Add files via upload

Embed/Dockerfile

@@ -1,16 +0,0 @@
-FROM python:3.10-slim
-
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    libfuzzy-dev \
-    git \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-
-COPY . .
-
-CMD ["python", "-u", "predict_onnx_linux.py"]

Embed/features.json

@@ -1 +0,0 @@
-["FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders", "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags", "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint", "BaseOfCode", "SectionAlignment", "FileAlignment", "MajorOperatingSystemVersion", "MinorOperatingSystemVersion", "MajorImageVersion", "MinorImageVersion", "MajorSubsystemVersion", "MinorSubsystemVersion", "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit", "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols", "SizeOfOptionalHeader", "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", "SectionCount", "ExecutableSections", "WritableSections", "ReadableSections", "SectionException", "Char_00000020_Count", "Char_00000020_MeanEntropy", "Char_00000040_Count", "Char_00000040_MeanEntropy", "Char_00000080_Count", "Char_00000080_MeanEntropy", "Char_02000000_Count", "Char_02000000_MeanEntropy", "Char_20000000_Count", "Char_20000000_MeanEntropy", "Char_40000000_Count", "Char_40000000_MeanEntropy", "Char_80000000_Count", "Char_80000000_MeanEntropy", "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount", "ImportCount", "ImportFunctionCount", "FileDescriptionLength", "FileVersionLength", "ProductNameLength", "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", "CommentsLength", "InternalNameLength", "LegalTrademarksLength", "SpecialBuildLength", "PrivateBuildLength", "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException", "Cat_AntiDebug", "Cat_Audio", "Cat_COM", "Cat_Camera", "Cat_Clipboard", "Cat_DataObfuscation", "Cat_DotNet", "Cat_Encryption", "Cat_FileIO", "Cat_Graphics", "Cat_Injection", "Cat_Input", "Cat_Keylogging", "Cat_Memory", "Cat_MultiThreading", "Cat_Native", "Cat_Network", "Cat_Privileges", "Cat_ProcessControl", "Cat_Registry", "Cat_Resource", "Cat_ScreenCapture", "Cat_Services", "Cat_Synchronization", "Cat_WindowControl", "Dll_advapi32_dll", "Dll_bcrypt_dll", "Dll_comctl32_dll", "Dll_crypt32_dll", "Dll_dbghelp_dll", "Dll_gdi32_dll", "Dll_hal_dll", "Dll_imagehlp_dll", "Dll_iphlpapi_dll", "Dll_kernel32_dll", "Dll_mscoree_dll", "Dll_netapi32_dll", "Dll_ntdll_dll", "Dll_ole32_dll", "Dll_oleaut32_dll", "Dll_psapi_dll", "Dll_shell32_dll", "Dll_shlwapi_dll", "Dll_urlmon_dll", "Dll_user32_dll", "Dll_vbscript_dll", "Dll_version_dll", "Dll_winhttp_dll", "Dll_wininet_dll", "Dll_winmm_dll", "Dll_ws2_32_dll", "Dll_wsock32_dll", "Dll_wtsapi32_dll", "Api_AdjustTokenPrivileges", "Api_Base64Decode", "Api_BitBlt", "Api_CallNextHookEx", "Api_CallWindowProcA", "Api_CapCreateCaptureWindowA", "Api_CapCreateCaptureWindowW", "Api_CharLowerA", "Api_CharUpperA", "Api_CheckRemoteDebuggerPresent", "Api_CloseClipboard", "Api_CloseHandle", "Api_CoCreateInstance", "Api_CoInitialize", "Api_CoUninitialize", "Api_CompareStringA", "Api_ConnectNamedPipe", "Api_ControlService", "Api_CopyFileA", "Api_CopyFileW", "Api_CreateCompatibleBitmap", "Api_CreateCompatibleDC", "Api_CreateDCA", "Api_CreateDCW", "Api_CreateEventA", "Api_CreateEventW", "Api_CreateFileA", "Api_CreateFileMappingA", "Api_CreateFileMappingW", "Api_CreateFileW", "Api_CreateMutexA", "Api_CreateMutexW", "Api_CreateProcessA", "Api_CreateProcessW", "Api_CreateRemoteThread", "Api_CreateServiceA", "Api_CreateServiceW", "Api_CreateThread", "Api_CreateThreadpoolWork", "Api_CreateWindowExA", "Api_CryptAcquireContextA", "Api_CryptAcquireContextW", "Api_CryptCreateHash", "Api_CryptDecodeObject", "Api_CryptDecrypt", "Api_CryptDeriveKey", "Api_CryptDestroyHash", "Api_CryptDestroyKey", "Api_CryptEncrypt", "Api_CryptExportKey", "Api_CryptGenKey", "Api_CryptHashData", "Api_CryptImportKey", "Api_CryptReleaseContext", "Api_D3D11CreateDevice", "Api_DecodePointer", "Api_DefWindowProcA", "Api_DeleteCriticalSection", "Api_DeleteDC", "Api_DeleteFileA", "Api_DeleteFileW", "Api_DeleteObject", "Api_DeleteService", "Api_DestroyWindow", "Api_DeviceIoControl", "Api_Direct3DCreate9", "Api_DispatchMessageA", "Api_DnsQuery_A", "Api_DnsQuery_W", "Api_EncodePointer", "Api_EnterCriticalSection", "Api_EnumChildWindows", "Api_EnumWindows", "Api_ExitProcess", "Api_ExitThread", "Api_FindClose", "Api_FindFirstFileA", "Api_FindNextFileA", "Api_FindResourceA", "Api_FindWindowA", "Api_FindWindowW", "Api_FlushFileBuffers", "Api_FreeEnvironmentStringsW", "Api_FreeLibrary", "Api_FreeResource", "Api_GdipSaveImageToFile", "Api_GetACP", "Api_GetActiveWindow", "Api_GetAsyncKeyState", "Api_GetCapture", "Api_GetClientRect", "Api_GetClipboardData", "Api_GetCommandLineA", "Api_Line truncated

Embed/predict_onnx_linux.py

@@ -1,611 +0,0 @@
-import os, sys, time, re, math, pefile, json, datetime, mmap
-import numpy as np
-import onnxruntime as ort
-from signify.authenticode.signed_file.pe import SignedPEFile
-from signify.authenticode.verification_result import AuthenticodeVerificationResult
-
-####################################################################################################
-
-MODEL_FILE = "model.onnx"
-FEATURE_FILE = "features.json"
-MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024
-
-####################################################################################################
-
-class WinTrust:
-    @staticmethod
-    def verify(file_path):
