Add files via upload

Engine/Properties/train.py

@@ -3,6 +3,7 @@ import pandas as pd
 import numpy as np
 import lightgbm as lgb
 import onnxmltools
+
 from onnxmltools.convert.common.data_types import FloatTensorType
 from sklearn.model_selection import train_test_split
 from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
@@ -10,8 +11,8 @@ from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
 ####################################################################################################
 
 DB_PATH = "pe_features.db"
-MODEL_FILE = "pe_malware_lgbm.txt"
-ONNX_FILE = "pe_malware.onnx"
+MODEL_FILE = "model.txt"
+ONNX_FILE = "model.onnx"
 FEATURE_FILE = "features.json"
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
@@ -20,7 +21,7 @@ LGBM_PARAMS = {
     'objective': 'binary',
     'metric': ['binary_logloss', 'auc'],
     'boosting_type': 'gbdt',
-    'num_leaves': 63,
+    'num_leaves': 255,
     'learning_rate': 0.05,
     'feature_fraction': 0.8,
     'bagging_fraction': 0.8,
@@ -29,13 +30,16 @@ LGBM_PARAMS = {
     'seed': RANDOM_SEED,
     'n_jobs': -1,
     'max_depth': -1,
-    'min_data_in_leaf': 20,
+    'min_data_in_leaf': 10,
     'lambda_l1': 0.1,
-    'lambda_l2': 0.1
+    'lambda_l2': 0.1,
 }
 
 ####################################################################################################
 
+def clean_col_name(name):
+    return re.sub(r'[^A-Za-z0-9_]+', '', name)
+
 def get_raw_schema(db_path):
     if not os.path.exists(db_path):
         return None
@@ -44,38 +48,53 @@ def get_raw_schema(db_path):
         cursor = conn.cursor()
         cursor.execute("PRAGMA table_info(PeData)")
         columns = [row[1] for row in cursor.fetchall()]
-        exclude_lower = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score'}
-        return [c for c in columns if c.lower().strip() not in exclude_lower]
-    except:
+        exclude = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score', 'filehash', 'timedatestamp'}
+        return [c for c in columns if c.lower().strip() not in exclude]
+    except Exception as e:
+        print(f"[-] Schema extraction error: {e}")
         return None
     finally:
         conn.close()
 
-def load_and_clean_data(db_path, raw_cols):
+####################################################################################################
+
+def load_data(db_path, raw_cols):
     print(f"[*] Connecting to database: {db_path}")
     conn = sqlite3.connect(db_path)
     req_cols = list(set(raw_cols + ['Label']))
     sql = f"SELECT {', '.join(req_cols)} FROM PeData"
     
     try:
-        df = pd.read_sql_query(sql, conn)
-        if df.empty: return None, None, None
+        chunks = []
+        for chunk in pd.read_sql_query(sql, conn, chunksize=20000):
+            label_col = next((c for c in chunk.columns if c.lower().strip() == 'label'), None)
+            if not label_col:
+                print("[-] Critical Error: Label column not found.")
+                return None, None, None
 
-        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
-        if not label_col:
-            print("[-] Critical Error: Label column not found.")
+            cols_to_cast = [c for c in chunk.columns if c != label_col]
+            chunk[cols_to_cast] = chunk[cols_to_cast].astype(np.float32)
+            chunk[label_col] = chunk[label_col].astype(np.int8)
+            chunks.append(chunk)
+
+        if not chunks:
             return None, None, None
 
+        df = pd.concat(chunks, ignore_index=True)
+
+        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
         y = df[label_col].astype(int)
         X = df.drop(columns=[label_col], errors='ignore')
         
         valid_features = [c for c in raw_cols if c in X.columns]
         X = X[valid_features].copy()
         
-        X = X.rename(columns=lambda x: re.sub('[^A-Za-z0-9_]+', '', x))
+        rename_map = {old: clean_col_name(old) for old in X.columns}
+        X = X.rename(columns=rename_map)
         
-        if X.isnull().values.any():
-            X = X.fillna(X.median(numeric_only=True))
+        if X.columns.duplicated().any():
+            print("[-] Warning: Duplicate column names detected after cleaning. Deduplicating...")
+            X = X.loc[:, ~X.columns.duplicated()]
 
         final_features = X.columns.tolist()
         return X, y, final_features
@@ -95,13 +114,11 @@ def train_process(X, y):
     n_neg = (y_train == 0).sum()
     
     base_weight = n_neg / n_pos if n_pos > 0 else 1.0
-    
-    weight_ratio_base = 1.0
-    weight_ratio_target = 0.1
-    final_pos_weight = base_weight * (weight_ratio_target / weight_ratio_base)
+    weight_ratio_target = 0.01
+    final_pos_weight = base_weight * weight_ratio_target
     
     print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
-    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted (Favor Safe)={final_pos_weight:.4f}")
+    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted={final_pos_weight:.4f}")
     
     train_data = lgb.Dataset(X_train, label=y_train)
     valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data)
@@ -109,7 +126,7 @@ def train_process(X, y):
     params = LGBM_PARAMS.copy()
     params['scale_pos_weight'] = final_pos_weight
 
-    print("\n[*] Starting LightGBM training (Full Force, No Early Stopping)...")
+    print("\n[*] Starting LightGBM training...")
     start_time = time.time()
     
     model = lgb.train(
@@ -127,6 +144,8 @@ def train_process(X, y):
     
     return model, X_test, y_test
 
+####################################################################################################
+
 def export_onnx_model(model, feature_names):
     print(f"[*] Exporting ONNX model to {ONNX_FILE}...")
     try:
@@ -141,6 +160,8 @@ def export_onnx_model(model, feature_names):
     except Exception as e:
         print(f"[-] ONNX export failed: {e}")
 
+####################################################################################################
+
 def evaluate_and_save(model, X_test, y_test):
     print("\n------------------- Evaluation Report -------------------\n")
     y_prob = model.predict(X_test, num_iteration=model.best_iteration)
@@ -171,7 +192,7 @@ def evaluate_and_save(model, X_test, y_test):
 ####################################################################################################
 
 if __name__ == "__main__":
-    print("\n---------------- PE Malware Trainer v3.0 ----------------\n")
+    print("\n---------------- PE Malware Trainer v3.1 ----------------\n")
 
     if not os.path.exists(DB_PATH):
         print(f"[-] Error: Database {DB_PATH} not found.")
@@ -182,7 +203,7 @@ if __name__ == "__main__":
         print("[-] Error: Could not read schema.")
         sys.exit(1)
 
-    X, y, _ = load_and_clean_data(DB_PATH, raw_schema)
+    X, y, _ = load_data(DB_PATH, raw_schema)
     if X is None:
         sys.exit(1)
 

PYAS.py

@@ -146,10 +146,10 @@ class MainWindow_Controller(QMainWindow):
             "traditional_switch", "simplified_switch", "english_switch",
         ]
         self.pyas_default = {
-            "version": "3.4.0",
+            "version": "3.4.1",
             "api_host": "https://pyas-security.com/",
             "api_key": "fBRZxYS1UxykM-qzNOlKOEl63WILzlvgNMn6QfsG6FXCAAIktCrOPTAfY5_hEyuZ",
-            "suffix": [".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui", ".cpl"],
+            "suffix": [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd"],
             "block": [2001, 3001, 4001, 5001, 6001],
             "size": 256 * 1024 * 1024,
             "language": "english_switch",
@@ -260,6 +260,33 @@ class MainWindow_Controller(QMainWindow):
         self.fltlib.FilterGetMessage.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.c_void_p]
         self.fltlib.FilterGetMessage.restype = ctypes.c_long
 
+        self.kernel32.CreateToolhelp32Snapshot.restype = ctypes.wintypes.HANDLE
+        self.kernel32.CreateToolhelp32Snapshot.argtypes = [ctypes.wintypes.DWORD, ctypes.wintypes.DWORD]
+        
+        self.kernel32.Process32FirstW.restype = ctypes.wintypes.BOOL
+        self.kernel32.Process32FirstW.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_void_p]
+        
+        self.kernel32.Process32NextW.restype = ctypes.wintypes.BOOL
+        self.kernel32.Process32NextW.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_void_p]
+        
+        self.kernel32.OpenProcess.restype = ctypes.wintypes.HANDLE
+        self.kernel32.OpenProcess.argtypes = [ctypes.wintypes.DWORD, ctypes.wintypes.BOOL, ctypes.wintypes.DWORD]
+        
+        self.kernel32.CloseHandle.restype = ctypes.wintypes.BOOL
+        self.kernel32.CloseHandle.argtypes = [ctypes.wintypes.HANDLE]
+        
+        self.kernel32.TerminateProcess.restype = ctypes.wintypes.BOOL
+        self.kernel32.TerminateProcess.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_uint]
+        
+        self.kernel32.CreateMutexW.restype = ctypes.wintypes.HANDLE
+        self.kernel32.CreateMutexW.argtypes = [ctypes.c_void_p, ctypes.wintypes.BOOL, ctypes.c_wchar_p]
+        
+        self.kernel32.CreateFileW.restype = ctypes.wintypes.HANDLE
+        self.kernel32.CreateFileW.argtypes = [ctypes.c_wchar_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.HANDLE]
+        
+        self.kernel32.ReadProcessMemory.restype = ctypes.wintypes.BOOL
+        self.kernel32.ReadProcessMemory.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
+
 ####################################################################################################
 
     def save_config(self, file_path, config):
@@ -309,6 +336,11 @@ class MainWindow_Controller(QMainWindow):
 
     def init_engine_thread(self):
         try:
+            self.backup_mbr()
+            self.relock_file()
+            self.init_whitelist()
+            self.init_thread()
+
             self.heuristic.load_path(self.path_heuristic, callback=lambda x: self.init_log_signal.emit(os.path.basename(x)))
             self.pattern.load_path(self.path_pattern, callback=lambda x: self.init_log_signal.emit(os.path.basename(x)))
             self.properties.load_path(self.path_properties, callback=lambda x: self.init_log_signal.emit(os.path.basename(x)))
@@ -622,22 +654,17 @@ class MainWindow_Controller(QMainWindow):
 
     def show_startup(self):
         try:
-            if self.singleton_mutex("pyas_security"):
-                self.backup_mbr()
-                self.relock_file()
-                self.init_whitelist()
-                self.init_thread()
-                self.init_connect()
-
-                param = ""
-                if self.args_pyas:
-                    param = self.args_pyas[0].replace("/", "-")
-                if "-h" not in param:
-                    self.show_button()
-                self.apply_settings()
-                self.start_daemon_thread(self.init_engine_thread)
-            else:
+            if not self.singleton_mutex("pyas_security"):
                 sys.exit(0)
+
+            self.init_connect()
+            self.apply_settings()
+
+            param = self.args_pyas[0].replace("/", "-") if self.args_pyas else ""
+            if "-h" not in param:
+                self.show_button()
+
+            self.start_daemon_thread(self.init_engine_thread)
         except Exception as e:
             self.send_message(f"show_startup | {e}", "warn", False)
 
