb0dccc	Add files via upload	2025-08-23 22:07:39 +08:00
PYDT	d46f145806	Delete Plugins/Filter/ProtectReg.c	2025-08-23 22:04:35 +08:00
PYDT	868eddfd2b	Add files via upload	2025-08-23 22:04:11 +08:00
PYDT	8295e6bb5b	Add files via upload	2025-08-22 23:13:46 +08:00
PYDT	424914b842	Add files via upload	2025-08-22 22:16:20 +08:00
PYDT	8c5027df0f	Delete Plugins/Filter/ProtectBoot.c	2025-08-22 21:16:55 +08:00
PYDT	0b7817d992	Add files via upload	2025-08-22 21:16:36 +08:00
PYDT	ca6c9bfd05	Add files via upload	2025-08-22 05:31:46 +08:00
PYDT	0a1abd8040	Add files via upload	2025-08-22 05:27:25 +08:00
PYDT	ed69a4fdf6	Add files via upload	2025-08-22 05:20:50 +08:00
PYDT	2ae19a6d4e	Add files via upload	2025-08-22 05:08:52 +08:00
PYDT	404bc50dd4	Add files via upload	2025-08-22 04:56:09 +08:00
PYDT	cada5eeeaf	Add files via upload	2025-08-22 04:16:55 +08:00
PYDT	5e9bd40e8b	Add files via upload	2025-08-22 03:22:40 +08:00
PYDT	0788bab0dd	Add files via upload	2025-08-22 03:21:51 +08:00
PYDT	4e8e0dbea7	Add files via upload	2025-08-19 08:27:20 +08:00
PYDT	b8c5279137	Add files via upload	2025-08-19 07:52:24 +08:00
PYDT	a3255b1681	Add files via upload	2025-08-19 07:43:35 +08:00
PYDT	f151379f8f	Add files via upload	2025-08-18 22:49:35 +08:00
PYDT	7784544583	Add files via upload	2025-08-18 15:34:45 +08:00
PYDT	f742937296	Add files via upload	2025-08-18 00:29:36 +08:00
PYDT	5fd9242291	Add files via upload	2025-08-17 15:30:24 +08:00
PYDT	9f343196a9	Add files via upload	2025-08-17 00:04:25 +08:00
PYDT	5468eded04	Add files via upload	2025-08-17 00:01:22 +08:00
PYDT	1b97758fc9	Add files via upload	2025-08-16 23:57:22 +08:00
PYDT	b2e8e49447	Add files via upload	2025-08-16 23:56:03 +08:00
PYDT	3eec781139	Add files via upload	2025-08-16 15:37:39 +08:00
PYDT	b6f1977fa0	Add files via upload	2025-08-16 00:02:23 +08:00
PYDT	e0aa080f00	Add files via upload	2025-08-15 23:56:43 +08:00
PYDT	66aa76c836	Add files via upload	2025-08-15 23:55:49 +08:00
PYDT	bb9444e1ae	Update README_zh_CN.md	2025-08-15 19:19:35 +08:00
PYDT	6c9bfa7755	Update README_zh_TW.md	2025-08-15 19:18:26 +08:00
PYDT	c4fa849290	Update README_zh_TW.md	2025-08-15 19:17:58 +08:00
PYDT	4807e2c410	Update README.md	2025-08-15 19:15:51 +08:00
PYDT	5388efdebc	Update README.md	2025-08-15 19:13:15 +08:00
PYDT	1d656de7ba	Add files via upload	2025-08-15 18:31:42 +08:00
PYDT	eaa1d725a9	Update README_zh_TW.md	2025-08-15 18:01:43 +08:00
PYDT	dea2150d63	Update README_zh_CN.md	2025-08-15 18:00:55 +08:00
PYDT	80f9d6cf75	Update README.md	2025-08-15 17:56:38 +08:00
PYDT	7430d38594	Update README.md	2025-08-15 17:54:45 +08:00
PYDT	6804e4af9f	Update README_zh_CN.md	2025-08-15 16:38:23 +08:00
