Add files via upload

refactor: replace ifs with dicts/sets + simplify exception handling

Engine/Pattern/convert.py

@@ -1,5 +1,5 @@
 from PIL import Image
-import numpy, pefile, os
+import numpy, os
 
 ####################################################################################################
 

Engine/Pattern/train.py

@@ -11,7 +11,7 @@ tf.keras.mixed_precision.set_global_policy('mixed_float16')
 
 ####################################################################################################
 
-def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=256, color_mode="grayscale"):
+def load_dataset(data_dir, image_size=(224, 224), val_split=0.0001, batch_size=256, color_mode="grayscale"):
     channels = 1 if color_mode == "grayscale" else 3
     file_paths, labels, class_indices = get_file_list(data_dir)
     
@@ -24,14 +24,13 @@ def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=
     train_labels = labels[num_val:]
     val_files = file_paths[:num_val]
     val_labels = labels[:num_val]
-    num_classes = len(class_indices)
 
     train_ds = tf.data.Dataset.from_tensor_slices((train_files, train_labels))
-    train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels), num_parallel_calls=tf.data.AUTOTUNE)
     train_ds = train_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
 
     val_ds = tf.data.Dataset.from_tensor_slices((val_files, val_labels))
-    val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE)
+    val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels), num_parallel_calls=tf.data.AUTOTUNE)
     val_ds = val_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
 
     train_ds.class_indices = class_indices
@@ -39,12 +38,12 @@ def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=
 
 ####################################################################################################
 
-def parse_fn(filename, label, image_size, channels, num_classes):
+def parse_fn(filename, label, image_size, channels):
     img = tf.io.read_file(filename)
     img = tf.image.decode_image(img, channels=channels, expand_animations=False)
     img = tf.cond(tf.reduce_all(tf.equal(tf.shape(img)[:2], image_size)), lambda: tf.cast(img, tf.float32), lambda: tf.image.resize(img, image_size))
     img = tf.cast(img, tf.float32) / 255.0
-    label = tf.one_hot(label, depth=num_classes)
+    label = tf.cast(label, tf.float32)
     return img, label
 
 def get_file_list(directory):
@@ -99,7 +98,7 @@ def coordinate_attention(x, reduction):
 
     return layers.Multiply()([x, x_h_sigmoid, x_w_sigmoid])
 
-def build_model(input_shape, num_classes):
+def build_model(input_shape):
     i = layers.Input(shape=input_shape)
     x = multi_conv(i, strides=1)
     x = gated_conv(x, strides=2)
@@ -112,7 +111,7 @@ def build_model(input_shape, num_classes):
     x = layers.GlobalMaxPooling2D()(x)
 
     x = layers.Dense(x.shape[-1] // 2, activation='gelu', dtype='float32')(x)
-    o = layers.Dense(num_classes, activation='softmax', dtype='float32')(x)
+    o = layers.Dense(1, activation='sigmoid', dtype='float32')(x)
     return models.Model(i, o)
 
 ####################################################################################################
@@ -124,18 +123,20 @@ def calculate_lr_cosine_sq(epoch, total_epochs=30, lr_start=5e-4, lr_end=5e-7):
 def lr_scheduler(epoch):
     return calculate_lr_cosine_sq(epoch)
 
-def categorical_focal_loss(gamma=2.0, alpha=0.25):
+def binary_focal_loss(gamma=2.0, alpha=0.25):
     def focal_loss(y_true, y_pred):
+        y_true = tf.cast(y_true, tf.float32)
         y_pred = tf.clip_by_value(y_pred, tf.keras.backend.epsilon(), 1.0 - tf.keras.backend.epsilon())
-        cross_entropy = -y_true * tf.math.log(y_pred)
-        loss = alpha * tf.math.pow(1.0 - y_pred, gamma) * cross_entropy
-        return tf.reduce_sum(loss, axis=-1)
+        p_t = tf.where(tf.equal(y_true, 1), y_pred, 1 - y_pred)
+        alpha_t = tf.where(tf.equal(y_true, 1), alpha, 1 - alpha)
+        loss = -alpha_t * tf.math.pow(1.0 - p_t, gamma) * tf.math.log(p_t)
+        return tf.reduce_mean(loss)
     return focal_loss
 
 class CustomModelCheckpoint(callbacks.Callback):
     def on_epoch_end(self, epoch, logs=False):
         models.save_model(self.model, f"PYAS_Model_Epoch_{epoch + 1}.h5")
-        spec = (tf.TensorSpec((None,) + train_ds.image_shape, tf.float32),)
+        spec = (tf.TensorSpec((None,) + self.model.input.shape[1:], tf.float32),)
         model_proto, _ = tf2onnx.convert.from_keras(self.model, input_signature=spec, opset=17)
         with open(f"PYAS_Model_Epoch_{epoch + 1}.onnx", "wb") as f:
             f.write(model_proto.SerializeToString())
@@ -148,16 +149,17 @@ for imgs, _ in train_ds.take(1):
     break
 
 try:
-    model = models.load_model('PYAS_Model_Epoch_0.h5')
+    model = models.load_model('PYAS_Model_Epoch_0.h5', compile=False)
     print("Load model from disk")
 except:
     print("Creating a new model")
-    model = build_model(train_ds.image_shape, len(train_ds.class_indices))
+    model = build_model(train_ds.image_shape)
 
 print(f"Total parameters: {model.count_params()}")
-model.compile(optimizer='adam', loss=categorical_focal_loss(gamma=2.0, alpha=0.25), 
-    metrics=['accuracy', metrics.Precision(name='precision'), metrics.Recall(name='recall'),
+model.compile(optimizer='adam', loss=binary_focal_loss(gamma=2.0, alpha=0.25), 
+    metrics=[metrics.BinaryAccuracy(name='accuracy'), metrics.AUC(name='auc'),
+    metrics.Precision(name='precision'), metrics.Recall(name='recall'),
     metrics.FalsePositives(name='fp'), metrics.TrueNegatives(name='tn')])
 
-model.fit(train_ds, epochs=30, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds)
+model.fit(train_ds, epochs=30, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds, class_weight={0: 10.0, 1: 1.0})
 input('Training Complete')