@@ -672,6 +699,7 @@ class MainWindow_Controller(QMainWindow):
     def reset_button(self):
         if self.send_message("您確定要重置所有設定嗎?", "quest", True):
             self.pyas_config = self.pyas_default.copy()
+            self.save_config(self.file_config, self.pyas_config)
             self.close_button()
 
     def singleton_mutex(self, name):
@@ -865,7 +893,7 @@ class MainWindow_Controller(QMainWindow):
                         continue
                     self.scan_count += 1
 
-                    suffix = self.pyas_config.get("suffix", [".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui"])
+                    suffix = self.pyas_config.get("suffix", [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd"])
                     ext = os.path.splitext(file_path)[-1].lower()
                     if ext not in suffix:
                         continue
@@ -1108,13 +1136,18 @@ class MainWindow_Controller(QMainWindow):
     def list_process(self):
         pe = self.get_process_entry()
         snapshot = self.kernel32.CreateToolhelp32Snapshot(0x00000002, 0)
-        result, success = [], self.kernel32.Process32FirstW(snapshot, ctypes.byref(pe))
-
+        result = []
+        
+        if snapshot in (-1, 0xFFFFFFFF, 0xFFFFFFFFFFFFFFFF):
+            return result
+            
+        success = self.kernel32.Process32FirstW(snapshot, ctypes.byref(pe))
         while success:
             pid = pe.th32ProcessID
             name, file_path = (None, None)
             if pid > 4:
                 name, file_path = self.get_exe_info(pid)
+
             if not name:
                 try:
                     name = pe.szExeFile
@@ -1123,6 +1156,7 @@ class MainWindow_Controller(QMainWindow):
 
             result.append((pid, name, file_path))
             success = self.kernel32.Process32NextW(snapshot, ctypes.byref(pe))
+            
         self.kernel32.CloseHandle(snapshot)
         return result
 
@@ -1215,12 +1249,14 @@ class MainWindow_Controller(QMainWindow):
         try:
             h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
             if h:
-                file_path = self.norm_path(self.get_process_file(h))
-                if self.path_equal(file_path, self.file_pyas):
-                    self.close_button()
-                else:
-                    self.kernel32.TerminateProcess(h, 0)
-                self.kernel32.CloseHandle(h)
+                try:
+                    file_path = self.norm_path(self.get_process_file(h))
+                    if self.path_equal(file_path, self.file_pyas):
+                        self.close_button()
+                    else:
+                        self.kernel32.TerminateProcess(h, 0)
+                finally:
+                    self.kernel32.CloseHandle(h)
         except Exception as e:
             self.send_message(f"kill_process | {e}", "warn", False)
         self.refresh_process()
@@ -1798,7 +1834,7 @@ class MainWindow_Controller(QMainWindow):
             seen = set()
             paths = [p for p in paths if p and (p not in seen and not seen.add(p))]
 
-            suffix = self.pyas_config.get("suffix", [".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui"])
+            suffix = self.pyas_config.get("suffix", [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd"])
 
             for p in paths:
                 file_path = self.norm_path(self.device_path_to_drive(p)) if p else ""
@@ -1841,6 +1877,10 @@ class MainWindow_Controller(QMainWindow):
     def get_process_list(self):
         exist_process, pe = set(), self.get_process_entry()
         hSnapshot = self.kernel32.CreateToolhelp32Snapshot(0x00000002, 0)
+        
+        if hSnapshot in (-1, 0xFFFFFFFF, 0xFFFFFFFFFFFFFFFF):
+            return exist_process
+            
         if self.kernel32.Process32FirstW(hSnapshot, ctypes.byref(pe)):
             while True:
                 exist_process.add(pe.th32ProcessID)
@@ -1962,7 +2002,7 @@ class MainWindow_Controller(QMainWindow):
                 file_path = self.norm_path(os.path.join(self.path_user, raw_filename), must_exist=True)
                 if file_path and notify.Action in [2, 3, 4] and not self.is_in_whitelist(file_path):
 
-                    suffix = self.pyas_config.get("suffix", [".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui"])
+                    suffix = self.pyas_config.get("suffix", [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd"])
                     ext = os.path.splitext(file_path)[-1].lower()
                     if ext not in suffix:
                         continue

PYAS_Engine.py

@@ -1,4 +1,4 @@
-import os, yara, time, numpy, base64, requests, pefile, math
+import os, yara, time, numpy, base64, requests, pefile, math, json, re, datetime
 import ctypes, ctypes.wintypes, hashlib, onnxruntime
 
 from PIL import Image
@@ -11,14 +11,25 @@ class GUID(ctypes.Structure):
         ("Data1", ctypes.wintypes.DWORD),
         ("Data2", ctypes.wintypes.WORD),
         ("Data3", ctypes.wintypes.WORD),
-        ("Data4", ctypes.c_ubyte * 8)]
+        ("Data4", ctypes.c_ubyte * 8)
+    ]
 
 class WINTRUST_FILE_INFO(ctypes.Structure):
     _fields_ = [
         ("cbStruct", ctypes.wintypes.DWORD),
         ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
         ("hFile", ctypes.wintypes.HANDLE),
-        ("pgKnownSubject", ctypes.wintypes.LPVOID)]
+        ("pgKnownSubject", ctypes.wintypes.LPVOID)
+    ]
+
+class WINTRUST_DATA_UNION(ctypes.Union):
+    _fields_ = [
+        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("pCatalog", ctypes.wintypes.LPVOID),
+        ("pBlob", ctypes.wintypes.LPVOID),
+        ("pSgnr", ctypes.wintypes.LPVOID),
+        ("pCert", ctypes.wintypes.LPVOID)
+    ]
 
 class WINTRUST_DATA(ctypes.Structure):
     _fields_ = [
@@ -28,19 +39,20 @@ class WINTRUST_DATA(ctypes.Structure):
         ("dwUIChoice", ctypes.wintypes.DWORD),
         ("fdwRevocationChecks", ctypes.wintypes.DWORD),
         ("dwUnionChoice", ctypes.wintypes.DWORD),
-        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("u", WINTRUST_DATA_UNION),
         ("dwStateAction", ctypes.wintypes.DWORD),
         ("hWVTStateData", ctypes.wintypes.HANDLE),
         ("pwszURLReference", ctypes.wintypes.LPCWSTR),
         ("dwProvFlags", ctypes.wintypes.DWORD),
         ("dwUIContext", ctypes.wintypes.DWORD),
-        ("pSignatureSettings", ctypes.wintypes.LPVOID)]
+        ("pSignatureSettings", ctypes.wintypes.LPVOID)
+    ]
 
 ####################################################################################################
 
 class sign_scanner:
     def __init__(self):
-        self.verify = GUID(0x00AAC56B, 0xCD44, 0x11D0, (0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
+        self.verify = GUID(0x00AAC56B, 0xCD44, 0x11D0, (ctypes.c_ubyte * 8)(0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
 
     def init_windll(self, path):
         for name in path:
@@ -48,7 +60,6 @@ class sign_scanner:
                 setattr(self, name.lower(), ctypes.WinDLL(name, use_last_error=True))
             except Exception:
                 pass
-
         try:
             self.WinVerifyTrust = self.wintrust.WinVerifyTrust
             self.WinVerifyTrust.restype = ctypes.wintypes.LONG
@@ -56,15 +67,34 @@ class sign_scanner:
         except Exception:
             pass
 
+####################################################################################################
+
     def sign_verify(self, file_path):
+        if os.name != 'nt':
+            return False
         try:
-            fi = WINTRUST_FILE_INFO(ctypes.sizeof(WINTRUST_FILE_INFO), file_path, None, None)
-            data = WINTRUST_DATA(ctypes.sizeof(WINTRUST_DATA), None, None, 2, 0, 1,
-                ctypes.pointer(fi), 1, None, None, 0, 0, None)
-            s = self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
-            data.dwStateAction = 2
-            self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(data))
-            return s == 0
+            fi = WINTRUST_FILE_INFO()
+            fi.cbStruct = ctypes.sizeof(WINTRUST_FILE_INFO)
+            fi.pcwszFilePath = os.path.abspath(file_path)
+            fi.hFile = None
+            fi.pgKnownSubject = None
+            wt_union = WINTRUST_DATA_UNION()
+            wt_union.pFile = ctypes.pointer(fi)
+            td = WINTRUST_DATA()
+            td.cbStruct = ctypes.sizeof(WINTRUST_DATA)
+            td.pPolicyCallbackData = None
+            td.pSIPClientData = None
+            td.dwUIChoice = 2
+            td.fdwRevocationChecks = 0
+            td.dwUnionChoice = 1
+            td.u = wt_union
+            td.dwStateAction = 0
+            td.hWVTStateData = None
+            td.pwszURLReference = None
+            td.dwProvFlags = 0
+            td.dwUIContext = 0
+            td.pSignatureSettings = None
+            return self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(td)) == 0
         except Exception:
             return False
 