PYDT	138756c31d	Update README_zh_TW.md	2025-08-15 16:37:50 +08:00
PYDT	349bc293c6	Update README.md	2025-08-15 16:37:17 +08:00
PYDT	2f87cd10f2	Update README.md	2025-08-15 16:30:41 +08:00
PYDT	fc50eafcca	Add files via upload	2025-08-15 16:13:36 +08:00
PYDT	b48e20a727	Update README_zh_CN.md	2025-08-15 15:58:20 +08:00
PYDT	ce7ed2e6eb	Update README_zh_TW.md	2025-08-15 15:58:04 +08:00
PYDT	043d71e0ff	Update README.md	2025-08-15 15:57:32 +08:00
PYDT	1855ae0e1d	Delete Plugins/Filter/PYAS_Driver.sys	2025-08-15 15:48:29 +08:00
PYDT	77323a50df	Add files via upload	2025-08-15 15:48:14 +08:00
PYDT	1c2f6b85ca	Add files via upload	2025-08-15 15:47:36 +08:00
PYDT	2b5c478e4b	Update and rename LICENSE.md to LICENSE.txt	2025-08-15 15:39:17 +08:00
PYDT	90fd83a81f	Rename LICENSE.proprietary to LICENSE.md	2025-08-15 15:38:29 +08:00
PYDT	8fa2a166f3	Delete LICENSE	2025-08-15 15:36:54 +08:00
PYDT	e8cc45ebe7	Update LICENSE.proprietary	2025-08-15 15:36:00 +08:00
PYDT	eb87117b91	Rename LICENSE.md to LICENSE	2025-08-15 14:51:50 +08:00
PYDT	3799dfa1e8	Rename LICENSE.proprietary.md to LICENSE.proprietary	2025-08-15 14:51:37 +08:00
PYDT	163c7fd680	Rename LICENSE.proprietary to LICENSE.proprietary.md	2025-08-15 14:51:22 +08:00
PYDT	44ca762f69	Create LICENSE.proprietary	2025-08-15 14:50:15 +08:00
PYDT	8db311ba33	Add files via upload	2025-08-15 14:21:22 +08:00
PYDT	99d8604db4	Add files via upload	2025-08-15 11:14:46 +08:00
PYDT	90aa88daeb	Update README.md	2025-08-14 20:31:29 +08:00
PYDT	ae6eebad4d	Update README_zh_CN.md	2025-08-14 20:30:39 +08:00
PYDT	cd31ce1c38	Update README_zh_TW.md	2025-08-14 20:30:00 +08:00
PYDT	ed3846e451	Update README_zh_TW.md	2025-08-14 20:28:02 +08:00
PYDT	0c79cf8e37	Update README_zh_CN.md	2025-08-14 20:25:36 +08:00
PYDT	81c7e16c0e	Update README_zh_CN.md	2025-08-14 20:23:44 +08:00
PYDT	16c03095b8	Update README.md	2025-08-14 20:22:36 +08:00
PYDT	b5dab3aa22	Update README_zh_CN.md	2025-08-14 20:21:11 +08:00
PYDT	e4a3c871f8	Update README.md	2025-08-14 20:15:46 +08:00
PYDT	a2fe947b08	Update README.md	2025-08-14 20:13:26 +08:00
PYDT	8df49ecfc1	Update README.md	2025-08-14 20:03:11 +08:00
PYDT	526b9bd4c7	Update README.md	2025-08-14 20:00:42 +08:00
PYDT	c67ff3d936	Add files via upload	2025-08-14 14:21:47 +08:00
PYDT	417b17da98	Add files via upload	2025-08-13 16:35:12 +08:00
PYDT	4ca19a4eb0	Update README_zh_CN.md	2025-08-13 16:00:20 +08:00
PYDT	e834dfb7ee	Update README_zh_TW.md	2025-08-13 16:00:05 +08:00
PYDT	5e1ff74fb3	Update README.md	2025-08-13 15:59:50 +08:00
PYDT	7a1d0f2ca7	Delete Engine/Model/PYAS_Model_A1.onnx	2025-08-13 15:53:33 +08:00
PYDT	b305522106	Delete Engine/Model/PYAS_Model.json	2025-08-13 15:53:15 +08:00
PYDT	ff3495645a	Add files via upload	2025-08-13 15:52:58 +08:00