Engine/Properties/convert.py

@@ -0,0 +1,721 @@
+import os, sys, time, ctypes, sqlite3, datetime, pefile, math, hashlib
+import numpy as np
+import ctypes.wintypes
+
+####################################################################################################
+
+DB_PATH = "pe_features.db"
+BATCH_SIZE = 1000
+MAX_FILE_SIZE = 256 * 1024 * 1024
+TARGET_EXTENSIONS = {
+    '.exe', '.dll', '.sys', '.ocx', '.scr', '.efi', '.acm', '.ax', '.cpl', '.drv', '.com', '.mui', '.pyd'
+}
+
+####################################################################################################
+
+class WINTRUST_FILE_INFO(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
+        ("hFile", ctypes.wintypes.HANDLE),
+        ("pgKnownSubject", ctypes.wintypes.LPVOID)
+    ]
+
+class WINTRUST_DATA_UNION(ctypes.Union):
+    _fields_ = [
+        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("pCatalog", ctypes.wintypes.LPVOID),
+        ("pBlob", ctypes.wintypes.LPVOID),
+        ("pSgnr", ctypes.wintypes.LPVOID),
+        ("pCert", ctypes.wintypes.LPVOID)
+    ]
+
+class WINTRUST_DATA(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pPolicyCallbackData", ctypes.wintypes.LPVOID),
+        ("pSIPClientData", ctypes.wintypes.LPVOID),
+        ("dwUIChoice", ctypes.wintypes.DWORD),
+        ("fdwRevocationChecks", ctypes.wintypes.DWORD),
+        ("dwUnionChoice", ctypes.wintypes.DWORD),
+        ("u", WINTRUST_DATA_UNION),
+        ("dwStateAction", ctypes.wintypes.DWORD),
+        ("hWVTStateData", ctypes.wintypes.HANDLE),
+        ("pwszURLReference", ctypes.wintypes.LPCWSTR),
+        ("dwProvFlags", ctypes.wintypes.DWORD),
+        ("dwUIContext", ctypes.wintypes.DWORD),
+        ("pSignatureSettings", ctypes.wintypes.LPVOID)
+    ]
+
+class GUID(ctypes.Structure):
+    _fields_ = [
+        ("Data1", ctypes.wintypes.DWORD),
+        ("Data2", ctypes.wintypes.WORD),
+        ("Data3", ctypes.wintypes.WORD),
+        ("Data4", ctypes.c_ubyte * 8)
+    ]
+
+V2_GUID = GUID(0x00AAC56B, 0xCD44, 0x11D0, (ctypes.c_ubyte * 8)(0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
+
+####################################################################################################
+
+def verify_signature(file_path):
+    if os.name != 'nt':
+        return 0
+    try:
+        wintrust = ctypes.windll.wintrust
+        wintrust.WinVerifyTrust.argtypes = [ctypes.wintypes.HWND, ctypes.POINTER(GUID), ctypes.wintypes.LPVOID]
+        wintrust.WinVerifyTrust.restype = ctypes.wintypes.LONG
+
+        abs_path = os.path.abspath(file_path)
+
+        fi = WINTRUST_FILE_INFO()
+        fi.cbStruct = ctypes.sizeof(WINTRUST_FILE_INFO)
+        fi.pcwszFilePath = abs_path
+        fi.hFile = None
+        fi.pgKnownSubject = None
+
+        wt_union = WINTRUST_DATA_UNION()
+        wt_union.pFile = ctypes.pointer(fi)
+
+        td = WINTRUST_DATA()
+        td.cbStruct = ctypes.sizeof(WINTRUST_DATA)
+        td.pPolicyCallbackData = None
+        td.pSIPClientData = None
+        td.dwUIChoice = 2
+        td.fdwRevocationChecks = 0
+        td.dwUnionChoice = 1
+        td.u = wt_union
+        td.dwStateAction = 0
+        td.hWVTStateData = None
+        td.pwszURLReference = None
+        td.dwProvFlags = 0
+        td.dwUIContext = 0
+        td.pSignatureSettings = None
+
+        return 1 if wintrust.WinVerifyTrust(None, ctypes.byref(V2_GUID), ctypes.byref(td)) == 0 else 0
+    except Exception as e:
+        print(e)
+        return 0
+
+####################################################################################################
+
+class Features:
+    API_CAT_MAPPING = {
+        'ProcessControl': {
+            'CreateProcessA', 'CreateProcessW', 'WinExec', 'ShellExecuteA', 'ShellExecuteW',
+            'ShellExecuteExW', 'ExitProcess', 'TerminateProcess', 'OpenProcess', 'GetExitCodeProcess',
+            'SetThreadPriority', 'GetThreadPriority', 'GetCurrentProcess', 'GetCurrentProcessId',
+            'GetModuleFileNameA', 'GetCommandLineA', 'GetModuleFileNameW', 'GetStartupInfoW'
+        },
+        'Injection': {
+            'VirtualAlloc', 'VirtualAllocEx', 'VirtualProtect', 'VirtualProtectEx', 'WriteProcessMemory', 
+            'ReadProcessMemory', 'CreateRemoteThread', 'QueueUserAPC', 'SetThreadContext', 'GetThreadContext', 
+            'Wow64SetThreadContext', 'NtUnmapViewOfSection', 'ZwUnmapViewOfSection', 'RtlCreateUserThread', 
+            'SetWindowsHookExA', 'SetWindowsHookExW', 'UnhookWindowsHookEx', 'LoadLibraryA', 'LoadLibraryW', 
+            'LoadLibraryExA', 'LoadLibraryExW', 'GetProcAddress', 'GetModuleHandleA', 'GetModuleHandleW',
+            'FreeLibrary', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'UnmapViewOfSection',
+            'VirtualFree', 'VirtualQuery'
+        },
+        'Synchronization': {
+            'WaitForSingleObject', 'WaitForSingleObjectEx', 'WaitForMultipleObjects', 'WaitForMultipleObjectsEx',
+            'CreateMutexA', 'CreateMutexW', 'OpenMutexW', 'ReleaseMutex', 'CreateEventA', 'CreateEventW', 
+            'OpenEventW', 'SetEvent', 'ResetEvent', 'EnterCriticalSection', 'LeaveCriticalSection', 
+            'InitializeCriticalSection', 'DeleteCriticalSection', 'Sleep', 'SleepEx',
+            'InitializeCriticalSectionAndSpinCount', 'InterlockedDecrement', 'InterlockedIncrement', 
+            'InterlockedExchange', 'InterlockedCompareExchange', 'SetTimer', 'KillTimer'
+        },
+        'MultiThreading': {
+            'CreateThread', 'ResumeThread', 'SuspendThread', 'ExitThread', 'TerminateThread',
+            'GetCurrentThread', 'GetCurrentThreadId', 'TlsAlloc', 'TlsSetValue', 'TlsGetValue',
+            'CreateThreadpoolWork', 'SubmitThreadpoolWork', 'TlsFree'
+        },
+        'Network': {
+            'socket', 'connect', 'send', 'recv', 'bind', 'listen', 'accept', 'gethostbyname', 'getaddrinfo',
+            'WSAStartup', 'WSACleanup', 'WSAIoctl', 'WSASocketA', 'WSASocketW', 'closesocket', 'htons',
+            'InternetOpenA', 'InternetOpenW', 'InternetConnectA', 'InternetConnectW', 'InternetOpenUrlA', 
+            'InternetOpenUrlW', 'HttpOpenRequestA', 'HttpOpenRequestW', 'HttpSendRequestA', 'HttpSendRequestW',
+            'InternetReadFile', 'URLDownloadToFileA', 'URLDownloadToFileW', 'DnsQuery_A', 'DnsQuery_W'
+        },
+        'Encryption': {
+            'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptCreateHash', 'CryptHashData', 
+            'CryptDeriveKey', 'CryptEncrypt', 'CryptDecrypt', 'CryptDestroyKey', 'CryptDestroyHash',
+            'CryptReleaseContext', 'CryptGenKey', 'CryptImportKey', 'CryptExportKey'
+        },
+        'DataObfuscation': {
+            'RtlDecompressBuffer', 'MultiByteToWideChar', 'WideCharToMultiByte', 'Base64Decode', 
+            'CryptDecodeObject', 'IsDBCSLeadByte', 'CharUpperA', 'CharLowerA',
+            'GetStringTypeW', 'LCMapStringW', 'IsValidCodePage', 'DecodePointer', 'EncodePointer'
+        },
+        'FileIO': {
+            'CreateFileA', 'CreateFileW', 'WriteFile', 'ReadFile', 'DeleteFileA', 'DeleteFileW',
+            'CopyFileA', 'CopyFileW', 'MoveFileA', 'MoveFileW', 'FindFirstFileA', 'FindNextFileA',
+            'GetTempPathA', 'GetTempPathW', 'GetTempFileNameA', 'GetTempFileNameW', 'SetFileAttributesA', 
+            'SetFileAttributesW', 'DeviceIoControl', 'SetFileTime', 'GetFileSize', 'GetFileSizeEx',
+            'SetFilePointer', 'FlushFileBuffers', 'ConnectNamedPipe', 'PeekNamedPipe',
+            'CloseHandle', 'GetFileType', 'SetStdHandle', 'SetFilePointerEx', 'FindClose', 
+            'SetHandleCount', 'SetEndOfFile', 'GetFullPathNameA', 'GetFileAttributesA'
+        },
+        'Registry': {
+            'RegOpenKeyExA', 'RegOpenKeyExW', 'RegSetValueExA', 'RegSetValueExW', 
+            'RegCreateKeyExA', 'RegCreateKeyExW', 'RegDeleteKeyA', 'RegDeleteKeyW',
+            'RegEnumValueA', 'RegEnumValueW', 'RegQueryValueExA', 'RegQueryValueExW',
+            'RegDeleteValueA', 'RegDeleteValueW', 'RegCloseKey'
+        },
+        'Services': {
+            'OpenSCManagerA', 'OpenSCManagerW', 'CreateServiceA', 'CreateServiceW',
+            'StartServiceA', 'StartServiceW', 'ControlService', 'DeleteService'
+        },
+        'Privileges': {
+            'AdjustTokenPrivileges', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 
+            'OpenProcessToken', 'NetUserAdd', 'NetLocalGroupAddMembers', 'IsAdmin', 
+            'GetUserNameA', 'GetUserNameW'
+        },
+        'Native': {
+            'RtlUnwind', 'RtlVirtualUnwind', 'RtlCaptureContext', 'RtlLookupFunctionEntry',
+            'NtClose', 'NtQueryInformationProcess', 'RtlAllocateHeap', 'RtlFreeHeap',
+            'GetSystemTimeAsFileTime', 'GetLocalTime', 'GlobalMemoryStatus', 
+            'GetVersionExA', 'GetVersionExW', 'GetComputerNameA', 'GetComputerNameW',
+            'GetLastError', 'GetACP', 'RaiseException', 'SetLastError', 'GetEnvironmentStringsW', 
+            'FreeEnvironmentStringsW', 'GetLocaleInfoA', 'lstrlenA', 'GetVersion', 'GetSystemInfo', 
+            'CompareStringA'
+        },
+        'DotNet': {
+            '_CorExeMain', '_CorDllMain'
+        },
+        'AntiDebug': {
+            'IsDebuggerPresent', 'CheckRemoteDebuggerPresent', 'OutputDebugStringA', 'OutputDebugStringW',
+            'GetTickCount', 'GetTickCount64', 'QueryPerformanceCounter', 'FindWindowA', 'FindWindowW',
+            'EnumWindows', 'EnumChildWindows', 'GetWindowRect', 'GetClientRect', 'SetWindowDisplayAffinity',
+            'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsProcessorFeaturePresent', 
+            'SetErrorMode', 'GetTimeZoneInformation', 'GetDriveTypeW', 'GetDiskFreeSpaceA'
+        },
+        'Keylogging': {
+            'GetAsyncKeyState', 'GetKeyState', 'GetKeyboardState', 'MapVirtualKeyA', 'MapVirtualKeyW',
+            'ToAscii', 'ToAsciiEx', 'ToUnicode', 'ToUnicodeEx', 'GetKeyNameTextA', 'GetForegroundWindow',
+            'KeybdEvent', 'SendInput', 'MapVirtualKeyExA', 'MapVirtualKeyExW', 'CallNextHookEx'
+        },
+        'Input': {
+            'GetCursorPos', 'SetCursorPos', 'MouseEvent', 'GetDoubleClickTime', 
+            'GetCapture', 'SetCapture'
+        },
+        'ScreenCapture': {
+            'BitBlt', 'StretchBlt', 'GetDC', 'GetWindowDC', 'CreateCompatibleDC', 'CreateCompatibleBitmap',
+            'GdipSaveImageToFile', 'PrintWindow', 'GetDesktopWindow', 'CreateDCW', 'CreateDCA',
+            'SelectObject', 'DeleteDC', 'DeleteObject', 'GetDeviceCaps', 'GetSystemMetrics'
+        },
+        'Graphics': {
+            'Direct3DCreate9', 'D3D11CreateDevice'
+        },
+        'Audio': {
+            'WaveInOpen', 'WaveInClose', 'WaveInStart', 'WaveInStop'
+        },
+        'Clipboard': {
+            'OpenClipboard', 'CloseClipboard', 'GetClipboardData', 'SetClipboardData'
+        },
+        'Camera': {
+            'CapCreateCaptureWindowA', 'CapCreateCaptureWindowW'
+        },
+        'Memory': {
+            'HeapAlloc', 'HeapFree', 'HeapSize', 'HeapCreate', 'GetProcessHeap',
+            'LocalAlloc', 'LocalFree', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock',
+            'HeapDestroy', 'GlobalLock', 'SysFreeString', 'SysAllocStringLen'
+        },
+        'Resource': {
+            'LoadResource', 'SizeofResource', 'LockResource', 'FreeResource', 'FindResourceA'
+        },
+        'WindowControl': {
+            'ShowWindow', 'DestroyWindow', 'TranslateMessage', 'DispatchMessageA', 'GetWindow',
+            'PeekMessageA', 'GetWindowLongA', 'CallWindowProcA', 'SetWindowLongA', 'GetWindowTextA',
+            'ScreenToClient', 'GetActiveWindow', 'CreateWindowExA', 'DefWindowProcA', 'GetMessageA',
+            'RegisterClassA', 'UnregisterClassA', 'MessageBoxA'
+        },
+        'COM': {
+            'CoCreateInstance', 'CoUninitialize', 'CoInitialize'
+        }
+    }
+
+    TARGET_DLLS = {
+        'kernel32.dll', 'user32.dll', 'gdi32.dll', 'advapi32.dll', 'shell32.dll', 'ntdll.dll', 'hal.dll',
+        'ws2_32.dll', 'wsock32.dll', 'wininet.dll', 'winhttp.dll', 'urlmon.dll', 'crypt32.dll', 'bcrypt.dll',
+        'psapi.dll', 'dbghelp.dll', 'imagehlp.dll', 'shlwapi.dll', 'ole32.dll', 'oleaut32.dll', 'comctl32.dll',
+        'mscoree.dll', 'vbscript.dll', 'netapi32.dll', 'iphlpapi.dll', 'wtsapi32.dll', 'version.dll', 'winmm.dll'
+    }
+
+    BASE_SCHEMA = [
+        "FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic",
+        "TimeDateStamp", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
+        "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
+        "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
+        "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
+        "BaseOfCode", "SectionAlignment", "FileAlignment",
+        "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
+        "MajorImageVersion", "MinorImageVersion",
+        "MajorSubsystemVersion", "MinorSubsystemVersion",
+        "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
+        "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
+        "SizeOfOptionalHeader",
+        
+        "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", 
+        "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", 
+        "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", 
+        "SectionCount", "ExecutableSections", 
+        "WritableSections", "ReadableSections", "SectionException",
+
+        "Char_00000020_Count", "Char_00000020_MeanEntropy",
+        "Char_00000040_Count", "Char_00000040_MeanEntropy",
+        "Char_00000080_Count", "Char_00000080_MeanEntropy",
+        "Char_02000000_Count", "Char_02000000_MeanEntropy",
+        "Char_20000000_Count", "Char_20000000_MeanEntropy",
+        "Char_40000000_Count", "Char_40000000_MeanEntropy",
+        "Char_80000000_Count", "Char_80000000_MeanEntropy",
+        
+        "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
+        "ImportCount", "ImportFunctionCount",
+        
+        "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
+        "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
+        "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
+        "SpecialBuildLength", "PrivateBuildLength",
+        
+        "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
+        "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
+        "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException"
+    ]
+
+    CAT_SCHEMA = [f"Cat_{k}" for k in sorted(API_CAT_MAPPING.keys())]
+    DLL_SCHEMA = [f"Dll_{d.replace('.', '_')}" for d in sorted(TARGET_DLLS)]
+    
+    _ALL_APIS = {api for apis in API_CAT_MAPPING.values() for api in apis}
+    API_SCHEMA = [f"Api_{api}" for api in sorted(_ALL_APIS)]
+    
+    SCHEMA = BASE_SCHEMA + CAT_SCHEMA + DLL_SCHEMA + API_SCHEMA
+    
+    _API_TO_CATS = {}
+    for _cat, _apis in API_CAT_MAPPING.items():
+        for _api in _apis:
+            if _api not in _API_TO_CATS:
+                _API_TO_CATS[_api] = []
+            _API_TO_CATS[_api].append(_cat)
+
+    PACKERS = {
+        'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
+        'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
+        'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
+        'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
+        'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
+    }
+    INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
+
+####################################################################################################
+
+def safe_float(val):
+    try:
+        f = float(val)
+        if math.isinf(f) or math.isnan(f): return 0.0
+        return f
+    except:
+        return 0.0
+
+####################################################################################################
+
+def calc_entropy(data):
+    if not data: return 0.0
+    arr = np.frombuffer(data, dtype=np.uint8)
+    counts = np.bincount(arr, minlength=256)
+    probs = counts[counts > 0] / len(arr)
+    return float(-np.sum(probs * np.log2(probs)))
+
+def safe_div(n, d): 
+    return float(n) / d if d > 0 else 0.0
+
+def process_single_file_content(file_bytes, file_path):
+    fsize = len(file_bytes)
+    if fsize == 0: return None
+
+    fts = {k: 0.0 for k in Features.SCHEMA}
+    pe = None
+    try:
+        pe = pefile.PE(data=file_bytes, fast_load=True)
+        fts['TrustSigned'] = verify_signature(file_path)
+
+        fh = pe.FILE_HEADER
+        fts['Machine'] = fh.Machine
+        fts['NumberOfSections'] = fh.NumberOfSections
+        fts['TimeDateStamp'] = fh.TimeDateStamp
+        fts['PointerToSymbolTable'] = fh.PointerToSymbolTable
+        fts['NumberOfSymbols'] = fh.NumberOfSymbols
+        fts['SizeOfOptionalHeader'] = fh.SizeOfOptionalHeader
+        fts['Characteristics'] = fh.Characteristics
+
+        curr_ts = datetime.datetime.utcnow().timestamp()
+        fts['HasInvalidTimestamp'] = 1.0 if (fh.TimeDateStamp < 631152000 or fh.TimeDateStamp > curr_ts + 2592000) else 0.0
+        fts['FileTimeException'] = 1.0 if fh.TimeDateStamp == 0 else 0.0
+
+        if hasattr(pe, 'OPTIONAL_HEADER'):
+            op = pe.OPTIONAL_HEADER
+            fts['Magic'] = getattr(op, 'Magic', 0)
+            fts['MajorLinkerVersion'] = getattr(op, 'MajorLinkerVersion', 0)
+            fts['MinorLinkerVersion'] = getattr(op, 'MinorLinkerVersion', 0)
+            fts['SizeOfCode'] = getattr(op, 'SizeOfCode', 0)
+            fts['SizeOfInitializedData'] = getattr(op, 'SizeOfInitializedData', 0)
+            fts['SizeOfUninitializedData'] = getattr(op, 'SizeOfUninitializedData', 0)
+            fts['AddressOfEntryPoint'] = getattr(op, 'AddressOfEntryPoint', 0)
+            fts['BaseOfCode'] = getattr(op, 'BaseOfCode', 0)
+            fts['ImageBase'] = getattr(op, 'ImageBase', 0)
+            fts['SectionAlignment'] = getattr(op, 'SectionAlignment', 0)
+            fts['FileAlignment'] = getattr(op, 'FileAlignment', 0)
+            fts['MajorOperatingSystemVersion'] = getattr(op, 'MajorOperatingSystemVersion', 0)
+            fts['MinorOperatingSystemVersion'] = getattr(op, 'MinorOperatingSystemVersion', 0)
+            fts['MajorImageVersion'] = getattr(op, 'MajorImageVersion', 0)
+            fts['MinorImageVersion'] = getattr(op, 'MinorImageVersion', 0)
+            fts['MajorSubsystemVersion'] = getattr(op, 'MajorSubsystemVersion', 0)
+            fts['MinorSubsystemVersion'] = getattr(op, 'MinorSubsystemVersion', 0)
+            fts['SizeOfImage'] = getattr(op, 'SizeOfImage', 0)
+            fts['SizeOfHeaders'] = getattr(op, 'SizeOfHeaders', 0)
+            fts['CheckSum'] = getattr(op, 'CheckSum', 0)
+            fts['Subsystem'] = getattr(op, 'Subsystem', 0)
+            fts['DllCharacteristics'] = getattr(op, 'DllCharacteristics', 0)
+            fts['SizeOfStackReserve'] = getattr(op, 'SizeOfStackReserve', 0)
+            fts['SizeOfStackCommit'] = getattr(op, 'SizeOfStackCommit', 0)
+            fts['SizeOfHeapReserve'] = getattr(op, 'SizeOfHeapReserve', 0)
+            fts['SizeOfHeapCommit'] = getattr(op, 'SizeOfHeapCommit', 0)
+            fts['LoaderFlags'] = getattr(op, 'LoaderFlags', 0)
+            fts['NumberOfRvaAndSizes'] = getattr(op, 'NumberOfRvaAndSizes', 0)
+            fts['Is64Bit'] = 1.0 if fh.Machine in (0x8664, 0xAA64, 0x0200) else 0.0
+            fts['IsExe'] = 1.0 if pe.is_exe() else 0.0
+            fts['IsDll'] = 1.0 if pe.is_dll() else 0.0
+            fts['IsDriver'] = 1.0 if fts['Subsystem'] == 1 else 0.0
+
+            if hasattr(op, 'DATA_DIRECTORY'):
+                reloc_idx = pefile.DIRECTORY_ENTRY.get('IMAGE_DIRECTORY_ENTRY_BASERELOC', 5)
+                if len(op.DATA_DIRECTORY) > reloc_idx and op.DATA_DIRECTORY[reloc_idx].Size > 0:
+                    fts['HasRelocationDirectory'] = 1.0
+
+        try:
+            fts['FileEntropy'] = calc_entropy(file_bytes)
+        except Exception:
+            pass
+
+        sec_entropies = []
+        text_entropies = []
+        data_entropies = []
+        rsrc_entropies = []
+        char_flags = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
+
+        if hasattr(pe, 'sections'):
+            fts['SectionCount'] = len(pe.sections)
+            for section in pe.sections:
+                try: 
+                    name = section.Name.decode('ascii', 'ignore').strip('\x00')
+                except Exception: 
+                    name = ""
+                    
+                try: 
+                    s_data = section.get_data()
+                    s_entropy = calc_entropy(s_data)
+                except Exception: 
+                    s_data = b""
+                    s_entropy = 0.0
+
+                sec_entropies.append(s_entropy)
+
+                if any(p in name.lower() for p in Features.PACKERS): fts['HasPacked'] = 1.0
+                if section.Characteristics & 0x20000000: fts['ExecutableSections'] += 1.0
+                if section.Characteristics & 0x80000000: fts['WritableSections'] += 1.0
+                if section.Characteristics & 0x40000000: fts['ReadableSections'] += 1.0
+                if section.SizeOfRawData + section.PointerToRawData > fsize: fts['SectionException'] = 1.0
+
+                for flag in char_flags:
+                    if section.Characteristics & flag:
+                        fts[f'Char_{flag:08X}_Count'] += 1.0
+                        fts[f'Char_{flag:08X}_MeanEntropy'] += s_entropy
+
+                ratio = safe_div(section.SizeOfRawData, fsize)
+                if name.startswith('.text'):
+                    text_entropies.append(s_entropy)
+                    fts['TextSizeRatio'] += ratio
+                elif name.startswith('.data'):
+                    data_entropies.append(s_entropy)
+                    fts['DataSizeRatio'] += ratio
+                elif name.startswith('.rsrc'):
+                    rsrc_entropies.append(s_entropy)
+                    fts['RsrcSizeRatio'] += ratio
+                    if b"requireAdministrator" in s_data: fts['IsAdmin'] = 1.0
+                    for sig in Features.INSTALLER_SIGS:
+                        if sig in s_data:
+                            fts['IsInstall'] = 1.0
+                            break
+
+        fts['SectionMeanEntropy'] = safe_div(sum(sec_entropies), len(sec_entropies))
+        fts['TextSectionMaxEntropy'] = max(text_entropies) if text_entropies else 0.0
+        fts['TextSectionMeanEntropy'] = safe_div(sum(text_entropies), len(text_entropies))
+        fts['DataSectionMaxEntropy'] = max(data_entropies) if data_entropies else 0.0
+        fts['DataSectionMeanEntropy'] = safe_div(sum(data_entropies), len(data_entropies))
+        fts['RsrcSectionMaxEntropy'] = max(rsrc_entropies) if rsrc_entropies else 0.0
+        fts['RsrcSectionMeanEntropy'] = safe_div(sum(rsrc_entropies), len(rsrc_entropies))
+
+        for flag in char_flags:
+            fts[f'Char_{flag:08X}_MeanEntropy'] = safe_div(fts[f'Char_{flag:08X}_MeanEntropy'], fts[f'Char_{flag:08X}_Count'])
+
+        try:
+            pe.parse_data_directories(directories=[
+                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
+                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
+                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
+                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG'],
+                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_TLS']
+            ])
+        except Exception:
+            pass
+
+        if hasattr(pe, 'DIRECTORY_ENTRY_TLS') and hasattr(pe.DIRECTORY_ENTRY_TLS, 'struct'):
+            if getattr(pe.DIRECTORY_ENTRY_TLS.struct, 'AddressOfCallBacks', 0) != 0:
+                fts['HasTlsCallbacks'] = 1.0
+
+        if hasattr(pe, 'VS_FIXEDFILEINFO') and len(pe.VS_FIXEDFILEINFO) > 0:
+            flags = getattr(pe.VS_FIXEDFILEINFO[0], 'FileFlags', 0)
+            fts['IsDebug'] = 1.0 if flags & 0x1 else 0.0
+            fts['IsPreRelease'] = 1.0 if flags & 0x2 else 0.0
+            fts['IsPatched'] = 1.0 if flags & 0x4 else 0.0
+            fts['IsPrivateBuild'] = 1.0 if flags & 0x8 else 0.0
+            fts['IsSpecialBuild'] = 1.0 if flags & 0x20 else 0.0
+
+        if hasattr(pe, 'FileInfo'):
+            for fileinfo_list in pe.FileInfo:
+                for fileinfo in fileinfo_list:
+                    if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
+                        for st in getattr(fileinfo, 'StringTable', []):
+                            for key, val in st.entries.items():
+                                try:
+                                    k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
+                                    v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
+                                    length = len(v)
+                                    if k == 'FileDescription': fts['FileDescriptionLength'] = length
+                                    elif k == 'FileVersion': fts['FileVersionLength'] = length
+                                    elif k == 'ProductName': fts['ProductNameLength'] = length
+                                    elif k == 'ProductVersion': fts['ProductVersionLength'] = length
+                                    elif k == 'CompanyName': fts['CompanyNameLength'] = length
+                                    elif k == 'LegalCopyright': fts['LegalCopyrightLength'] = length
+                                    elif k == 'Comments': fts['CommentsLength'] = length
+                                    elif k == 'InternalName': fts['InternalNameLength'] = length
+                                    elif k == 'LegalTrademarks': fts['LegalTrademarksLength'] = length
+                                    elif k == 'SpecialBuild': fts['SpecialBuildLength'] = length
+                                    elif k == 'PrivateBuild': fts['PrivateBuildLength'] = length
+                                except Exception:
+                                    continue
+
+        if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
+            fts['ImportCount'] = len(pe.DIRECTORY_ENTRY_IMPORT)
+            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                if getattr(entry, 'dll', None):
+                    try:
+                        dll_name = entry.dll.decode('ascii', 'ignore').lower()
+                        if dll_name in Features.TARGET_DLLS: 
+                            fts[f"Dll_{dll_name.replace('.', '_')}"] = 1.0
+                    except Exception: 
+                        pass
+                
+                imports = getattr(entry, 'imports', [])
+                for imp in imports:
+                    fts['ImportFunctionCount'] += 1.0
+                    if not getattr(imp, 'name', None): continue
+                    try:
+                        func_name = imp.name.decode('ascii', 'ignore')
+                        if func_name in Features._ALL_APIS:
+                            fts[f'Api_{func_name}'] += 1.0
+                            fts['ApiCount'] += 1.0
+                        for cat in Features._API_TO_CATS.get(func_name, []):
+                            fts[f'Cat_{cat}'] += 1.0
+                    except Exception: 
+                        continue
+
+        if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols'):
+            fts['ExportCount'] = len(pe.DIRECTORY_ENTRY_EXPORT.symbols)
+        
+        if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
+            for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
+                if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
+                    fts['IconCount'] += len(getattr(entry.directory, 'entries', []))
+                    
+        if hasattr(pe, 'OPTIONAL_HEADER') and hasattr(pe.OPTIONAL_HEADER, 'DATA_DIRECTORY') and len(pe.OPTIONAL_HEADER.DATA_DIRECTORY) > 3:
+            exc_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[3]
+            if exc_dir.Size > 0:
+                fts['ExceptionCount'] = exc_dir.Size // 12 if fts['Machine'] in (0x8664, 0xAA64) else 0.0
+            
+        if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'): 
+            fts['DebugCount'] = len(pe.DIRECTORY_ENTRY_DEBUG)
+
+        for k in fts: 
+            fts[k] = safe_float(fts[k])
+            
+        return fts
+
+    except pefile.PEFormatError:
+        return None
+    except Exception:
+        return None
+    finally:
+        if pe: 
+            pe.close()
+
+####################################################################################################
+
+def init_db():
+    conn = sqlite3.connect(DB_PATH)
+    conn.execute("PRAGMA synchronous = OFF")
+    conn.execute("PRAGMA journal_mode = WAL")
+    conn.execute("PRAGMA cache_size = 10000")
+    
+    cols = "FileHash TEXT, " + ", ".join([f"{c} REAL" for c in Features.SCHEMA])
+    conn.execute(f"CREATE TABLE IF NOT EXISTS PeData ({cols}, Label INTEGER)")
+    conn.execute(f"CREATE UNIQUE INDEX IF NOT EXISTS idx_pedata_hash ON PeData (FileHash)")
+    conn.commit()
+    return conn
+
+def load_existing_hashes(conn):
+    print("[*] Loading existing hashes into memory...")
+    try:
+        cursor = conn.execute("SELECT FileHash FROM PeData")
+        return {row[0] for row in cursor.fetchall()}
+    except:
+        return set()
+
+####################################################################################################
+
+def scan_and_save(conn, path, label, existing_hashes):
+    print(f"\n[*] Scanning: {path} (Label={label})")
+    print(f"[*] Config: Max File Size = {MAX_FILE_SIZE/1024/1024:.0f} MB")
+    
+    files = []
+    if os.path.isfile(path): 
+        files.append(path)
+    else:
+        for r, _, fs in os.walk(path):
+            for f in fs:
+                if os.path.splitext(f)[1].lower() in TARGET_EXTENSIONS:
+                    files.append(os.path.join(r, f))
+    
+    total = len(files)
+    if total == 0:
+        print("[-] No valid PE files found.")
+        return
+
+    print(f"[*] Found {total} files. Processing...\n")
+    
+    batch = []
+    count = 0
+    errors = 0
+    skipped = 0
+    start_time = time.time()
+    
+    placeholders = ",".join(["?"] * (len(Features.SCHEMA) + 2))
+    sql = f"INSERT INTO PeData VALUES ({placeholders})"
+    
+    try:
+        for i, file_path in enumerate(files):
+            try:
+                fsize = os.path.getsize(file_path)
+                if fsize == 0 or fsize > MAX_FILE_SIZE:
+                    errors += 1
+                    continue
+
+                with open(file_path, "rb") as f:
+                    file_bytes = f.read()
+
+                sha256 = hashlib.sha256(file_bytes).hexdigest()
+                if sha256 in existing_hashes:
+                    skipped += 1
+                else:
+                    res = process_single_file_content(file_bytes, file_path)
+                    
+                    if res:
+                        vals = [sha256]
+                        vals.extend([res.get(c, 0.0) for c in Features.SCHEMA])
+                        vals.append(float(label))
+                        batch.append(tuple(vals))
+                        
+                        existing_hashes.add(sha256)
+                        count += 1
+                    else:
+                        errors += 1
+
+            except Exception:
+                errors += 1
+            
+            if len(batch) >= BATCH_SIZE:
+                try:
+                    conn.executemany(sql, batch)
+                    conn.commit()
+                    batch = []
+                except Exception as batch_err:
+                    print(f"\n[-] Batch Error: {batch_err}")
+                    batch = []
+            
+            elapsed = time.time() - start_time
+            rate = (i + 1) / elapsed if elapsed > 0 else 0
+            sys.stdout.write(f"\r[{i+1}/{total}] New: {count} | Skip: {skipped} | Err: {errors} | {rate:.1f} files/s")
+            sys.stdout.flush()
+
+    except KeyboardInterrupt:
+        print("\n\n[-] Interrupted by user.")
+    except Exception as e:
+        print(f"\n[-] Unexpected Error: {e}")
+    finally:
+        if batch:
+            try:
+                conn.executemany(sql, batch)
+                conn.commit()
+            except Exception:
+                pass
+        
+        print(f"\n\n[+] Scan finished. Total New: {count}, Total Skipped: {skipped}")
+
+####################################################################################################
+
+if __name__ == "__main__":
+    print("\n---------------- PE Dataset Builder v3.2 ----------------\n")
+    
+    if os.path.exists(DB_PATH):
+        try:
+            conn_check = sqlite3.connect(DB_PATH)
+            cursor = conn_check.execute("PRAGMA table_info(PeData)")
+            cols = [row[1] for row in cursor.fetchall()]
+            if 'FileHash' not in cols or len(cols) != len(Features.SCHEMA) + 2:
+                print(f"[-] WARNING: DB Schema mismatch. Please delete {DB_PATH} to rebuild.")
+            conn_check.close()
+        except: pass
+
+    conn = init_db()
+    
+    existing_hashes = load_existing_hashes(conn)
+    print(f"[+] Loaded {len(existing_hashes)} hashes from database.\n")
+
+    try:
+        while True:
+            print("-" * 60)
+            raw_path = input("\n[*] Enter Path (File or Folder): ").strip()
+            target_path = raw_path.strip('"').strip("'")
+
+            if target_path.lower() in ['exit', 'q']: break
+            if not target_path or not os.path.exists(target_path):
+                print("[-] Invalid path.")
+                continue
+
+            while True:
+                label_input = input("[*] Enter Label (0=Safe, 1=Malware): ").strip()
+                if label_input.lower() in ['exit', 'q']:
+                    conn.close()
+                    sys.exit()
+                if label_input in ['0', '1']:
+                    label = int(label_input)
+                    break
+                print("[-] Please enter 0 or 1.")
+
+            scan_and_save(conn, target_path, label, existing_hashes)
+            
+    except KeyboardInterrupt:
+        print("\n\n[-] Interrupted.")
+    finally:
+        conn.close()
+        print(f"\n[+] Database saved to: {os.path.abspath(DB_PATH)}")

Engine/Properties/train.py

@@ -0,0 +1,217 @@
+import os, sys, time, sqlite3, re, json
+import pandas as pd
+import numpy as np
+import lightgbm as lgb
+import onnxmltools
+
+from onnxmltools.convert.common.data_types import FloatTensorType
+from sklearn.model_selection import train_test_split
+from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
+
+####################################################################################################
+
+DB_PATH = "pe_features.db"
+MODEL_FILE = "model.txt"
+ONNX_FILE = "model.onnx"
+FEATURE_FILE = "features.json"
+TEST_SIZE = 0.0001
+RANDOM_SEED = 42
+
+LGBM_PARAMS = {
+    'objective': 'binary',
+    'metric': ['binary_logloss', 'auc'],
+    'boosting_type': 'gbdt',
+    'num_leaves': 31,
+    'learning_rate': 0.05,
+    'feature_fraction': 0.8,
+    'bagging_fraction': 0.8,
+    'bagging_freq': 5,
+    'verbose': -1,
+    'seed': RANDOM_SEED,
+    'n_jobs': -1,
+    'max_depth': -1,
+    'min_data_in_leaf': 10,
+    'lambda_l1': 0.1,
+    'lambda_l2': 0.1,
+}
+
+####################################################################################################
+
+def clean_col_name(name):
+    return re.sub(r'[^A-Za-z0-9_]+', '', name)
+
+def get_raw_schema(db_path):
+    if not os.path.exists(db_path):
+        return None
+    conn = sqlite3.connect(db_path)
+    try:
+        cursor = conn.cursor()
+        cursor.execute("PRAGMA table_info(PeData)")
+        columns = [row[1] for row in cursor.fetchall()]
+        exclude = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score', 'filehash', 'timedatestamp'}
+        return [c for c in columns if c.lower().strip() not in exclude]
+    except Exception as e:
+        print(f"[-] Schema extraction error: {e}")
+        return None
+    finally:
+        conn.close()
+
+####################################################################################################
+
+def load_data(db_path, raw_cols):
+    print(f"[*] Connecting to database: {db_path}")
+    conn = sqlite3.connect(db_path)
+    req_cols = list(set(raw_cols + ['Label']))
+    sql = f"SELECT {', '.join(req_cols)} FROM PeData"
+    
+    try:
+        chunks = []
+        for chunk in pd.read_sql_query(sql, conn, chunksize=20000):
+            label_col = next((c for c in chunk.columns if c.lower().strip() == 'label'), None)
+            if not label_col:
+                print("[-] Critical Error: Label column not found.")
+                return None, None, None
+
+            cols_to_cast = [c for c in chunk.columns if c != label_col]
+            chunk[cols_to_cast] = chunk[cols_to_cast].astype(np.float32)
+            chunk[label_col] = chunk[label_col].astype(np.int8)
+            chunks.append(chunk)
+
+        if not chunks:
+            return None, None, None
+
+        df = pd.concat(chunks, ignore_index=True)
+
+        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
+        y = df[label_col].astype(int)
+        X = df.drop(columns=[label_col], errors='ignore')
+        
+        valid_features = [c for c in raw_cols if c in X.columns]
+        X = X[valid_features].copy()
+        
+        rename_map = {old: clean_col_name(old) for old in X.columns}
+        X = X.rename(columns=rename_map)
+        
+        if X.columns.duplicated().any():
+            print("[-] Warning: Duplicate column names detected after cleaning. Deduplicating...")
+            X = X.loc[:, ~X.columns.duplicated()]
+
+        final_features = X.columns.tolist()
+        return X, y, final_features
+    finally:
+        conn.close()
+
+####################################################################################################
+
+def train_process(X, y):
+    print(f"[*] Dataset shape: {X.shape}")
+    
+    X_train, X_test, y_train, y_test = train_test_split(
+        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
+    )
+    
+    n_pos = (y_train == 1).sum()
+    n_neg = (y_train == 0).sum()
+    
+    base_weight = n_neg / n_pos if n_pos > 0 else 1.0
+    weight_ratio_target = 0.01
+    final_pos_weight = base_weight * weight_ratio_target
+    
+    print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
+    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted={final_pos_weight:.4f}")
+    
+    train_data = lgb.Dataset(X_train, label=y_train)
+    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data)
+    
+    params = LGBM_PARAMS.copy()
+    params['scale_pos_weight'] = final_pos_weight
+
+    print("\n[*] Starting LightGBM training...")
+    start_time = time.time()
+    
+    model = lgb.train(
+        params,
+        train_data,
+        valid_sets=[valid_data],
+        num_boost_round=1000,
+        callbacks=[
+            lgb.log_evaluation(period=100)
+        ]
+    )
+    
+    elapsed = time.time() - start_time
+    print(f"\n[+] Training finished in {elapsed:.2f}s")
+    
+    return model, X_test, y_test
+
+####################################################################################################
+
+def export_onnx_model(model, feature_names):
+    print(f"[*] Exporting ONNX model to {ONNX_FILE}...")
+    try:
+        initial_type = [('float_input', FloatTensorType([None, len(feature_names)]))]
+        onnx_model = onnxmltools.convert_lightgbm(model, initial_types=initial_type)
+        onnxmltools.utils.save_model(onnx_model, ONNX_FILE)
+        
+        with open(FEATURE_FILE, 'w') as f:
+            json.dump(feature_names, f)
+            
+        print(f"[+] ONNX export success. Features synced to {FEATURE_FILE}")
+    except Exception as e:
+        print(f"[-] ONNX export failed: {e}")
+
+####################################################################################################
+
+def evaluate_and_save(model, X_test, y_test):
+    print("\n------------------- Evaluation Report -------------------\n")
+    y_prob = model.predict(X_test, num_iteration=model.best_iteration)
+    y_pred = (y_prob > 0.5).astype(int)
+    
+    acc = accuracy_score(y_test, y_pred)
+    auc = roc_auc_score(y_test, y_prob)
+    
+    print(f"Accuracy : {acc:.4f}")
+    print(f"ROC AUC  : {auc:.4f}")
+    print("\n" + classification_report(y_test, y_pred, zero_division=0))
+
+    print("---------------------------------------------------------\n")
+    print("[*] Top 20 Features (Importance by Gain):")
+    
+    feature_names = model.feature_name()
+    importance = model.feature_importance(importance_type='gain')
+    feature_imp = pd.DataFrame(sorted(zip(importance, feature_names), reverse=True), columns=['Value', 'Feature'])
+    print(feature_imp.head(20).to_string(index=False))
+    
+    print("\n---------------------------------------------------------\n")
+    
+    model.save_model(MODEL_FILE)
+    print(f"[+] Native model saved to: {os.path.abspath(MODEL_FILE)}")
+    
+    export_onnx_model(model, feature_names)
+
+####################################################################################################
+
+if __name__ == "__main__":
+    print("\n---------------- PE Malware Trainer v3.1 ----------------\n")
+
+    if not os.path.exists(DB_PATH):
+        print(f"[-] Error: Database {DB_PATH} not found.")
+        sys.exit(1)
+
+    raw_schema = get_raw_schema(DB_PATH)
+    if not raw_schema:
+        print("[-] Error: Could not read schema.")
+        sys.exit(1)
+
+    X, y, _ = load_data(DB_PATH, raw_schema)
+    if X is None:
+        sys.exit(1)
+
+    try:
+        model, X_test, y_test = train_process(X, y)
+        evaluate_and_save(model, X_test, y_test)
+    except KeyboardInterrupt:
+        print("\n\n[-] Training interrupted.")
+    except Exception as e:
+        print(f"\n[-] Critical Error: {e}")
+

