Add files via upload

PYAS.py

@@ -151,7 +151,7 @@ class MainWindow_Controller(QMainWindow):
             "hindi_switch", "arabic_switch", "russian_switch", "slovenian_switch",
         ]
         self.pyas_default = {
-            "version": "3.4.3",
+            "version": "3.4.5",
             "api_host": "https://pyas-security.com/",
             "api_key": "fBRZxYS1UxykM-qzNOlKOEl63WILzlvgNMn6QfsG6FXCAAIktCrOPTAfY5_hEyuZ",
             "suffix": [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd"],
@@ -309,9 +309,32 @@ class MainWindow_Controller(QMainWindow):
                 if k.endswith("_button") and isinstance(v, bool) and k.replace("_button", "_window") in self.widgets:
                     continue
                 filter_config[k] = v
+                
             path = os.path.dirname(file_path)
             if not os.path.exists(path):
                 os.makedirs(path)
+
+            if os.path.exists(file_path):
+                old_config = self.read_config(file_path, {})
+                changes = []
+                
+                for k, v in filter_config.items():
+                    if k not in old_config:
+                        changes.append(f"增加 [{k}]")
+
+                    elif old_config[k] != v:
+                        if isinstance(v, (list, dict)):
+                            changes.append(f"更新 [{k}]")
+                        else:
+                            changes.append(f"更新 [{k}]: {old_config[k]} -> {v}")
+                            
+                for k in old_config:
+                    if k not in filter_config:
+                        changes.append(f"刪除 [{k}]")
+
+                if changes:
+                    self.send_message(f"配置更新 | {', '.join(changes)}", "config", True)
+
             with open(file_path, "w", encoding="utf-8", errors="ignore") as f:
                 f.write(json.dumps(filter_config, indent=4, ensure_ascii=False))
         except Exception as e:
@@ -374,11 +397,15 @@ class MainWindow_Controller(QMainWindow):
             "taskmgr_window", "tool_window", "scan_window", "home_window"]]
 
         for w in self.sub_window:
-            if w: w.hide()
+            if w:
+                w.hide()
         for w in self.main_window + self.menu_window:
-            if w: w.raise_()
+            if w:
+                w.raise_()
         for w in self.menu_window + self.blank_window:
-            if w: w.setGraphicsEffect(self.create_shadow())
+            if w:
+                w.setAttribute(Qt.WA_StyledBackground, True)
+                w.setGraphicsEffect(self.create_shadow())
 
         self.last_widget = self.widgets.get("home_window")
         self.setup_theme_mapping()
@@ -451,33 +478,53 @@ class MainWindow_Controller(QMainWindow):
     def save_state(self, name, checked):
         self.pyas_config[name] = bool(checked)
         if name == "sensitive_switch":
-            pass
+            if checked:
+                if not self.isVisible():
+                    self.save_config(self.file_config, self.pyas_config)
+                elif self.send_message("增強模式可能會誤報檔案，您確定要啟用嗎?", "quest", True):
+                    self.save_config(self.file_config, self.pyas_config)
+                else:
+                    self.pyas_config[name] = False
+                    if name in self.widgets:
+                        QTimer.singleShot(0, lambda: self.widgets[name].setChecked(False))
+            else:
+                self.save_config(self.file_config, self.pyas_config)
+
         elif name == "extension_switch":
-            pass
+            self.save_config(self.file_config, self.pyas_config)
         elif name == "cloud_switch":
-            pass
+            self.save_config(self.file_config, self.pyas_config)
+
         elif name == "process_switch":
             if checked:
                 self.start_daemon_thread(self.protect_proc_thread)
+            self.save_config(self.file_config, self.pyas_config)
         elif name == "document_switch":
             if checked:
                 self.start_daemon_thread(self.protect_file_thread)
+            self.save_config(self.file_config, self.pyas_config)
         elif name == "system_switch":
             if checked:
                 self.start_daemon_thread(self.protect_system_thread)
-        elif name == "driver_switch":
-            if not checked:
-                self.stop_system_driver()
-            elif self.install_system_driver():
-                self.start_daemon_thread(self.pipe_server_thread)
-            else:
-                self.send_message("驅動防護啟用失敗，請重啟裝置來修復錯誤", "warn", True)
+            self.save_config(self.file_config, self.pyas_config)
         elif name == "network_switch":
             if checked:
                 self.start_daemon_thread(self.protect_net_thread)
+            self.save_config(self.file_config, self.pyas_config)
+        elif name == "driver_switch":
+            if checked:
+                if self.install_system_driver():
+                    self.start_daemon_thread(self.pipe_server_thread)
+                else:
+                    self.pyas_config[name] = False
+                    if name in self.widgets:
+                        QTimer.singleShot(0, lambda: self.widgets[name].setChecked(False))
+                    self.send_message("驅動防護啟用失敗", "warn", True)
+            else:
+                self.stop_system_driver()
+            self.save_config(self.file_config, self.pyas_config)
         else:
             self.send_message(f"此功能不支持使用", "info", True)
-        self.save_config(self.file_config, self.pyas_config)
 