@@ -243,101 +273,214 @@ class cnn_scanner:
 ####################################################################################################
 
 class pe_scanner:
+    API_CAT_MAPPING = {
+        'ProcessControl': {
+            'CreateProcessA', 'CreateProcessW', 'WinExec', 'ShellExecuteA', 'ShellExecuteW',
+            'ShellExecuteExW', 'ExitProcess', 'TerminateProcess', 'OpenProcess', 'GetExitCodeProcess',
+            'SetThreadPriority', 'GetThreadPriority', 'GetCurrentProcess', 'GetCurrentProcessId',
+            'GetModuleFileNameA', 'GetCommandLineA', 'GetModuleFileNameW', 'GetStartupInfoW'
+        },
+        'Injection': {
+            'VirtualAlloc', 'VirtualAllocEx', 'VirtualProtect', 'VirtualProtectEx', 'WriteProcessMemory', 
+            'ReadProcessMemory', 'CreateRemoteThread', 'QueueUserAPC', 'SetThreadContext', 'GetThreadContext', 
+            'Wow64SetThreadContext', 'NtUnmapViewOfSection', 'ZwUnmapViewOfSection', 'RtlCreateUserThread', 
+            'SetWindowsHookExA', 'SetWindowsHookExW', 'UnhookWindowsHookEx', 'LoadLibraryA', 'LoadLibraryW', 
+            'LoadLibraryExA', 'LoadLibraryExW', 'GetProcAddress', 'GetModuleHandleA', 'GetModuleHandleW',
+            'FreeLibrary', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'UnmapViewOfSection',
+            'VirtualFree', 'VirtualQuery'
+        },
+        'Synchronization': {
+            'WaitForSingleObject', 'WaitForSingleObjectEx', 'WaitForMultipleObjects', 'WaitForMultipleObjectsEx',
+            'CreateMutexA', 'CreateMutexW', 'OpenMutexW', 'ReleaseMutex', 'CreateEventA', 'CreateEventW', 
+            'OpenEventW', 'SetEvent', 'ResetEvent', 'EnterCriticalSection', 'LeaveCriticalSection', 
+            'InitializeCriticalSection', 'DeleteCriticalSection', 'Sleep', 'SleepEx',
+            'InitializeCriticalSectionAndSpinCount', 'InterlockedDecrement', 'InterlockedIncrement', 
+            'InterlockedExchange', 'InterlockedCompareExchange', 'SetTimer', 'KillTimer'
+        },
+        'MultiThreading': {
+            'CreateThread', 'ResumeThread', 'SuspendThread', 'ExitThread', 'TerminateThread',
+            'GetCurrentThread', 'GetCurrentThreadId', 'TlsAlloc', 'TlsSetValue', 'TlsGetValue',
+            'CreateThreadpoolWork', 'SubmitThreadpoolWork', 'TlsFree'
+        },
+        'Network': {
+            'socket', 'connect', 'send', 'recv', 'bind', 'listen', 'accept', 'gethostbyname', 'getaddrinfo',
+            'WSAStartup', 'WSACleanup', 'WSAIoctl', 'WSASocketA', 'WSASocketW', 'closesocket', 'htons',
+            'InternetOpenA', 'InternetOpenW', 'InternetConnectA', 'InternetConnectW', 'InternetOpenUrlA', 
+            'InternetOpenUrlW', 'HttpOpenRequestA', 'HttpOpenRequestW', 'HttpSendRequestA', 'HttpSendRequestW',
+            'InternetReadFile', 'URLDownloadToFileA', 'URLDownloadToFileW', 'DnsQuery_A', 'DnsQuery_W'
+        },
+        'Encryption': {
+            'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptCreateHash', 'CryptHashData', 
+            'CryptDeriveKey', 'CryptEncrypt', 'CryptDecrypt', 'CryptDestroyKey', 'CryptDestroyHash',
+            'CryptReleaseContext', 'CryptGenKey', 'CryptImportKey', 'CryptExportKey'
+        },
+        'DataObfuscation': {
+            'RtlDecompressBuffer', 'MultiByteToWideChar', 'WideCharToMultiByte', 'Base64Decode', 
+            'CryptDecodeObject', 'IsDBCSLeadByte', 'CharUpperA', 'CharLowerA',
+            'GetStringTypeW', 'LCMapStringW', 'IsValidCodePage', 'DecodePointer', 'EncodePointer'
+        },
+        'FileIO': {
+            'CreateFileA', 'CreateFileW', 'WriteFile', 'ReadFile', 'DeleteFileA', 'DeleteFileW',
+            'CopyFileA', 'CopyFileW', 'MoveFileA', 'MoveFileW', 'FindFirstFileA', 'FindNextFileA',
+            'GetTempPathA', 'GetTempPathW', 'GetTempFileNameA', 'GetTempFileNameW', 'SetFileAttributesA', 
+            'SetFileAttributesW', 'DeviceIoControl', 'SetFileTime', 'GetFileSize', 'GetFileSizeEx',
+            'SetFilePointer', 'FlushFileBuffers', 'ConnectNamedPipe', 'PeekNamedPipe',
+            'CloseHandle', 'GetFileType', 'SetStdHandle', 'SetFilePointerEx', 'FindClose', 
+            'SetHandleCount', 'SetEndOfFile', 'GetFullPathNameA', 'GetFileAttributesA'
+        },
+        'Registry': {
+            'RegOpenKeyExA', 'RegOpenKeyExW', 'RegSetValueExA', 'RegSetValueExW', 
+            'RegCreateKeyExA', 'RegCreateKeyExW', 'RegDeleteKeyA', 'RegDeleteKeyW',
+            'RegEnumValueA', 'RegEnumValueW', 'RegQueryValueExA', 'RegQueryValueExW',
+            'RegDeleteValueA', 'RegDeleteValueW', 'RegCloseKey'
+        },
+        'Services': {
+            'OpenSCManagerA', 'OpenSCManagerW', 'CreateServiceA', 'CreateServiceW',
+            'StartServiceA', 'StartServiceW', 'ControlService', 'DeleteService'
+        },
+        'Privileges': {
+            'AdjustTokenPrivileges', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 
+            'OpenProcessToken', 'NetUserAdd', 'NetLocalGroupAddMembers', 'IsAdmin', 
+            'GetUserNameA', 'GetUserNameW'
+        },
+        'Native': {
+            'RtlUnwind', 'RtlVirtualUnwind', 'RtlCaptureContext', 'RtlLookupFunctionEntry',
+            'NtClose', 'NtQueryInformationProcess', 'RtlAllocateHeap', 'RtlFreeHeap',
+            'GetSystemTimeAsFileTime', 'GetLocalTime', 'GlobalMemoryStatus', 
+            'GetVersionExA', 'GetVersionExW', 'GetComputerNameA', 'GetComputerNameW',
+            'GetLastError', 'GetACP', 'RaiseException', 'SetLastError', 'GetEnvironmentStringsW', 
+            'FreeEnvironmentStringsW', 'GetLocaleInfoA', 'lstrlenA', 'GetVersion', 'GetSystemInfo', 
+            'CompareStringA'
+        },
+        'DotNet': {
+            '_CorExeMain', '_CorDllMain'
+        },
+        'AntiDebug': {
+            'IsDebuggerPresent', 'CheckRemoteDebuggerPresent', 'OutputDebugStringA', 'OutputDebugStringW',
+            'GetTickCount', 'GetTickCount64', 'QueryPerformanceCounter', 'FindWindowA', 'FindWindowW',
+            'EnumWindows', 'EnumChildWindows', 'GetWindowRect', 'GetClientRect', 'SetWindowDisplayAffinity',
+            'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsProcessorFeaturePresent', 
+            'SetErrorMode', 'GetTimeZoneInformation', 'GetDriveTypeW', 'GetDiskFreeSpaceA'
+        },
+        'Keylogging': {
+            'GetAsyncKeyState', 'GetKeyState', 'GetKeyboardState', 'MapVirtualKeyA', 'MapVirtualKeyW',
+            'ToAscii', 'ToAsciiEx', 'ToUnicode', 'ToUnicodeEx', 'GetKeyNameTextA', 'GetForegroundWindow',
+            'KeybdEvent', 'SendInput', 'MapVirtualKeyExA', 'MapVirtualKeyExW', 'CallNextHookEx'
+        },
+        'Input': {
+            'GetCursorPos', 'SetCursorPos', 'MouseEvent', 'GetDoubleClickTime', 
+            'GetCapture', 'SetCapture'
+        },
+        'ScreenCapture': {
+            'BitBlt', 'StretchBlt', 'GetDC', 'GetWindowDC', 'CreateCompatibleDC', 'CreateCompatibleBitmap',
+            'GdipSaveImageToFile', 'PrintWindow', 'GetDesktopWindow', 'CreateDCW', 'CreateDCA',
+            'SelectObject', 'DeleteDC', 'DeleteObject', 'GetDeviceCaps', 'GetSystemMetrics'
+        },
+        'Graphics': {
+            'Direct3DCreate9', 'D3D11CreateDevice'
+        },
+        'Audio': {
+            'WaveInOpen', 'WaveInClose', 'WaveInStart', 'WaveInStop'
+        },
+        'Clipboard': {
+            'OpenClipboard', 'CloseClipboard', 'GetClipboardData', 'SetClipboardData'
+        },
+        'Camera': {
+            'CapCreateCaptureWindowA', 'CapCreateCaptureWindowW'
+        },
+        'Memory': {
+            'HeapAlloc', 'HeapFree', 'HeapSize', 'HeapCreate', 'GetProcessHeap',
+            'LocalAlloc', 'LocalFree', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock',
+            'HeapDestroy', 'GlobalLock', 'SysFreeString', 'SysAllocStringLen'
+        },
+        'Resource': {
+            'LoadResource', 'SizeofResource', 'LockResource', 'FreeResource', 'FindResourceA'
+        },
+        'WindowControl': {
+            'ShowWindow', 'DestroyWindow', 'TranslateMessage', 'DispatchMessageA', 'GetWindow',
+            'PeekMessageA', 'GetWindowLongA', 'CallWindowProcA', 'SetWindowLongA', 'GetWindowTextA',
+            'ScreenToClient', 'GetActiveWindow', 'CreateWindowExA', 'DefWindowProcA', 'GetMessageA',
+            'RegisterClassA', 'UnregisterClassA', 'MessageBoxA'
+        },
+        'COM': {
+            'CoCreateInstance', 'CoUninitialize', 'CoInitialize'
+        }
+    }
+
+    TARGET_DLLS = {
+        'kernel32.dll', 'user32.dll', 'gdi32.dll', 'advapi32.dll', 'shell32.dll', 'ntdll.dll', 'hal.dll',
+        'ws2_32.dll', 'wsock32.dll', 'wininet.dll', 'winhttp.dll', 'urlmon.dll', 'crypt32.dll', 'bcrypt.dll',
+        'psapi.dll', 'dbghelp.dll', 'imagehlp.dll', 'shlwapi.dll', 'ole32.dll', 'oleaut32.dll', 'comctl32.dll',
+        'mscoree.dll', 'vbscript.dll', 'netapi32.dll', 'iphlpapi.dll', 'wtsapi32.dll', 'version.dll', 'winmm.dll'
+    }
+
+    BASE_SCHEMA = [
+        "FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit",
+        "Machine", "Magic", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
+        "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
+        "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
+        "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
+        "BaseOfCode", "SectionAlignment", "FileAlignment",
+        "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
+        "MajorImageVersion", "MinorImageVersion",
+        "MajorSubsystemVersion", "MinorSubsystemVersion",
+        "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
+        "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
+        "SizeOfOptionalHeader",
+        "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", 
+        "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", 
+        "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", 
+        "SectionCount", "ExecutableSections", 
+        "WritableSections", "ReadableSections", "SectionException",
+        "Char_00000020_Count", "Char_00000020_MeanEntropy",
+        "Char_00000040_Count", "Char_00000040_MeanEntropy",
+        "Char_00000080_Count", "Char_00000080_MeanEntropy",
+        "Char_02000000_Count", "Char_02000000_MeanEntropy",
+        "Char_20000000_Count", "Char_20000000_MeanEntropy",
+        "Char_40000000_Count", "Char_40000000_MeanEntropy",
+        "Char_80000000_Count", "Char_80000000_MeanEntropy",
+        "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
+        "ImportCount", "ImportFunctionCount",
+        "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
+        "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
+        "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
+        "SpecialBuildLength", "PrivateBuildLength",
+        "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
+        "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
+        "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException"
+    ]
+
+    CAT_SCHEMA = [f"Cat_{k}" for k in sorted(API_CAT_MAPPING.keys())]
+    DLL_SCHEMA = [f"Dll_{d.replace('.', '_')}" for d in sorted(TARGET_DLLS)]
+    
+    _ALL_APIS = {api for apis in API_CAT_MAPPING.values() for api in apis}
+    API_SCHEMA = [f"Api_{api}" for api in sorted(_ALL_APIS)]
+    SCHEMA = BASE_SCHEMA + CAT_SCHEMA + DLL_SCHEMA + API_SCHEMA
+
+    _API_TO_CATS = {}
+    for _cat, _apis in API_CAT_MAPPING.items():
+        for _api in _apis:
+            if _api not in _API_TO_CATS:
+                _API_TO_CATS[_api] = []
+            _API_TO_CATS[_api].append(_cat)
+
+    PACKERS = {
+        'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
+        'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
+        'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
+        'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
+        'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
+    }
+    INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
+
+####################################################################################################
+
     def __init__(self):
         self.model = None
         self.input_name = None
+        self.feature_order = []
         self.signer = sign_scanner()
         self.signer.init_windll(["wintrust"])
-        self.SCHEMA = [
-            "FileEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic",
-            "TimeDateStamp", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
-            "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
-            "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
-            "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
-            "BaseOfCode", "SectionAlignment", "FileAlignment",
-            "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
-            "MajorImageVersion", "MinorImageVersion",
-            "MajorSubsystemVersion", "MinorSubsystemVersion",
-            "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
-            "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
-            "SizeOfOptionalHeader",
-            "TextSection", "TextSizeRatio", "DataSection", "DataSizeRatio", 
-            "RsrcSection", "RsrcSizeRatio", "SectionCount", "ExecutableSections", 
-            "WritableSections", "ReadableSections", "SectionException",
-            "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
-            "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
-            "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
-            "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
-            "SpecialBuildLength", "PrivateBuildLength",
-            "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
-            "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
-            "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException",
-            "_CorExeMain", "_CorDllMain",
-            "GetDC", "CreateDCW", "CreateDCA", "BitBlt", "StretchBlt", "CreateCompatibleDC",
-            "CreateCompatibleBitmap", "SelectObject", "DeleteDC", "DeleteObject", "GetDeviceCaps",
-            "GetSystemMetrics",
-            "SetWindowsHookExA", "SetWindowsHookExW", "UnhookWindowsHookEx", 
-            "GetAsyncKeyState", "GetKeyState", "GetKeyboardState", 
-            "MapVirtualKeyA", "MapVirtualKeyW", "MapVirtualKeyExA", "MapVirtualKeyExW", 
-            "ToAscii", "ToAsciiEx", "ToUnicode", "ToUnicodeEx", "KeybdEvent", "SendInput",
-            "GetCursorPos", "SetCursorPos", "MouseEvent", "GetDoubleClickTime", 
-            "GetCapture", "SetCapture",
-            "WaveInOpen", "WaveInClose", "WaveInStart", "WaveInStop", 
-            "CapCreateCaptureWindowA", "CapCreateCaptureWindowW", 
-            "OpenClipboard", "CloseClipboard", "GetClipboardData", "SetClipboardData",
-            "GetDesktopWindow", "GetForegroundWindow", "GetWindowDC", "GetWindowRect",
-            "GetClientRect", "PrintWindow", "SetWindowDisplayAffinity", "FindWindowA", "FindWindowW",
-            "EnumWindows", "EnumChildWindows",
-            "Direct3DCreate9", "D3D11CreateDevice", "GdipSaveImageToFile",
-            "CreateProcessA", "CreateProcessW", "CreateThread", "ResumeThread", "SuspendThread",
-            "OpenProcess", "TerminateProcess", "GetCurrentProcess", "GetCurrentProcessId",
-            "ExitProcess", "WinExec", "ShellExecuteA", "ShellExecuteW",
-            "CreateRemoteThread", "QueueUserAPC", "VirtualAlloc", "VirtualAllocEx",
-            "VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "ReadProcessMemory",
-            "NtUnmapViewOfSection", "SetThreadContext", "GetThreadContext", "Wow64SetThreadContext",
-            "ZwUnmapViewOfSection", "CreateFileMappingA", "CreateFileMappingW", "MapViewOfFile",
-            "UnmapViewOfSection",
-            "LoadLibraryA", "LoadLibraryW", "LoadLibraryExA", "LoadLibraryExW", 
-            "GetProcAddress", "GetModuleHandleA", "GetModuleHandleW", "FreeLibrary",
-            "CreateFileA", "CreateFileW", "WriteFile", "ReadFile", "DeleteFileA", "DeleteFileW",
-            "CopyFileA", "CopyFileW", "MoveFileA", "MoveFileW", "FindFirstFileA", "FindNextFileA",
-            "GetTempPathA", "GetTempPathW", "GetTempFileNameA", "GetTempFileNameW", 
-            "SetFileAttributesA", "SetFileAttributesW", "DeviceIoControl", "SetFileTime",
-            "RegOpenKeyExA", "RegOpenKeyExW", "RegSetValueExA", "RegSetValueExW", 
-            "RegCreateKeyExA", "RegCreateKeyExW", "RegDeleteKeyA", "RegDeleteKeyW",
-            "RegEnumValueA", "RegEnumValueW", "RegQueryValueExA", "RegQueryValueExW",
-            "RegDeleteValueA", "RegDeleteValueW",
-            "OpenSCManagerA", "OpenSCManagerW", "CreateServiceA", "CreateServiceW",
-            "StartServiceA", "StartServiceW", "ControlService", "DeleteService",
-            "AdjustTokenPrivileges", "LookupPrivilegeValueA", "LookupPrivilegeValueW", 
-            "OpenProcessToken", "NetUserAdd", "NetLocalGroupAddMembers",
-            "Socket", "Connect", "Send", "Recv", "WSAStartup", "gethostbyname", "getaddrinfo",
-            "WSAIoctl", "WSASocketA", "WSASocketW",
-            "URLDownloadToFileA", "URLDownloadToFileW", 
-            "InternetOpenA", "InternetOpenW", "InternetConnectA", "InternetConnectW",
-            "InternetOpenUrlA", "InternetOpenUrlW",
-            "HttpOpenRequestA", "HttpOpenRequestW", "HttpSendRequestA", "HttpSendRequestW",
-            "InternetReadFile", "DnsQuery_A", "DnsQuery_W",
-            "IsDebuggerPresent", "CheckRemoteDebuggerPresent", "OutputDebugStringA", "OutputDebugStringW",
-            "GetTickCount", "QueryPerformanceCounter", "Sleep", "GetSystemTimeAsFileTime",
-            "GetLocalTime", "GlobalMemoryStatus", "GetVersionExA", "GetVersionExW",
-            "GetComputerNameA", "GetComputerNameW", "GetUserNameA", "GetUserNameW",
-            "CryptAcquireContextA", "CryptAcquireContextW", "CryptCreateHash", "CryptHashData", 
-            "CryptDeriveKey", "CryptEncrypt", "CryptDecrypt", "CryptDestroyKey", "CryptDestroyHash",
-            "CryptReleaseContext", "CryptGenKey", "CryptImportKey", "CryptExportKey",
-            "RtlDecompressBuffer", "ConnectNamedPipe", "PeekNamedPipe"
-        ]
-        self.PACKERS = {
-            'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
-            'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
-            'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
-            'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
-            'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
-        }
-        self.INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
-        self.SCHEMA_SET = set(self.SCHEMA)
-
-####################################################################################################
 