-        if not file_path or not os.path.exists(file_path) or os.path.getsize(file_path) == 0:
-            return 0
-        try:
-            with open(file_path, 'rb') as f:
-                with mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ) as mm:
-                    pe = SignedPEFile(mm)
-                    if not pe.signatures:
-                        return 0
-
-                    status, _ = pe.explain_verify()
-                    if status == AuthenticodeVerificationResult.OK:
-                        return 1
-        except Exception:
-            pass
-        return 0
-
-####################################################################################################
-
-class FeatureExtractor:
-    API_CAT_MAPPING = {
-        'ProcessControl': {
-            'CreateProcessA', 'CreateProcessW', 'WinExec', 'ShellExecuteA', 'ShellExecuteW',
-            'ShellExecuteExW', 'ExitProcess', 'TerminateProcess', 'OpenProcess', 'GetExitCodeProcess',
-            'SetThreadPriority', 'GetThreadPriority', 'GetCurrentProcess', 'GetCurrentProcessId',
-            'GetModuleFileNameA', 'GetCommandLineA', 'GetModuleFileNameW', 'GetStartupInfoW'
-        },
-        'Injection': {
-            'VirtualAlloc', 'VirtualAllocEx', 'VirtualProtect', 'VirtualProtectEx', 'WriteProcessMemory', 
-            'ReadProcessMemory', 'CreateRemoteThread', 'QueueUserAPC', 'SetThreadContext', 'GetThreadContext', 
-            'Wow64SetThreadContext', 'NtUnmapViewOfSection', 'ZwUnmapViewOfSection', 'RtlCreateUserThread', 
-            'SetWindowsHookExA', 'SetWindowsHookExW', 'UnhookWindowsHookEx', 'LoadLibraryA', 'LoadLibraryW', 
-            'LoadLibraryExA', 'LoadLibraryExW', 'GetProcAddress', 'GetModuleHandleA', 'GetModuleHandleW',
-            'FreeLibrary', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'UnmapViewOfSection',
-            'VirtualFree', 'VirtualQuery'
-        },
-        'Synchronization': {
-            'WaitForSingleObject', 'WaitForSingleObjectEx', 'WaitForMultipleObjects', 'WaitForMultipleObjectsEx',
-            'CreateMutexA', 'CreateMutexW', 'OpenMutexW', 'ReleaseMutex', 'CreateEventA', 'CreateEventW', 
-            'OpenEventW', 'SetEvent', 'ResetEvent', 'EnterCriticalSection', 'LeaveCriticalSection', 
-            'InitializeCriticalSection', 'DeleteCriticalSection', 'Sleep', 'SleepEx',
-            'InitializeCriticalSectionAndSpinCount', 'InterlockedDecrement', 'InterlockedIncrement', 
-            'InterlockedExchange', 'InterlockedCompareExchange', 'SetTimer', 'KillTimer'
-        },
-        'MultiThreading': {
-            'CreateThread', 'ResumeThread', 'SuspendThread', 'ExitThread', 'TerminateThread',
-            'GetCurrentThread', 'GetCurrentThreadId', 'TlsAlloc', 'TlsSetValue', 'TlsGetValue',
-            'CreateThreadpoolWork', 'SubmitThreadpoolWork', 'TlsFree'
-        },
-        'Network': {
-            'socket', 'connect', 'send', 'recv', 'bind', 'listen', 'accept', 'gethostbyname', 'getaddrinfo',
-            'WSAStartup', 'WSACleanup', 'WSAIoctl', 'WSASocketA', 'WSASocketW', 'closesocket', 'htons',
-            'InternetOpenA', 'InternetOpenW', 'InternetConnectA', 'InternetConnectW', 'InternetOpenUrlA', 
-            'InternetOpenUrlW', 'HttpOpenRequestA', 'HttpOpenRequestW', 'HttpSendRequestA', 'HttpSendRequestW',
-            'InternetReadFile', 'URLDownloadToFileA', 'URLDownloadToFileW', 'DnsQuery_A', 'DnsQuery_W'
-        },
-        'Encryption': {
-            'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptCreateHash', 'CryptHashData', 
-            'CryptDeriveKey', 'CryptEncrypt', 'CryptDecrypt', 'CryptDestroyKey', 'CryptDestroyHash',
-            'CryptReleaseContext', 'CryptGenKey', 'CryptImportKey', 'CryptExportKey'
-        },
-        'DataObfuscation': {
-            'RtlDecompressBuffer', 'MultiByteToWideChar', 'WideCharToMultiByte', 'Base64Decode', 
-            'CryptDecodeObject', 'IsDBCSLeadByte', 'CharUpperA', 'CharLowerA',
-            'GetStringTypeW', 'LCMapStringW', 'IsValidCodePage', 'DecodePointer', 'EncodePointer'
-        },
-        'FileIO': {
-            'CreateFileA', 'CreateFileW', 'WriteFile', 'ReadFile', 'DeleteFileA', 'DeleteFileW',
-            'CopyFileA', 'CopyFileW', 'MoveFileA', 'MoveFileW', 'FindFirstFileA', 'FindNextFileA',
-            'GetTempPathA', 'GetTempPathW', 'GetTempFileNameA', 'GetTempFileNameW', 'SetFileAttributesA', 
-            'SetFileAttributesW', 'DeviceIoControl', 'SetFileTime', 'GetFileSize', 'GetFileSizeEx',
-            'SetFilePointer', 'FlushFileBuffers', 'ConnectNamedPipe', 'PeekNamedPipe',
-            'CloseHandle', 'GetFileType', 'SetStdHandle', 'SetFilePointerEx', 'FindClose', 
-            'SetHandleCount', 'SetEndOfFile', 'GetFullPathNameA', 'GetFileAttributesA'
-        },
-        'Registry': {
-            'RegOpenKeyExA', 'RegOpenKeyExW', 'RegSetValueExA', 'RegSetValueExW', 
-            'RegCreateKeyExA', 'RegCreateKeyExW', 'RegDeleteKeyA', 'RegDeleteKeyW',
-            'RegEnumValueA', 'RegEnumValueW', 'RegQueryValueExA', 'RegQueryValueExW',
-            'RegDeleteValueA', 'RegDeleteValueW', 'RegCloseKey'
-        },
-        'Services': {
-            'OpenSCManagerA', 'OpenSCManagerW', 'CreateServiceA', 'CreateServiceW',
-            'StartServiceA', 'StartServiceW', 'ControlService', 'DeleteService'
-        },
-        'Privileges': {
-            'AdjustTokenPrivileges', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 
-            'OpenProcessToken', 'NetUserAdd', 'NetLocalGroupAddMembers', 'IsAdmin', 