     def init_thread(self):
         self.start_daemon_thread(self.popup_intercept_thread)
@@ -540,7 +587,20 @@ class MainWindow_Controller(QMainWindow):
                 style = widget._origin_style
                 for k, v in theme_map.items():
                     style = style.replace(str(k), str(v))
+                
                 widget.setStyleSheet(style)
+                widget.style().unpolish(widget)
+                widget.style().polish(widget)
+                
+                try:
+                    widget.update()
+                except TypeError:
+                    if hasattr(widget, "viewport"):
+                        widget.viewport().update()
+                
+                effect = widget.graphicsEffect()
+                if effect:
+                    effect.update()
 
             mapping = getattr(widget, "_theme_mapping", None)
             if isinstance(mapping, dict):
@@ -697,6 +757,9 @@ class MainWindow_Controller(QMainWindow):
             self.init_connect()
             self.apply_settings()
 
+            current_version = self.pyas_config.get("version", "None")
+            self.send_message(f"當前版本 | {current_version}", "version", True)
+
             param = self.args_pyas[0].replace("/", "-") if self.args_pyas else ""
             if "-h" not in param:
                 self.show_button()
@@ -974,6 +1037,7 @@ class MainWindow_Controller(QMainWindow):
                         self.virus_results.append(norm_path)
                         self.scan_add_virus_signal.emit(f"[{result}] > {norm_path}")
                         self.start_daemon_thread(self.cloud_check, norm_path)
+                        self.send_message(f"病毒掃描 | scan_worker | None | None | {norm_path}", "scan", True)
 
                     lang = self.pyas_config.get("language", "english_switch")
                     self.progress_title_signal.emit(self.trans(lang, "正在掃描"))
@@ -1827,9 +1891,10 @@ class MainWindow_Controller(QMainWindow):
             current = str(self.pyas_config.get("version", "")).strip()
             page = "https://github.com/87owo/PYAS/releases"
             latest = ""
+            
             try:
                 j = requests.get("https://api.github.com/repos/87owo/PYAS/releases/latest", headers={"Accept": "application/vnd.github+json", "User-Agent": "PYAS"}, timeout=10).json()
-                latest = (j.get("tag_name") or j.get("name") or "").strip()
+                latest = str(j.get("tag_name") or j.get("name") or "").strip()
                 page = j.get("html_url") or page
             except Exception:
                 try:
@@ -1840,10 +1905,15 @@ class MainWindow_Controller(QMainWindow):
                 except Exception:
                     pass
 
-            rl = re.sub(r"^[vV]\s*", "", str(latest))
-            cl = re.sub(r"^[vV]\s*", "", str(current))
+            if not latest:
+                self.send_message("檢查更新失敗", "error", True)
+                return False
+
+            rl = re.sub(r"^[vV]\s*", "", latest)
+            cl = re.sub(r"^[vV]\s*", "", current)
             tr = tuple(int(x) for x in re.findall(r"\d+", rl))
             tl = tuple(int(x) for x in re.findall(r"\d+", cl))
+            
             if tr and (not tl or tr > tl):
                 if self.send_message(f"發現新版本 {latest}，您確定要前往更新嗎?", "quest", True):
                     webbrowser.open(page)
@@ -1853,8 +1923,9 @@ class MainWindow_Controller(QMainWindow):
                 else:
                     webbrowser.open(page)
             return True
+            
         except Exception as e:
-            self.send_message(f"update_button | {e}", "warn", False)
+            self.send_message(f"update_button | {e}", "error", False)
             return False
 