     def load_path(self, path, callback=None):
         for root, _, files in os.walk(path):
@@ -345,14 +488,26 @@ class pe_scanner:
                 full_path = os.path.join(root, file)
                 if callback:
                     callback(full_path)
-                self.load_model(full_path)
+                if full_path.endswith('.onnx'):
+                    self.load_model(full_path)
 
     def load_model(self, model_path):
-        if not os.path.exists(model_path) or not model_path.endswith('.onnx'):
+        if not os.path.exists(model_path):
             return
         try:
             self.model = onnxruntime.InferenceSession(model_path, providers=['CPUExecutionProvider'])
             self.input_name = self.model.get_inputs()[0].name
+            feat_path = os.path.join(os.path.dirname(model_path), "features.json")
+
+            model_features = []
+            if os.path.exists(feat_path):
+                with open(feat_path, 'r') as f:
+                    model_features = json.load(f)
+            else:
+                model_features = [re.sub(r'[^A-Za-z0-9_]+', '', f) for f in self.SCHEMA]
+
+            local_map = {re.sub(r'[^A-Za-z0-9_]+', '', raw_name): raw_name for raw_name in self.SCHEMA}
+            self.feature_order = [local_map.get(req_feat) for req_feat in model_features]
         except Exception:
             pass
 
@@ -363,9 +518,12 @@ class pe_scanner:
             f = float(val)
             if math.isinf(f) or math.isnan(f): return 0.0
             return f
-        except:
+        except Exception:
             return 0.0
 