PYAS_Config.py

@@ -27,7 +27,7 @@ translate_dict = {
               "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","正在加載":"Loading ","加載":"Load ",
               "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ","主要":"Main ",
               "許可條款":"License Terms ","惡意":"Malicious", "開發":"Developers ",
-              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
+              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ","初始化":"initialize ",
               "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
               "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
               "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
@@ -69,12 +69,437 @@ translate_dict = {
               "重置":"Reset ","窗口":"Window ","暫存":"Temp ","自訂":"Custom ",
               "不支持":"Not Support ","共":"Total ","秒":"Seconds ","耗時":"Takes ",
               "沙箱":"Sandbox ", "虛擬":"Virtual ", "隔離":"Quarantine ", "時":"",
-              "建立":"Create ","環境":"Environment ","沙箱":"Sandbox ","化":"", "表":"",
+              "建立":"Create ","環境":"Environment ","化":"","表":"",
               "達":"Reached ", "上限":"Limit ", "區":"", "金鑰":"Key ", "產品":"Product ",
               "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Inject ",
               "前往":"Go ","檢查":"Check ","可用":"Available ","靜態":"Static ",
-              "版本":"Version ","是":"","剩餘":"Remain ","遠控":"Remote ","監控":"Monitor ",
-              "  ":" "},
+              "版本":"Version ","是":"","剩餘":"Remain ","遠控":"Remote ","  ":" "},
+
+    "japanese_switch": {"開啟":"オン","關閉":"オフ","开启":"オン","关闭":"オフ","，":", ",
+              "立即刪除":"即時削除","安全模式":"セーフモード","官方網站":"公式サイト",
+              "腳本":"スクリプト","鏈式":"チェーン","記憶體":"メモリ","正在加載":"読み込み中","加載":"ロード",
+              "行為":"振る舞い","可疑":"疑わしい","勒索":"ランサム","主要":"メイン",
+              "許可條款":"ライセンス条項","惡意":"悪意のある","開發":"開発",
+              "啟用":"有効化","禁用":"無効化","正在初始化中":"初期化中","初始化":"初期化",
+              "正在掃描":"スキャン中","正在刪除":"削除中","正在追蹤":"追跡中",
+              "最小化到":"最小化先","靈敏度":"感度","正在檢查":"確認中",
+              "確定要":"本当によろしいですか","引擎靈敏度":"エンジン感度","更新":"更新",
+              "白色主題":"ホワイト","黃色主題":"イエロー","紅色主題":"レッド","語言":"言語",
+              "藍色主題":"ブルー","綠色主題":"グリーン","自訂主題":"カスタム","黑色主題":"ブラック",
+              "特別感謝":"貢献者","版本資訊":"バージョン情報","通訊":"通信",
+              "註冊":"レジストリ","退出":"終了","檔案":"ファイル","當前":"現在の",
+              "狀態":"状態","掃描":"スキャン","工具":"ツール","防護":"保護",
+              "失敗":"失敗","請":"してください","路徑":"パス","方式":"方式",
+              "需要":"必要","病毒":"ウイルス","選擇":"選択","返回":"戻る",
+              "受到":"受けた","錯誤":"エラー","完成":"完了","引擎":"エンジン",
+              "托盤":"トレイ","圖標":"アイコン","不安全":"非セキュア","增強":"強化",
+              "系統":"システム","雲端":"クラウド","重啟":"再起動","修復":"修復",
+              "裝置":"デバイス","發現":"検出","成功":"成功","清理":"クリーンアップ",
+              "確定":"確定","執行":"実行","警告":"警告","使用":"使用",
+              "網路":"ネットワーク","變更":"変更","總數":"合計","結束":"終了",
+              "選項":"オプション","監控":"監視","連接":"接続","可以":"可能",
+              "進程":"プロセス","攔截":"ブロック","引導":"ブート","刪除":"削除",
+              "分區":"パーティション","設定":"設定","關於":"情報","模式":"モード",
+              "提高":"向上","安全":"セキュリティ","顯色":"色","顏色":"色",
+              "主題":"テーマ","回收":"回収","無用":"不要な","導入":"インポート",
+              "風險":"リスク","介面":"インターフェース","核心":"コア","服務":"サービス",
+              "管理":"管理","所有":"すべての","您":"あなた","取消":"キャンセル","未":"未",
+              "垃圾":"ジャンク","位元":"バイト","本機":"PC","停止":"停止",
+              "到":"へ","白名單":"ホワイトリスト","軟體":"ソフトウェア","正在":"",
+              "增加":"追加","移除":"削除","項目":"項目","生成":"生成","稱":"",
+              "複製":"コピー","此":"この","並":"および","全盤":"フル","最新":"最新",
+              "已存在":"既に存在します","數據庫":"データベース","誤報":"誤検知",
+              "高":"高","新":"新","和":"と","可能會":"可能性があります","會":"します",
+              "日誌":"ログ","已":"済み","彈窗":"ポップアップ","要":"する","驅動":"ドライバ",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"ルール",
+              "密鑰":"キー","檢測":"検知","製作":"作成","運行":"実行中",
+              "擴展":"拡張","套件":"キット","自動":"自動","上報":"報告",
+              "分析":"分析","自身":"自身","其他":"その他","配置":"設定",
+              "丟失":"紛失","網站":"ウェブサイト","不兼容":"非互換","列表":"リスト",
+              "竄改":"改ざん","第三方":"サードパーティ","實時":"リアルタイム","查看":"表示",
+              "指定":"指定","清空":"空にする","資源回收桶":"ごみ箱","無法":"できません",
+              "與":"と","當":"時","功能":"機能","異常":"異常","來":"へ",
+              "重置":"リセット","窗口":"ウィンドウ","暫存":"一時","自訂":"カスタム",
+              "不支持":"未対応","共":"合計","秒":"秒","耗時":"所要時間",
+              "沙箱":"サンドボックス","虛擬":"仮想","隔離":"隔離","時":"",
+              "建立":"作成","環境":"環境","化":"","表":"",
+              "達":"到達","上限":"上限","區":"","金鑰":"キー","產品":"製品",
+              "運行庫":".NET CLR","殼碼":"シェルコード","線程":"スレッド","注入":"インジェクション",
+              "前往":"移動","檢查":"確認","可用":"利用可能","靜態":"静的",
+              "版本":"バージョン","是":"","剩餘":"残り","遠控":"遠隔操作","  ":" "},
+
+    "korean_switch": {"開啟":"켜기","關閉":"끄기","开启":"켜기","关闭":"끄기","，":", ",
+              "立即刪除":"즉시 삭제","安全模式":"안전 모드","官方網站":"공식 웹사이트",
+              "腳本":"스크립트","鏈式":"체인","記憶體":"메모리","正在加載":"로딩 중","加載":"로드",
+              "行為":"행위","可疑":"의심스러운","勒索":"랜섬웨어","主要":"주요",
+              "許可條款":"라이선스 약관","惡意":"악성","開發":"개발",
+              "啟用":"활성화","禁用":"비활성화","正在初始化中":"초기화 중","初始化":"초기화",
+              "正在掃描":"스캔 중","正在刪除":"삭제 중","正在追蹤":"추적 중",
+              "最小化到":"최소화","靈敏度":"민감도","正在檢查":"검사 중",
+              "確定要":"정말","引擎靈敏度":"엔진 민감도","更新":"업데이트",
+              "白色主題":"화이트","黃色主題":"옐로우","紅色主題":"레드","語言":"언어",
+              "藍色主題":"블루","綠色主題":"그린","自訂主題":"사용자 지정","黑色主題":"블랙",
+              "特別感謝":"기여자","版本資訊":"버전 정보","通訊":"통신",
+              "註冊":"레지스트리","退出":"종료","檔案":"파일","當前":"현재",
+              "狀態":"상태","掃描":"스캔","工具":"도구","防護":"보호",
+              "失敗":"실패","請":"부탁합니다","路徑":"경로","方式":"방식",
+              "需要":"필요","病毒":"바이러스","選擇":"선택","返回":"뒤로",
+              "受到":"받음","錯誤":"오류","完成":"완료","引擎":"엔진",
+              "托盤":"트레이","圖標":"아이콘","不安全":"안전하지 않음","增強":"강화",
+              "系統":"시스템","雲端":"클라우드","重啟":"재부팅","修復":"복구",
+              "裝置":"장치","發現":"발견","成功":"성공","清理":"정리",
+              "確定":"확인","執行":"실행","警告":"경고","使用":"사용",
+              "網路":"네트워크","變更":"변경","總數":"총계","結束":"종료",
+              "選項":"옵션","監控":"모니터링","連接":"연결","可以":"가능",
+              "進程":"프로세스","攔截":"차단","引導":"부트","刪除":"삭제",
+              "分區":"파티션","設定":"설정","關於":"정보","模式":"모드",
+              "提高":"향상","安全":"보안","顯色":"색상","顏色":"색상",
+              "主題":"테마","回收":"회수","無用":"불필요한","導入":"가져오기",
+              "風險":"위험","介面":"인터페이스","核心":"코어","服務":"서비스",
+              "管理":"관리","所有":"모든","您":"귀하","取消":"취소","未":"미",
+              "垃圾":"정크","位元":"바이트","本機":"PC","停止":"중지",
+              "到":"로","白名單":"화이트리스트","軟體":"소프트웨어","正在":"",
+              "增加":"추가","移除":"제거","項目":"항목","生成":"생성","稱":"",
+              "複製":"복사","此":"이","並":"및","全盤":"전체","最新":"최신",
+              "已存在":"이미 존재함","數據庫":"데이터베이스","誤報":"오탐지",
+              "高":"높음","新":"신규","和":"와","可能會":"할 수 있습니다","會":"합니다",
+              "日誌":"로그","已":"완료","彈窗":"팝업","要":"할","驅動":"드라이버",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"규칙",
+              "密鑰":"키","檢測":"탐지","製作":"제작","運行":"실행 중",
+              "擴展":"확장","套件":"키트","自動":"자동","上報":"보고",
+              "分析":"분석","自身":"자신","其他":"기타","配置":"구성",
+              "丟失":"분실","網站":"웹사이트","不兼容":"호환되지 않음","列表":"목록",
+              "竄改":"변조","第三方":"서드파티","實時":"실시간","查看":"보기",
+              "指定":"지정","清空":"비우기","資源回收桶":"휴지통","無法":"할 수 없음",
+              "與":"와","當":"할 때","功能":"기능","異常":"이상","來":"오다",
+              "重置":"초기화","窗口":"창","暫存":"임시","自訂":"사용자 지정",
+              "不支持":"지원하지 않음","共":"총","秒":"초","耗時":"소요 시간",
+              "沙箱":"샌드박스","虛擬":"가상","隔離":"격리","時":"",
+              "建立":"생성","環境":"환경","化":"","表":"",
+              "達":"도달","上限":"제한","區":"","金鑰":"키","제품":"제품",
+              "運行庫":".NET CLR","殼碼":"셸코드","線程":"스레드","注入":"인젝션",
+              "前往":"이동","檢查":"검사","可用":"사용 가능","靜態":"정적",
+              "版本":"버전","是":"","剩餘":"남은","遠控":"원격 제어","  ":" "},
+
+    "french_switch": {"開啟":"On ","關閉":"Off ","开启":"On ","关闭":"Off ","，":", ",
+              "立即刪除":"Supprimer ","安全模式":"Mode sans échec ","官方網站":"Site officiel ",
+              "腳本":"Script ","鏈式":"Chaîne ","記憶體":"Mémoire ","正在加載":"Chargement ","加載":"Charger ",
+              "行為":"Comportement ","可疑":"Suspect ","勒索":"Ransomware ","主要":"Principal ",
+              "許可條款":"Licence ","惡意":"Malveillant ","開發":"Développeurs ",
+              "啟用":"Activer ","禁用":"Désactiver ","正在初始化中":"Initialisation ","初始化":"Initialiser ",
+              "正在掃描":"Analyse en cours ","正在刪除":"Suppression ","正在追蹤":"Suivi en cours ",
+              "最小化到":"Réduire vers ","靈敏度":"Sensibilité ","正在檢查":"Vérification ",
+              "確定要":"Êtes-vous sûr ","引擎靈敏度":"Sensibilité ","更新":"Mettre à jour ",
+              "白色主題":"Blanc","黃色主題":"Jaune","紅色主題":"Rouge","語言":"Langue ",
+              "藍色主題":"Bleu","綠色主題":"Vert","自訂主題":"Personnalisé","黑色主題":"Noir",
+              "特別感謝":"Contributeurs ","版本資訊":"Information ","通訊":"Connexion ",
+              "註冊":"Registre ","退出":"Quitter ","檔案":"Fichier ","當前":"Actuellement ",
+              "狀態":"État ","掃描":"Analyser ","工具":"Outils ","防護":"Protection ",
+              "失敗":"Échec ","請":"Veuillez ","路徑":"Chemin ","方式":"Méthode ",
+              "需要":"Nécessaire ","病毒":"Virus ","選擇":"Sélectionner ","返回":"Retour ",
+              "受到":"Reçu ","錯誤":"Erreur ","完成":"Terminé ","引擎":"Moteur ",
+              "托盤":"Barre ","圖標":"Icône ","不安全":"Non sécurisé ","增強":"Améliorer ",
+              "系統":"Système ","雲端":"Cloud ","重啟":"Redémarrer ","修復":"Réparer ",
+              "裝置":"Appareil ","發現":"Trouvé ","成功":"Succès ","清理":"Nettoyer ",
+              "確定":"OK ","執行":"Exécuter ","警告":"Avertissement ","使用":"Utiliser ",
+              "網路":"Réseau ","變更":"Modifier ","總數":"Total ","結束":"Fin ",
+              "選項":"Options ","監控":"Surveiller ","連接":"Connecter ","可以":"Peut ",
+              "進程":"Processus ","攔截":"Bloquer ","引導":"Amorçage ","刪除":"Supprimer ",
+              "分區":"Partition ","設定":"Paramètres ","關於":"À propos ","模式":"Mode ",
+              "提高":"Améliorer ","安全":"Sécurité ","顯色":"Couleur ","顏色":"Couleur ",
+              "主題":"Thème ","回收":"Corbeille ","無用":"Inutile ","導入":"Importer ",
+              "風險":"Risque ","介面":"UI ","核心":"Cœur ","服務":"Services ",
+              "管理":"Gérer ","所有":"Tout ","您":"Vous ","取消":"Annuler ","未":"Non ",
+              "垃圾":"Déchet ","位元":"octets ","本機":"PC ","停止":"Arrêter ",
+              "到":"Vers ","白名單":"Liste blanche ","軟體":"Logiciel ","正在":"",
+              "增加":"Ajouter ","移除":"Retirer ","項目":"Éléments ","生成":"Créer ","稱":"",
+              "複製":"Copier ","此":"Ce ","並":"Et ","全盤":"Complet ","最新":"Dernier ",
+              "已存在":"Existe déjà ","數據庫":"Base de données ","誤報":"Faux positif ",
+              "高":"Haut ","新":"Nouveau ","和":"Et ","可能會":"Possible ","會":"Peut ",
+              "日誌":"Journal ","已":"Déjà ","彈窗":"Fenêtre ","要":"À ","驅動":"Pilote ",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Règle ",
+              "密鑰":"Clé ","檢測":"Détecter ","製作":"Créateur ","運行":"En cours ",
+              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Signaler ",
+              "分析":"Analyse ","自身":"Soi-même ","其他":"Autre ","配置":"Config ",
+              "丟失":"Perdu ","網站":"Site ","不兼容":"Incompatible ","列表":"Liste ",
+              "竄改":"Altérer ","第三方":"Tiers ","實時":"Temps réel ","查看":"Voir ",
+              "指定":"Spécifier ","清空":"Vider ","資源回收桶":"Corbeille ","無法":"Impossible ",
+              "與":"Avec ","當":"Quand ","功能":"Fonction ","異常":"Anormal ","來":"Pour ",
+              "重置":"Réinitialiser ","窗口":"Fenêtre ","暫存":"Temp ","自訂":"Personnalisé ",
+              "不支持":"Non supporté ","共":"Total ","秒":"Secondes ","耗時":"Prend ",
+              "沙箱":"Sandbox ","虛擬":"Virtuel ","隔離":"Quarantaine ","時":"",
+              "建立":"Créer ","環境":"Environnement ","化":"","表":"",
+              "達":"Atteint ","上限":"Limite ","區":"","金鑰":"Clé ","產品":"Produit ",
+              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Injecter ",
+              "前往":"Aller ","檢查":"Vérifier ","可用":"Disponible ","靜態":"Statique ",
+              "版本":"Version ","是":"","剩餘":"Restant ","遠控":"Distant ","  ":" "},
+
+    "spanish_switch": {"開啟":"On ","關閉":"Off ","开启":"On ","关闭":"Off ","，":", ",
+              "立即刪除":"Eliminar ","安全模式":"Modo seguro ","官方網站":"Sitio web ",
+              "腳本":"Script ","鏈式":"Cadena ","記憶體":"Memoria ","正在加載":"Cargando ","加載":"Cargar ",
+              "行為":"Comportamiento ","可疑":"Sospechoso ","勒索":"Ransomware ","主要":"Principal ",
+              "許可條款":"Licencia ","惡意":"Malicioso ","開發":"Desarrolladores ",
+              "啟用":"Activar ","禁用":"Desactivar ","正在初始化中":"Inicializando ","初始化":"Inicializar ",
+              "正在掃描":"Escaneando ","正在刪除":"Eliminando ","正在追蹤":"Rastreando ",
+              "最小化到":"Minimizar a ","靈敏度":"Sensibilidad ","正在檢查":"Comprobando ",
+              "確定要":"Seguro que ","引擎靈敏度":"Sensibilidad ","更新":"Actualizar ",
+              "白色主題":"Blanco","黃色主題":"Amarillo","紅色主題":"Rojo","語言":"Idioma ",
+              "藍色主題":"Azul","綠色主題":"Verde","自訂主題":"Personalizado","黑色主題":"Negro",
+              "特別感謝":"Colaboradores ","版本資訊":"Información ","通訊":"Conectar ",
+              "註冊":"Registro ","退出":"Salir ","檔案":"Archivo ","當前":"Actualmente ",
+              "狀態":"Estado ","掃描":"Escanear ","工具":"Herramientas ","防護":"Protección ",
+              "失敗":"Fallido ","請":"Por favor ","路徑":"Ruta ","方式":"Método ",
+              "需要":"Necesita ","病毒":"Virus ","選擇":"Seleccionar ","返回":"Volver ",
+              "受到":"Recibido ","錯誤":"Error ","完成":"Completado ","引擎":"Motor ",
+              "托盤":"Bandeja ","圖標":"Icono ","不安全":"Inseguro ","增強":"Mejorar ",
+              "系統":"Sistema ","雲端":"Nube ","重啟":"Reiniciar ","修復":"Reparar ",
+              "裝置":"Dispositivo ","發現":"Encontrado ","成功":"Éxito ","清理":"Limpiar ",
+              "確定":"OK ","執行":"Ejecutar ","警告":"Advertencia ","使用":"Usar ",
+              "網路":"Red ","變更":"Cambiar ","總數":"Total ","結束":"Fin ",
+              "選項":"Opciones ","監控":"Monitor ","連接":"Conectar ","可以":"Puede ",
+              "進程":"Proceso ","攔截":"Bloquear ","引導":"Arranque ","刪除":"Eliminar ",
+              "分區":"Partición ","設定":"Ajustes ","關於":"Acerca de ","模式":"Modo ",
+              "提高":"Mejorar ","安全":"Seguridad ","顯色":"Color ","顏色":"Color ",
+              "主題":"Tema ","回收":"Papelera ","無用":"Inútil ","導入":"Importar ",
+              "風險":"Riesgo ","介面":"UI ","核心":"Núcleo ","服務":"Servicios ",
+              "管理":"Gestionar ","所有":"Todo ","您":"Tú ","取消":"Cancelar ","未":"No ",
+              "垃圾":"Basura ","位元":"bytes ","本機":"PC ","停止":"Detener ",
+              "到":"A ","白名單":"Lista blanca ","軟體":"Software ","正在":"",
+              "增加":"Añadir ","移除":"Eliminar ","項目":"Elementos ","生成":"Crear ","稱":"",
+              "複製":"Copiar ","此":"Este ","並":"Y ","全盤":"Completo ","最新":"Último ",
+              "已存在":"Ya existe ","數據庫":"Base de datos ","誤報":"Falso positivo ",
+              "高":"Alto ","新":"Nuevo ","和":"Y ","可能會":"Posible ","會":"Puede ",
+              "日誌":"Registro ","已":"Ya ","彈窗":"Ventana ","要":"A ","驅動":"Controlador ",
+              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Regla ",
+              "密鑰":"Clave ","檢測":"Detectar ","製作":"Creador ","運行":"Ejecutando ",
+              "擴展":"Extensión ","套件":"Kit ","自動":"Auto ","上報":"Reportar ",
+              "分析":"Análisis ","自身":"Sí mismo ","其他":"Otro ","配置":"Config ",
+              "丟失":"Perdido ","網站":"Sitio ","不兼容":"Incompatible ","列表":"Lista ",
+              "竄改":"Manipular ","第三方":"Terceros ","實時":"Tiempo real ","查看":"Ver ",
+              "指定":"Especificar ","清空":"Vaciar ","資源回收桶":"Papelera ","無法":"No puede ",
+              "與":"Con ","當":"Cuando ","功能":"Función ","異常":"Anormal ","來":"Para ",
+              "重置":"Restablecer ","窗口":"Ventana ","暫存":"Temp ","自訂":"Personalizado ",
+              "不支持":"No soportado ","共":"Total ","秒":"Segundos ","耗時":"Tarda ",
+              "沙箱":"Sandbox ","虛擬":"Virtual ","隔離":"Cuarentena ","時":"",
+              "建立":"Crear ","環境":"Entorno ","化":"","表":"",
+              "達":"Alcanzado ","上限":"Límite ","區":"","金鑰":"Clave ","產品":"Producto ",
+              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Hilo ","注入":"Inyectar ",
+              "前往":"Ir ","檢查":"Comprobar ","可用":"Disponible ","靜態":"Estático ",
+              "版本":"Versión ","是":"","剩餘":"Restante ","遠控":"Remoto ","  ":" "},
+
+    "hindi_switch": {"開啟":"चालू ", "關閉":"बंद ", "开启":"चालू ", "关闭":"बंद ", "，":", ",
+              "立即刪除":"अभी हटाएं ", "安全模式":"सुरक्षित मोड ", "官方網站":"आधिकारिक वेबसाइट ",
+              "腳本":"स्क्रिप्ट ", "鏈式":"चेन ", "記憶體":"मेमोरी ", "正在加載":"लोड हो रहा है ", "加載":"लोड करें ",
+              "行為":"व्यवहार ", "可疑":"संदिग्ध ", "勒索":"रैनसमवेयर ", "主要":"मुख्य ",
+              "許可條款":"लाइसेंस शर्तें ", "惡意":"दुर्भावनापूर्ण ", "開發":"डेवलपर्स ",