 ####################################################################################################
@@ -2195,7 +2266,7 @@ class MainWindow_Controller(QMainWindow):
                 winreg.SetValueEx(key, "Flags", 0, winreg.REG_DWORD, 0)
 
             subprocess.run(["sc", "start", service_name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, shell=True)
-            return True
+            return self.check_system_driver()
         except Exception as e:
             self.send_message(f"install_system_driver | {e}", "warn", False)
             return False
@@ -2217,6 +2288,20 @@ class MainWindow_Controller(QMainWindow):
         except Exception:
             return False
 
+    def check_system_driver(self):
+        try:
+            service_name = "PYAS_Driver"
+            result = subprocess.run(
+                ["sc", "query", service_name],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                shell=True
+            )
+            return "RUNNING" in result.stdout
+        except Exception:
+            return False
+
 ####################################################################################################
 
     def pipe_server_thread(self):

PYAS_Engine.py

@@ -538,10 +538,12 @@ class pe_scanner:
         pe = None
         try:
             fsize = os.path.getsize(file_path)
-            if fsize == 0 or fsize > 268435456:
+            if fsize == 0 or fsize > 512 * 1024 * 1024:
                 return None
+
             with open(file_path, "rb") as f:
                 file_bytes = f.read()
+
             pe = pefile.PE(data=file_bytes, fast_load=True)
             fts['TrustSigned'] = 1 if self.signer.sign_verify(file_path) else 0
             fh = pe.FILE_HEADER

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.4.3',
+version='3.4.5',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

Plugins/Rules/Rules_Driver_P1.json

@@ -3,11 +3,7 @@
     "\\REGISTRY\\MACHINE\\BCD00000000",
     "\\REGISTRY\\MACHINE\\BCD00000000\\*",
     "*\\Image File Execution Options\\*",
-
-    "\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\NetWire\\*",
-    "\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\Remcos*\\*",
-    "\\REGISTRY\\USER\\S-1-*\\SOFTWARE\\DC3_FEXEC\\*",
-
+    
     "*\\Classes\\.exe",
     "*\\Classes\\.bat",
     "*\\Classes\\.cmd",
@@ -19,7 +15,6 @@
     
     "*\\mouclass",
     "*\\kbdclass",
-    "*\\DefaultIcon",
     "*\\DisableAntiSpyware",
     "*\\DisableWindowsUpdateAccess",
     "*\\EnableLUA",
@@ -79,7 +74,6 @@
     "*\\NoInteractiveServices",
     "*\\ShutdownWithoutLogon",
     "*\\AutoAdminLogon",
-    "*\\ImagePath",
     "*\\BootExecute",
     "*\\SubSystems",
     "*\\FirmwareBootDevice",
@@ -89,7 +83,6 @@
     "*\\DisableAutomaticRestartOnFailure",
     "*\\SystemBiosVersion",
     "*\\NoTheme",
-    "*\\PendingFileRenameOperations",
     "*\\SystemSetupInProgress",
     "*\\CmdLine",
     "*\\SetupType",
@@ -108,17 +101,30 @@
   "Rule_Registry_TrustedList": [
   ],
   "Rule_Process_TrustedPaths": [
-    "*\\Windows\\*",
-    "*\\Windows Defender\\*",
-    "*\\Windows Defender Advanced Threat Protection\\*",
-    "*\\Program Files\\*",
-    "*\\Program Files (x86)\\*",
+    "\\Device\\HarddiskVolume*\\Windows\\*",
+    "\\Device\\HarddiskVolume*\\Program Files\\*",
+    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+    
+    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+    
     "*\\Google\\Chrome\\Application\\chrome.exe",
     "*\\Microsoft\\Edge\\Application\\msedge.exe",
     "*\\Mozilla Firefox\\firefox.exe",
+    
     "*\\Steam\\steam.exe",
+    "*\\steam\\*\\steam.exe",
     "*\\Battle.net\\*\\Battle.net.exe",
-    "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe"
+    "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+    
+    "*\\ThunderEv.exe",
+    "*\\ThunderStart.exe",
+    "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+    "*\\KuGou.exe",
+    "*\\XLGame.exe",
+    "*\\XLLiveUD.exe",
+    "*\\PC4399_WPFLauncher.exe",
+    "*\\bin\\APlayer.exe",
   ],
   "Rule_Process_ExploitableBlacklist": [
     "*\\cmd.exe",
@@ -153,31 +159,24 @@
     "*\\taskkill.exe",
     "*\\ProcessHacker.exe",
     "*\\procmon.exe",
-    "*\\procexp.exe"
+    "*\\procexp.exe",
   ],
   "Rule_File_ProtectedPaths": [
     "*\\PYAS.exe",
     "*\\PYAS_Driver.sys",
     "*\\ProgramData\\PYAS\\*.json",
+    "*\\Plugins\\Rules\\Rules_Driver_P1.json",
+    "*\\Engine\\Pattern\\*.onnx",
+    "*\\Engine\\Properties\\*.onnx",
     