+    def _safe_div(self, n, d):
+        return float(n) / d if d > 0 else 0.0
+
     def _calc_entropy(self, data):
         if not data: return 0.0
         arr = numpy.frombuffer(data, dtype=numpy.uint8)
@@ -376,15 +534,16 @@ class pe_scanner:
 ####################################################################################################
 
     def extract_features(self, file_path):
-        fts = {k: 0 for k in self.SCHEMA}
+        fts = {k: 0.0 for k in self.SCHEMA}
         pe = None
         try:
             fsize = os.path.getsize(file_path)
-            if fsize == 0: return None
-
-            pe = pefile.PE(file_path, fast_load=True)
+            if fsize == 0 or fsize > 268435456:
+                return None
+            with open(file_path, "rb") as f:
+                file_bytes = f.read()
+            pe = pefile.PE(data=file_bytes, fast_load=True)
             fts['TrustSigned'] = 1 if self.signer.sign_verify(file_path) else 0
-
             fh = pe.FILE_HEADER
             fts['Machine'] = fh.Machine
             fts['NumberOfSections'] = fh.NumberOfSections
@@ -393,159 +552,247 @@ class pe_scanner:
             fts['NumberOfSymbols'] = fh.NumberOfSymbols
             fts['SizeOfOptionalHeader'] = fh.SizeOfOptionalHeader
             fts['Characteristics'] = fh.Characteristics
-
-            curr_ts = time.time()
+            curr_ts = datetime.datetime.now(datetime.timezone.utc).timestamp()
             fts['HasInvalidTimestamp'] = 1 if (fh.TimeDateStamp < 631152000 or fh.TimeDateStamp > curr_ts + 2592000) else 0
+            fts['FileTimeException'] = 1 if fh.TimeDateStamp == 0 else 0
 
             if hasattr(pe, 'OPTIONAL_HEADER'):
                 op = pe.OPTIONAL_HEADER
-                fts['Magic'] = op.Magic
-                fts['MajorLinkerVersion'] = op.MajorLinkerVersion
-                fts['MinorLinkerVersion'] = op.MinorLinkerVersion
-                fts['SizeOfCode'] = op.SizeOfCode
-                fts['SizeOfInitializedData'] = op.SizeOfInitializedData
-                fts['SizeOfUninitializedData'] = op.SizeOfUninitializedData
-                fts['AddressOfEntryPoint'] = op.AddressOfEntryPoint
-                fts['BaseOfCode'] = op.BaseOfCode
-                fts['ImageBase'] = op.ImageBase
-                fts['SectionAlignment'] = op.SectionAlignment
-                fts['FileAlignment'] = op.FileAlignment
-                fts['MajorOperatingSystemVersion'] = op.MajorOperatingSystemVersion
-                fts['MinorOperatingSystemVersion'] = op.MinorOperatingSystemVersion
-                fts['MajorImageVersion'] = op.MajorImageVersion
-                fts['MinorImageVersion'] = op.MinorImageVersion
-                fts['MajorSubsystemVersion'] = op.MajorSubsystemVersion
-                fts['MinorSubsystemVersion'] = op.MinorSubsystemVersion
-                fts['SizeOfImage'] = op.SizeOfImage
-                fts['SizeOfHeaders'] = op.SizeOfHeaders
-                fts['CheckSum'] = op.CheckSum
-                fts['Subsystem'] = op.Subsystem
-                fts['DllCharacteristics'] = op.DllCharacteristics
-                fts['SizeOfStackReserve'] = op.SizeOfStackReserve
-                fts['SizeOfStackCommit'] = op.SizeOfStackCommit
-                fts['SizeOfHeapReserve'] = op.SizeOfHeapReserve
-                fts['SizeOfHeapCommit'] = op.SizeOfHeapCommit
-                fts['LoaderFlags'] = op.LoaderFlags
-                fts['NumberOfRvaAndSizes'] = op.NumberOfRvaAndSizes
-
-                fts['Is64Bit'] = 1 if fh.Machine == 0x8664 else 0
+                fts['Magic'] = getattr(op, 'Magic', 0)
+                fts['MajorLinkerVersion'] = getattr(op, 'MajorLinkerVersion', 0)
+                fts['MinorLinkerVersion'] = getattr(op, 'MinorLinkerVersion', 0)
+                fts['SizeOfCode'] = getattr(op, 'SizeOfCode', 0)
+                fts['SizeOfInitializedData'] = getattr(op, 'SizeOfInitializedData', 0)
+                fts['SizeOfUninitializedData'] = getattr(op, 'SizeOfUninitializedData', 0)
+                fts['AddressOfEntryPoint'] = getattr(op, 'AddressOfEntryPoint', 0)
+                fts['BaseOfCode'] = getattr(op, 'BaseOfCode', 0)
+                fts['ImageBase'] = getattr(op, 'ImageBase', 0)
+                fts['SectionAlignment'] = getattr(op, 'SectionAlignment', 0)
+                fts['FileAlignment'] = getattr(op, 'FileAlignment', 0)
+                fts['MajorOperatingSystemVersion'] = getattr(op, 'MajorOperatingSystemVersion', 0)
+                fts['MinorOperatingSystemVersion'] = getattr(op, 'MinorOperatingSystemVersion', 0)
+                fts['MajorImageVersion'] = getattr(op, 'MajorImageVersion', 0)
+                fts['MinorImageVersion'] = getattr(op, 'MinorImageVersion', 0)
+                fts['MajorSubsystemVersion'] = getattr(op, 'MajorSubsystemVersion', 0)
+                fts['MinorSubsystemVersion'] = getattr(op, 'MinorSubsystemVersion', 0)
+                fts['SizeOfImage'] = getattr(op, 'SizeOfImage', 0)
+                fts['SizeOfHeaders'] = getattr(op, 'SizeOfHeaders', 0)
+                fts['CheckSum'] = getattr(op, 'CheckSum', 0)
+                fts['Subsystem'] = getattr(op, 'Subsystem', 0)
+                fts['DllCharacteristics'] = getattr(op, 'DllCharacteristics', 0)
+                fts['SizeOfStackReserve'] = getattr(op, 'SizeOfStackReserve', 0)
+                fts['SizeOfStackCommit'] = getattr(op, 'SizeOfStackCommit', 0)
+                fts['SizeOfHeapReserve'] = getattr(op, 'SizeOfHeapReserve', 0)
+                fts['SizeOfHeapCommit'] = getattr(op, 'SizeOfHeapCommit', 0)
+                fts['LoaderFlags'] = getattr(op, 'LoaderFlags', 0)
+                fts['NumberOfRvaAndSizes'] = getattr(op, 'NumberOfRvaAndSizes', 0)
+                fts['Is64Bit'] = 1 if fh.Machine in (0x8664, 0xAA64, 0x0200) else 0
                 fts['IsExe'] = 1 if pe.is_exe() else 0
                 fts['IsDll'] = 1 if pe.is_dll() else 0
-                fts['IsDriver'] = 1 if pe.is_driver() else 0
+                fts['IsDriver'] = 1 if fts['Subsystem'] == 1 else 0
+                if hasattr(op, 'DATA_DIRECTORY'):
+                    reloc_idx = pefile.DIRECTORY_ENTRY.get('IMAGE_DIRECTORY_ENTRY_BASERELOC', 5)
+                    if len(op.DATA_DIRECTORY) > reloc_idx and op.DATA_DIRECTORY[reloc_idx].Size > 0:
+                        fts['HasRelocationDirectory'] = 1
 
-                if len(op.DATA_DIRECTORY) > 9 and op.DATA_DIRECTORY[9].VirtualAddress > 0:
+            try:
+                fts['FileEntropy'] = self._calc_entropy(file_bytes)
+            except Exception:
+                pass
+
+            sec_entropies = []
+            text_entropies = []
+            data_entropies = []
+            rsrc_entropies = []
+            char_flags = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
+
+            if hasattr(pe, 'sections'):
+                fts['SectionCount'] = len(pe.sections)
+                for section in pe.sections:
+                    try: 
+                        name = section.Name.decode('ascii', 'ignore').strip('\x00')
+                    except Exception: 
+                        name = ""
+                    try: 
+                        s_data = section.get_data()
+                        s_entropy = self._calc_entropy(s_data)
+                    except Exception: 
+                        s_data = b""
+                        s_entropy = 0.0
+
+                    sec_entropies.append(s_entropy)
+                    if any(p in name.lower() for p in self.PACKERS): fts['HasPacked'] = 1
+                    if section.Characteristics & 0x20000000: fts['ExecutableSections'] += 1
+                    if section.Characteristics & 0x80000000: fts['WritableSections'] += 1
+                    if section.Characteristics & 0x40000000: fts['ReadableSections'] += 1
+                    if section.SizeOfRawData + section.PointerToRawData > fsize: fts['SectionException'] = 1
+
+                    for flag in char_flags:
+                        if section.Characteristics & flag:
+                            fts[f'Char_{flag:08X}_Count'] += 1
+                            fts[f'Char_{flag:08X}_MeanEntropy'] += s_entropy
+
+                    ratio = self._safe_div(section.SizeOfRawData, fsize)
+                    if name.startswith('.text'):
+                        text_entropies.append(s_entropy)
+                        fts['TextSizeRatio'] += ratio
+                    elif name.startswith('.data'):
+                        data_entropies.append(s_entropy)
+                        fts['DataSizeRatio'] += ratio
+                    elif name.startswith('.rsrc'):
+                        rsrc_entropies.append(s_entropy)
+                        fts['RsrcSizeRatio'] += ratio
+                        if b"requireAdministrator" in s_data: fts['IsAdmin'] = 1
+                        for sig in self.INSTALLER_SIGS:
+                            if sig in s_data:
+                                fts['IsInstall'] = 1
+                                break
+
+            fts['SectionMeanEntropy'] = self._safe_div(sum(sec_entropies), len(sec_entropies))
+            fts['TextSectionMaxEntropy'] = max(text_entropies) if text_entropies else 0.0
+            fts['TextSectionMeanEntropy'] = self._safe_div(sum(text_entropies), len(text_entropies))
+            fts['DataSectionMaxEntropy'] = max(data_entropies) if data_entropies else 0.0
+            fts['DataSectionMeanEntropy'] = self._safe_div(sum(data_entropies), len(data_entropies))
+            fts['RsrcSectionMaxEntropy'] = max(rsrc_entropies) if rsrc_entropies else 0.0
+            fts['RsrcSectionMeanEntropy'] = self._safe_div(sum(rsrc_entropies), len(rsrc_entropies))
+
+            for flag in char_flags:
+                fts[f'Char_{flag:08X}_MeanEntropy'] = self._safe_div(fts[f'Char_{flag:08X}_MeanEntropy'], fts[f'Char_{flag:08X}_Count'])
+
+            try:
+                pe.parse_data_directories(directories=[
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_TLS']
+                ])
+            except Exception:
+                pass
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_TLS') and hasattr(pe.DIRECTORY_ENTRY_TLS, 'struct'):
+                if getattr(pe.DIRECTORY_ENTRY_TLS.struct, 'AddressOfCallBacks', 0) != 0:
                     fts['HasTlsCallbacks'] = 1
-                if len(op.DATA_DIRECTORY) > 5 and op.DATA_DIRECTORY[5].Size > 0:
-                    fts['HasRelocationDirectory'] = 1
 