PYDT	ddc000321f	Add files via upload	2025-08-13 15:41:32 +08:00
PYDT	fe4e6af3b9	Add files via upload	2025-08-13 15:40:43 +08:00
PYDT	a1a83cc32c	Add files via upload	2025-08-13 15:39:56 +08:00
PYDT	e37665218b	Update README_zh_CN.md	2025-08-12 17:25:31 +08:00
PYDT	2a876f4136	Update README_zh_TW.md	2025-08-12 17:20:27 +08:00
PYDT	290d8e8a64	Update README_zh_TW.md	2025-08-12 17:19:09 +08:00
PYDT	121bce529f	Update README_zh_TW.md	2025-08-12 17:17:17 +08:00
PYDT	1232d98573	Update README.md	2025-08-12 17:16:46 +08:00
PYDT	208d9150b0	Update README.md	2025-08-12 17:10:23 +08:00
PYDT	351bf7725e	Update README.md	2025-08-12 17:07:56 +08:00
PYDT	a547776766	Add files via upload	2025-08-12 17:06:02 +08:00
PYDT	86a8d20757	Add files via upload	2025-08-11 11:26:26 +08:00
PYDT	760c420f95	Delete Plugins/Filter directory	2025-08-11 11:26:15 +08:00
PYDT	44c2edf58e	Add files via upload	2025-08-10 21:14:30 +08:00
PYDT	e88207c232	Update README.md	2025-08-10 05:02:16 +08:00
PYDT	f6b2450fcd	Update README.md	2025-08-10 04:58:10 +08:00
PYDT	a124ecd3ed	Update README.md	2025-08-10 04:54:52 +08:00
PYDT	34fcc3d29e	Update README.md	2025-08-10 04:43:12 +08:00
PYDT	5f3011eebc	Update README.md	2025-08-10 04:40:49 +08:00
PYDT	d4464edb6c	Update README.md	2025-08-10 04:34:13 +08:00
PYDT	1dc89a80db	Update README.md	2025-08-10 04:33:27 +08:00
PYDT	bd23599770	Add files via upload	2025-08-10 00:46:48 +08:00
PYDT	bda6ff80da	Delete PYAS.py	2025-08-10 00:42:33 +08:00
PYDT	16bee9825f	Add files via upload	2025-08-10 00:41:16 +08:00
PYDT	5e4a4c4e8f	Add files via upload	2025-08-09 23:50:31 +08:00
PYDT	0a03093333	Delete Plugins/Filter directory	2025-08-09 23:50:08 +08:00
PYDT	960b1d53f7	Add files via upload	2025-08-09 19:32:57 +08:00
PYDT	f09dee6a52	Add files via upload	2025-08-09 19:32:08 +08:00
PYDT	301e1e56d1	Delete Plugins/Filter/PYAS_Driver.sys	2025-08-09 19:31:04 +08:00
PYDT	6b2dbd382d	Add files via upload	2025-08-08 23:15:27 +08:00
PYDT	e6f526c766	Update README_zh_CN.md	2025-08-06 01:09:35 +08:00
PYDT	06cca669a0	Update README_zh_CN.md	2025-08-06 01:09:18 +08:00
PYDT	f89ccea208	Update README_zh_TW.md	2025-08-06 01:07:35 +08:00
PYDT	0728f2d995	Update README.md	2025-08-06 01:06:20 +08:00
PYDT	c7a7a61c9a	Delete PYAS_Suffixes.py	2025-08-06 00:43:52 +08:00
PYDT	aca11e66a8	Delete PYAS_Language.py	2025-08-06 00:43:36 +08:00
PYDT	46c7a001c2	Delete Extens directory	2025-08-06 00:43:07 +08:00
PYDT	d6aa3c50a3	Add files via upload	2025-08-06 00:42:43 +08:00
PYDT	caaadc5cf3	Add files via upload	2025-08-06 00:41:52 +08:00
PYDT	14d703903c	Delete Driver directory	2025-08-06 00:41:07 +08:00
PYDT	76fa14ab01	Add files via upload	2025-08-06 00:40:11 +08:00