+              "啟用":"सक्षम करें ", "禁用":"अक्षम करें ", "正在初始化中":"प्रारंभ हो रहा है ", "初始化":"प्रारंभ करें ",
+              "正在掃描":"स्कैन हो रहा है ", "正在刪除":"हटाया जा रहा है ", "正在追蹤":"ट्रैक किया जा रहा है ",
+              "最小化到":"इसमें छोटा करें ", "靈敏度":"संवेदनशीलता ", "正在檢查":"जांच हो रही है ",
+              "確定要":"क्या आप सुनिश्चित हैं ", "引擎靈敏度":"इंजन संवेदनशीलता ", "更新":"अपडेट करें ",
+              "白色主題":"सफ़ेद", "黃色主題":"पीला", "紅色主題":"लाल", "語言":"भाषा ",
+              "藍色主題":"नीला", "綠色主題":"हरा", "自訂主題":"कस्टम", "黑色主題":"काला",
+              "特別感謝":"योगदानकर्ता ", "版本資訊":"संस्करण जानकारी ", "通訊":"संचार ",
+              "註冊":"रजिस्ट्री ", "退出":"बाहर निकलें ", "檔案":"फ़ाइल ", "當前":"वर्तमान ",
+              "狀態":"स्थिति ", "掃描":"स्कैन ", "工具":"उपकरण ", "防護":"सुरक्षा ",
+              "失敗":"विफल ", "請":"कृपया ", "路徑":"पथ ", "方式":"तरीका ",
+              "需要":"आवश्यक ", "病毒":"वायरस ", "選擇":"चुनें ", "返回":"वापस",
+              "受到":"प्राप्त हुआ ", "錯誤":"त्रुटि ", "完成":"पूरा हुआ ", "引擎":"इंजन ",
+              "托盤":"ट्रे ", "圖標":"आइकन ", "不安全":"असुरक्षित ", "增強":"बढ़ाना ",
+              "系統":"सिस्टम ", "雲端":"क्लाउड ", "重啟":"रीबूट ", "修復":"मरम्मत ",
+              "裝置":"डिवाइस ", "發現":"मिला ", "成功":"सफल ", "清理":"सफाई ",
+              "確定":"ठीक ", "執行":"निष्पादित करें ", "警告":"चेतावनी ", "使用":"उपयोग ",
+              "網路":"नेटवर्क ", "變更":"बदलें ", "總數":"कुल ", "結束":"समाप्त ",
+              "選項":"विकल्प ", "監控":"मॉनिटर ", "連接":"कनेक्ट ", "可以":"सकता है ",
+              "進程":"प्रक्रिया ", "攔截":"ब्लॉक ", "引導":"बूट ", "刪除":"हटाएं ",
+              "分區":"पार्टीशन ", "設定":"सेटिंग्स ", "關於":"के बारे में ", "模式":"मोड ",
+              "提高":"सुधारें ", "安全":"सुरक्षा ", "顯色":"रंग ", "顏色":"रंग ",
+              "主題":"थीम ", "回收":"रीसायकल ", "無用":"बेकार ", "導入":"आयात ",
+              "風險":"जोखिम ", "介面":"यूआई ", "核心":"कोर ", "服務":"सेवाएं ",
+              "管理":"प्रबंधित करें ", "所有":"सभी ", "您":"आप ", "取消":"रद्द करें ", "未":"नहीं ",
+              "垃圾":"कचरा ", "位元":"बाइट ", "本機":"पीसी ", "停止":"रोकें ",
+              "到":"तक ", "白名單":"श्वेत सूची ", "軟體":"सॉफ़्टवेयर ", "正在":"",
+              "增加":"जोड़ें ", "移除":"हटाएं ", "項目":"आइटम ", "生成":"बनाएं ", "稱":"",
+              "複製":"कॉपी ", "此":"यह ", "並":"और ", "全盤":"पूर्ण ", "最新":"नवीनतम ",
+              "已存在":"पहले से मौजूद ", "數據庫":"डेटाबेस ", "誤報":"गलत सूचना ",
+              "高":"उच्च ", "新":"नया ", "和":"और ", "可能會":"संभव ", "會":"सकता है ",
+              "日誌":"लॉग ", "已":"हो चुका ", "彈窗":"विंडो ", "要":"को ", "驅動":"ड्राइवर ",
+              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"नियम ",
+              "密鑰":"कुंजी ", "檢測":"पता लगाएं ", "製作":"निर्माता ", "運行":"चल रहा है ",
+              "擴展":"एक्सटेंशन ", "套件":"किट ", "自動":"ऑटो ", "上報":"रिपोर्ट ",
+              "分析":"विश्लेषण ", "自身":"स्वयं ", "其他":"अन्य ", "配置":"कॉन्फ़िगर ",
+              "丟失":"खो गया ", "網站":"वेबसाइट ", "不兼容":"असंगत ", "列表":"सूची ",
+              "竄改":"छेड़छाड़ ", "第三方":"थर्ड पार्टी ", "實時":"वास्तविक समय ", "查看":"देखें ",
+              "指定":"निर्दिष्ट करें ", "清空":"खाली करें ", "資源回收桶":"रीसायकल बिन ", "無法":"असमर्थ ",
+              "與":"के साथ ", "當":"जब ", "功能":"कार्य ", "異常":"असामान्य ", "來":"के लिए ",
+              "重置":"रीसेट ", "窗口":"विंडो ", "暫存":"अस्थायी ", "自訂":"कस्टम ",
+              "不支持":"समर्थित नहीं ", "共":"कुल ", "秒":"सेकंड ", "耗時":"लगा समय ",
+              "沙箱":"सैंडबॉक्स ", "虛擬":"आभासी ", "隔離":"संगरोध ", "時":"",
+              "建立":"बनाएं ", "環境":"वातावरण ", "化":"", "表":"",
+              "達":"पहुंच गया ", "上限":"सीमा ", "區":"", "金鑰":"कुंजी ", "產品":"उत्पाद ",
+              "運行庫":".NET CLR ", "殼碼":"शेलकोड ", "線程":"थ्रेड ", "注入":"इंजेक्टर ",
+              "前往":"जाएं ", "檢查":"जांचें ", "可用":"उपलब्ध ", "靜態":"स्थैतिक ",
+              "版本":"संस्करण ", "是":"", "剩餘":"शेष ", "遠控":"रिमोट ", "  ":" "},
+
+    "arabic_switch": {"開啟":"تشغيل ", "關閉":"إيقاف ", "开启":"تشغيل ", "关闭":"إيقاف ", "，":", ",
+              "立即刪除":"حذف الآن ", "安全模式":"الوضع الآمن ", "官方網站":"الموقع الرسمي ",
+              "腳本":"برنامج نصي ", "鏈式":"سلسلة ", "記憶體":"الذاكرة ", "正在加載":"جار التحميل ", "加載":"تحميل ",
+              "行為":"سلوك ", "可疑":"مشبوه ", "勒索":"فدية ", "主要":"رئيسي ",
+              "許可條款":"شروط الترخيص ", "惡意":"ضار ", "開發":"المطورين ",
+              "啟用":"تفعيل ", "禁用":"تعطيل ", "正在初始化中":"جار التهيئة ", "初始化":"تهيئة ",
+              "正在掃描":"جار الفحص ", "正在刪除":"جار الحذف ", "正在追蹤":"جار التتبع ",
+              "最小化到":"تصغير إلى ", "靈敏度":"حساسية ", "正在檢查":"جار التحقق ",
+              "確定要":"هل أنت متأكد ", "引擎靈敏度":"حساسية المحرك ", "更新":"تحديث ",
+              "白色主題":"أبيض", "黃色主題":"أصفر", "紅色主題":"أحمر", "語言":"اللغة ",
+              "藍色主題":"أزرق", "綠色主題":"أخضر", "自訂主題":"مخصص", "黑色主題":"أسود",
+              "特別感謝":"المساهمون ", "版本資訊":"معلومات الإصدار ", "通訊":"اتصال ",
+              "註冊":"السجل ", "退出":"خروج ", "檔案":"ملف ", "當前":"الحالي ",
+              "狀態":"الحالة ", "掃描":"فحص ", "工具":"أدوات ", "防護":"حماية ",
+              "失敗":"فشل ", "請":"يرجى ", "路徑":"مسار ", "方式":"طريقة ",
+              "需要":"يحتاج ", "病毒":"فيروس ", "選擇":"تحديد ", "返回":"رجوع",
+              "受到":"تم الاستلام ", "錯誤":"خطأ ", "完成":"مكتمل ", "引擎":"محرك ",
+              "托盤":"صينية ", "圖標":"أيقونة ", "不安全":"غير آمن ", "增強":"تحسين ",
+              "系統":"النظام ", "雲端":"سحابة ", "重啟":"إعادة تشغيل ", "修復":"إصلاح ",
+              "裝置":"جهاز ", "發現":"تم العثور ", "成功":"نجاح ", "清理":"تنظيف ",
+              "確定":"موافق ", "執行":"تنفيذ ", "警告":"تحذير ", "使用":"استخدام ",
+              "網路":"الشبكة ", "變更":"تغيير ", "總數":"الإجمالي ", "結束":"إنهاء ",
+              "選項":"خيارات ", "監控":"مراقبة ", "連接":"اتصال ", "可以":"يمكن ",
+              "進程":"عملية ", "攔截":"حظر ", "引導":"إقلاع ", "刪除":"حذف ",
+              "分區":"قسم ", "設定":"إعدادات ", "關於":"حول ", "模式":"وضع ",
+              "提高":"تحسين ", "安全":"أمان ", "顯色":"لون ", "顏色":"لون ",
+              "主題":"سمة ", "回收":"استرجاع ", "無用":"غير مفيد ", "導入":"استيراد ",
+              "風險":"خطر ", "介面":"واجهة ", "核心":"نواة ", "服務":"خدمات ",
+              "管理":"إدارة ", "所有":"الكل ", "您":"أنت ", "取消":"إلغاء ", "未":"غير ",
+              "垃圾":"مهملات ", "位元":"بايت ", "本機":"الكمبيوتر ", "停止":"إيقاف ",
+              "到":"إلى ", "白名單":"القائمة البيضاء ", "軟體":"برنامج ", "正在":"",
+              "增加":"إضافة ", "移除":"إزالة ", "項目":"عناصر ", "生成":"إنشاء ", "稱":"",
+              "複製":"نسخ ", "此":"هذا ", "並":"و ", "全盤":"كامل ", "最新":"الأحدث ",
+              "已存在":"موجود بالفعل ", "數據庫":"قاعدة البيانات ", "誤報":"إيجابي كاذب ",
+              "高":"عالي ", "新":"جديد ", "和":"و ", "可能會":"محتمل ", "會":"سوف ",
+              "日誌":"سجل ", "已":"بالفعل ", "彈窗":"نافذة ", "要":"إلى ", "驅動":"برنامج تشغيل ",
+              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"قاعدة ",
+              "密鑰":"مفتاح ", "檢測":"اكتشاف ", "製作":"صانع ", "運行":"قيد التشغيل ",
+              "擴展":"امتداد ", "套件":"مجموعة ", "自動":"تلقائي ", "上報":"إبلاغ ",
+              "分析":"تحليل ", "自身":"نفسه ", "其他":"آخر ", "配置":"تكوين ",
+              "丟失":"مفقود ", "網站":"موقع ", "不兼容":"غير متوافق ", "列表":"قائمة ",
+              "竄改":"تلاعب ", "第三方":"جهة خارجية ", "實時":"الوقت الفعلي ", "查看":"عرض ",
+              "指定":"تحديد ", "清空":"إفراغ ", "資源回收桶":"سلة المهملات ", "無法":"غير قادر ",
+              "與":"مع ", "當":"عندما ", "功能":"وظيفة ", "異常":"شاذ ", "來":"ل ",
+              "重置":"إعادة ضبط ", "窗口":"نافذة ", "暫存":"مؤقت ", "自訂":"مخصص ",
+              "不支持":"غير مدعوم ", "共":"إجمالي ", "秒":"ثواني ", "耗時":"استغرق ",
+              "沙箱":"صندوق الحماية ", "虛擬":"افتراضي ", "隔離":"عزل ", "時":"",
+              "建立":"إنشاء ", "環境":"بيئة ", "化":"", "表":"",
+              "達":"وصل ", "上限":"الحد ", "區":"", "金鑰":"مفتاح ", "產品":"منتج ",
+              "運行庫":".NET CLR ", "殼碼":"رمز قشرة ", "線程":"سلسلة ", "注入":"حقن ",
+              "前往":"الذهاب ", "檢查":"فحص ", "可用":"متاح ", "靜態":"ثابت ",
+              "版本":"إصدار ", "是":"", "剩餘":"المتبقي ", "遠控":"عن بعد ", "  ":" "},
+
+    "russian_switch": {"開啟":"Вкл ", "關閉":"Выкл ", "开启":"Вкл ", "关闭":"Выкл ", "，":", ",
+              "立即刪除":"Удалить сейчас ", "安全模式":"Безопасный режим ", "官方網站":"Официальный сайт ",
+              "腳本":"Скрипт ", "鏈式":"Цепочка ", "記憶體":"Память ", "正在加載":"Загрузка ", "加載":"Загрузить ",
+              "行為":"Поведение ", "可疑":"Подозрительный ", "勒索":"Вымогатель ", "主要":"Главный ",
+              "許可條款":"Условия лицензии ", "惡意":"Вредоносный ", "開發":"Разработчики ",
+              "啟用":"Включить ", "禁用":"Отключить ", "正在初始化中":"Инициализация ", "初始化":"Инициализировать ",
+              "正在掃描":"Сканирование ", "正在刪除":"Удаление ", "正在追蹤":"Отслеживание ",
+              "最小化到":"Свернуть в ", "靈敏度":"Чувствительность ", "正在檢查":"Проверка ",
+              "確定要":"Вы уверены, что ", "引擎靈敏度":"Чувствительность движка ", "更新":"Обновить ",
+              "白色主題":"Белый", "黃色主題":"Желтый", "紅色主題":"Красный", "語言":"Язык ",
+              "藍色主題":"Синий", "綠色主題":"Зеленый", "自訂主題":"Пользовательский", "黑色主題":"Черный",
+              "特別感謝":"Участники ", "版本資訊":"Информация о версии ", "通訊":"Связь ",
+              "註冊":"Реестр ", "退出":"Выход ", "檔案":"Файл ", "當前":"Текущий ",
+              "狀態":"Статус ", "掃描":"Сканировать ", "工具":"Инструменты ", "防護":"Защита ",
+              "失敗":"Ошибка ", "請":"Пожалуйста ", "路徑":"Путь ", "方式":"Метод ",
+              "需要":"Требуется ", "病毒":"Вирус ", "選擇":"Выбрать ", "返回":"Назад",
+              "受到":"Получено ", "錯誤":"Ошибка ", "完成":"Завершено ", "引擎":"Движок ",
+              "托盤":"Трей ", "圖標":"Значок ", "不安全":"Небезопасно ", "增強":"Улучшить ",
+              "系統":"Система ", "雲端":"Облако ", "重啟":"Перезагрузка ", "修復":"Восстановить ",
+              "裝置":"Устройство ", "發現":"Найдено ", "成功":"Успех ", "清理":"Очистка ",
+              "確定":"ОК ", "執行":"Выполнить ", "警告":"Предупреждение ", "使用":"Использовать ",
+              "網路":"Сеть ", "變更":"Изменить ", "總數":"Всего ", "結束":"Завершить ",
+              "選項":"Опции ", "監控":"Монитор ", "連接":"Подключить ", "可以":"Можно ",
+              "進程":"Процесс ", "攔截":"Блокировать ", "引導":"Загрузка ", "刪除":"Удалить ",
+              "分區":"Раздел ", "設定":"Настройки ", "關於":"О программе ", "模式":"Режим ",
+              "提高":"Улучшить ", "安全":"Безопасность ", "顯色":"Цвет ", "顏色":"Цвет ",
+              "主題":"Тема ", "回收":"Корзина ", "無用":"Бесполезно ", "導入":"Импорт ",
+              "風險":"Риск ", "介面":"Интерфейс ", "核心":"Ядро ", "服務":"Службы ",
+              "管理":"Управление ", "所有":"Все ", "您":"Вы ", "取消":"Отмена ", "未":"Не ",
+              "垃圾":"Мусор ", "位元":"байт ", "本機":"ПК ", "停止":"Остановить ",
+              "到":"К ", "白名單":"Белый список ", "軟體":"ПО ", "正在":"",
+              "增加":"Добавить ", "移除":"Удалить ", "項目":"Элементы ", "生成":"Создать ", "稱":"",
+              "複製":"Копировать ", "此":"Этот ", "並":"И ", "全盤":"Полный ", "最新":"Последний ",
+              "已存在":"Уже существует ", "數據庫":"База данных ", "誤報":"Ложное срабатывание ",
+              "高":"Высокий ", "新":"Новый ", "和":"И ", "可能會":"Возможно ", "會":"Может ",
+              "日誌":"Журнал ", "已":"Уже ", "彈窗":"Окно ", "要":"Нужно ", "驅動":"Драйвер ",
+              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"Правило ",
+              "密鑰":"Ключ ", "檢測":"Обнаружить ", "製作":"Создатель ", "運行":"Работает ",
+              "擴展":"Расширение ", "套件":"Набор ", "自動":"Авто ", "上報":"Отчет ",
+              "分析":"Анализ ", "自身":"Сам ", "其他":"Другое ", "配置":"Конфиг ",
+              "丟失":"Утерян ", "網站":"Сайт ", "不兼容":"Несовместимо ", "列表":"Список ",
+              "竄改":"Вмешательство ", "第三方":"Сторонний ", "實時":"Реальное время ", "查看":"Просмотр ",
+              "指定":"Указать ", "清空":"Очистить ", "資源回收桶":"Корзина ", "無法":"Невозможно ",
+              "與":"С ", "當":"Когда ", "功能":"Функция ", "異常":"Аномалия ", "來":"Для ",
+              "重置":"Сброс ", "窗口":"Окно ", "暫存":"Временный ", "自訂":"Пользовательский ",
+              "不支持":"Не поддерживается ", "共":"Всего ", "秒":"Секунд ", "耗時":"Заняло ",
+              "沙箱":"Песочница ", "虛擬":"Виртуальный ", "隔離":"Карантин ", "時":"",
+              "建立":"Создать ", "環境":"Среда ", "化":"", "表":"",
+              "達":"Достигнут ", "上限":"Лимит ", "區":"", "金鑰":"Ключ ", "產品":"Продукт ",
+              "運行庫":".NET CLR ", "殼碼":"Шелл-код ", "線程":"Поток ", "注入":"Инъекция ",
+              "前往":"Перейти ", "檢查":"Проверить ", "可用":"Доступно ", "靜態":"Статический ",
+              "版本":"Версия ", "是":"", "剩餘":"Осталось ", "遠控":"Удаленный ", "  ":" "},
+
+    "slovenian_switch": {"開啟":"Vklop ", "關閉":"Izklop ", "开启":"Vklop ", "关闭":"Izklop ", "，":", ",
+              "立即刪除":"Izbriši zdaj ", "安全模式":"Varni način ", "官方網站":"Uradna spletna stran ",
+              "腳本":"Skripta ", "鏈式":"Veriga ", "記憶體":"Pomnilnik ", "正在加載":"Nalaganje ", "加載":"Naloži ",
+              "行為":"Vedenje ", "可疑":"Sumljivo ", "勒索":"Izsiljevalska ", "主要":"Glavni ",
+              "許可條款":"Licenčni pogoji ", "惡意":"Zlonamerno ", "開發":"Razvijalci ",
+              "啟用":"Omogoči ", "禁用":"Onemogoči ", "正在初始化中":"Inicializacija ", "初始化":"Inicializiraj ",
+              "正在掃描":"Skeniranje ", "正在刪除":"Brisanje ", "正在追蹤":"Sledenje ",
+              "最小化到":"Minimiziraj v ", "靈敏度":"Občutljivost ", "正在檢查":"Preverjanje ",
+              "確定要":"Ali ste prepričani ", "引擎靈敏度":"Občutljivost mehanizma ", "更新":"Posodobi ",
+              "白色主題":"Bela", "黃色主題":"Rumena", "紅色主題":"Rdeča", "語言":"Jezik ",
+              "藍色主題":"Modra", "綠色主題":"Zelena", "自訂主題":"Po meri", "黑色主題":"Črna",
+              "特別感謝":"Sodelavci ", "版本資訊":"Informacije o različici ", "通訊":"Povezava ",
+              "註冊":"Register ", "退出":"Izhod ", "檔案":"Datoteka ", "當前":"Trenutno ",
+              "狀態":"Stanje ", "掃描":"Skeniraj ", "工具":"Orodja ", "防護":"Zaščita ",
+              "失敗":"Neuspešno ", "請":"Prosim ", "路徑":"Pot ", "方式":"Način ",
+              "需要":"Potrebno ", "病毒":"Virus ", "選擇":"Izberi ", "返回":"Nazaj",
+              "受到":"Prejeto ", "錯誤":"Napaka ", "完成":"Končano ", "引擎":"Mehanizem ",
+              "托盤":"Pladenj ", "圖標":"Ikona ", "不安全":"Nevarno ", "增強":"Izboljšaj ",
+              "系統":"Sistem ", "雲端":"Oblak ", "重啟":"Ponovni zagon ", "修復":"Popravi ",
+              "裝置":"Naprava ", "發現":"Najdeno ", "成功":"Uspeh ", "清理":"Čiščenje ",
+              "確定":"V redu ", "執行":"Izvedi ", "警告":"Opozorilo ", "使用":"Uporabi ",
+              "網路":"Omrežje ", "變更":"Spremeni ", "總數":"Skupaj ", "結束":"Konec ",
+              "選項":"Možnosti ", "監控":"Nadzor ", "連接":"Poveži ", "可以":"Lahko ",
+              "進程":"Proces ", "攔截":"Blokiraj ", "引導":"Zagon ", "刪除":"Izbriši ",
+              "分區":"Particija ", "設定":"Nastavitve ", "關於":"O programu ", "模式":"Način ",
+              "提高":"Povečaj ", "安全":"Varnost ", "顯色":"Barva ", "顏色":"Barva ",
+              "主題":"Tema ", "回收":"Koš ", "無用":"Nekoristno ", "導入":"Uvozi ",
+              "風險":"Tveganje ", "介面":"Vmesnik ", "核心":"Jedro ", "服務":"Storitve ",
+              "管理":"Upravljaj ", "所有":"Vse ", "您":"Vi ", "取消":"Prekliči ", "未":"Ne ",
+              "垃圾":"Smeti ", "位元":"bajtov ", "本機":"PC ", "停止":"Ustavi ",
+              "到":"V ", "白名單":"Beli seznam ", "軟體":"Programska oprema ", "正在":"",
+              "增加":"Dodaj ", "移除":"Odstrani ", "項目":"Predmeti ", "生成":"Ustvari ", "稱":"",
+              "複製":"Kopiraj ", "此":"To ", "並":"In ", "全盤":"Popolno ", "最新":"Najnovejše ",
+              "已存在":"Že obstaja ", "數據庫":"Podatkovna baza ", "誤報":"Lažni alarm ",
+              "高":"Visoko ", "新":"Novo ", "和":"In ", "可能會":"Možno ", "會":"Bo ",
+              "日誌":"Dnevnik ", "已":"Že ", "彈窗":"Okno ", "要":"V ", "驅動":"Gonilnik ",
+              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"Pravilo ",
+              "密鑰":"Ključ ", "檢測":"Zaznaj ", "製作":"Ustvarjalec ", "運行":"Se izvaja ",
+              "擴展":"Razširitev ", "套件":"Komplet ", "自動":"Samodejno ", "上報":"Prijavi ",
+              "分析":"Analiza ", "自身":"Samo ", "其他":"Drugo ", "配置":"Konfiguracija ",
+              "丟失":"Izgubljeno ", "網站":"Spletno mesto ", "不兼容":"Nezdružljivo ", "列表":"Seznam ",
+              "竄改":"Spreminjanje ", "第三方":"Tretja oseba ", "實時":"V realnem času ", "查看":"Poglej ",
+              "指定":"Določi ", "清空":"Izprazni ", "資源回收桶":"Koš ", "無法":"Ni mogoče ",
+              "與":"Z ", "當":"Ko ", "功能":"Funkcija ", "異常":"Nenormalno ", "來":"Za ",
+              "重置":"Ponastavi ", "窗口":"Okno ", "暫存":"Začasno ", "自訂":"Po meri ",
+              "不支持":"Ni podprto ", "共":"Skupaj ", "秒":"Sekund ", "耗時":"Trajalo ",
+              "沙箱":"Peskovnik ", "虛擬":"Virtualno ", "隔離":"Karantena ", "時":"",
+              "建立":"Ustvari ", "環境":"Okolje ", "化":"", "表":"",
+              "達":"Doseženo ", "上限":"Omejitev ", "區":"", "金鑰":"Ključ ", "產品":"Izdelek ",
+              "運行庫":".NET CLR ", "殼碼":"Zlonamerna koda ", "線程":"Nit ", "注入":"Vbrizgavanje ",
+              "前往":"Pojdi ", "檢查":"Preveri ", "可用":"Na voljo ", "靜態":"Statično ",
+              "版本":"Različica ", "是":"", "剩餘":"Preostalo ", "遠控":"Oddaljeno ", "  ":" "},
+
+    "custom_language_switch": {},
 