-    "*\\bootmgr",
-    "*\\boot.ini",
-    "*\\BOOTNXT",
-    "*\\BCD",
-    "*\\EFI\\*",
-    "*\\Boot\\*",
-    "*\\Recovery\\*",
-
-	"*\\Windows\\*.exe",
-    "*\\Windows\\*.dll",
-    "*\\Windows\\*.sys",
-    "*\\Windows\\System32\\*.exe",
-    "*\\Windows\\System32\\*.dll",
-    "*\\Windows\\System32\\*.sys",
-    "*\\Windows\\SysWOW64\\*.exe",
-    "*\\Windows\\SysWOW64\\*.dll",
-    "*\\Windows\\SysWOW64\\*.sys",
-    "*\\System Volume Information\\*",
+    "\\Device\\HarddiskVolume*\\bootmgr",
+    "\\Device\\HarddiskVolume*\\boot.ini",
+    "\\Device\\HarddiskVolume*\\BOOTNXT",
+    "\\Device\\HarddiskVolume*\\EFI\\*",
+    "\\Device\\HarddiskVolume*\\Boot\\*",
+    "\\Device\\HarddiskVolume*\\Recovery\\*",
+    "\\Device\\HarddiskVolume*\\System Volume Information\\*",
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
     
     "*\\CON",
     "*\\CON\\*",
@@ -191,20 +190,19 @@
     "*\\COM?\\*",
     "*\\LPT?",
     "*\\LPT?\\*",
-    "*\\LPT?",
-    "*\\LPT?\\*",
     "*\\OSDATA",
     "*\\OSDATA\\*",
-
     "*\\*<*",
     "*\\*>*",
-    "*\\*:*",
   ],
   "Rule_File_ExceptionPaths": [
-    "*\\AppData\\*"
+    "*\\Users\\*\\steam\\*",
+    "*\\AppData\\*",
+    "*\\Temp\\*",
+    "*\\Local\\Temp\\*",
+    "*\\ventoy\\Boot\\*",
   ],
   "Rule_File_RansomwareExtensions": [
-    ".exe", ".dll", ".sys", ".com", ".scr",
     ".zip", ".7z", ".rar", ".tar", ".gz",
     ".js", ".bat", ".cmd", ".ps1", ".vbs",
     ".ppt", ".pptx", ".wps", ".txt", ".rtf",
@@ -213,7 +211,5 @@
     ".mp3", ".wav", ".aac", ".ogg", ".flac",
     ".mp4", ".avi", ".mov", ".wmv", ".mkv",
     ".aux", ".cur", ".mui", ".ttf", ".efi",
-    ".cpp", ".h", ".c", ".hpp", ".cs", ".java", ".py", ".go", ".rs",
-    ".php", ".html", ".css", ".xml", ".sql", ".db"
   ]
 }