PYDT	d1afe255e5	Add files via upload	2025-05-06 17:28:11 +08:00
PYDT	8f27739331	Add files via upload	2025-04-25 17:09:33 +08:00
PYDT	7a6aba5a2a	Add files via upload	2025-02-22 23:18:46 -08:00
PYDT	ca0ec1f99d	Add files via upload	2025-02-22 23:18:09 -08:00
PYDT	4e167486a1	Add files via upload	2025-02-16 14:51:54 -08:00
PYDT	503bbcd995	Add files via upload	2025-02-16 14:51:20 -08:00
PYDT	b160d2f634	Add files via upload	2025-02-16 00:27:25 -08:00
PYDT	2e7628a837	Add files via upload	2025-02-15 03:40:02 -08:00
PYDT	1259948ed7	Update README_zh_TW.md	2025-02-15 15:49:09 +08:00
PYDT	81881ae1a4	Update README_zh_CN.md	2025-02-15 15:48:35 +08:00
PYDT	0b5c581aca	Update README.md	2025-02-15 15:47:42 +08:00
PYDT	eb3614ed0c	Add files via upload	2025-02-14 09:01:50 -08:00
PYDT	eb50513277	Add files via upload	2025-02-14 01:10:11 -08:00
PYDT	c3af73b8cf	Add files via upload	2025-02-13 08:41:54 -08:00
PYDT	b552164a13	Add files via upload	2025-02-13 07:42:33 -08:00
PYDT	b6dc9ecadb	Add files via upload	2025-02-13 07:04:08 -08:00
PYDT	0723dc8dbb	Add files via upload	2025-02-13 06:24:22 -08:00
PYDT	0b1fffb5bf	Add files via upload	2025-02-13 06:03:33 -08:00
PYDT	a39d87e5c5	Add files via upload	2025-02-13 05:52:51 -08:00
PYDT	0b0c3310cf	Add files via upload	2025-02-13 05:36:46 -08:00
PYDT	f75c3750a5	Add files via upload	2025-02-13 04:15:07 -08:00
PYDT	3da760721b	Add files via upload	2025-02-13 03:15:23 -08:00
PYDT	a9ad3feeec	Add files via upload	2025-02-12 19:27:01 -08:00
PYDT	479c4ade67	Add files via upload	2025-02-12 18:32:50 -08:00
PYDT	84afa3e714	Add files via upload	2025-02-12 18:32:11 -08:00
PYDT	9a69665bab	Add files via upload	2025-02-12 18:30:14 -08:00
PYDT	fea34ee937	Add files via upload	2025-02-12 01:15:57 -08:00
PYDT	ff2412c65d	Add files via upload	2025-02-12 01:15:19 -08:00
PYDT	658953860a	Add files via upload	2025-02-12 01:13:55 -08:00
PYDT	b473783527	Add files via upload	2025-02-09 02:11:01 -08:00
PYDT	7e590d4925	Add files via upload	2025-02-08 17:37:01 -08:00
PYDT	232fd3e2f2	Add files via upload	2025-02-08 17:16:21 -08:00
PYDT	9ea25fb77c	Add files via upload	2025-02-08 16:55:43 -08:00
PYDT	6c47136de3	Add files via upload	2025-02-08 16:33:55 -08:00
PYDT	6fae29b488	Add files via upload	2025-02-08 07:11:31 -08:00
PYDT	7ed8cc9380	Add files via upload	2025-02-06 23:38:20 -08:00
PYDT	142e9d1028	Add files via upload	2025-02-05 06:56:05 -08:00
PYDT	c96c30ff9a	Add files via upload	2025-02-04 19:22:57 -08:00
PYDT	337f1cc100	Add files via upload	2025-02-04 19:21:48 -08:00
PYDT	c3cb89dbea	Add files via upload	2025-02-02 08:53:39 -08:00
PYDT	445bd1f668	Add files via upload	2025-02-02 08:51:46 -08:00
PYDT	1bded908c1	Add files via upload	2025-01-13 13:28:19 +08:00