     "white_switch": {
         "_white": "_black",},

PYAS_Engine.py

@@ -1,4 +1,4 @@
-import os, yara, time, numpy, base64, requests
+import os, yara, time, numpy, base64, requests, pefile, math, json, re, datetime
 import ctypes, ctypes.wintypes, hashlib, onnxruntime
 
 from PIL import Image
@@ -11,14 +11,25 @@ class GUID(ctypes.Structure):
         ("Data1", ctypes.wintypes.DWORD),
         ("Data2", ctypes.wintypes.WORD),
         ("Data3", ctypes.wintypes.WORD),
-        ("Data4", ctypes.c_ubyte * 8)]
+        ("Data4", ctypes.c_ubyte * 8)
+    ]
 
 class WINTRUST_FILE_INFO(ctypes.Structure):
     _fields_ = [
         ("cbStruct", ctypes.wintypes.DWORD),
         ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
         ("hFile", ctypes.wintypes.HANDLE),
-        ("pgKnownSubject", ctypes.wintypes.LPVOID)]
+        ("pgKnownSubject", ctypes.wintypes.LPVOID)
+    ]
+
+class WINTRUST_DATA_UNION(ctypes.Union):
+    _fields_ = [
+        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("pCatalog", ctypes.wintypes.LPVOID),
+        ("pBlob", ctypes.wintypes.LPVOID),
+        ("pSgnr", ctypes.wintypes.LPVOID),
+        ("pCert", ctypes.wintypes.LPVOID)
+    ]
 
 class WINTRUST_DATA(ctypes.Structure):
     _fields_ = [
@@ -28,19 +39,20 @@ class WINTRUST_DATA(ctypes.Structure):
         ("dwUIChoice", ctypes.wintypes.DWORD),
         ("fdwRevocationChecks", ctypes.wintypes.DWORD),
         ("dwUnionChoice", ctypes.wintypes.DWORD),
-        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("u", WINTRUST_DATA_UNION),
         ("dwStateAction", ctypes.wintypes.DWORD),
         ("hWVTStateData", ctypes.wintypes.HANDLE),
         ("pwszURLReference", ctypes.wintypes.LPCWSTR),
         ("dwProvFlags", ctypes.wintypes.DWORD),
         ("dwUIContext", ctypes.wintypes.DWORD),
-        ("pSignatureSettings", ctypes.wintypes.LPVOID)]
+        ("pSignatureSettings", ctypes.wintypes.LPVOID)
+    ]
 
 ####################################################################################################
 
 class sign_scanner:
     def __init__(self):
-        self.verify = GUID(0x00AAC56B, 0xCD44, 0x11D0, (0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
+        self.verify = GUID(0x00AAC56B, 0xCD44, 0x11D0, (ctypes.c_ubyte * 8)(0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
 
     def init_windll(self, path):
         for name in path:
@@ -48,7 +60,6 @@ class sign_scanner:
                 setattr(self, name.lower(), ctypes.WinDLL(name, use_last_error=True))
             except Exception:
                 pass
-
         try:
             self.WinVerifyTrust = self.wintrust.WinVerifyTrust
             self.WinVerifyTrust.restype = ctypes.wintypes.LONG
@@ -56,15 +67,34 @@ class sign_scanner:
         except Exception:
             pass
 
+####################################################################################################
+
     def sign_verify(self, file_path):
+        if os.name != 'nt':
+            return False
         try:
-            fi = WINTRUST_FILE_INFO(ctypes.sizeof(WINTRUST_FILE_INFO), file_path, None, None)
-            data = WINTRUST_DATA(ctypes.sizeof(WINTRUST_DATA), None, None, 2, 0, 1,
-                ctypes.pointer(fi), 1, None, None, 0, 0, None)
-            s = self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
-            data.dwStateAction = 2
-            self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
-            return s == 0
+            fi = WINTRUST_FILE_INFO()
+            fi.cbStruct = ctypes.sizeof(WINTRUST_FILE_INFO)
+            fi.pcwszFilePath = os.path.abspath(file_path)
+            fi.hFile = None
+            fi.pgKnownSubject = None
+            wt_union = WINTRUST_DATA_UNION()
+            wt_union.pFile = ctypes.pointer(fi)
+            td = WINTRUST_DATA()
+            td.cbStruct = ctypes.sizeof(WINTRUST_DATA)
+            td.pPolicyCallbackData = None
+            td.pSIPClientData = None
+            td.dwUIChoice = 2
+            td.fdwRevocationChecks = 0
+            td.dwUnionChoice = 1
+            td.u = wt_union
+            td.dwStateAction = 0
+            td.hWVTStateData = None
+            td.pwszURLReference = None
+            td.dwProvFlags = 0
+            td.dwUIContext = 0
+            td.pSignatureSettings = None
+            return self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(td)) == 0
         except Exception:
             return False
 
@@ -94,6 +124,8 @@ class rule_scanner:
         if yara_files:
             self.compile_all_rules(yara_files)
 
+####################################################################################################
+
     def load_compiled_rule(self, file):
         try:
             self.rules = yara.load(file)
@@ -113,6 +145,8 @@ class rule_scanner:
         except Exception:
             pass
 
+####################################################################################################
+
     def yara_scan(self, file_path):
         try:
             if not self.rules:
@@ -121,21 +155,20 @@ class rule_scanner:
             matches = self.rules.match(filepath=file_path)
             if matches:
                 rule_name = str(matches[0])
-                types = rule_name.split("_")[0]
-                label = rule_name.split("_")[1]
-                level = rule_name.split("_")[2]
-                return f"{types}/{label}", level
+                label = rule_name.split("_")[0]
+                level = rule_name.split("_")[-1]
+                return f"{label}:WinPE/Unknown.A!rb", level
             return False, False
         except Exception:
             return False, False
 
 ####################################################################################################
 
-class model_scanner:
+class cnn_scanner:
     def __init__(self):
         self.models = []
-        self.labels = ["Pefile/White", "Pefile/General"]
-        self.detect_set = {"Pefile/General"}
+        self.labels = ["White:WinPE/Unknown", "General:WinPE/Unknown"]
+        self.detect_set = {"General:WinPE/Unknown"}
         self.resize = (224, 224)
 
     def load_path(self, path, callback=None):
@@ -149,11 +182,13 @@ class model_scanner:
     def load_file(self, file):
         if file.lower().endswith('.onnx'):
             try:
-                session = onnxruntime.InferenceSession(file)
+                session = onnxruntime.InferenceSession(file, providers=['CPUExecutionProvider'])
                 self.models.append(session)
             except Exception:
                 return False
 
+####################################################################################################
+
     def model_scan(self, file_path, full_output=False):
         if not self.models:
             return (False, False) if not full_output else ([], str(file_path), None)
@@ -186,20 +221,23 @@ class model_scanner:
             
             try:
                 probs = model.run(None, {input_name: curr_arr})[0]
-                pred = probs[0]
+                pred_prob = float(probs[0][0]) if hasattr(probs[0], '__len__') else float(probs[0])
             except Exception:
                 continue
 
-            idx = int(numpy.argmax(pred))
-            label = self.labels[idx] if idx < len(self.labels) else f"Class_{idx}"
-            conf = round(float(pred[idx]) * 100, 2)
+            is_malicious = pred_prob > 0.5
+            idx = 1 if is_malicious else 0
+            label = self.labels[idx]
+            
+            conf = pred_prob if is_malicious else (1.0 - pred_prob)
+            conf = round(conf * 100, 2)
 
             if full_output:
                 results.append(("Whole File", label, conf, self.pil_to_base64(image)))
             
             if label in self.detect_set:
                 if best_malicious is None or conf > best_malicious[1]:
-                    best_malicious = (label, int(conf))
+                    best_malicious = (f"{label}.{int(conf)}!dl", int(conf))
 
         if full_output:
             results.sort(key=lambda x: (x[1] not in self.detect_set, -x[2]))
@@ -209,6 +247,8 @@ class model_scanner:
 
         return best_malicious if best_malicious else (False, False)
 
+####################################################################################################
+
     def pil_to_base64(self, img):
         buf = BytesIO()
         img.save(buf, format='PNG')
@@ -232,9 +272,556 @@ class model_scanner:
 
 ####################################################################################################
 