-            'GetUserNameA', 'GetUserNameW'
-        },
-        'Native': {
-            'RtlUnwind', 'RtlVirtualUnwind', 'RtlCaptureContext', 'RtlLookupFunctionEntry',
-            'NtClose', 'NtQueryInformationProcess', 'RtlAllocateHeap', 'RtlFreeHeap',
-            'GetSystemTimeAsFileTime', 'GetLocalTime', 'GlobalMemoryStatus', 
-            'GetVersionExA', 'GetVersionExW', 'GetComputerNameA', 'GetComputerNameW',
-            'GetLastError', 'GetACP', 'RaiseException', 'SetLastError', 'GetEnvironmentStringsW', 
-            'FreeEnvironmentStringsW', 'GetLocaleInfoA', 'lstrlenA', 'GetVersion', 'GetSystemInfo', 
-            'CompareStringA'
-        },
-        'DotNet': {
-            '_CorExeMain', '_CorDllMain'
-        },
-        'AntiDebug': {
-            'IsDebuggerPresent', 'CheckRemoteDebuggerPresent', 'OutputDebugStringA', 'OutputDebugStringW',
-            'GetTickCount', 'GetTickCount64', 'QueryPerformanceCounter', 'FindWindowA', 'FindWindowW',
-            'EnumWindows', 'EnumChildWindows', 'GetWindowRect', 'GetClientRect', 'SetWindowDisplayAffinity',
-            'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsProcessorFeaturePresent', 
-            'SetErrorMode', 'GetTimeZoneInformation', 'GetDriveTypeW', 'GetDiskFreeSpaceA'
-        },
-        'Keylogging': {
-            'GetAsyncKeyState', 'GetKeyState', 'GetKeyboardState', 'MapVirtualKeyA', 'MapVirtualKeyW',
-            'ToAscii', 'ToAsciiEx', 'ToUnicode', 'ToUnicodeEx', 'GetKeyNameTextA', 'GetForegroundWindow',
-            'KeybdEvent', 'SendInput', 'MapVirtualKeyExA', 'MapVirtualKeyExW', 'CallNextHookEx'
-        },
-        'Input': {
-            'GetCursorPos', 'SetCursorPos', 'MouseEvent', 'GetDoubleClickTime', 
-            'GetCapture', 'SetCapture'
-        },
-        'ScreenCapture': {
-            'BitBlt', 'StretchBlt', 'GetDC', 'GetWindowDC', 'CreateCompatibleDC', 'CreateCompatibleBitmap',
-            'GdipSaveImageToFile', 'PrintWindow', 'GetDesktopWindow', 'CreateDCW', 'CreateDCA',
-            'SelectObject', 'DeleteDC', 'DeleteObject', 'GetDeviceCaps', 'GetSystemMetrics'
-        },
-        'Graphics': {
-            'Direct3DCreate9', 'D3D11CreateDevice'
-        },
-        'Audio': {
-            'WaveInOpen', 'WaveInClose', 'WaveInStart', 'WaveInStop'
-        },
-        'Clipboard': {
-            'OpenClipboard', 'CloseClipboard', 'GetClipboardData', 'SetClipboardData'
-        },
-        'Camera': {
-            'CapCreateCaptureWindowA', 'CapCreateCaptureWindowW'
-        },
-        'Memory': {
-            'HeapAlloc', 'HeapFree', 'HeapSize', 'HeapCreate', 'GetProcessHeap',
-            'LocalAlloc', 'LocalFree', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock',
-            'HeapDestroy', 'GlobalLock', 'SysFreeString', 'SysAllocStringLen'
-        },
-        'Resource': {
-            'LoadResource', 'SizeofResource', 'LockResource', 'FreeResource', 'FindResourceA'
-        },
-        'WindowControl': {
-            'ShowWindow', 'DestroyWindow', 'TranslateMessage', 'DispatchMessageA', 'GetWindow',
-            'PeekMessageA', 'GetWindowLongA', 'CallWindowProcA', 'SetWindowLongA', 'GetWindowTextA',
-            'ScreenToClient', 'GetActiveWindow', 'CreateWindowExA', 'DefWindowProcA', 'GetMessageA',
-            'RegisterClassA', 'UnregisterClassA', 'MessageBoxA'
-        },
-        'COM': {
-            'CoCreateInstance', 'CoUninitialize', 'CoInitialize'
-        }
-    }
-
-    TARGET_DLLS = {
-        'kernel32.dll', 'user32.dll', 'gdi32.dll', 'advapi32.dll', 'shell32.dll', 'ntdll.dll', 'hal.dll',
-        'ws2_32.dll', 'wsock32.dll', 'wininet.dll', 'winhttp.dll', 'urlmon.dll', 'crypt32.dll', 'bcrypt.dll',
-        'psapi.dll', 'dbghelp.dll', 'imagehlp.dll', 'shlwapi.dll', 'ole32.dll', 'oleaut32.dll', 'comctl32.dll',
-        'mscoree.dll', 'vbscript.dll', 'netapi32.dll', 'iphlpapi.dll', 'wtsapi32.dll', 'version.dll', 'winmm.dll'
-    }
-
-    BASE_SCHEMA = [
-        "FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic",
-        "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
-        "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
-        "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
-        "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
-        "BaseOfCode", "SectionAlignment", "FileAlignment",
-        "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
-        "MajorImageVersion", "MinorImageVersion",
-        "MajorSubsystemVersion", "MinorSubsystemVersion",
-        "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
-        "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
-        "SizeOfOptionalHeader",
-        
-        "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", 
-        "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", 
-        "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", 
-        "SectionCount", "ExecutableSections", 
-        "WritableSections", "ReadableSections", "SectionException",
-
-        "Char_00000020_Count", "Char_00000020_MeanEntropy",
-        "Char_00000040_Count", "Char_00000040_MeanEntropy",
-        "Char_00000080_Count", "Char_00000080_MeanEntropy",
-        "Char_02000000_Count", "Char_02000000_MeanEntropy",
-        "Char_20000000_Count", "Char_20000000_MeanEntropy",
-        "Char_40000000_Count", "Char_40000000_MeanEntropy",
-        "Char_80000000_Count", "Char_80000000_MeanEntropy",
-        
-        "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