-            pe.parse_sections(pe.FILE_HEADER.NumberOfSections)
-            file_data = pe.get_memory_mapped_image()
-            fts['FileEntropy'] = self._calc_entropy(file_data)
-            fts['SectionCount'] = len(pe.sections)
+            if hasattr(pe, 'VS_FIXEDFILEINFO') and len(pe.VS_FIXEDFILEINFO) > 0:
+                flags = getattr(pe.VS_FIXEDFILEINFO[0], 'FileFlags', 0)
+                fts['IsDebug'] = 1 if flags & 0x1 else 0
+                fts['IsPreRelease'] = 1 if flags & 0x2 else 0
+                fts['IsPatched'] = 1 if flags & 0x4 else 0
+                fts['IsPrivateBuild'] = 1 if flags & 0x8 else 0
+                fts['IsSpecialBuild'] = 1 if flags & 0x20 else 0
 
-            for section in pe.sections:
-                try:
-                    name = section.Name.decode('ascii', 'ignore').strip('\x00')
-                except:
-                    name = ""
-                s_data = section.get_data()
-                s_entropy = self._calc_entropy(s_data)
-
-                if any(p in name.lower() for p in self.PACKERS):
-                    fts['HasPacked'] = 1
-                if section.Characteristics & 0x20000000:
-                    fts['ExecutableSections'] += 1
-                if section.Characteristics & 0x80000000:
-                    fts['WritableSections'] += 1
-                if section.Characteristics & 0x40000000:
-                    fts['ReadableSections'] += 1
-                if section.SizeOfRawData + section.PointerToRawData > fsize:
-                    fts['SectionException'] = 1
-
-                ratio = section.SizeOfRawData / fsize if fsize > 0 else 0
-                if name.startswith('.text'):
-                    fts['TextSection'] = s_entropy
-                    fts['TextSizeRatio'] = ratio
-                elif name.startswith('.data'):
-                    fts['DataSection'] = s_entropy
-                    fts['DataSizeRatio'] = ratio
-                elif name.startswith('.rsrc'):
-                    fts['RsrcSection'] = s_entropy
-                    fts['RsrcSizeRatio'] = ratio
-                    if b"requireAdministrator" in s_data:
-                        fts['IsAdmin'] = 1
-                    for sig in self.INSTALLER_SIGS:
-                        if sig in s_data:
-                            fts['IsInstall'] = 1
-                            break
-
-            pe.parse_data_directories(directories=[
-                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
-                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
-                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
-                pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG']
-            ])
+            if hasattr(pe, 'FileInfo'):
+                for fileinfo_list in pe.FileInfo:
+                    for fileinfo in fileinfo_list:
+                        if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
+                            for st in getattr(fileinfo, 'StringTable', []):
+                                for key, val in st.entries.items():
+                                    try:
+                                        k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
+                                        v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
+                                        length = len(v)
+                                        if k == 'FileDescription': fts['FileDescriptionLength'] = length
+                                        elif k == 'FileVersion': fts['FileVersionLength'] = length
+                                        elif k == 'ProductName': fts['ProductNameLength'] = length
+                                        elif k == 'ProductVersion': fts['ProductVersionLength'] = length
+                                        elif k == 'CompanyName': fts['CompanyNameLength'] = length
+                                        elif k == 'LegalCopyright': fts['LegalCopyrightLength'] = length
+                                        elif k == 'Comments': fts['CommentsLength'] = length
+                                        elif k == 'InternalName': fts['InternalNameLength'] = length
+                                        elif k == 'LegalTrademarks': fts['LegalTrademarksLength'] = length
+                                        elif k == 'SpecialBuild': fts['SpecialBuildLength'] = length
+                                        elif k == 'PrivateBuild': fts['PrivateBuildLength'] = length
+                                    except Exception:
+                                        continue
 
             if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
+                fts['ImportCount'] = len(pe.DIRECTORY_ENTRY_IMPORT)
                 for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                    for imp in entry.imports:
-                        fts['ApiCount'] += 1
-                        if not imp or not hasattr(imp, 'name') or not imp.name:
-                            continue
+                    if getattr(entry, 'dll', None):
                         try:
-                            name = imp.name.decode('ascii', 'ignore')
-                            if name in self.SCHEMA_SET:
-                                fts[name] = 1
-                        except:
+                            dll_name = entry.dll.decode('ascii', 'ignore').lower()
+                            if dll_name in self.TARGET_DLLS: 
+                                fts[f"Dll_{dll_name.replace('.', '_')}"] = 1.0
+                        except Exception: 
                             pass
 
-            if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
+                    imports = getattr(entry, 'imports', [])
+                    for imp in imports:
+                        fts['ImportFunctionCount'] += 1
+                        if not getattr(imp, 'name', None): continue
+                        try:
+                            func_name = imp.name.decode('ascii', 'ignore')
+                            if func_name in self._ALL_APIS:
+                                fts[f'Api_{func_name}'] += 1
+                                fts['ApiCount'] += 1
+                            for cat in self._API_TO_CATS.get(func_name, []):
+                                fts[f'Cat_{cat}'] += 1
+                        except Exception: 
+                            continue
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols'):
                 fts['ExportCount'] = len(pe.DIRECTORY_ENTRY_EXPORT.symbols)
             
             if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
                 for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
-                    if entry.id == 3 and hasattr(entry, 'directory'):
-                        fts['IconCount'] = len(entry.directory.entries)
-                        break
-            
-            if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'):
+                    if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
+                        fts['IconCount'] += len(getattr(entry.directory, 'entries', []))
+                        
+            if hasattr(pe, 'OPTIONAL_HEADER') and hasattr(pe.OPTIONAL_HEADER, 'DATA_DIRECTORY') and len(pe.OPTIONAL_HEADER.DATA_DIRECTORY) > 3:
+                exc_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[3]
+                if exc_dir.Size > 0:
+                    fts['ExceptionCount'] = exc_dir.Size // 12 if fts['Machine'] in (0x8664, 0xAA64) else 0
+                
+            if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'): 
                 fts['DebugCount'] = len(pe.DIRECTORY_ENTRY_DEBUG)
 
-            return {k: self._safe_float(v) for k, v in fts.items()}
+            for k in fts: 
+                fts[k] = self._safe_float(fts[k])
+                
+            return fts
 
         except Exception:
             return None
         finally:
-            if pe: pe.close()
+            if pe: 
+                pe.close()
 
 ####################################################################################################
 
     def pe_scan(self, file_path):
         if not self.model:
             return False, False
-        
         try:
             data = self.extract_features(file_path)
             if not data:
                 return False, False
 
-            vec = numpy.array(
-                [data.get(feat, 0.0) for feat in self.SCHEMA], 
-                dtype=numpy.float32
-            ).reshape(1, -1)
-            
+            vec_data = []
+            for key in self.feature_order:
+                if key:
+                    vec_data.append(data.get(key, 0.0))
+                else:
+                    vec_data.append(0.0)
+
+            vec = numpy.array(vec_data, dtype=numpy.float32).reshape(1, -1)
             outputs = self.model.run(None, {self.input_name: vec})
             result = outputs[1]
             prob = 0.0
-            if isinstance(result, list):
-                prob = float(result[0].get(1, 0.0))
+
+            if isinstance(result, list) and len(result) > 0:
+                prob_dict = result[0]
+                if hasattr(prob_dict, 'get'):
+                    prob = float(prob_dict.get(1, prob_dict.get('1', 0.0)))
+
+            elif isinstance(result, numpy.ndarray):
+                if result.ndim == 2 and result.shape[1] > 1:
+                    prob = float(result[0][1])
 
             score = int(prob * 100)
             if prob > 0.5:
                 return f"General:WinPE/Unknown.{score}!ml", score
-            
             return False, False
-
         except Exception:
             return False, False
 
@@ -627,6 +874,7 @@ class cloud_scanner:
                 data = r.json().get('data', {})
                 res = data.get('detection', {}).get('results', {}).get('PYAS', {})
                 label = res.get('label', 'Unsupport')
+                score = res.get('score', 100)
                 sims = data.get('similar', [])
 
                 is_malicious = 'General' in label
@@ -635,7 +883,7 @@ class cloud_scanner:
                 for s in sims:
                     if s.get('similarity', 0) > 80:
                         valid_sim_count += 1
-                        if "General" in s.get('label'):
+                        if "General" in s.get('label', ''):
                             sim_malicious_count += 1
 
                 if is_malicious and (valid_sim_count == 0 or sim_malicious_count == valid_sim_count):

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.4.0',
+version='3.4.1',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -45,7 +45,21 @@ constexpr auto PYAS_POOL_TAG = 'SAYP';
 #ifndef PROCESS_SET_QUOTA
 #define PROCESS_SET_QUOTA (0x0100)
 #endif
-
+#ifndef THREAD_TERMINATE
+#define THREAD_TERMINATE               (0x0001)
+#endif
+#ifndef THREAD_SUSPEND_RESUME
+#define THREAD_SUSPEND_RESUME          (0x0002)
+#endif
+#ifndef THREAD_SET_CONTEXT
+#define THREAD_SET_CONTEXT             (0x0010)
+#endif
+#ifndef THREAD_SET_INFORMATION
+#define THREAD_SET_INFORMATION         (0x0020)
+#endif
+#ifndef THREAD_SET_THREAD_TOKEN
+#define THREAD_SET_THREAD_TOKEN        (0x0080)
+#endif
 #ifndef POOL_FLAG_NON_PAGED
 #define POOL_FLAG_NON_PAGED 0x0000000000000040UI64
 #endif
@@ -107,17 +121,6 @@ typedef struct _RULE_NODE {
 
 extern DRIVER_DATA GlobalData;
 
-//
-// Rule Lists Externs (Added for Exception Path support)
-//
-extern PRULE_NODE g_RegistryBlockList;
-extern PRULE_NODE g_RegistryTrustedList;
-extern PRULE_NODE g_ProcessTrustedPaths;
-extern PRULE_NODE g_ProcessExploitable;
-extern PRULE_NODE g_FileProtectedPaths;
-extern PRULE_NODE g_FileExceptionPaths; // [Added] Exception List
-extern PRULE_NODE g_FileRansomExts;
-
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
@@ -138,9 +141,7 @@ VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INF
 NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
 
 BOOLEAN IsProcessTrusted(HANDLE ProcessId);
-BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId);
 BOOLEAN IsTargetProtected(HANDLE ProcessId);
-BOOLEAN IsInstallerProcess(HANDLE ProcessId);
 BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
 
 BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);