+class pe_scanner:
+    API_CAT_MAPPING = {
+        'ProcessControl': {
+            'CreateProcessA', 'CreateProcessW', 'WinExec', 'ShellExecuteA', 'ShellExecuteW',
+            'ShellExecuteExW', 'ExitProcess', 'TerminateProcess', 'OpenProcess', 'GetExitCodeProcess',
+            'SetThreadPriority', 'GetThreadPriority', 'GetCurrentProcess', 'GetCurrentProcessId',
+            'GetModuleFileNameA', 'GetCommandLineA', 'GetModuleFileNameW', 'GetStartupInfoW'
+        },
+        'Injection': {
+            'VirtualAlloc', 'VirtualAllocEx', 'VirtualProtect', 'VirtualProtectEx', 'WriteProcessMemory', 
+            'ReadProcessMemory', 'CreateRemoteThread', 'QueueUserAPC', 'SetThreadContext', 'GetThreadContext', 
+            'Wow64SetThreadContext', 'NtUnmapViewOfSection', 'ZwUnmapViewOfSection', 'RtlCreateUserThread', 
+            'SetWindowsHookExA', 'SetWindowsHookExW', 'UnhookWindowsHookEx', 'LoadLibraryA', 'LoadLibraryW', 
+            'LoadLibraryExA', 'LoadLibraryExW', 'GetProcAddress', 'GetModuleHandleA', 'GetModuleHandleW',
+            'FreeLibrary', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'UnmapViewOfSection',
+            'VirtualFree', 'VirtualQuery'
+        },
+        'Synchronization': {
+            'WaitForSingleObject', 'WaitForSingleObjectEx', 'WaitForMultipleObjects', 'WaitForMultipleObjectsEx',
+            'CreateMutexA', 'CreateMutexW', 'OpenMutexW', 'ReleaseMutex', 'CreateEventA', 'CreateEventW', 
+            'OpenEventW', 'SetEvent', 'ResetEvent', 'EnterCriticalSection', 'LeaveCriticalSection', 
+            'InitializeCriticalSection', 'DeleteCriticalSection', 'Sleep', 'SleepEx',
+            'InitializeCriticalSectionAndSpinCount', 'InterlockedDecrement', 'InterlockedIncrement', 
+            'InterlockedExchange', 'InterlockedCompareExchange', 'SetTimer', 'KillTimer'
+        },
+        'MultiThreading': {
+            'CreateThread', 'ResumeThread', 'SuspendThread', 'ExitThread', 'TerminateThread',
+            'GetCurrentThread', 'GetCurrentThreadId', 'TlsAlloc', 'TlsSetValue', 'TlsGetValue',
+            'CreateThreadpoolWork', 'SubmitThreadpoolWork', 'TlsFree'
+        },
+        'Network': {
+            'socket', 'connect', 'send', 'recv', 'bind', 'listen', 'accept', 'gethostbyname', 'getaddrinfo',
+            'WSAStartup', 'WSACleanup', 'WSAIoctl', 'WSASocketA', 'WSASocketW', 'closesocket', 'htons',
+            'InternetOpenA', 'InternetOpenW', 'InternetConnectA', 'InternetConnectW', 'InternetOpenUrlA', 
+            'InternetOpenUrlW', 'HttpOpenRequestA', 'HttpOpenRequestW', 'HttpSendRequestA', 'HttpSendRequestW',
+            'InternetReadFile', 'URLDownloadToFileA', 'URLDownloadToFileW', 'DnsQuery_A', 'DnsQuery_W'
+        },
+        'Encryption': {
+            'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptCreateHash', 'CryptHashData', 
+            'CryptDeriveKey', 'CryptEncrypt', 'CryptDecrypt', 'CryptDestroyKey', 'CryptDestroyHash',
+            'CryptReleaseContext', 'CryptGenKey', 'CryptImportKey', 'CryptExportKey'
+        },
+        'DataObfuscation': {
+            'RtlDecompressBuffer', 'MultiByteToWideChar', 'WideCharToMultiByte', 'Base64Decode', 
+            'CryptDecodeObject', 'IsDBCSLeadByte', 'CharUpperA', 'CharLowerA',
+            'GetStringTypeW', 'LCMapStringW', 'IsValidCodePage', 'DecodePointer', 'EncodePointer'
+        },
+        'FileIO': {
+            'CreateFileA', 'CreateFileW', 'WriteFile', 'ReadFile', 'DeleteFileA', 'DeleteFileW',
+            'CopyFileA', 'CopyFileW', 'MoveFileA', 'MoveFileW', 'FindFirstFileA', 'FindNextFileA',
+            'GetTempPathA', 'GetTempPathW', 'GetTempFileNameA', 'GetTempFileNameW', 'SetFileAttributesA', 
+            'SetFileAttributesW', 'DeviceIoControl', 'SetFileTime', 'GetFileSize', 'GetFileSizeEx',
+            'SetFilePointer', 'FlushFileBuffers', 'ConnectNamedPipe', 'PeekNamedPipe',
+            'CloseHandle', 'GetFileType', 'SetStdHandle', 'SetFilePointerEx', 'FindClose', 
+            'SetHandleCount', 'SetEndOfFile', 'GetFullPathNameA', 'GetFileAttributesA'
+        },
+        'Registry': {
+            'RegOpenKeyExA', 'RegOpenKeyExW', 'RegSetValueExA', 'RegSetValueExW', 
+            'RegCreateKeyExA', 'RegCreateKeyExW', 'RegDeleteKeyA', 'RegDeleteKeyW',
+            'RegEnumValueA', 'RegEnumValueW', 'RegQueryValueExA', 'RegQueryValueExW',
+            'RegDeleteValueA', 'RegDeleteValueW', 'RegCloseKey'
+        },
+        'Services': {
+            'OpenSCManagerA', 'OpenSCManagerW', 'CreateServiceA', 'CreateServiceW',
+            'StartServiceA', 'StartServiceW', 'ControlService', 'DeleteService'
+        },
+        'Privileges': {
+            'AdjustTokenPrivileges', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 
+            'OpenProcessToken', 'NetUserAdd', 'NetLocalGroupAddMembers', 'IsAdmin', 
+            'GetUserNameA', 'GetUserNameW'
+        },
+        'Native': {
+            'RtlUnwind', 'RtlVirtualUnwind', 'RtlCaptureContext', 'RtlLookupFunctionEntry',
+            'NtClose', 'NtQueryInformationProcess', 'RtlAllocateHeap', 'RtlFreeHeap',
+            'GetSystemTimeAsFileTime', 'GetLocalTime', 'GlobalMemoryStatus', 
+            'GetVersionExA', 'GetVersionExW', 'GetComputerNameA', 'GetComputerNameW',
+            'GetLastError', 'GetACP', 'RaiseException', 'SetLastError', 'GetEnvironmentStringsW', 
+            'FreeEnvironmentStringsW', 'GetLocaleInfoA', 'lstrlenA', 'GetVersion', 'GetSystemInfo', 
+            'CompareStringA'
+        },
+        'DotNet': {
+            '_CorExeMain', '_CorDllMain'
+        },
+        'AntiDebug': {
+            'IsDebuggerPresent', 'CheckRemoteDebuggerPresent', 'OutputDebugStringA', 'OutputDebugStringW',
+            'GetTickCount', 'GetTickCount64', 'QueryPerformanceCounter', 'FindWindowA', 'FindWindowW',
+            'EnumWindows', 'EnumChildWindows', 'GetWindowRect', 'GetClientRect', 'SetWindowDisplayAffinity',
+            'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsProcessorFeaturePresent', 
+            'SetErrorMode', 'GetTimeZoneInformation', 'GetDriveTypeW', 'GetDiskFreeSpaceA'
+        },
+        'Keylogging': {
+            'GetAsyncKeyState', 'GetKeyState', 'GetKeyboardState', 'MapVirtualKeyA', 'MapVirtualKeyW',
+            'ToAscii', 'ToAsciiEx', 'ToUnicode', 'ToUnicodeEx', 'GetKeyNameTextA', 'GetForegroundWindow',
+            'KeybdEvent', 'SendInput', 'MapVirtualKeyExA', 'MapVirtualKeyExW', 'CallNextHookEx'
+        },
+        'Input': {
+            'GetCursorPos', 'SetCursorPos', 'MouseEvent', 'GetDoubleClickTime', 
+            'GetCapture', 'SetCapture'
+        },
+        'ScreenCapture': {
+            'BitBlt', 'StretchBlt', 'GetDC', 'GetWindowDC', 'CreateCompatibleDC', 'CreateCompatibleBitmap',
+            'GdipSaveImageToFile', 'PrintWindow', 'GetDesktopWindow', 'CreateDCW', 'CreateDCA',
+            'SelectObject', 'DeleteDC', 'DeleteObject', 'GetDeviceCaps', 'GetSystemMetrics'
+        },
+        'Graphics': {
+            'Direct3DCreate9', 'D3D11CreateDevice'
+        },
+        'Audio': {
+            'WaveInOpen', 'WaveInClose', 'WaveInStart', 'WaveInStop'
+        },
+        'Clipboard': {
+            'OpenClipboard', 'CloseClipboard', 'GetClipboardData', 'SetClipboardData'
+        },
+        'Camera': {
+            'CapCreateCaptureWindowA', 'CapCreateCaptureWindowW'
+        },
+        'Memory': {
+            'HeapAlloc', 'HeapFree', 'HeapSize', 'HeapCreate', 'GetProcessHeap',
+            'LocalAlloc', 'LocalFree', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock',
+            'HeapDestroy', 'GlobalLock', 'SysFreeString', 'SysAllocStringLen'
+        },
+        'Resource': {
+            'LoadResource', 'SizeofResource', 'LockResource', 'FreeResource', 'FindResourceA'
+        },
+        'WindowControl': {
+            'ShowWindow', 'DestroyWindow', 'TranslateMessage', 'DispatchMessageA', 'GetWindow',
+            'PeekMessageA', 'GetWindowLongA', 'CallWindowProcA', 'SetWindowLongA', 'GetWindowTextA',
+            'ScreenToClient', 'GetActiveWindow', 'CreateWindowExA', 'DefWindowProcA', 'GetMessageA',
+            'RegisterClassA', 'UnregisterClassA', 'MessageBoxA'
+        },
+        'COM': {
+            'CoCreateInstance', 'CoUninitialize', 'CoInitialize'
+        }
+    }
+
+    TARGET_DLLS = {
+        'kernel32.dll', 'user32.dll', 'gdi32.dll', 'advapi32.dll', 'shell32.dll', 'ntdll.dll', 'hal.dll',
+        'ws2_32.dll', 'wsock32.dll', 'wininet.dll', 'winhttp.dll', 'urlmon.dll', 'crypt32.dll', 'bcrypt.dll',
+        'psapi.dll', 'dbghelp.dll', 'imagehlp.dll', 'shlwapi.dll', 'ole32.dll', 'oleaut32.dll', 'comctl32.dll',
+        'mscoree.dll', 'vbscript.dll', 'netapi32.dll', 'iphlpapi.dll', 'wtsapi32.dll', 'version.dll', 'winmm.dll'
+    }
+
+    BASE_SCHEMA = [
+        "FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit",
+        "Machine", "Magic", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
+        "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
+        "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
+        "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
+        "BaseOfCode", "SectionAlignment", "FileAlignment",
+        "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
+        "MajorImageVersion", "MinorImageVersion",
+        "MajorSubsystemVersion", "MinorSubsystemVersion",
+        "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
+        "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
+        "SizeOfOptionalHeader",
+        "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", 
+        "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", 
+        "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", 
+        "SectionCount", "ExecutableSections", 
+        "WritableSections", "ReadableSections", "SectionException",
+        "Char_00000020_Count", "Char_00000020_MeanEntropy",
+        "Char_00000040_Count", "Char_00000040_MeanEntropy",
+        "Char_00000080_Count", "Char_00000080_MeanEntropy",
+        "Char_02000000_Count", "Char_02000000_MeanEntropy",
+        "Char_20000000_Count", "Char_20000000_MeanEntropy",
+        "Char_40000000_Count", "Char_40000000_MeanEntropy",
+        "Char_80000000_Count", "Char_80000000_MeanEntropy",
+        "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
+        "ImportCount", "ImportFunctionCount",
+        "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
+        "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
+        "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
+        "SpecialBuildLength", "PrivateBuildLength",
+        "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
+        "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
+        "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException"
+    ]
+
+    CAT_SCHEMA = [f"Cat_{k}" for k in sorted(API_CAT_MAPPING.keys())]
+    DLL_SCHEMA = [f"Dll_{d.replace('.', '_')}" for d in sorted(TARGET_DLLS)]
+    
+    _ALL_APIS = {api for apis in API_CAT_MAPPING.values() for api in apis}
+    API_SCHEMA = [f"Api_{api}" for api in sorted(_ALL_APIS)]
+    SCHEMA = BASE_SCHEMA + CAT_SCHEMA + DLL_SCHEMA + API_SCHEMA
+
+    _API_TO_CATS = {}
+    for _cat, _apis in API_CAT_MAPPING.items():
+        for _api in _apis:
+            if _api not in _API_TO_CATS:
+                _API_TO_CATS[_api] = []
+            _API_TO_CATS[_api].append(_cat)
+
+    PACKERS = {
+        'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
+        'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
+        'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
+        'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
+        'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
+    }
+    INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
+
+####################################################################################################
+
+    def __init__(self):
+        self.model = None
+        self.input_name = None
+        self.feature_order = []
+        self.signer = sign_scanner()
+        self.signer.init_windll(["wintrust"])
+
+    def load_path(self, path, callback=None):
+        for root, _, files in os.walk(path):
+            for file in files:
+                full_path = os.path.join(root, file)
+                if callback:
+                    callback(full_path)
+                if full_path.endswith('.onnx'):
+                    self.load_model(full_path)
+
+    def load_model(self, model_path):
+        if not os.path.exists(model_path):
+            return
+        try:
+            self.model = onnxruntime.InferenceSession(model_path, providers=['CPUExecutionProvider'])
+            self.input_name = self.model.get_inputs()[0].name
+            feat_path = os.path.join(os.path.dirname(model_path), "features.json")
+
+            model_features = []
+            if os.path.exists(feat_path):
+                with open(feat_path, 'r') as f:
+                    model_features = json.load(f)
+            else:
+                model_features = [re.sub(r'[^A-Za-z0-9_]+', '', f) for f in self.SCHEMA]
+
+            local_map = {re.sub(r'[^A-Za-z0-9_]+', '', raw_name): raw_name for raw_name in self.SCHEMA}
+            self.feature_order = [local_map.get(req_feat) for req_feat in model_features]
+        except Exception:
+            pass
+
+####################################################################################################
+
+    def _safe_float(self, val):
+        try:
+            f = float(val)
+            if math.isinf(f) or math.isnan(f): return 0.0
+            return f
+        except Exception:
+            return 0.0
+
+    def _safe_div(self, n, d):
+        return float(n) / d if d > 0 else 0.0
+
+    def _calc_entropy(self, data):
+        if not data: return 0.0
+        arr = numpy.frombuffer(data, dtype=numpy.uint8)
+        counts = numpy.bincount(arr, minlength=256)
+        probs = counts[counts > 0] / len(arr)
+        return float(-numpy.sum(probs * numpy.log2(probs)))
+
+####################################################################################################
+
+    def extract_features(self, file_path):
+        fts = {k: 0.0 for k in self.SCHEMA}
+        pe = None
+        try:
+            fsize = os.path.getsize(file_path)
+            if fsize == 0 or fsize > 512 * 1024 * 1024:
+                return None
+
+            with open(file_path, "rb") as f:
+                file_bytes = f.read()
+
+            pe = pefile.PE(data=file_bytes, fast_load=True)
+            fts['TrustSigned'] = 1 if self.signer.sign_verify(file_path) else 0
+            fh = pe.FILE_HEADER
+            fts['Machine'] = fh.Machine
+            fts['NumberOfSections'] = fh.NumberOfSections
+            fts['TimeDateStamp'] = fh.TimeDateStamp
+            fts['PointerToSymbolTable'] = fh.PointerToSymbolTable
+            fts['NumberOfSymbols'] = fh.NumberOfSymbols
+            fts['SizeOfOptionalHeader'] = fh.SizeOfOptionalHeader
+            fts['Characteristics'] = fh.Characteristics
+            curr_ts = datetime.datetime.now(datetime.timezone.utc).timestamp()
+            fts['HasInvalidTimestamp'] = 1 if (fh.TimeDateStamp < 631152000 or fh.TimeDateStamp > curr_ts + 2592000) else 0
+            fts['FileTimeException'] = 1 if fh.TimeDateStamp == 0 else 0
+
+            if hasattr(pe, 'OPTIONAL_HEADER'):
+                op = pe.OPTIONAL_HEADER
+                fts['Magic'] = getattr(op, 'Magic', 0)
+                fts['MajorLinkerVersion'] = getattr(op, 'MajorLinkerVersion', 0)
+                fts['MinorLinkerVersion'] = getattr(op, 'MinorLinkerVersion', 0)
+                fts['SizeOfCode'] = getattr(op, 'SizeOfCode', 0)
+                fts['SizeOfInitializedData'] = getattr(op, 'SizeOfInitializedData', 0)
+                fts['SizeOfUninitializedData'] = getattr(op, 'SizeOfUninitializedData', 0)
+                fts['AddressOfEntryPoint'] = getattr(op, 'AddressOfEntryPoint', 0)
+                fts['BaseOfCode'] = getattr(op, 'BaseOfCode', 0)
+                fts['ImageBase'] = getattr(op, 'ImageBase', 0)
+                fts['SectionAlignment'] = getattr(op, 'SectionAlignment', 0)
+                fts['FileAlignment'] = getattr(op, 'FileAlignment', 0)
+                fts['MajorOperatingSystemVersion'] = getattr(op, 'MajorOperatingSystemVersion', 0)
+                fts['MinorOperatingSystemVersion'] = getattr(op, 'MinorOperatingSystemVersion', 0)
+                fts['MajorImageVersion'] = getattr(op, 'MajorImageVersion', 0)
+                fts['MinorImageVersion'] = getattr(op, 'MinorImageVersion', 0)
+                fts['MajorSubsystemVersion'] = getattr(op, 'MajorSubsystemVersion', 0)
+                fts['MinorSubsystemVersion'] = getattr(op, 'MinorSubsystemVersion', 0)
+                fts['SizeOfImage'] = getattr(op, 'SizeOfImage', 0)
+                fts['SizeOfHeaders'] = getattr(op, 'SizeOfHeaders', 0)
+                fts['CheckSum'] = getattr(op, 'CheckSum', 0)
+                fts['Subsystem'] = getattr(op, 'Subsystem', 0)
+                fts['DllCharacteristics'] = getattr(op, 'DllCharacteristics', 0)
+                fts['SizeOfStackReserve'] = getattr(op, 'SizeOfStackReserve', 0)
+                fts['SizeOfStackCommit'] = getattr(op, 'SizeOfStackCommit', 0)
+                fts['SizeOfHeapReserve'] = getattr(op, 'SizeOfHeapReserve', 0)
+                fts['SizeOfHeapCommit'] = getattr(op, 'SizeOfHeapCommit', 0)
+                fts['LoaderFlags'] = getattr(op, 'LoaderFlags', 0)
+                fts['NumberOfRvaAndSizes'] = getattr(op, 'NumberOfRvaAndSizes', 0)
+                fts['Is64Bit'] = 1 if fh.Machine in (0x8664, 0xAA64, 0x0200) else 0
+                fts['IsExe'] = 1 if pe.is_exe() else 0
+                fts['IsDll'] = 1 if pe.is_dll() else 0
+                fts['IsDriver'] = 1 if fts['Subsystem'] == 1 else 0
+                if hasattr(op, 'DATA_DIRECTORY'):
+                    reloc_idx = pefile.DIRECTORY_ENTRY.get('IMAGE_DIRECTORY_ENTRY_BASERELOC', 5)
+                    if len(op.DATA_DIRECTORY) > reloc_idx and op.DATA_DIRECTORY[reloc_idx].Size > 0:
+                        fts['HasRelocationDirectory'] = 1
+
+            try:
+                fts['FileEntropy'] = self._calc_entropy(file_bytes)
+            except Exception:
+                pass
+
+            sec_entropies = []
+            text_entropies = []
+            data_entropies = []
+            rsrc_entropies = []
+            char_flags = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
+
+            if hasattr(pe, 'sections'):
+                fts['SectionCount'] = len(pe.sections)
+                for section in pe.sections:
+                    try: 
+                        name = section.Name.decode('ascii', 'ignore').strip('\x00')
+                    except Exception: 
+                        name = ""
+                    try: 
+                        s_data = section.get_data()
+                        s_entropy = self._calc_entropy(s_data)
+                    except Exception: 
+                        s_data = b""
+                        s_entropy = 0.0
+
+                    sec_entropies.append(s_entropy)
+                    if any(p in name.lower() for p in self.PACKERS): fts['HasPacked'] = 1
+                    if section.Characteristics & 0x20000000: fts['ExecutableSections'] += 1
+                    if section.Characteristics & 0x80000000: fts['WritableSections'] += 1
+                    if section.Characteristics & 0x40000000: fts['ReadableSections'] += 1
+                    if section.SizeOfRawData + section.PointerToRawData > fsize: fts['SectionException'] = 1
+
+                    for flag in char_flags:
+                        if section.Characteristics & flag:
+                            fts[f'Char_{flag:08X}_Count'] += 1
+                            fts[f'Char_{flag:08X}_MeanEntropy'] += s_entropy
+
+                    ratio = self._safe_div(section.SizeOfRawData, fsize)
+                    if name.startswith('.text'):
+                        text_entropies.append(s_entropy)
+                        fts['TextSizeRatio'] += ratio
+                    elif name.startswith('.data'):
+                        data_entropies.append(s_entropy)
+                        fts['DataSizeRatio'] += ratio
+                    elif name.startswith('.rsrc'):
+                        rsrc_entropies.append(s_entropy)
+                        fts['RsrcSizeRatio'] += ratio
+                        if b"requireAdministrator" in s_data: fts['IsAdmin'] = 1
+                        for sig in self.INSTALLER_SIGS:
+                            if sig in s_data:
+                                fts['IsInstall'] = 1
+                                break
+
+            fts['SectionMeanEntropy'] = self._safe_div(sum(sec_entropies), len(sec_entropies))
+            fts['TextSectionMaxEntropy'] = max(text_entropies) if text_entropies else 0.0
+            fts['TextSectionMeanEntropy'] = self._safe_div(sum(text_entropies), len(text_entropies))
+            fts['DataSectionMaxEntropy'] = max(data_entropies) if data_entropies else 0.0
+            fts['DataSectionMeanEntropy'] = self._safe_div(sum(data_entropies), len(data_entropies))
+            fts['RsrcSectionMaxEntropy'] = max(rsrc_entropies) if rsrc_entropies else 0.0
+            fts['RsrcSectionMeanEntropy'] = self._safe_div(sum(rsrc_entropies), len(rsrc_entropies))
+
+            for flag in char_flags:
+                fts[f'Char_{flag:08X}_MeanEntropy'] = self._safe_div(fts[f'Char_{flag:08X}_MeanEntropy'], fts[f'Char_{flag:08X}_Count'])
+
+            try:
+                pe.parse_data_directories(directories=[
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_TLS']
+                ])
+            except Exception:
+                pass
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_TLS') and hasattr(pe.DIRECTORY_ENTRY_TLS, 'struct'):
+                if getattr(pe.DIRECTORY_ENTRY_TLS.struct, 'AddressOfCallBacks', 0) != 0:
+                    fts['HasTlsCallbacks'] = 1
+
+            if hasattr(pe, 'VS_FIXEDFILEINFO') and len(pe.VS_FIXEDFILEINFO) > 0:
+                flags = getattr(pe.VS_FIXEDFILEINFO[0], 'FileFlags', 0)
+                fts['IsDebug'] = 1 if flags & 0x1 else 0
+                fts['IsPreRelease'] = 1 if flags & 0x2 else 0
+                fts['IsPatched'] = 1 if flags & 0x4 else 0
+                fts['IsPrivateBuild'] = 1 if flags & 0x8 else 0
+                fts['IsSpecialBuild'] = 1 if flags & 0x20 else 0
+
+            if hasattr(pe, 'FileInfo'):
+                for fileinfo_list in pe.FileInfo:
+                    for fileinfo in fileinfo_list:
+                        if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
+                            for st in getattr(fileinfo, 'StringTable', []):
+                                for key, val in st.entries.items():
+                                    try:
+                                        k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
+                                        v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
+                                        length = len(v)
+                                        if k == 'FileDescription': fts['FileDescriptionLength'] = length
+                                        elif k == 'FileVersion': fts['FileVersionLength'] = length
+                                        elif k == 'ProductName': fts['ProductNameLength'] = length
+                                        elif k == 'ProductVersion': fts['ProductVersionLength'] = length
+                                        elif k == 'CompanyName': fts['CompanyNameLength'] = length
+                                        elif k == 'LegalCopyright': fts['LegalCopyrightLength'] = length
+                                        elif k == 'Comments': fts['CommentsLength'] = length
+                                        elif k == 'InternalName': fts['InternalNameLength'] = length
+                                        elif k == 'LegalTrademarks': fts['LegalTrademarksLength'] = length
+                                        elif k == 'SpecialBuild': fts['SpecialBuildLength'] = length
+                                        elif k == 'PrivateBuild': fts['PrivateBuildLength'] = length
+                                    except Exception:
+                                        continue
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
+                fts['ImportCount'] = len(pe.DIRECTORY_ENTRY_IMPORT)
+                for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                    if getattr(entry, 'dll', None):
+                        try:
+                            dll_name = entry.dll.decode('ascii', 'ignore').lower()
+                            if dll_name in self.TARGET_DLLS: 
+                                fts[f"Dll_{dll_name.replace('.', '_')}"] = 1.0
+                        except Exception: 
+                            pass
+
+                    imports = getattr(entry, 'imports', [])
+                    for imp in imports:
+                        fts['ImportFunctionCount'] += 1
+                        if not getattr(imp, 'name', None): continue
+                        try:
+                            func_name = imp.name.decode('ascii', 'ignore')
+                            if func_name in self._ALL_APIS:
+                                fts[f'Api_{func_name}'] += 1
+                                fts['ApiCount'] += 1
+                            for cat in self._API_TO_CATS.get(func_name, []):
+                                fts[f'Cat_{cat}'] += 1
+                        except Exception: 
+                            continue
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols'):
+                fts['ExportCount'] = len(pe.DIRECTORY_ENTRY_EXPORT.symbols)
+            
+            if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
+                for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
+                    if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
+                        fts['IconCount'] += len(getattr(entry.directory, 'entries', []))
+                        
+            if hasattr(pe, 'OPTIONAL_HEADER') and hasattr(pe.OPTIONAL_HEADER, 'DATA_DIRECTORY') and len(pe.OPTIONAL_HEADER.DATA_DIRECTORY) > 3:
+                exc_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[3]
+                if exc_dir.Size > 0:
+                    fts['ExceptionCount'] = exc_dir.Size // 12 if fts['Machine'] in (0x8664, 0xAA64) else 0
+                
+            if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'): 
+                fts['DebugCount'] = len(pe.DIRECTORY_ENTRY_DEBUG)
+
+            for k in fts: 
+                fts[k] = self._safe_float(fts[k])
+                
+            return fts
+
+        except Exception:
+            return None
+        finally:
+            if pe: 
+                pe.close()
+
+####################################################################################################
+
+    def pe_scan(self, file_path):
+        if not self.model:
+            return False, False
+        try:
+            data = self.extract_features(file_path)
+            if not data:
+                return False, False
+
+            vec_data = []
+            for key in self.feature_order:
+                if key:
+                    vec_data.append(data.get(key, 0.0))
+                else:
+                    vec_data.append(0.0)
+
+            vec = numpy.array(vec_data, dtype=numpy.float32).reshape(1, -1)
+            outputs = self.model.run(None, {self.input_name: vec})
+            result = outputs[1]
+            prob = 0.0
+
+            if isinstance(result, list) and len(result) > 0:
+                prob_dict = result[0]
+                if hasattr(prob_dict, 'get'):
+                    prob = float(prob_dict.get(1, prob_dict.get('1', 0.0)))
+
+            elif isinstance(result, numpy.ndarray):
+                if result.ndim == 2 and result.shape[1] > 1:
+                    prob = float(result[0][1])
+
+            score = int(prob * 100)
+            if prob > 0.5:
+                return f"General:WinPE/Unknown.{score}!ml", score
+            return False, False
+        except Exception:
+            return False, False
+
+####################################################################################################
+
 class cloud_scanner:
     def __init__(self):
-        pass
+        self.session = None
+        self.api_host = None
+        self.api_key = None
+        self.timeout = 30
+
+    def _init_session(self, api_host, api_key):
+        if self.session is None or self.api_host != api_host or self.api_key != api_key:
+            self.api_host = api_host.rstrip('/')
+            self.api_key = api_key
+            self.session = requests.Session()
+            self.session.headers.update({"X-API-Key": api_key, "User-Agent": "PYAS-Engine/1.2"})
+
+    def _request(self, method, endpoint, **kwargs):
+        try:
+            r = self.session.request(method, f"{self.api_host}{endpoint}", timeout=self.timeout, **kwargs)
+            if r.status_code == 200:
+                return r
+        except Exception:
+            pass
+        return None
 
     def calc_hash(self, file_path, block_size=65536):
         try:
@@ -246,64 +833,95 @@ class cloud_scanner:
         except Exception:
             return ""
 
-    def upload_file(self, file_path, api_host, api_key):
+####################################################################################################
+
+    def rescan(self, sha256, api_host, api_key):
+        self._init_session(api_host, api_key)
+        r = self._request("POST", f"/api/rescan/{sha256}")
+        return r is not None and r.json().get('status') == 'success'
+
+    def upload_file(self, file_path, api_host, api_key, chunk_size=5242880):
         try:
+            self._init_session(api_host, api_key)
             sha256 = self.calc_hash(file_path)
             if not sha256:
                 return False, None
 
-            base = api_host.rstrip('/')
-            base_headers = {"X-API-Key": api_key, "User-Agent": "PYAS-Client/1.0"}
+            status_req = self._request("GET", f"/api/processing_status/{sha256}")
+            if status_req and status_req.json().get('status') != 'missing':
+                self.rescan(sha256, api_host, api_key)
+                return True, sha256
 
-            def _req(m, ep, files=None, **k):
-                try:
-                    return requests.request(m, f"{base}{ep}", headers=base_headers, files=files, timeout=120, **k)
-                except:
-                    return None
+            file_size = os.path.getsize(file_path)
+            if file_size > 104857600:
+                return False, sha256
 
-            r = _req("GET", f"/api/processing_status/{sha256}")
-            status = r.json().get('status') if r and r.status_code == 200 else 'missing'
-            if status in ['failed', 'error']:
-                status = 'missing'
-
-            if status == 'missing':
+            if file_size > chunk_size:
+                total_chunks = (file_size + chunk_size - 1) // chunk_size
+                upload_id = os.urandom(16).hex()
                 with open(file_path, 'rb') as f:
-                    r = _req("POST", "/api/upload", files={'file': f})
-                    if not r or r.status_code != 200:
-                        return False, sha256
+                    for i in range(total_chunks):
+                        chunk_data = f.read(chunk_size)
+                        headers = {
+                            "X-Chunk-Index": str(i),
+                            "X-Total-Chunks": str(total_chunks),
+                            "X-Upload-ID": upload_id
+                        }
+                        
+                        chunk_success = False
+                        for _ in range(3):
+                            r = self._request("POST", "/api/upload", files={'file': (os.path.basename(file_path), chunk_data)}, headers=headers)
+                            if r:
+                                chunk_success = True
+                                break
+                            time.sleep(1)
+                            
+                        if not chunk_success:
+                            return False, sha256
+                return True, sha256
 
-            return True, sha256
+            with open(file_path, 'rb') as f:
+                file_data = f.read()
+                
+            for _ in range(3):
+                r = self._request("POST", "/api/upload", files={'file': (os.path.basename(file_path), file_data)})
+                if r:
+                    return True, sha256
+                time.sleep(1)
+                
+            return False, sha256
         except Exception:
             return False, None
 
-    def get_result(self, sha256, api_host, api_key):
+####################################################################################################
+
+    def get_result(self, sha256, api_host, api_key, max_retries=6, interval=10):
         try:
             if not sha256:
                 return False
+            self._init_session(api_host, api_key)
 
-            base = api_host.rstrip('/')
-            headers = {"X-API-Key": api_key, "User-Agent": "PYAS-Client/1.0"}
+            is_done = False
+            for _ in range(max_retries):
+                r = self._request("GET", f"/api/processing_status/{sha256}")
+                if r:
+                    st = r.json().get('status', 'error')
+                    if st == 'done':
+                        is_done = True
+                        break
+                    if st in ['error', 'failed']:
+                        return False
+                time.sleep(interval)
 
-            def _req(m, ep, **k):
-                try:
-                    return requests.request(m, f"{base}{ep}", headers=headers, timeout=10, **k)
-                except:
-                    return None
+            if not is_done:
+                return False
 
-            for _ in range(30):
-                r = _req("GET", f"/api/processing_status/{sha256}")
-                st = r.json().get('status') if r else 'error'
-                if st == 'done':
-                    break
-                if st in ['error', 'failed']:
-                    return False
-                time.sleep(1)
-
-            r = _req("GET", f"/api/report/{sha256}")
-            if r and r.status_code == 200:
+            r = self._request("GET", f"/api/report/{sha256}")
+            if r:
                 data = r.json().get('data', {})
-                res = data.get('detection', {}).get('results', {}).get('PYAS', {})
-                label = res.get('label', 'Unsupport')
+                metadata = data.get('metadata', {})
+                label = metadata.get('label', 'Unsupport')
+                score = metadata.get('score', 0)
                 sims = data.get('similar', [])
 
                 is_malicious = 'General' in label
@@ -312,11 +930,11 @@ class cloud_scanner:
                 for s in sims:
                     if s.get('similarity', 0) > 80:
                         valid_sim_count += 1
-                        if "General" in s.get('label'):
+                        if "General" in s.get('label', ''):
                             sim_malicious_count += 1
 
                 if is_malicious and (valid_sim_count == 0 or sim_malicious_count == valid_sim_count):
-                    return True
+                    return f"General:WinPE/Unknown.{score}!cl"
         except Exception:
             pass
         return False

PYAS_Interface.py

@@ -363,6 +363,7 @@ class Ui_main_window(object):
         self.english_switch.setLayoutDirection(Qt.LeftToRight)
         self.english_switch.setStyleSheet(u"QRadioButton { background-color: transparent; color: rgb(0, 0, 0); }\n"
 "")
+        self.english_switch.setChecked(True)
         self.extension_widget = QWidget(self.setting_window)
         self.extension_widget.setObjectName(u"extension_widget")
         self.extension_widget.setGeometry(QRect(30, 100, 750, 80))
@@ -463,6 +464,7 @@ class Ui_main_window(object):
         self.white_switch.setLayoutDirection(Qt.LeftToRight)
         self.white_switch.setStyleSheet(u"QRadioButton { background-color: transparent; color: rgb(0, 0, 0); }\n"
 "")
+        self.white_switch.setChecked(True)
         self.cloud_widget = QWidget(self.setting_window)
         self.cloud_widget.setObjectName(u"cloud_widget")
         self.cloud_widget.setGeometry(QRect(30, 180, 750, 80))
@@ -488,18 +490,19 @@ class Ui_main_window(object):
         self.cloud_text.setScaledContents(False)
         self.cloud_text.setAlignment(Qt.AlignLeading|Qt.AlignLeft|Qt.AlignVCenter)
         self.cloud_text.setWordWrap(False)
-        self.cloud_button = QPushButton(self.cloud_widget)
-        self.cloud_button.setObjectName(u"cloud_button")
-        self.cloud_button.setGeometry(QRect(660, 20, 80, 30))
-        sizePolicy1.setHeightForWidth(self.cloud_button.sizePolicy().hasHeightForWidth())
-        self.cloud_button.setSizePolicy(sizePolicy1)
-        self.cloud_button.setFont(font)
-        self.cloud_button.setFocusPolicy(Qt.StrongFocus)
-        self.cloud_button.setLayoutDirection(Qt.LeftToRight)
-        self.cloud_button.setStyleSheet(u"QPushButton { background-color: rgb(235, 235, 235); color: rgb(0, 0, 0); border-radius: 10px; } QPushButton:hover { background-color: rgb(240, 240, 240); }\n"
+        self.cloud_switch = QPushButton(self.cloud_widget)
+        self.cloud_switch.setObjectName(u"cloud_switch")
+        self.cloud_switch.setGeometry(QRect(660, 20, 80, 30))
+        sizePolicy1.setHeightForWidth(self.cloud_switch.sizePolicy().hasHeightForWidth())
+        self.cloud_switch.setSizePolicy(sizePolicy1)
+        self.cloud_switch.setFont(font)
+        self.cloud_switch.setFocusPolicy(Qt.StrongFocus)
+        self.cloud_switch.setLayoutDirection(Qt.LeftToRight)
+        self.cloud_switch.setStyleSheet(u"QPushButton { background-color: rgb(235, 235, 235); color: rgb(0, 0, 0); border-radius: 10px; } QPushButton:hover { background-color: rgb(240, 240, 240); } QPushButton:checked { background-color: rgb(210, 255, 210); } QPushButton:checked:hover { background-color: rgb(220, 255, 220); }\n"
 "")
-        self.cloud_button.setIconSize(QSize(16, 16))
-        self.cloud_button.setCheckable(False)
+        self.cloud_switch.setIconSize(QSize(16, 16))
+        self.cloud_switch.setCheckable(True)
+        self.cloud_switch.setChecked(True)
         self.reset_widget = QWidget(self.setting_window)
         self.reset_widget.setObjectName(u"reset_widget")
         self.reset_widget.setGeometry(QRect(30, 260, 750, 80))
@@ -1413,10 +1416,10 @@ class Ui_main_window(object):
         self.blank_window.raise_()
         self.tool_window.raise_()
         self.taskmgr_window.raise_()
-        self.setting_window.raise_()
         self.home_window.raise_()
         self.navigate_window.raise_()
         self.options_window.raise_()
+        self.setting_window.raise_()
 
         self.retranslateUi(main_window)
 