-        "ImportCount", "ImportFunctionCount",
-        
-        "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
-        "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
-        "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
-        "SpecialBuildLength", "PrivateBuildLength",
-        
-        "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
-        "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
-        "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException"
-    ]
-
-    CAT_SCHEMA = [f"Cat_{k}" for k in sorted(API_CAT_MAPPING.keys())]
-    DLL_SCHEMA = [f"Dll_{d.replace('.', '_')}" for d in sorted(TARGET_DLLS)]
-    
-    _ALL_APIS = {api for apis in API_CAT_MAPPING.values() for api in apis}
-    API_SCHEMA = [f"Api_{api}" for api in sorted(_ALL_APIS)]
-    
-    SCHEMA = BASE_SCHEMA + CAT_SCHEMA + DLL_SCHEMA + API_SCHEMA
-    
-    _API_TO_CATS = {}
-    for _cat, _apis in API_CAT_MAPPING.items():
-        for _api in _apis:
-            if _api not in _API_TO_CATS:
-                _API_TO_CATS[_api] = []
-            _API_TO_CATS[_api].append(_cat)
-
-    PACKERS = {
-        'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
-        'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
-        'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
-        'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
-        'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
-    }
-    INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
-
-####################################################################################################
-
-    @staticmethod
-    def _safe_float(val):
-        try:
-            f = float(val)
-            if math.isinf(f) or math.isnan(f): return 0.0
-            return f
-        except Exception:
-            return 0.0
-
-    @staticmethod
-    def _calc_entropy(data):
-        if not data: return 0.0
-        arr = np.frombuffer(data, dtype=np.uint8)
-        counts = np.bincount(arr, minlength=256)
-        probs = counts[counts > 0] / len(arr)
-        return float(-np.sum(probs * np.log2(probs)))
-
-    @staticmethod
-    def _safe_div(n, d):
-        return float(n) / d if d > 0 else 0.0
-
-####################################################################################################
-
-    @classmethod
-    def extract(cls, file_path):
-        fts = {k: 0.0 for k in cls.SCHEMA}
-        pe = None
-        try:
-            fsize = os.path.getsize(file_path)
-            if fsize == 0 or fsize > MAX_FILE_SIZE:
-                return None
-
-            with open(file_path, "rb") as f:
-                file_bytes = f.read()
-
-            pe = pefile.PE(data=file_bytes, fast_load=True)
-            fts['TrustSigned'] = WinTrust.verify(file_path)
-
-            fh = pe.FILE_HEADER
-            fts['Machine'] = fh.Machine
-            fts['NumberOfSections'] = fh.NumberOfSections
-            fts['TimeDateStamp'] = fh.TimeDateStamp
-            fts['PointerToSymbolTable'] = fh.PointerToSymbolTable
-            fts['NumberOfSymbols'] = fh.NumberOfSymbols
-            fts['SizeOfOptionalHeader'] = fh.SizeOfOptionalHeader
-            fts['Characteristics'] = fh.Characteristics
-
-            curr_ts = datetime.datetime.utcnow().timestamp()
-            fts['HasInvalidTimestamp'] = 1 if (fh.TimeDateStamp < 631152000 or fh.TimeDateStamp > curr_ts + 2592000) else 0
-            fts['FileTimeException'] = 1 if fh.TimeDateStamp == 0 else 0
-
-            if hasattr(pe, 'OPTIONAL_HEADER'):
-                op = pe.OPTIONAL_HEADER
-                fts['Magic'] = getattr(op, 'Magic', 0)
-                fts['MajorLinkerVersion'] = getattr(op, 'MajorLinkerVersion', 0)
-                fts['MinorLinkerVersion'] = getattr(op, 'MinorLinkerVersion', 0)
-                fts['SizeOfCode'] = getattr(op, 'SizeOfCode', 0)
-                fts['SizeOfInitializedData'] = getattr(op, 'SizeOfInitializedData', 0)
-                fts['SizeOfUninitializedData'] = getattr(op, 'SizeOfUninitializedData', 0)
-                fts['AddressOfEntryPoint'] = getattr(op, 'AddressOfEntryPoint', 0)
-                fts['BaseOfCode'] = getattr(op, 'BaseOfCode', 0)
-                fts['ImageBase'] = getattr(op, 'ImageBase', 0)
-                fts['SectionAlignment'] = getattr(op, 'SectionAlignment', 0)
-                fts['FileAlignment'] = getattr(op, 'FileAlignment', 0)
-                fts['MajorOperatingSystemVersion'] = getattr(op, 'MajorOperatingSystemVersion', 0)
-                fts['MinorOperatingSystemVersion'] = getattr(op, 'MinorOperatingSystemVersion', 0)
-                fts['MajorImageVersion'] = getattr(op, 'MajorImageVersion', 0)
-                fts['MinorImageVersion'] = getattr(op, 'MinorImageVersion', 0)
-                fts['MajorSubsystemVersion'] = getattr(op, 'MajorSubsystemVersion', 0)
-                fts['MinorSubsystemVersion'] = getattr(op, 'MinorSubsystemVersion', 0)
-                fts['SizeOfImage'] = getattr(op, 'SizeOfImage', 0)
-                fts['SizeOfHeaders'] = getattr(op, 'SizeOfHeaders', 0)
-                fts['CheckSum'] = getattr(op, 'CheckSum', 0)
-                fts['Subsystem'] = getattr(op, 'Subsystem', 0)
-                fts['DllCharacteristics'] = getattr(op, 'DllCharacteristics', 0)
-                fts['SizeOfStackReserve'] = getattr(op, 'SizeOfStackReserve', 0)
-                fts['SizeOfStackCommit'] = getattr(op, 'SizeOfStackCommit', 0)
-                fts['SizeOfHeapReserve'] = getattr(op, 'SizeOfHeapReserve', 0)