Plugins/Filter/DriverEntry.cpp

@@ -28,28 +28,27 @@ static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTA
 
 static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
     if (!(Flags & FLTFL_FILTER_UNLOAD_MANDATORY)) {
-        ExAcquireFastMutex(&GlobalData.PortMutex);
-        BOOLEAN IsConnected = (GlobalData.ClientPort != NULL);
-        ExReleaseFastMutex(&GlobalData.PortMutex);
+        return STATUS_FLT_DO_NOT_DETACH;
+    }
 
-        if (IsConnected) {
-            return STATUS_FLT_DO_NOT_DETACH;
-        }
+    if (GlobalData.ServerPort) {
+        FltCloseCommunicationPort(GlobalData.ServerPort);
+        GlobalData.ServerPort = NULL;
+    }
+
+    if (GlobalData.FilterHandle) {
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        GlobalData.FilterHandle = NULL;
     }
 
     PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
     UninitializeRegistryProtection();
     UninitializeProcessProtection();
-    UnloadRules(); // Release JSON rules memory
 
     ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
 
-    if (GlobalData.ServerPort) {
-        FltCloseCommunicationPort(GlobalData.ServerPort);
-    }
-    if (GlobalData.FilterHandle) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-    }
+    UnloadRules();
+
     return STATUS_SUCCESS;
 }
 
@@ -77,10 +76,6 @@ static VOID PortDisconnect(PVOID ConnectionCookie) {
 
     ExAcquireFastMutex(&GlobalData.PortMutex);
     GlobalData.ClientPort = NULL;
-    GlobalData.PyasPid = 0;
-    if (GlobalData.PyasProcess) {
-        GlobalData.PyasProcess = NULL;
-    }
     ExReleaseFastMutex(&GlobalData.PortMutex);
 
     ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
@@ -126,13 +121,12 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     ExInitializeRundownProtection(&GlobalData.PortRundown);
 
     status = LoadRulesFromDisk(RegistryPath);
-    if (!NT_SUCCESS(status)) {
-        // Optional: Fail load if rules missing, or continue with empty rules
-        // return status; 
-    }
 
     status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) return status;
+    if (!NT_SUCCESS(status)) {
+        UnloadRules();
+        return status;
+    }
 
     status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
     if (NT_SUCCESS(status)) {
@@ -143,7 +137,11 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     }
 
     if (!NT_SUCCESS(status)) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
+        if (GlobalData.FilterHandle) {
+            FltUnregisterFilter(GlobalData.FilterHandle);
+            GlobalData.FilterHandle = NULL;
+        }
+        UnloadRules();
         return status;
     }
 
@@ -151,5 +149,24 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     InitializeRegistryProtection(DriverObject);
     PsSetLoadImageNotifyRoutine(ImageLoadNotify);
 
-    return FltStartFiltering(GlobalData.FilterHandle);
+    status = FltStartFiltering(GlobalData.FilterHandle);
+    if (!NT_SUCCESS(status)) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        UninitializeRegistryProtection();
+        UninitializeProcessProtection();
+
+        if (GlobalData.ServerPort) {
+            FltCloseCommunicationPort(GlobalData.ServerPort);
+            GlobalData.ServerPort = NULL;
+        }
+
+        if (GlobalData.FilterHandle) {
+            FltUnregisterFilter(GlobalData.FilterHandle);
+            GlobalData.FilterHandle = NULL;
+        }
+
+        UnloadRules();
+    }
+
+    return status;
 }

Plugins/Filter/ProtectBoot.cpp

@@ -12,7 +12,6 @@ FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data,
     UNREFERENCED_PARAMETER(CompletionContext);
 
     if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     ULONG IoControlCode = Data->Iopb->Parameters.DeviceIoControl.Common.IoControlCode;
@@ -23,7 +22,7 @@ FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data,
         IoControlCode == IOCTL_DISK_FORMAT_TRACKS_EX) {
 
         HANDLE Pid = PsGetCurrentProcessId();
-        if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+        if (!IsProcessTrusted(Pid)) {
             UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
             SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
             Data->IoStatus.Status = STATUS_ACCESS_DENIED;

Plugins/Filter/ProtectFile.cpp

@@ -34,7 +34,8 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
 
     FileName = nameInfo->Name;
     if (!FileName.Buffer || FileName.Length == 0) {
-        goto cleanup;
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
 
     HANDLE Pid = PsGetCurrentProcessId();
@@ -64,7 +65,7 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
         if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
             (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE | WRITE_DAC | WRITE_OWNER)) {
 
-            if (!Trusted && !IsInstallerProcess(Pid)) {
+            if (!Trusted) {
                 UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
                 SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
                 Data->IoStatus.Status = STATUS_ACCESS_DENIED;
@@ -178,11 +179,9 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT
     SECURITY_INFORMATION SecurityInfo = Data->Iopb->Parameters.SetSecurity.SecurityInformation;
 
     if (SecurityInfo & (OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION)) {
-
         if (CheckProtectedPathRule(&nameInfo->Name)) {
             HANDLE Pid = PsGetCurrentProcessId();
-
-            if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+            if (!IsProcessTrusted(Pid)) {
                 SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
                 Data->IoStatus.Status = STATUS_ACCESS_DENIED;
                 FltReleaseFileNameInformation(nameInfo);
@@ -220,7 +219,6 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
                 HANDLE Pid = PsGetCurrentProcessId();
 
                 if (!IsProcessTrusted(Pid)) {
-
                     PVOID SystemBuffer = NULL;
                     PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
 
@@ -238,11 +236,9 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
 
                     if (SystemBuffer) {
                         if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
-                            if (!IsInstallerProcess(Pid)) {
-                                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                                callbackStatus = FLT_PREOP_COMPLETE;
-                            }
+                            SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                            callbackStatus = FLT_PREOP_COMPLETE;
                         }
                     }
                 }
@@ -270,7 +266,6 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data,
             if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) {
                 if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) {
                     if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
-
                         Data->IoStatus.Status = STATUS_NOT_SUPPORTED;
                         FltReleaseFileNameInformation(nameInfo);
                         return FLT_PREOP_COMPLETE;

Plugins/Filter/ProtectProcess.cpp

@@ -1,8 +1,8 @@
 #include "DriverCommon.h"
 
-PVOID ObRegistrationHandle = NULL;
-OB_CALLBACK_REGISTRATION ObRegistration;
-OB_OPERATION_REGISTRATION ObCallbacks[1];
+static PVOID ObRegistrationHandle = NULL;
+static OB_CALLBACK_REGISTRATION ObRegistration;
+static OB_OPERATION_REGISTRATION ObCallbacks[2];
 
 static BOOLEAN IsSystemImage(PUNICODE_STRING FullImageName) {
     if (!FullImageName || !FullImageName->Buffer) return FALSE;
@@ -35,7 +35,7 @@ VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INF
 }
 
 static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
 
     NTSTATUS status;
     BOOLEAN isBlacklisted = FALSE;
@@ -75,22 +75,19 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
     HANDLE SourcePid = PsGetCurrentProcessId();
 
     if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-
     if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
     if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
 
-    BOOLEAN bProtected = IsTargetProtected(TargetPid);
+    if (IsTargetProtected(TargetPid)) {
+        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
 
-    if (bProtected) {
-        BOOLEAN bIsInstaller = IsInstallerProcess(SourcePid);
-
-        if (bIsInstaller) {
+        if (bIsTrusted) {
             if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsInstaller = FALSE;
+                bIsTrusted = FALSE;
             }
         }
 
-        if (bIsInstaller) return OB_PREOP_SUCCESS;
+        if (bIsTrusted) return OB_PREOP_SUCCESS;
 
         ACCESS_MASK DenyMask = PROCESS_TERMINATE |
             PROCESS_VM_OPERATION |
@@ -114,6 +111,53 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
     return OB_PREOP_SUCCESS;
 }
 
+static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    UNREFERENCED_PARAMETER(RegistrationContext);
+
+    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
+
+    PETHREAD TargetThread = (PETHREAD)OperationInformation->Object;
+    if (!TargetThread) return OB_PREOP_SUCCESS;
+
+    PEPROCESS TargetProcess = IoThreadToProcess(TargetThread);
+    if (!TargetProcess) return OB_PREOP_SUCCESS;
+
+    HANDLE TargetPid = PsGetProcessId(TargetProcess);
+    HANDLE SourcePid = PsGetCurrentProcessId();
+
+    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
+    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
+    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
+
+    if (IsTargetProtected(TargetPid)) {
+        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
+
+        if (bIsTrusted) {
+            if (IsBlacklistedAdminTool(SourcePid)) {
+                bIsTrusted = FALSE;
+            }
+        }
+
+        if (bIsTrusted) return OB_PREOP_SUCCESS;
+
+        ACCESS_MASK DenyMask = THREAD_TERMINATE |
+            THREAD_SUSPEND_RESUME |
+            THREAD_SET_CONTEXT |
+            THREAD_SET_INFORMATION |
+            THREAD_SET_THREAD_TOKEN;
+
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess &= ~DenyMask;
+
+        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess &= ~DenyMask;
+        }
+    }
+
+    return OB_PREOP_SUCCESS;
+}
+
 NTSTATUS InitializeProcessProtection() {
     static UNICODE_STRING Altitude = { 0 };
     RtlInitUnicodeString(&Altitude, L"320000");
@@ -123,8 +167,13 @@ NTSTATUS InitializeProcessProtection() {
     ObCallbacks[0].PreOperation = PreOpenProcess;
     ObCallbacks[0].PostOperation = NULL;
 
+    ObCallbacks[1].ObjectType = PsThreadType;
+    ObCallbacks[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    ObCallbacks[1].PreOperation = PreOpenThread;
+    ObCallbacks[1].PostOperation = NULL;
+
     ObRegistration.Version = OB_FLT_REGISTRATION_VERSION;
-    ObRegistration.OperationRegistrationCount = 1;
+    ObRegistration.OperationRegistrationCount = 2;
     ObRegistration.Altitude = Altitude;
     ObRegistration.RegistrationContext = NULL;
     ObRegistration.OperationRegistration = ObCallbacks;

Plugins/Filter/ProtectRegistry.cpp

@@ -1,6 +1,6 @@
 #include "DriverCommon.h"
 