@@ -1460,7 +1463,7 @@ class Ui_main_window(object):
         self.white_switch.setText(QCoreApplication.translate("main_window", u"\u767d\u8272\u4e3b\u984c", None))
         self.cloud_title.setText(QCoreApplication.translate("main_window", u"\u96f2\u7aef\u670d\u52d9", None))
         self.cloud_text.setText(QCoreApplication.translate("main_window", u"\u6b64\u9078\u9805\u53ef\u4ee5\u4e0a\u5831\u96f2\u7aef\u5f15\u64ce", None))
-        self.cloud_button.setText(QCoreApplication.translate("main_window", u"\u9078\u64c7", None))
+        self.cloud_switch.setText(QCoreApplication.translate("main_window", u"\u958b\u555f", None))
         self.reset_title.setText(QCoreApplication.translate("main_window", u"\u91cd\u7f6e\u9078\u9805", None))
         self.reset_text.setText(QCoreApplication.translate("main_window", u"\u6b64\u9078\u9805\u53ef\u4ee5\u91cd\u7f6e\u6240\u6709\u8a2d\u5b9a", None))
         self.reset_button.setText(QCoreApplication.translate("main_window", u"\u9078\u64c7", None))

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.3.8',
+version='3.4.5',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -45,7 +45,21 @@ constexpr auto PYAS_POOL_TAG = 'SAYP';
 #ifndef PROCESS_SET_QUOTA
 #define PROCESS_SET_QUOTA (0x0100)
 #endif
-
+#ifndef THREAD_TERMINATE
+#define THREAD_TERMINATE               (0x0001)
+#endif
+#ifndef THREAD_SUSPEND_RESUME
+#define THREAD_SUSPEND_RESUME          (0x0002)
+#endif
+#ifndef THREAD_SET_CONTEXT
+#define THREAD_SET_CONTEXT             (0x0010)
+#endif
+#ifndef THREAD_SET_INFORMATION
+#define THREAD_SET_INFORMATION         (0x0020)
+#endif
+#ifndef THREAD_SET_THREAD_TOKEN
+#define THREAD_SET_THREAD_TOKEN        (0x0080)
+#endif
 #ifndef POOL_FLAG_NON_PAGED
 #define POOL_FLAG_NON_PAGED 0x0000000000000040UI64
 #endif
@@ -100,12 +114,18 @@ typedef struct _DRIVER_DATA {
     EX_RUNDOWN_REF PortRundown;
 } DRIVER_DATA, * PDRIVER_DATA;
 
+typedef struct _RULE_NODE {
+    struct _RULE_NODE* Next;
+    UNICODE_STRING Pattern;
+} RULE_NODE, * PRULE_NODE;
+
 extern DRIVER_DATA GlobalData;
 
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 
 NTSTATUS InitializeProcessProtection();
@@ -113,17 +133,21 @@ VOID UninitializeProcessProtection();
 NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
 VOID UninitializeRegistryProtection();
 
+NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
+VOID UnloadRules();
+
 VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
 
+NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
+
 BOOLEAN IsProcessTrusted(HANDLE ProcessId);
 BOOLEAN IsTargetProtected(HANDLE ProcessId);
-BOOLEAN IsInstallerProcess(HANDLE ProcessId);
 BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
 
 BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);
 BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName);
 BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Buffer, ULONG Length, BOOLEAN IsWrite);
+BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID WriteBuffer, ULONG WriteLength, BOOLEAN IsWrite);
 
 NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
 

Plugins/Filter/DriverEntry.cpp

@@ -27,7 +27,19 @@ static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTA
 }
 
 static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(Flags);
+    if (!(Flags & FLTFL_FILTER_UNLOAD_MANDATORY)) {
+        return STATUS_FLT_DO_NOT_DETACH;
+    }
+
+    if (GlobalData.ServerPort) {
+        FltCloseCommunicationPort(GlobalData.ServerPort);
+        GlobalData.ServerPort = NULL;
+    }
+
+    if (GlobalData.FilterHandle) {
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        GlobalData.FilterHandle = NULL;
+    }
 
     PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
     UninitializeRegistryProtection();
@@ -35,12 +47,8 @@ static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
 
     ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
 
-    if (GlobalData.ServerPort) {
-        FltCloseCommunicationPort(GlobalData.ServerPort);
-    }
-    if (GlobalData.FilterHandle) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-    }
+    UnloadRules();
+
     return STATUS_SUCCESS;
 }
 
@@ -68,10 +76,6 @@ static VOID PortDisconnect(PVOID ConnectionCookie) {
 
     ExAcquireFastMutex(&GlobalData.PortMutex);
     GlobalData.ClientPort = NULL;
-    GlobalData.PyasPid = 0;
-    if (GlobalData.PyasProcess) {
-        GlobalData.PyasProcess = NULL;
-    }
     ExReleaseFastMutex(&GlobalData.PortMutex);
 
     ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
@@ -81,6 +85,7 @@ CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
     { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
     { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
     { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
+    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
     { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
     { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
     { IRP_MJ_OPERATION_END }
@@ -103,8 +108,6 @@ CONST FLT_REGISTRATION FilterRegistration = {
 };
 
 extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
-    UNREFERENCED_PARAMETER(RegistryPath);
-
     NTSTATUS status = STATUS_SUCCESS;
     PSECURITY_DESCRIPTOR sd = NULL;
     OBJECT_ATTRIBUTES oa = { 0 };
@@ -117,8 +120,13 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
 
     ExInitializeRundownProtection(&GlobalData.PortRundown);
 
+    status = LoadRulesFromDisk(RegistryPath);
+
     status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) return status;
+    if (!NT_SUCCESS(status)) {
+        UnloadRules();
+        return status;
+    }
 
     status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
     if (NT_SUCCESS(status)) {
@@ -129,7 +137,11 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     }
 
     if (!NT_SUCCESS(status)) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
+        if (GlobalData.FilterHandle) {
+            FltUnregisterFilter(GlobalData.FilterHandle);
+            GlobalData.FilterHandle = NULL;
+        }
+        UnloadRules();
         return status;
     }
 
@@ -137,5 +149,24 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     InitializeRegistryProtection(DriverObject);
     PsSetLoadImageNotifyRoutine(ImageLoadNotify);
 
-    return FltStartFiltering(GlobalData.FilterHandle);
+    status = FltStartFiltering(GlobalData.FilterHandle);
+    if (!NT_SUCCESS(status)) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        UninitializeRegistryProtection();
+        UninitializeProcessProtection();
+
+        if (GlobalData.ServerPort) {
+            FltCloseCommunicationPort(GlobalData.ServerPort);
+            GlobalData.ServerPort = NULL;
+        }
+
+        if (GlobalData.FilterHandle) {
+            FltUnregisterFilter(GlobalData.FilterHandle);
+            GlobalData.FilterHandle = NULL;
+        }
+
+        UnloadRules();
+    }
+
+    return status;
 }

Plugins/Filter/ProtectBoot.cpp

@@ -12,7 +12,6 @@ FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data,
     UNREFERENCED_PARAMETER(CompletionContext);
 
     if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     ULONG IoControlCode = Data->Iopb->Parameters.DeviceIoControl.Common.IoControlCode;
@@ -23,7 +22,7 @@ FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data,
         IoControlCode == IOCTL_DISK_FORMAT_TRACKS_EX) {
 
         HANDLE Pid = PsGetCurrentProcessId();
-        if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+        if (!IsProcessTrusted(Pid)) {
             UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
             SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
             Data->IoStatus.Status = STATUS_ACCESS_DENIED;

Plugins/Filter/ProtectFile.cpp

@@ -34,15 +34,23 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
 
     FileName = nameInfo->Name;
     if (!FileName.Buffer || FileName.Length == 0) {
-        goto cleanup;
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
 
     HANDLE Pid = PsGetCurrentProcessId();
     BOOLEAN Trusted = IsProcessTrusted(Pid);
 
+    ULONG CreateDisposition = (Data->Iopb->Parameters.Create.Options >> 24) & 0xFF;
+    BOOLEAN IsCreateAction = (CreateDisposition == FILE_CREATE ||
+        CreateDisposition == FILE_SUPERSEDE ||
+        CreateDisposition == FILE_OVERWRITE ||
+        CreateDisposition == FILE_OVERWRITE_IF ||
+        CreateDisposition == FILE_OPEN_IF);
+
     if (IsHoneyToken(&FileName)) {
         if (!Trusted) {
-            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE)) {
+            if ((Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE)) || IsCreateAction) {
                 SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
                 Data->IoStatus.Status = STATUS_ACCESS_DENIED;
                 callbackStatus = FLT_PREOP_COMPLETE;
@@ -57,7 +65,7 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
         if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
             (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE | WRITE_DAC | WRITE_OWNER)) {
 
-            if (!Trusted && !IsInstallerProcess(Pid)) {
+            if (!Trusted) {
                 UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
                 SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
                 Data->IoStatus.Status = STATUS_ACCESS_DENIED;
@@ -69,7 +77,8 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
 
     if (CheckProtectedPathRule(&FileName)) {
         if (!Trusted) {
-            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE | WRITE_DAC | GENERIC_WRITE)) {
+            if ((Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
+                (FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | DELETE | WRITE_DAC | GENERIC_WRITE)) || IsCreateAction) {
                 SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
                 Data->IoStatus.Status = STATUS_ACCESS_DENIED;
                 callbackStatus = FLT_PREOP_COMPLETE;
@@ -126,7 +135,15 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_
 
     HANDLE Pid = PsGetCurrentProcessId();
     if (!IsProcessTrusted(Pid)) {
-        if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
+
+        if (CheckProtectedPathRule(&nameInfo->Name)) {
+            SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+            FltReleaseFileNameInformation(nameInfo);
+            return FLT_PREOP_COMPLETE;
+        }
+
+        if (CheckFileExtensionRule(&nameInfo->Name)) {
             if (CheckRansomActivity(Pid, &nameInfo->Name, NULL, 0, FALSE)) {
                 SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
                 Data->IoStatus.Status = STATUS_ACCESS_DENIED;
@@ -135,17 +152,51 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_
             }
         }
     }
-
     if (nameInfo) {
         FltReleaseFileNameInformation(nameInfo);
     }
     return FLT_PREOP_SUCCESS_NO_CALLBACK;
 }
 
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
     UNREFERENCED_PARAMETER(FltObjects);
     UNREFERENCED_PARAMETER(CompletionContext);
 
+    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
+    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+
+    if (!NT_SUCCESS(status) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    status = FltParseFileNameInformation(nameInfo);
+    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) {
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
+
+    SECURITY_INFORMATION SecurityInfo = Data->Iopb->Parameters.SetSecurity.SecurityInformation;
+
+    if (SecurityInfo & (OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION)) {
+        if (CheckProtectedPathRule(&nameInfo->Name)) {
+            HANDLE Pid = PsGetCurrentProcessId();
+            if (!IsProcessTrusted(Pid)) {
+                SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                FltReleaseFileNameInformation(nameInfo);
+                return FLT_PREOP_COMPLETE;
+            }
+        }
+    }
+
+    FltReleaseFileNameInformation(nameInfo);
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(CompletionContext);
+
     if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) {
@@ -168,7 +219,6 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
                 HANDLE Pid = PsGetCurrentProcessId();
 
                 if (!IsProcessTrusted(Pid)) {
-
                     PVOID SystemBuffer = NULL;
                     PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
 
@@ -186,11 +236,9 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
 
                     if (SystemBuffer) {
                         if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
-                            if (!IsInstallerProcess(Pid)) {
-                                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                                callbackStatus = FLT_PREOP_COMPLETE;
-                            }
+                            SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                            callbackStatus = FLT_PREOP_COMPLETE;
                         }
                     }
                 }
@@ -218,7 +266,6 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data,
             if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) {
                 if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) {
                     if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
-
                         Data->IoStatus.Status = STATUS_NOT_SUPPORTED;
                         FltReleaseFileNameInformation(nameInfo);
                         return FLT_PREOP_COMPLETE;

Plugins/Filter/ProtectProcess.cpp

@@ -1,15 +1,18 @@
 #include "DriverCommon.h"
 
-PVOID ObRegistrationHandle = NULL;
-OB_CALLBACK_REGISTRATION ObRegistration;
-OB_OPERATION_REGISTRATION ObCallbacks[1];
+static PVOID ObRegistrationHandle = NULL;
+static OB_CALLBACK_REGISTRATION ObRegistration;
+static OB_OPERATION_REGISTRATION ObCallbacks[2];
 
 static BOOLEAN IsSystemImage(PUNICODE_STRING FullImageName) {
     if (!FullImageName || !FullImageName->Buffer) return FALSE;
 
     if (WildcardMatch(L"*\\Windows\\System32\\*", FullImageName->Buffer, FullImageName->Length) ||
         WildcardMatch(L"*\\Windows\\SysWOW64\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\WinSxS\\*", FullImageName->Buffer, FullImageName->Length)) {
+        WildcardMatch(L"*\\Windows\\WinSxS\\*", FullImageName->Buffer, FullImageName->Length) ||
+        WildcardMatch(L"*\\Windows\\Microsoft.NET\\*", FullImageName->Buffer, FullImageName->Length) ||
+        WildcardMatch(L"*\\Common Files\\Microsoft Shared\\*", FullImageName->Buffer, FullImageName->Length) ||
+        WildcardMatch(L"*\\Program Files*\\*", FullImageName->Buffer, FullImageName->Length)) {
         return TRUE;
     }
     return FALSE;
@@ -32,7 +35,7 @@ VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INF
 }
 
 static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
 
     NTSTATUS status;
     BOOLEAN isBlacklisted = FALSE;
@@ -72,22 +75,19 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
     HANDLE SourcePid = PsGetCurrentProcessId();
 
     if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-
     if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
     if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
 
-    BOOLEAN bProtected = IsTargetProtected(TargetPid);
+    if (IsTargetProtected(TargetPid)) {
+        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
 
-    if (bProtected) {
-        BOOLEAN bIsInstaller = IsInstallerProcess(SourcePid);
-
-        if (bIsInstaller) {
+        if (bIsTrusted) {
             if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsInstaller = FALSE;
+                bIsTrusted = FALSE;
             }
         }
 
-        if (bIsInstaller) return OB_PREOP_SUCCESS;
+        if (bIsTrusted) return OB_PREOP_SUCCESS;
 
         ACCESS_MASK DenyMask = PROCESS_TERMINATE |
             PROCESS_VM_OPERATION |
@@ -111,6 +111,53 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
     return OB_PREOP_SUCCESS;
 }
 
+static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    UNREFERENCED_PARAMETER(RegistrationContext);
+
+    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
+
+    PETHREAD TargetThread = (PETHREAD)OperationInformation->Object;
+    if (!TargetThread) return OB_PREOP_SUCCESS;
+
+    PEPROCESS TargetProcess = IoThreadToProcess(TargetThread);
+    if (!TargetProcess) return OB_PREOP_SUCCESS;
+
+    HANDLE TargetPid = PsGetProcessId(TargetProcess);
+    HANDLE SourcePid = PsGetCurrentProcessId();
+
+    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
+    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
+    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
+
+    if (IsTargetProtected(TargetPid)) {
+        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
+
+        if (bIsTrusted) {
+            if (IsBlacklistedAdminTool(SourcePid)) {
+                bIsTrusted = FALSE;
+            }
+        }
+
+        if (bIsTrusted) return OB_PREOP_SUCCESS;
+
+        ACCESS_MASK DenyMask = THREAD_TERMINATE |
+            THREAD_SUSPEND_RESUME |
+            THREAD_SET_CONTEXT |
+            THREAD_SET_INFORMATION |
+            THREAD_SET_THREAD_TOKEN;
+
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess &= ~DenyMask;
+
+        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess &= ~DenyMask;
+        }
+    }
+
+    return OB_PREOP_SUCCESS;
+}
+
 NTSTATUS InitializeProcessProtection() {
     static UNICODE_STRING Altitude = { 0 };
     RtlInitUnicodeString(&Altitude, L"320000");
@@ -120,8 +167,13 @@ NTSTATUS InitializeProcessProtection() {
     ObCallbacks[0].PreOperation = PreOpenProcess;
     ObCallbacks[0].PostOperation = NULL;
 
+    ObCallbacks[1].ObjectType = PsThreadType;
+    ObCallbacks[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    ObCallbacks[1].PreOperation = PreOpenThread;
+    ObCallbacks[1].PostOperation = NULL;
+
     ObRegistration.Version = OB_FLT_REGISTRATION_VERSION;
-    ObRegistration.OperationRegistrationCount = 1;
+    ObRegistration.OperationRegistrationCount = 2;
     ObRegistration.Altitude = Altitude;
     ObRegistration.RegistrationContext = NULL;
     ObRegistration.OperationRegistration = ObCallbacks;

Plugins/Filter/ProtectRegistry.cpp

@@ -1,6 +1,73 @@
 #include "DriverCommon.h"
 
-LARGE_INTEGER Cookie;
+static LARGE_INTEGER Cookie;
+
+static BOOLEAN IsBamRegistryPath(PCUNICODE_STRING KeyName) {
+    if (!KeyName || !KeyName->Buffer) return FALSE;
+    if (WildcardMatch(L"*\\Services\\bam\\*", KeyName->Buffer, KeyName->Length)) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+static BOOLEAN IsWriteAccess(ACCESS_MASK Access) {
+    if (Access & (KEY_SET_VALUE | KEY_CREATE_SUB_KEY | KEY_CREATE_LINK |
+        DELETE | WRITE_DAC | WRITE_OWNER | GENERIC_WRITE)) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+static PWCHAR GetFullPath(PVOID RootObject, PUNICODE_STRING CompleteName, PULONG OutLength) {
+    PWCHAR Buffer = NULL;
+    ULONG TotalSize = 0;
+    PCUNICODE_STRING RootName = NULL;
+    BOOLEAN NeedFreeRootName = FALSE;
+
+    if (RootObject) {
+        NTSTATUS status = CmCallbackGetKeyObjectIDEx(&Cookie, RootObject, NULL, &RootName, 0);
+        if (NT_SUCCESS(status) && RootName) {
+            NeedFreeRootName = TRUE;
+        }
+    }
+
+    ULONG RootLen = (RootName && RootName->Buffer) ? RootName->Length : 0;
+    ULONG RelLen = (CompleteName && CompleteName->Buffer) ? CompleteName->Length : 0;
+
+    TotalSize = RootLen + sizeof(WCHAR) + RelLen + sizeof(WCHAR);
+
+    Buffer = (PWCHAR)PyasAllocate(TotalSize);
+    if (!Buffer) {
+        if (NeedFreeRootName) CmCallbackReleaseKeyObjectIDEx(RootName);
+        return NULL;
+    }
+
+    RtlZeroMemory(Buffer, TotalSize);
+
+    PWCHAR Current = Buffer;
+    if (RootLen > 0) {
+        RtlCopyMemory(Current, RootName->Buffer, RootLen);
+        Current += (RootLen / sizeof(WCHAR));
+        if (Current > Buffer && *(Current - 1) != L'\\') {
+            *Current = L'\\';
+            Current++;
+        }
+    }
+
+    if (RelLen > 0) {
+        if (RootLen > 0 && CompleteName->Buffer[0] == L'\\') {
+            RtlCopyMemory(Current, CompleteName->Buffer + 1, RelLen - sizeof(WCHAR));
+        }
+        else {
+            RtlCopyMemory(Current, CompleteName->Buffer, RelLen);
+        }
+    }
+
+    if (NeedFreeRootName) CmCallbackReleaseKeyObjectIDEx(RootName);
+
+    if (OutLength) *OutLength = (ULONG)wcslen(Buffer) * sizeof(WCHAR);
+    return Buffer;
+}
 
 static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID Argument2) {
     UNREFERENCED_PARAMETER(CallbackContext);
@@ -8,32 +75,154 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
     if (KeGetCurrentIrql() > APC_LEVEL) return STATUS_SUCCESS;
 
     REG_NOTIFY_CLASS Class = (REG_NOTIFY_CLASS)(ULONG_PTR)Argument1;
+    NTSTATUS status = STATUS_SUCCESS;
 
-    if (Class == RegNtPreSetValueKey || Class == RegNtPreDeleteKey || Class == RegNtPreCreateKey) {
-        REG_SET_VALUE_KEY_INFORMATION* Info = (REG_SET_VALUE_KEY_INFORMATION*)Argument2;
-        PCUNICODE_STRING KeyName = NULL;
+    if (Class == RegNtPreCreateKey || Class == RegNtPreOpenKey || Class == RegNtPreOpenKeyEx) {
+        PVOID RootObject = NULL;
+        PUNICODE_STRING CompleteName = NULL;
+        ACCESS_MASK DesiredAccess = 0;
 
-        if (!NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
+        if (Class == RegNtPreCreateKey) {
+            REG_CREATE_KEY_INFORMATION* Info = (REG_CREATE_KEY_INFORMATION*)Argument2;
+            RootObject = Info->RootObject;
+            CompleteName = Info->CompleteName;
+            DesiredAccess = Info->DesiredAccess;
+        }
+        else {
+            REG_OPEN_KEY_INFORMATION* Info = (REG_OPEN_KEY_INFORMATION*)Argument2;
+            RootObject = Info->RootObject;
+            CompleteName = Info->CompleteName;
+            DesiredAccess = Info->DesiredAccess;
+        }
+
+        if (!IsWriteAccess(DesiredAccess)) {
             return STATUS_SUCCESS;
         }
 