-                fts['SizeOfHeapCommit'] = getattr(op, 'SizeOfHeapCommit', 0)
-                fts['LoaderFlags'] = getattr(op, 'LoaderFlags', 0)
-                fts['NumberOfRvaAndSizes'] = getattr(op, 'NumberOfRvaAndSizes', 0)
-                fts['Is64Bit'] = 1 if fh.Machine in (0x8664, 0xAA64, 0x0200) else 0
-                fts['IsExe'] = 1 if pe.is_exe() else 0
-                fts['IsDll'] = 1 if pe.is_dll() else 0
-                fts['IsDriver'] = 1 if fts['Subsystem'] == 1 else 0
-
-                if hasattr(op, 'DATA_DIRECTORY'):
-                    reloc_idx = pefile.DIRECTORY_ENTRY.get('IMAGE_DIRECTORY_ENTRY_BASERELOC', 5)
-                    if len(op.DATA_DIRECTORY) > reloc_idx and op.DATA_DIRECTORY[reloc_idx].Size > 0:
-                        fts['HasRelocationDirectory'] = 1
-
-            try:
-                fts['FileEntropy'] = cls._calc_entropy(file_bytes)
-            except Exception:
-                pass
-
-            sec_entropies = []
-            text_entropies = []
-            data_entropies = []
-            rsrc_entropies = []
-            char_flags = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
-
-            if hasattr(pe, 'sections'):
-                fts['SectionCount'] = len(pe.sections)
-                for section in pe.sections:
-                    try: 
-                        name = section.Name.decode('ascii', 'ignore').strip('\x00')
-                    except Exception: 
-                        name = ""
-                        
-                    try: 
-                        s_data = section.get_data()
-                        s_entropy = cls._calc_entropy(s_data)
-                    except Exception: 
-                        s_data = b""
-                        s_entropy = 0.0
-
-                    sec_entropies.append(s_entropy)
-
-                    if any(p in name.lower() for p in cls.PACKERS): fts['HasPacked'] = 1
-                    if section.Characteristics & 0x20000000: fts['ExecutableSections'] += 1
-                    if section.Characteristics & 0x80000000: fts['WritableSections'] += 1
-                    if section.Characteristics & 0x40000000: fts['ReadableSections'] += 1
-                    if section.SizeOfRawData + section.PointerToRawData > fsize: fts['SectionException'] = 1
-
-                    for flag in char_flags:
-                        if section.Characteristics & flag:
-                            fts[f'Char_{flag:08X}_Count'] += 1
-                            fts[f'Char_{flag:08X}_MeanEntropy'] += s_entropy
-
-                    ratio = cls._safe_div(section.SizeOfRawData, fsize)
-                    if name.startswith('.text'):
-                        text_entropies.append(s_entropy)
-                        fts['TextSizeRatio'] += ratio
-                    elif name.startswith('.data'):
-                        data_entropies.append(s_entropy)
-                        fts['DataSizeRatio'] += ratio
-                    elif name.startswith('.rsrc'):
-                        rsrc_entropies.append(s_entropy)
-                        fts['RsrcSizeRatio'] += ratio
-                        if b"requireAdministrator" in s_data: fts['IsAdmin'] = 1
-                        for sig in cls.INSTALLER_SIGS:
-                            if sig in s_data:
-                                fts['IsInstall'] = 1
-                                break
-
-            fts['SectionMeanEntropy'] = cls._safe_div(sum(sec_entropies), len(sec_entropies))
-            fts['TextSectionMaxEntropy'] = max(text_entropies) if text_entropies else 0.0
-            fts['TextSectionMeanEntropy'] = cls._safe_div(sum(text_entropies), len(text_entropies))
-            fts['DataSectionMaxEntropy'] = max(data_entropies) if data_entropies else 0.0
-            fts['DataSectionMeanEntropy'] = cls._safe_div(sum(data_entropies), len(data_entropies))
-            fts['RsrcSectionMaxEntropy'] = max(rsrc_entropies) if rsrc_entropies else 0.0
-            fts['RsrcSectionMeanEntropy'] = cls._safe_div(sum(rsrc_entropies), len(rsrc_entropies))
-
-            for flag in char_flags:
-                fts[f'Char_{flag:08X}_MeanEntropy'] = cls._safe_div(fts[f'Char_{flag:08X}_MeanEntropy'], fts[f'Char_{flag:08X}_Count'])
-
-            try:
-                pe.parse_data_directories(directories=[
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_TLS']
-                ])
-            except Exception:
-                pass
-
-            if hasattr(pe, 'DIRECTORY_ENTRY_TLS') and hasattr(pe.DIRECTORY_ENTRY_TLS, 'struct'):
-                if getattr(pe.DIRECTORY_ENTRY_TLS.struct, 'AddressOfCallBacks', 0) != 0:
-                    fts['HasTlsCallbacks'] = 1
-
-            if hasattr(pe, 'VS_FIXEDFILEINFO') and len(pe.VS_FIXEDFILEINFO) > 0:
-                flags = getattr(pe.VS_FIXEDFILEINFO[0], 'FileFlags', 0)
-                fts['IsDebug'] = 1 if flags & 0x1 else 0
-                fts['IsPreRelease'] = 1 if flags & 0x2 else 0
-                fts['IsPatched'] = 1 if flags & 0x4 else 0
-                fts['IsPrivateBuild'] = 1 if flags & 0x8 else 0
-                fts['IsSpecialBuild'] = 1 if flags & 0x20 else 0
-
-            if hasattr(pe, 'FileInfo'):
-                for fileinfo_list in pe.FileInfo:
-                    for fileinfo in fileinfo_list:
-                        if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
-                            for st in getattr(fileinfo, 'StringTable', []):