-LARGE_INTEGER Cookie;
+static LARGE_INTEGER Cookie;
 
 static BOOLEAN IsBamRegistryPath(PCUNICODE_STRING KeyName) {
     if (!KeyName || !KeyName->Buffer) return FALSE;
@@ -108,7 +108,7 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 
             if (CheckRegistryRule(&FullPath)) {
                 HANDLE Pid = PsGetCurrentProcessId();
-                if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+                if (!IsProcessTrusted(Pid)) {
                     SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
                     status = STATUS_ACCESS_DENIED;
                 }
@@ -126,7 +126,7 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
             if (KeyName) {
                 if (CheckRegistryRule(KeyName)) {
                     HANDLE Pid = PsGetCurrentProcessId();
-                    if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+                    if (!IsProcessTrusted(Pid)) {
                         SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
                         status = STATUS_ACCESS_DENIED;
                     }
@@ -166,22 +166,9 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 
                         if (CheckRegistryRule(&FullPath)) {
                             HANDLE Pid = PsGetCurrentProcessId();
-
-                            BOOLEAN IsCriticalReg = FALSE;
-                            if (WildcardMatch(L"*\\MACHINE\\SAM*", FullPath.Buffer, FullPath.Length) ||
-                                WildcardMatch(L"*\\MACHINE\\SECURITY*", FullPath.Buffer, FullPath.Length) ||
-                                WildcardMatch(L"*\\MACHINE\\SYSTEM*", FullPath.Buffer, FullPath.Length) ||
-                                WildcardMatch(L"*\\MACHINE\\BCD00000000*", FullPath.Buffer, FullPath.Length)) {
-                                if (IsCriticalSystemProcess(Pid)) {
-                                    IsCriticalReg = TRUE;
-                                }
-                            }
-
-                            if (!IsCriticalReg) {
-                                if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
-                                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                    status = STATUS_ACCESS_DENIED;
-                                }
+                            if (!IsProcessTrusted(Pid)) {
+                                SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                status = STATUS_ACCESS_DENIED;
                             }
                         }
                         PyasFree(Buffer);
@@ -222,7 +209,7 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 
                         if (CheckRegistryRule(&FullPath)) {
                             HANDLE Pid = PsGetCurrentProcessId();
-                            if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) {
+                            if (!IsProcessTrusted(Pid)) {
                                 SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
                                 status = STATUS_ACCESS_DENIED;
                             }

Plugins/Filter/ProtectRules.cpp

@@ -9,31 +9,30 @@ constexpr auto TRUST_CACHE_SIZE = 128;
 constexpr auto TRUST_CACHE_TTL_SEC = 300;
 
 typedef struct _RANSOM_TRACKER {
-    HANDLE ProcessId;
+    PEPROCESS Process;
     ULONG ActivityCount;
     LARGE_INTEGER LastActivityTime;
 } RANSOM_TRACKER, * PRANSOM_TRACKER;
 
 typedef struct _TRUST_CACHE_ENTRY {
-    HANDLE ProcessId;
+    PEPROCESS Process;
     BOOLEAN IsTrusted;
     LARGE_INTEGER CacheTime;
 } TRUST_CACHE_ENTRY, * PTRUST_CACHE_ENTRY;
 
-RANSOM_TRACKER RansomTrackers[MAX_TRACKERS];
-TRUST_CACHE_ENTRY TrustCache[TRUST_CACHE_SIZE];
-FAST_MUTEX TrustCacheLock;
-
+static RANSOM_TRACKER RansomTrackers[MAX_TRACKERS];
+static TRUST_CACHE_ENTRY TrustCache[TRUST_CACHE_SIZE];
+static FAST_MUTEX TrustCacheLock;
 static BOOLEAN g_CacheInitialized = FALSE;
 
-ERESOURCE RuleLock;
-PRULE_NODE g_RegistryBlockList = NULL;
-PRULE_NODE g_RegistryTrustedList = NULL;
-PRULE_NODE g_ProcessTrustedPaths = NULL;
-PRULE_NODE g_ProcessExploitable = NULL;
-PRULE_NODE g_FileProtectedPaths = NULL;
-PRULE_NODE g_FileExceptionPaths = NULL;
-PRULE_NODE g_FileRansomExts = NULL;
+static ERESOURCE RuleLock;
+static PRULE_NODE g_RegistryBlockList = NULL;
+static PRULE_NODE g_RegistryTrustedList = NULL;
+static PRULE_NODE g_ProcessTrustedPaths = NULL;
+static PRULE_NODE g_ProcessExploitable = NULL;
+static PRULE_NODE g_FileProtectedPaths = NULL;
+static PRULE_NODE g_FileExceptionPaths = NULL;
+static PRULE_NODE g_FileRansomExts = NULL;
 
 const PCWSTR Helper_NaturallyCompressedExtensions[] = {
     L".zip", L".7z", L".rar", L".tar", L".gz",
@@ -423,7 +422,7 @@ static VOID InitTrustCache() {
 static BOOLEAN IsWindowsSystemApp(PCWSTR Buffer, USHORT Length) {
     if (WildcardMatch(L"*\\Windows\\SystemApps\\*", Buffer, Length)) return TRUE;
     if (WildcardMatch(L"*\\Windows\\ImmersiveControlPanel\\*", Buffer, Length)) return TRUE;
-    if (WildcardMatch(L"*\\explorer.exe", Buffer, Length)) return TRUE;
+    if (WildcardMatch(L"*\\Windows\\explorer.exe", Buffer, Length)) return TRUE;
     return FALSE;
 }
 
@@ -431,15 +430,25 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
     if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
     if (ProcessId == (HANDLE)4) return TRUE;
 
-    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    PEPROCESS Process = NULL;
+    if (!NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &Process))) {
+        return FALSE;
+    }
 
     if (g_CacheInitialized) {
         ExAcquireFastMutex(&TrustCacheLock);
         ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
-        if (TrustCache[Hash].ProcessId == ProcessId) {
-            BOOLEAN cachedResult = TrustCache[Hash].IsTrusted;
-            ExReleaseFastMutex(&TrustCacheLock);
-            return cachedResult;
+        if (TrustCache[Hash].Process == Process) {
+            LARGE_INTEGER Now;
+            KeQuerySystemTime(&Now);
+            if ((Now.QuadPart - TrustCache[Hash].CacheTime.QuadPart) < (TRUST_CACHE_TTL_SEC * 10000000LL)) {
+                BOOLEAN cachedResult = TrustCache[Hash].IsTrusted;
+                ExReleaseFastMutex(&TrustCacheLock);
+                ObDereferenceObject(Process);
+                return cachedResult;
+            }
         }
         ExReleaseFastMutex(&TrustCacheLock);
     }
@@ -452,7 +461,6 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
     BOOLEAN isTrusted = FALSE;
 
     if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
-
         ExAcquireResourceSharedLite(&RuleLock, TRUE);
 
         PRULE_NODE Node = g_ProcessExploitable;
@@ -487,27 +495,17 @@ cleanup:
     if (g_CacheInitialized) {
         ExAcquireFastMutex(&TrustCacheLock);
         ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
-        TrustCache[Hash].ProcessId = ProcessId;
+        TrustCache[Hash].Process = Process;
         TrustCache[Hash].IsTrusted = isTrusted;
         KeQuerySystemTime(&TrustCache[Hash].CacheTime);
         ExReleaseFastMutex(&TrustCacheLock);
     }
 
     if (imageFileName) ExFreePool(imageFileName);
+    ObDereferenceObject(Process);
     return isTrusted;
 }
 
-BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId) {
-    if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
-    if (ProcessId == (HANDLE)4) return TRUE;
-
-    return IsProcessTrusted(ProcessId);
-}
-
-BOOLEAN IsInstallerProcess(HANDLE ProcessId) {
-    return IsProcessTrusted(ProcessId);
-}
-
 BOOLEAN IsTargetProtected(HANDLE ProcessId) {
     if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
     return FALSE;
@@ -585,7 +583,7 @@ BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName) {
     while (ExNode) {
         if (WildcardMatch(ExNode->Pattern.Buffer, FileName->Buffer, FileName->Length)) {
             ExReleaseResourceLite(&RuleLock);
-            return FALSE; 
+            return FALSE;
         }
         ExNode = ExNode->Next;
     }
@@ -654,7 +652,7 @@ static BOOLEAN IsNoisyRansomPath(PCUNICODE_STRING FileName) {
 }
 
 static BOOLEAN IsExplorerProcess(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
     PUNICODE_STRING imageFileName = NULL;
     NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);
     BOOLEAN isExplorer = FALSE;
@@ -685,6 +683,11 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
         return FALSE;
     }
 
+    PEPROCESS Process = NULL;
+    if (!NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &Process))) {
+        return FALSE;
+    }
+
     LARGE_INTEGER Now = { 0 };
     KeQuerySystemTime(&Now);
     BOOLEAN Result = FALSE;
@@ -702,13 +705,13 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
             LruSlot = Current;
         }
 
-        if (Current->ProcessId == ProcessId) {
+        if (Current->Process == Process) {
             Tracker = Current;
             break;
         }
 
         BOOLEAN IsExpired = FALSE;
-        if (Current->ProcessId != NULL) {
+        if (Current->Process != NULL) {
             LARGE_INTEGER Diff;
             Diff.QuadPart = Now.QuadPart - Current->LastActivityTime.QuadPart;
             if (Diff.QuadPart > (RANSOM_TIME_WINDOW_MS * 10000LL)) {
@@ -716,7 +719,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
             }
         }
 
-        if ((Current->ProcessId == NULL || IsExpired) && !CandidateSlot) {
+        if ((Current->Process == NULL || IsExpired) && !CandidateSlot) {
             CandidateSlot = Current;
         }
     }
@@ -729,7 +732,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
             Tracker = LruSlot;
         }
 
-        Tracker->ProcessId = ProcessId;
+        Tracker->Process = Process;
         Tracker->ActivityCount = 0;
         Tracker->LastActivityTime = Now;
     }
@@ -750,6 +753,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
         Result = TRUE;
     }
     ExReleaseFastMutex(&GlobalData.TrackerMutex);
+    ObDereferenceObject(Process);
     return Result;
 }
 

Plugins/Rules/Rules_Driver_P1.json

@@ -17,6 +17,8 @@
     "*\\Classes\\cmdfile\\*",
     "*\\Classes\\comfile\\*",
     
+    "*\\mouclass",
+    "*\\kbdclass",
     "*\\DefaultIcon",
     "*\\DisableAntiSpyware",
     "*\\DisableWindowsUpdateAccess",
@@ -212,6 +214,6 @@
     ".mp4", ".avi", ".mov", ".wmv", ".mkv",
     ".aux", ".cur", ".mui", ".ttf", ".efi",
     ".cpp", ".h", ".c", ".hpp", ".cs", ".java", ".py", ".go", ".rs",
-    ".php", ".html", ".css", ".json", ".xml", ".sql", ".db"
+    ".php", ".html", ".css", ".xml", ".sql", ".db"
   ]
 }