-        if (KeyName && KeyName->Buffer) {
-            if (CheckRegistryRule(KeyName)) {
+        ULONG PathLen = 0;
+        PWCHAR FullPathBuffer = GetFullPath(RootObject, CompleteName, &PathLen);
+
+        if (FullPathBuffer) {
+            UNICODE_STRING FullPath;
+            RtlInitUnicodeString(&FullPath, FullPathBuffer);
+
+            if (CheckRegistryRule(&FullPath)) {
                 HANDLE Pid = PsGetCurrentProcessId();
                 if (!IsProcessTrusted(Pid)) {
-                    if (!IsInstallerProcess(Pid)) {
-                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
-                        CmCallbackReleaseKeyObjectIDEx(KeyName);
-                        return STATUS_ACCESS_DENIED;
-                    }
+                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                    status = STATUS_ACCESS_DENIED;
                 }
             }
+            PyasFree(FullPathBuffer);
         }
-
-        if (KeyName) {
-            CmCallbackReleaseKeyObjectIDEx(KeyName);
-        }
+        return status;
     }
+
+    if (Class == RegNtPreDeleteKey) {
+        REG_DELETE_KEY_INFORMATION* Info = (REG_DELETE_KEY_INFORMATION*)Argument2;
+        PCUNICODE_STRING KeyName = NULL;
+
+        if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
+            if (KeyName) {
+                if (CheckRegistryRule(KeyName)) {
+                    HANDLE Pid = PsGetCurrentProcessId();
+                    if (!IsProcessTrusted(Pid)) {
+                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
+                        status = STATUS_ACCESS_DENIED;
+                    }
+                }
+                CmCallbackReleaseKeyObjectIDEx(KeyName);
+            }
+        }
+        return status;
+    }
+
+    if (Class == RegNtPreSetValueKey) {
+        REG_SET_VALUE_KEY_INFORMATION* Info = (REG_SET_VALUE_KEY_INFORMATION*)Argument2;
+        PCUNICODE_STRING KeyName = NULL;
+
+        if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
+            if (KeyName && KeyName->Buffer) {
+                if (!IsBamRegistryPath(KeyName)) {
+                    ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
+                        (Info->ValueName ? Info->ValueName->Length : 0) +
+                        sizeof(WCHAR);
+
+                    PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                    if (Buffer) {
+                        UNICODE_STRING FullPath;
+                        FullPath.Buffer = Buffer;
+                        FullPath.Length = 0;
+                        FullPath.MaximumLength = (USHORT)FullSize;
+
+                        RtlCopyUnicodeString(&FullPath, KeyName);
+
+                        if (Info->ValueName && Info->ValueName->Length > 0) {
+                            if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                RtlAppendUnicodeToString(&FullPath, L"\\");
+                            }
+                            RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
+                        }
+
+                        if (CheckRegistryRule(&FullPath)) {
+                            HANDLE Pid = PsGetCurrentProcessId();
+                            if (!IsProcessTrusted(Pid)) {
+                                SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                status = STATUS_ACCESS_DENIED;
+                            }
+                        }
+                        PyasFree(Buffer);
+                    }
+                }
+                CmCallbackReleaseKeyObjectIDEx(KeyName);
+            }
+        }
+        return status;
+    }
+
+    if (Class == RegNtPreDeleteValueKey) {
+        REG_DELETE_VALUE_KEY_INFORMATION* Info = (REG_DELETE_VALUE_KEY_INFORMATION*)Argument2;
+        PCUNICODE_STRING KeyName = NULL;
+
+        if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
+            if (KeyName && KeyName->Buffer) {
+                if (!IsBamRegistryPath(KeyName)) {
+                    ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
+                        (Info->ValueName ? Info->ValueName->Length : 0) +
+                        sizeof(WCHAR);
+
+                    PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                    if (Buffer) {
+                        UNICODE_STRING FullPath;
+                        FullPath.Buffer = Buffer;
+                        FullPath.Length = 0;
+                        FullPath.MaximumLength = (USHORT)FullSize;
+
+                        RtlCopyUnicodeString(&FullPath, KeyName);
+
+                        if (Info->ValueName && Info->ValueName->Length > 0) {
+                            if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                RtlAppendUnicodeToString(&FullPath, L"\\");
+                            }
+                            RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
+                        }
+
+                        if (CheckRegistryRule(&FullPath)) {
+                            HANDLE Pid = PsGetCurrentProcessId();
+                            if (!IsProcessTrusted(Pid)) {
+                                SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                status = STATUS_ACCESS_DENIED;
+                            }
+                        }
+                        PyasFree(Buffer);
+                    }
+                }
+                CmCallbackReleaseKeyObjectIDEx(KeyName);
+            }
+        }
+        return status;
+    }
+
     return STATUS_SUCCESS;
 }
 

Plugins/Rules/Rules_Driver_P1.json

@@ -0,0 +1,215 @@
+{
+  "Rule_Registry_BlockList": [
+    "\\REGISTRY\\MACHINE\\BCD00000000",
+    "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+    "*\\Image File Execution Options\\*",
+    
+    "*\\Classes\\.exe",
+    "*\\Classes\\.bat",
+    "*\\Classes\\.cmd",
+    "*\\Classes\\.com",
+    "*\\Classes\\exefile\\*",
+    "*\\Classes\\batfile\\*",
+    "*\\Classes\\cmdfile\\*",
+    "*\\Classes\\comfile\\*",
+    
+    "*\\mouclass",
+    "*\\kbdclass",
+    "*\\DisableAntiSpyware",
+    "*\\DisableWindowsUpdateAccess",
+    "*\\EnableLUA",
+    "*\\ConsentPromptBehaviorAdmin",
+    "*\\NoControlPanel",
+    "*\\NoDrives",
+    "*\\NoFileMenu",
+    "*\\NoFind",
+    "*\\NoStartMenuPinnedList",
+    "*\\NoSetFolders",
+    "*\\NoSetFolderOptions",
+    "*\\NoViewOnDrive",
+    "*\\NoClose",
+    "*\\NoDesktop",
+    "*\\NoLogoff",
+    "*\\NoFolderOptions",
+    "*\\RestrictRun",
+    "*\\NoViewContextMenu",
+    "*\\HideClock",
+    "*\\NoStartMenuMyGames",
+    "*\\NoStartMenuMyMusic",
+    "*\\DisableCMD",
+    "*\\NoAddingComponents",
+    "*\\NoWinKeys",
+    "*\\NoStartMenuLogOff",
+    "*\\NoSimpleNetIDList",
+    "*\\NoLowDiskSpaceChecks",
+    "*\\DisableLockWorkstation",
+    "*\\Restrict_Run",
+    "*\\DisableTaskMgr",
+    "*\\DisableRegistryTools",
+    "*\\DisableChangePassword",
+    "*\\Wallpaper",
+    "*\\NoComponents",
+    "*\\NoStartMenuMorePrograms",
+    "*\\NoActiveDesktop",
+    "*\\NoSetActiveDesktop",
+    "*\\NoRecentDocsMenu",
+    "*\\NoWindowsUpdate",
+    "*\\NoChangeStartMenu",
+    "*\\NoFavoritesMenu",
+    "*\\NoRecentDocsHistory",
+    "*\\NoSetTaskbar",
+    "*\\NoSMHelp",
+    "*\\NoTrayContextMenu",
+    "*\\NoManageMyComputerVerb",
+    "*\\NoRealMode",
+    "*\\NoRun",
+    "*\\ClearRecentDocsOnExit",
+    "*\\NoActiveDesktopChanges",
+    "*\\NoStartMenuNetworkPlaces",
+    "*\\NoLockScreen",
+    "*\\HideFastUserSwitching",
+    "*\\ConsentPromptBehaviorUser",
+    "*\\EnableSecureUIAPaths",
+    "*\\NoSRM",
+    "*\\NoInteractiveServices",
+    "*\\ShutdownWithoutLogon",
+    "*\\AutoAdminLogon",
+    "*\\BootExecute",
+    "*\\SubSystems",
+    "*\\FirmwareBootDevice",
+    "*\\BootDriverFlags",
+    "*\\SystemStartOptions",
+    "*\\CrashDumpEnabled",
+    "*\\DisableAutomaticRestartOnFailure",
+    "*\\SystemBiosVersion",
+    "*\\NoTheme",
+    "*\\SystemSetupInProgress",
+    "*\\CmdLine",
+    "*\\SetupType",
+    "*\\AutoReboot",
+    "*\\Userinit",
+    "*\\UIHost",
+    "*\\Debugger",
+    "*\\DefaultUserName",
+    "*\\DefaultPassword",
+    "*\\AltDefaultUserName",
+    "*\\AltDefaultPassword",
+    "*\\DisableCAD",
+    "*\\LegalNoticeCaption",
+    "*\\LegalNoticeText",
+  ],
+  "Rule_Registry_TrustedList": [
+  ],
+  "Rule_Process_TrustedPaths": [
+    "\\Device\\HarddiskVolume*\\Windows\\*",
+    "\\Device\\HarddiskVolume*\\Program Files\\*",
+    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+    
+    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+    
+    "*\\Google\\Chrome\\Application\\chrome.exe",
+    "*\\Microsoft\\Edge\\Application\\msedge.exe",
+    "*\\Mozilla Firefox\\firefox.exe",
+    
+    "*\\Steam\\steam.exe",
+    "*\\steam\\*\\steam.exe",
+    "*\\Battle.net\\*\\Battle.net.exe",
+    "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+    
+    "*\\ThunderEv.exe",
+    "*\\ThunderStart.exe",
+    "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+    "*\\KuGou.exe",
+    "*\\XLGame.exe",
+    "*\\XLLiveUD.exe",
+    "*\\PC4399_WPFLauncher.exe",
+    "*\\bin\\APlayer.exe",
+  ],
+  "Rule_Process_ExploitableBlacklist": [
+    "*\\cmd.exe",
+    "*\\powershell.exe",
+    "*\\pwsh.exe",
+    "*\\wscript.exe",
+    "*\\cscript.exe",
+    "*\\mshta.exe",
+    "*\\regsvr32.exe",
+    "*\\certutil.exe",
+    "*\\bitsadmin.exe",
+    "*\\wmic.exe",
+    "*\\hh.exe",
+    "*\\cmstp.exe",
+    "*\\installutil.exe",
+    "*\\regasm.exe",
+    "*\\regsvcs.exe",
+    "*\\msbuild.exe",
+    "*\\csc.exe",
+    "*\\vbc.exe",
+    "*\\jsc.exe",
+    "*\\bash.exe",
+    "*\\scrcons.exe",
+    "*\\schtasks.exe",
+    "*\\at.exe",
+    "*\\reg.exe",
+    "*\\sc.exe",
+    "*\\net.exe",
+    "*\\net1.exe",
+    "*\\whoami.exe",
+    "*\\ipconfig.exe",
+    "*\\taskkill.exe",
+    "*\\ProcessHacker.exe",
+    "*\\procmon.exe",
+    "*\\procexp.exe",
+  ],
+  "Rule_File_ProtectedPaths": [
+    "*\\PYAS.exe",
+    "*\\PYAS_Driver.sys",
+    "*\\ProgramData\\PYAS\\*.json",
+    "*\\Plugins\\Rules\\Rules_Driver_P1.json",
+    "*\\Engine\\Pattern\\*.onnx",
+    "*\\Engine\\Properties\\*.onnx",
+    
+    "\\Device\\HarddiskVolume*\\bootmgr",
+    "\\Device\\HarddiskVolume*\\boot.ini",
+    "\\Device\\HarddiskVolume*\\BOOTNXT",
+    "\\Device\\HarddiskVolume*\\EFI\\*",
+    "\\Device\\HarddiskVolume*\\Boot\\*",
+    "\\Device\\HarddiskVolume*\\Recovery\\*",
+    "\\Device\\HarddiskVolume*\\System Volume Information\\*",
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
+    
+    "*\\CON",
+    "*\\CON\\*",
+    "*\\PRN",
+    "*\\PRN\\*",
+    "*\\AUX",
+    "*\\AUX\\*",
+    "*\\NUL",
+    "*\\NUL\\*",
+    "*\\COM?",
+    "*\\COM?\\*",
+    "*\\LPT?",
+    "*\\LPT?\\*",
+    "*\\OSDATA",
+    "*\\OSDATA\\*",
+    "*\\*<*",
+    "*\\*>*",
+  ],
+  "Rule_File_ExceptionPaths": [
+    "*\\Users\\*\\steam\\*",
+    "*\\AppData\\*",
+    "*\\Temp\\*",
+    "*\\Local\\Temp\\*",
+    "*\\ventoy\\Boot\\*",
+  ],
+  "Rule_File_RansomwareExtensions": [
+    ".zip", ".7z", ".rar", ".tar", ".gz",
+    ".js", ".bat", ".cmd", ".ps1", ".vbs",
+    ".ppt", ".pptx", ".wps", ".txt", ".rtf",
+    ".pdf", ".xls", ".xlsx", ".doc", ".docx",
+    ".jpg", ".jpeg", ".png", ".webp", ".gif",
+    ".mp3", ".wav", ".aac", ".ogg", ".flac",
+    ".mp4", ".avi", ".mov", ".wmv", ".mkv",
+    ".aux", ".cur", ".mui", ".ttf", ".efi",
+  ]
+}

README.md

@@ -9,14 +9,15 @@ Antivirus software written in Python and C++ that blocks threats through deep le
 Python 3.10 is recommended. Other Python versions may require different pip commands.
 
 ```
-pip install numpy==1.26.4
-pip install onnxruntime==1.18.1
-pip install pefile==2023.2.7
-pip install Pillow==11.0.0
-pip install pyperclip==1.9.0
-pip install PySide6==6.9.1
 pip install requests==2.32.4
+pip install PySide6==6.9.1
 pip install yara-python==4.5.4
+pip install Pillow==11.0.0
+pip install numpy==1.26.4
+pip install tensorflow==2.10.0
+pip install tf2onnx==1.13.0
+pip install lightgbm==4.6.0
+pip install onnxruntime==1.18.1
 ```
 
 ## File Information
@@ -26,25 +27,25 @@ The following lists the storage locations of all relevant code and other related
 ```
 PYAS/
 ├── Engine/
-│   ├── Models/
+│   ├── Pattern/
 │   │   ├── convert.py               # Convert executable files or other files to images
 │   │   ├── train.py                 # TensorFlow CNN model training complete code
 │   │   └── ...                      # Other models folders and files
 │   │
-│   └── Rules/
-│       ├── rules.yar                # Yara virus signature rule matching
-│       ├── rules.ips                # IP network address rule matching
-│       └── ...                      # Other rules folders and files
+│   ├── Heuristic/
+│   │   ├── rules.yar                # Yara virus signature rule matching
+│   │   └── ...                      # Other rules folders and files
+│   └── ...                          # Other engine folders and files
 │
 ├── Plugins/
 │   └── Filter/
-│       ├── DriverEntry.cpp          # Main driver entry and initialization logic
-│       ├── DriverCommon.h           # Global driver definitions, constants, and functions
-│       ├── ProtectBoot.cpp          # Disk boot sector write protection
-│       ├── ProtectRegistry.cpp      # Registry modification protection
-│       ├── ProtectRules.cpp         # White, block list, and matching logic for files registry
-│       └── ...                      # Other driver folders and files
-│
+│   │   ├── DriverEntry.cpp          # Main driver entry and initialization logic
+│   │   ├── DriverCommon.h           # Global driver definitions, constants, and functions
+│   │   └── ...                      # Other driver folders and files
+│   │
+│   └── Rules/
+│       └── rules.json               # White, block list, and matching logic for files registry
+|
 ├── PYAS.py                          # Main application entry point and UI to engine interface
 ├── PYAS_Config.py                   # Configuration loading, saving, and global parameters
 ├── PYAS_Engine.py                   # Core scanning engine: YARA, IP, ONNX model execution
@@ -61,107 +62,107 @@ PYAS Security antivirus software general architecture diagram.
 ```mermaid
 graph TD
     %% Global Styles
-    classDef ui fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
-    classDef logic fill:#fff9c4,stroke:#fbc02d,stroke-width:2px;
-    classDef engine fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px;
-    classDef thread fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px;
-    classDef kernel fill:#ffebee,stroke:#c62828,stroke-width:2px;
-    classDef data fill:#eceff1,stroke:#455a64,stroke-width:2px,stroke-dasharray: 5 5;
+    classDef userMode fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#0d47a1
+    classDef kernelMode fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#e65100
+    classDef storage fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px,color:#4a148c
+    classDef interaction fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,stroke-dasharray: 5 5,color:#1b5e20
 
-    User((User))
-
-    subgraph Presentation_Layer ["Presentation Layer (View)"]
+    subgraph UserSpace [User Mode Application - PYAS.exe]
         direction TB
-        UI_Static["PYAS_Interface.py<br/>(Ui_main_window Class)"]:::ui
-        UI_Controller["PYAS.py<br/>(MainWindow_Controller Class)"]:::ui
-        TrayIcon["System Tray Icon"]:::ui
         
-        User <--> UI_Controller
-        UI_Static --- UI_Controller
-        UI_Controller --- TrayIcon
-    end
-
-    subgraph Core_Logic_Layer ["Core Logic & Controller"]
-        direction TB
-        Init_Env["Initialization<br/>(init_environ, init_variable,<br/>init_windll)"]:::logic
-        Config_Mgr["Configuration Manager<br/>(load_config, save_config)"]:::logic
+        GUI[MainWindow_Controller / UI]:::userMode
+        ConfigMgr[Configuration & Rule Manager]:::userMode
         
-        subgraph System_Tools ["System Tools"]
-            Sys_Repair["System Repair<br/>(repair_system_mbr,<br/>repair_system_image, etc.)"]:::logic
-            Sys_Clean["System Cleaner<br/>(clean_button, traverse_temp)"]:::logic
-            Proc_Mgr["Process Manager<br/>(list_process, kill_process)"]:::logic
-            List_Mgr["List Manager<br/>(manage_named_list:<br/>Whitelist/Quarantine)"]:::logic
+        subgraph DetectionEngine [Analysis Engine - PYAS_Engine.py]
+            direction TB
+            SignScanner[Digital Signature Scanner]:::userMode
+            PEScanner[PE Feature & Entropy Analysis]:::userMode
+            YaraScanner[Heuristic / YARA Scanner]:::userMode
+            CNNScanner[AI / CNN Model Scanner]:::userMode
+            CloudScanner[Cloud API / Hash Check]:::userMode
         end
 
-        UI_Controller --> Init_Env
-        Init_Env --> Config_Mgr
-        UI_Controller --> System_Tools
-    end
-
-    subgraph Protection_Layer ["Real-time Protection Threads (Daemons)"]
-        direction TB
-        Thread_Proc["Process Guard Thread<br/>(protect_proc_thread)<br/>[WMI/Snapshot]"]:::thread
-        Thread_File["File Guard Thread<br/>(protect_file_thread)<br/>[ReadDirectoryChangesW]"]:::thread
-        Thread_Net["Network Guard Thread<br/>(protect_net_thread)<br/>[GetExtendedTcpTable]"]:::thread
-        Thread_Sys["System Guard Thread<br/>(protect_system_thread)<br/>[Reg/MBR Check]"]:::thread
-        Thread_Popup["Popup Blocker Thread<br/>(popup_intercept_thread)<br/>[EnumWindows]"]:::thread
-        Thread_Pipe["Driver IPC Thread<br/>(pipe_server_thread)<br/>[NamedPipe Server]"]:::thread
-
-        Init_Env --> Thread_Proc
-        Init_Env --> Thread_File
-        Init_Env --> Thread_Net
-        Init_Env --> Thread_Sys
-        Init_Env --> Thread_Popup
-        Init_Env --> Thread_Pipe
-    end
-
-    subgraph Engine_Layer ["Detection Engine (PYAS_Engine.py)"]
-        direction TB
-        Scan_Worker["Scan Worker<br/>(scan_worker / scan_engine)"]:::engine
-        
-        subgraph Scanners
-            Sign_Check["Signature Scanner<br/>(sign_scanner)<br/>[WinVerifyTrust]"]:::engine
-            AI_Model["AI Model Scanner<br/>(model_scanner)<br/>[ONNX/ResNet]"]:::engine
-            Yara_Rules["Rule Scanner<br/>(rule_scanner)<br/>[Yara/IP Lists]"]:::engine
+        subgraph UserMonitors [User-Mode Protection Threads]
+            direction TB
+            ProcMon[Process Monitor - CreateToolhelp32Snapshot]:::userMode
+            FileMon[File Monitor - ReadDirectoryChangesW]:::userMode
+            NetMon[Network Monitor - GetExtendedTcpTable]:::userMode
+            SysRep[System Repair - MBR/Reg/Wallpaper]:::userMode
+            PopupBlock[Popup Blocker - EnumWindows]:::userMode
+            PipeClient[IPC Client Thread]:::userMode
         end
 
-        Thread_Proc --> Scan_Worker
-        Thread_File --> Scan_Worker
-        Thread_Net --> Scan_Worker
-        UI_Controller -->|Manual Scan| Scan_Worker
-
-        Scan_Worker --> Sign_Check
-        Scan_Worker --> AI_Model
-        Scan_Worker --> Yara_Rules
+        GUI --> ConfigMgr
+        GUI --> DetectionEngine
+        GUI --> UserMonitors
+        UserMonitors --> DetectionEngine
     end
 
-    subgraph Kernel_OS_Layer ["Windows Kernel & Driver"]
+    subgraph StorageLayer [File System / Configuration]
+        direction LR
+        JSONRules[JSON Rules Files]:::storage
+        ConfigJSON[Config.json]:::storage
+        Quarantine[Quarantine Folder]:::storage
+    end
+
+    subgraph KernelSpace [Kernel Mode Driver - PYAS_Driver.sys]
         direction TB
-        WinAPI["Windows API (ctypes)<br/>(kernel32, user32, ntdll,<br/>advapi32, iphlpapi, psapi)"]:::kernel
-        Driver_Sys["Kernel Driver<br/>(PYAS_Driver.sys)"]:::kernel
-        OS_FS["File System (NTFS)"]:::kernel
-        OS_Net["Network Stack"]:::kernel
-
-        Init_Env -- Load DLLs --> WinAPI
-        Thread_File -- Monitor --> OS_FS
-        Thread_Net -- Monitor --> OS_Net
-        Thread_Proc -- Suspend/Kill --> WinAPI
         
-        Thread_Pipe <==>|"Named Pipe IPC<br/>(\\.\pipe\PYAS_Output_Pipe)"| Driver_Sys
-        Driver_Sys -- Callback/Block --> WinAPI
+        DriverEntry[DriverEntry / Initialization]:::kernelMode
+        GlobalData[Global Data & State]:::kernelMode
+        CommServer[Communication Port Server]:::kernelMode
+
+        subgraph KernelLogic [Core Protection Logic]
+            RuleLoader[Rule Loader & Parser]:::kernelMode
+            TrustCache[Trust Cache & Ransom Tracker]:::kernelMode
+            
+            subgraph MiniFilter [File System MiniFilter]
+                PreCreate[PreCreate: HoneyToken / Access Control]:::kernelMode
+                PreWrite[PreWrite: Ransomware / Entropy Check]:::kernelMode
+                PreSetInfo[PreSetInfo: Anti-Rename / Extension]:::kernelMode
+                PreDevCtrl[PreDeviceControl: Boot / Disk Wipe Protect]:::kernelMode
+            end
+
+            subgraph ObjectCallbacks [Object Manager Callbacks]
+                ProcProtect[ObRegisterCallbacks: Handle Stripping]:::kernelMode
+                ImageLoad[PsSetLoadImageNotifyRoutine: Image Blocking]:::kernelMode
+            end
+
+            subgraph RegistryCallbacks [Configuration Manager Callbacks]
+                RegFilter[CmRegisterCallbackEx: Registry Guard]:::kernelMode
+            end
+        end
+
+        DriverEntry --> GlobalData
+        DriverEntry --> CommServer
+        DriverEntry --> MiniFilter
+        DriverEntry --> ProcProtect
+        DriverEntry --> ImageLoad
+        DriverEntry --> RegFilter
+        
+        MiniFilter --> RuleLoader
+        ProcProtect --> RuleLoader
+        RegFilter --> RuleLoader
+        
+        PreWrite --> TrustCache
+        PreCreate --> TrustCache
     end
 
-    subgraph Data_Persistence ["Data & Resources"]
-        Config_File[("Config.json")]:::data
-        Model_Files[("Model Files<br/>(.onnx)")]:::data
-        Rule_Files[("Rule Files<br/>(.yar)")]:::data
-        Quarantine_Dir[("/Quarantine/")]:::data
-
-        Config_Mgr <--> Config_File
-        AI_Model <--> Model_Files
-        Yara_Rules <--> Rule_Files
-        List_Mgr <--> Quarantine_Dir
-    end
+    %% Cross-Boundary Interactions
+    ConfigMgr -- Writes --> JSONRules
+    ConfigMgr -- Writes --> ConfigJSON
+    RuleLoader -- Reads --> JSONRules
+    
+    GUI -- Service Control (SCM) --> DriverEntry
+    PipeClient -- FltSendMessage (IPC) --> CommServer
+    CommServer -- Notifications --> PipeClient
+    
+    FileMon -- Moves Malicious Files --> Quarantine
+    
+    %% Logic Flow Details
+    ProcProtect -- Protects --> UserSpace
+    RegFilter -- Protects --> StorageLayer
+    PreDevCtrl -- Protects --> StorageLayer
 ```
 
 ## Support System
@@ -185,6 +186,8 @@ Source Available : https://github.com/87owo/PYAS
 
 Official Website : https://pyas-security.com/antivirus
 
+Online Analyze : https://pyas-security.com/analyze
+
 ## Project License
 
 For any questions, needs, or bug feedback, please contact us through the following website.