-                                for key, val in st.entries.items():
-                                    try:
-                                        k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
-                                        v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
-                                        length = len(v)
-                                        if k == 'FileDescription': fts['FileDescriptionLength'] = length
-                                        elif k == 'FileVersion': fts['FileVersionLength'] = length
-                                        elif k == 'ProductName': fts['ProductNameLength'] = length
-                                        elif k == 'ProductVersion': fts['ProductVersionLength'] = length
-                                        elif k == 'CompanyName': fts['CompanyNameLength'] = length
-                                        elif k == 'LegalCopyright': fts['LegalCopyrightLength'] = length
-                                        elif k == 'Comments': fts['CommentsLength'] = length
-                                        elif k == 'InternalName': fts['InternalNameLength'] = length
-                                        elif k == 'LegalTrademarks': fts['LegalTrademarksLength'] = length
-                                        elif k == 'SpecialBuild': fts['SpecialBuildLength'] = length
-                                        elif k == 'PrivateBuild': fts['PrivateBuildLength'] = length
-                                    except Exception:
-                                        continue
-
-            if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
-                fts['ImportCount'] = len(pe.DIRECTORY_ENTRY_IMPORT)
-                for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                    if getattr(entry, 'dll', None):
-                        try:
-                            dll_name = entry.dll.decode('ascii', 'ignore').lower()
-                            if dll_name in cls.TARGET_DLLS: 
-                                fts[f"Dll_{dll_name.replace('.', '_')}"] = 1.0
-                        except Exception: 
-                            pass
-                    
-                    imports = getattr(entry, 'imports', [])
-                    for imp in imports:
-                        fts['ImportFunctionCount'] += 1
-                        if not getattr(imp, 'name', None): continue
-                        try:
-                            func_name = imp.name.decode('ascii', 'ignore')
-                            if func_name in cls._ALL_APIS:
-                                fts[f'Api_{func_name}'] += 1
-                                fts['ApiCount'] += 1
-                            for cat in cls._API_TO_CATS.get(func_name, []):
-                                fts[f'Cat_{cat}'] += 1
-                        except Exception: 
-                            continue
-
-            if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols'):
-                fts['ExportCount'] = len(pe.DIRECTORY_ENTRY_EXPORT.symbols)
-            
-            if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
-                for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
-                    if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
-                        fts['IconCount'] += len(getattr(entry.directory, 'entries', []))
-                        
-            if hasattr(pe, 'OPTIONAL_HEADER') and hasattr(pe.OPTIONAL_HEADER, 'DATA_DIRECTORY') and len(pe.OPTIONAL_HEADER.DATA_DIRECTORY) > 3:
-                exc_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[3]
-                if exc_dir.Size > 0:
-                    fts['ExceptionCount'] = exc_dir.Size // 12 if fts['Machine'] in (0x8664, 0xAA64) else 0
-                
-            if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'): 
-                fts['DebugCount'] = len(pe.DIRECTORY_ENTRY_DEBUG)
-
-            for k in fts: 
-                fts[k] = cls._safe_float(fts[k])
-                
-            return fts
-
-        except Exception:
-            return None
-        finally:
-            if pe: 
-                pe.close()
-
-####################################################################################################
-
-class ModelPredictor:
-    def __init__(self, model_path, feature_path):
-        self.sess = None
-        self.input_name = None
-        self.feature_order = [] 
-        self.model_features = self._load_features(feature_path)
-        self._load_model(model_path)
-        self._build_input_map()
-
-    def _load_features(self, path):
-        if os.path.exists(path):
-            try:
-                with open(path, 'r') as f:
-                    return json.load(f)
-            except Exception:
-                pass
-        return [re.sub(r'[^A-Za-z0-9_]+', '', f) for f in FeatureExtractor.SCHEMA]
-
-    def _load_model(self, model_path):
-        if not os.path.exists(model_path):
-            raise FileNotFoundError(f"Model missing: {model_path}")
-
-        self.sess = ort.InferenceSession(model_path, providers=['CPUExecutionProvider'])
-        model_inputs = self.sess.get_inputs()
-        self.input_name = model_inputs[0].name
-        expected_dim = model_inputs[0].shape[1]
-        
-        current_dim = len(self.model_features)
-        if current_dim != expected_dim:
-            raise ValueError(f"Dimension Mismatch: Expected {expected_dim}, got {current_dim}.")
-
-    def _build_input_map(self):
-        local_map = {re.sub(r'[^A-Za-z0-9_]+', '', raw_name): raw_name for raw_name in FeatureExtractor.SCHEMA}
-        self.feature_order = [local_map.get(req_feat) for req_feat in self.model_features]
-
-    def predict(self, raw_data):
-        vec_data = [raw_data.get(key, 0.0) if key else 0.0 for key in self.feature_order]
-        vec = np.array(vec_data, dtype=np.float32).reshape(1, -1)
-        outputs = self.sess.run(None, {self.input_name: vec})
-        
-        if len(outputs) > 1:
-            result = outputs[1]
-            if isinstance(result, list) and len(result) > 0:
-                prob_dict = result[0]
-                if hasattr(prob_dict, 'get'):
-                    return float(prob_dict.get(1, prob_dict.get('1', 0.0)))
-            elif isinstance(result, np.ndarray):
-                if result.ndim == 2 and result.shape[1] > 1:
-                    return float(result[0][1])
-        return 0.0
-
-####################################################################################################
-
-def get_threat_name(prob_float):
-    prob_pct = min(int(prob_float * 100), 99)
-    
-    if prob_pct >= 80:
-        return f"General:WinPE/Malware.{prob_pct}!ml"
-    elif prob_pct >= 50:
-        return f"General:WinPE/Suspicious.{prob_pct}!ml"
-    else:
-        return "Undetected"
-
-def scan_target(target, predictor):
-    if not os.path.exists(target):
-        print(json.dumps({"result": "error", "prob": 0.0, "file": target, "details": "Path not found"}))
-        sys.stdout.flush()
-        return
-
-    try:
-        data = FeatureExtractor.extract(target)
-        if not data:
-            print(json.dumps({"result": "error", "prob": 0.0, "file": target, "details": "Extraction failed"}))
-            sys.stdout.flush()
-            return
-        
-        prob = predictor.predict(data)
-        label = get_threat_name(prob)
-        
-        print(json.dumps({"result": label, "prob": round(prob, 4), "file": target}))
-        sys.stdout.flush()
-        
-    except Exception as e:
-        print(json.dumps({"result": "error", "prob": 0.0, "file": target, "details": str(e)}))
-        sys.stdout.flush()
-
-####################################################################################################
-
-if __name__ == "__main__":
-    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
-    model_path = os.path.join(base_dir, MODEL_FILE)
-    feature_path = os.path.join(base_dir, FEATURE_FILE)
-
-    try:
-        predictor = ModelPredictor(model_path, feature_path)
-    except Exception as e:
-        print(json.dumps({"result": "fatal", "details": str(e)}))
-        sys.stdout.flush()
-        sys.exit(1)
-
-    if len(sys.argv) > 1:
-        for path in sys.argv[1:]:
-            scan_target(path.strip(), predictor)
-    else:
-        for line in sys.stdin:
-            target = line.strip()
-            if not target or target.lower() in ['q', 'exit']:
-                break
-            scan_target(target, predictor)

Embed/requirements.txt

@@ -1,4 +0,0 @@
-onnxruntime
-numpy
-pefile
-signify[full]

Engine/Pattern/convert.py

@@ -1,55 +0,0 @@
-from PIL import Image
-import numpy, os
-
-####################################################################################################
-
-def preprocess_image(file_data, size, channels=1):
-    width, height = size
-    wah = int(numpy.ceil(numpy.sqrt(len(file_data) / channels)))
-    arr = numpy.frombuffer(file_data, dtype=numpy.uint8)
-    img = numpy.zeros(wah*wah*channels, dtype=numpy.uint8)
-    img[:len(file_data)] = arr
-    image = Image.fromarray(img.reshape((wah, wah)), 'L')
-    return image.resize((width, height), Image.Resampling.NEAREST)
-
-####################################################################################################
-
-def get_type(file_path):
-    suffix = {".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui", ".cpl"}
-    try:
-        file_content = None
-        if not os.path.splitext(file_path)[-1].lower() in suffix:
-            return file_content
-        with open(file_path, 'rb') as f:
-            file_content = f.read()
-    except:
-        pass
-    return file_content
-
-####################################################################################################
-
-def file_to_images(input_dir, output_dir):
-    for root, dirs, files in os.walk(input_dir):
-        for file in files:
-            try:
-                file_path = os.path.join(root, file)
-                file_content = get_type(file_path)
-                if file_content:
-                    print(file_path)
-                    relative_path = os.path.relpath(root, input_dir)
-                    output_path_dir = os.path.join(output_dir, relative_path)
-
-                    if not os.path.exists(output_path_dir):
-                        os.makedirs(output_path_dir)
-                    image = preprocess_image(file_content, (224, 224))
-                    safe_name = os.path.basename(file_path).replace('/', '_').replace('\\', '_')
-                    image.save(os.path.join(output_path_dir, f"{safe_name}.png"))
-            except Exception as e:
-                print(e)
-
-####################################################################################################
-
-input_directory = input('Enter the folder path: ')
-output_directory = "./Image_Output"
-file_to_images(input_directory, output_directory)
-input('Conversion Complete')

Engine/Pattern/deduplicate.py

@@ -1,34 +0,0 @@
-import os, hashlib
-
-####################################################################################################
-
-def calc_sha256(path):
-    with open(path, "rb") as f:
-        return hashlib.sha256(f.read()).digest()
-
-def dedup_realtime(root):
-    seen = set()
-    deleted = 0
-    for dirpath, _, files in os.walk(root):
-        for name in files:
-            p = os.path.join(dirpath, name)
-            try:
-                h = calc_sha256(p)
-            except Exception:
-                continue
-            if h in seen:
-                try:
-                    os.remove(p)
-                    print(p)
-                    deleted += 1
-                except Exception:
-                    pass
-            else:
-                seen.add(h)
-    print(f"deleted {deleted}")
-
-####################################################################################################
-
-if __name__ == "__main__":
-    dedup_realtime(input("Input file path: "))
-input('Deduplicate Complete')

Engine/Pattern/train.py

@@ -1,165 +0,0 @@
-import tensorflow as tf
-import os, tf2onnx, numpy, random
-from PIL import Image
-from tensorflow.keras import *
-from collections import Counter
-
-####################################################################################################
-
-Image.MAX_IMAGE_PIXELS = None
-tf.keras.mixed_precision.set_global_policy('mixed_float16')
-
-####################################################################################################
-
-def load_dataset(data_dir, image_size=(224, 224), val_split=0.0001, batch_size=256, color_mode="grayscale"):
-    channels = 1 if color_mode == "grayscale" else 3
-    file_paths, labels, class_indices = get_file_list(data_dir)
-    
-    combined = list(zip(file_paths, labels))
-    random.shuffle(combined)
-    file_paths[:], labels[:] = zip(*combined)
-
-    num_val = int(val_split * len(file_paths))
-    train_files = file_paths[num_val:]
-    train_labels = labels[num_val:]
-    val_files = file_paths[:num_val]
-    val_labels = labels[:num_val]
-
-    train_ds = tf.data.Dataset.from_tensor_slices((train_files, train_labels))
-    train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels), num_parallel_calls=tf.data.AUTOTUNE)
-    train_ds = train_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
-
-    val_ds = tf.data.Dataset.from_tensor_slices((val_files, val_labels))
-    val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels), num_parallel_calls=tf.data.AUTOTUNE)
-    val_ds = val_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE)
-
-    train_ds.class_indices = class_indices
-    return train_ds, val_ds
-
-####################################################################################################
-
-def parse_fn(filename, label, image_size, channels):
-    img = tf.io.read_file(filename)
-    img = tf.image.decode_image(img, channels=channels, expand_animations=False)
-    img = tf.cond(tf.reduce_all(tf.equal(tf.shape(img)[:2], image_size)), lambda: tf.cast(img, tf.float32), lambda: tf.image.resize(img, image_size))
-    img = tf.cast(img, tf.float32) / 255.0
-    label = tf.cast(label, tf.float32)
-    return img, label
-
-def get_file_list(directory):
-    file_paths, labels, class_indices = [], [], {}
-    for i, cls in enumerate(sorted([d for d in os.listdir(directory) if os.path.isdir(os.path.join(directory, d))])):
-        class_indices[cls] = i
-        cls_dir = os.path.join(directory, cls)
-
-        for root, _, files in os.walk(cls_dir):
-            for file in files:
-                if file.lower().endswith(('.jpg', '.jpeg', '.png', '.bmp', '.gif')):
-                    file_paths.append(os.path.join(root, file))
-                    labels.append(i)
-    return file_paths, labels, class_indices
-
-####################################################################################################
-
-def multi_conv(x, strides):
-    convs = []
-    for k in [(1, 7), (1, 1), (3, 3), (5, 5)]:
-        c = layers.DepthwiseConv2D(kernel_size=k, strides=strides, padding='same', activation='gelu')(x)
-        convs.append(c)
-
-    x = layers.Concatenate()(convs)
-    x = layers.BatchNormalization()(x)
-    return layers.Activation('gelu')(x)
-
-def gated_conv(x, strides):
-    c = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='gelu')(x)
-    g = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='sigmoid')(x)
-    return layers.Multiply()([c, g])
-
-def coordinate_attention(x, reduction):
-    input_shape = tf.shape(x)
-    h, w = input_shape[1], input_shape[2]
-    filters = x.shape[-1]
-    mip = max(8, filters // reduction)
-
-    x_h = layers.Lambda(lambda t: tf.reduce_mean(t, axis=2, keepdims=True))(x)
-    x_w = layers.Lambda(lambda t: tf.reduce_mean(t, axis=1, keepdims=True))(x)
-    x_w_t = layers.Permute((2, 1, 3))(x_w)
-
-    x_cat = layers.Concatenate(axis=1)([x_h, x_w_t])
-    x_cat = layers.Conv2D(mip, 1, padding='valid', use_bias=False)(x_cat)
-    x_cat = layers.BatchNormalization()(x_cat)
-    x_cat = layers.Activation('gelu')(x_cat)
-
-    x_cat_h, x_cat_w = layers.Lambda(lambda t: tf.split(t[0], [t[1], t[2]], axis=1))([x_cat, h, w])
-    x_h_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_h)
-    x_cat_w = layers.Permute((2, 1, 3))(x_cat_w)
-    x_w_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_w)
-
-    return layers.Multiply()([x, x_h_sigmoid, x_w_sigmoid])
-
-def build_model(input_shape):
-    i = layers.Input(shape=input_shape)
-    x = multi_conv(i, strides=1)
-    x = gated_conv(x, strides=2)
-    x = multi_conv(x, strides=2)
-    x = multi_conv(x, strides=2)
-    x = multi_conv(x, strides=2)
-    x = multi_conv(x, strides=2)
-
-    x = coordinate_attention(x, reduction=4)
-    x = layers.GlobalMaxPooling2D()(x)
-
-    x = layers.Dense(x.shape[-1] // 2, activation='gelu', dtype='float32')(x)
-    o = layers.Dense(1, activation='sigmoid', dtype='float32')(x)
-    return models.Model(i, o)
-
-####################################################################################################
-
-def calculate_lr_cosine_sq(epoch, total_epochs=30, lr_start=5e-4, lr_end=5e-7):
-    cos_val = 0.5 * (1 + numpy.cos(epoch / total_epochs * numpy.pi))
-    return lr_end + (lr_start - lr_end) * (cos_val ** 2)
-
-def lr_scheduler(epoch):
-    return calculate_lr_cosine_sq(epoch)
-
-def binary_focal_loss(gamma=2.0, alpha=0.25):
-    def focal_loss(y_true, y_pred):
-        y_true = tf.cast(y_true, tf.float32)
-        y_pred = tf.clip_by_value(y_pred, tf.keras.backend.epsilon(), 1.0 - tf.keras.backend.epsilon())
-        p_t = tf.where(tf.equal(y_true, 1), y_pred, 1 - y_pred)
-        alpha_t = tf.where(tf.equal(y_true, 1), alpha, 1 - alpha)
-        loss = -alpha_t * tf.math.pow(1.0 - p_t, gamma) * tf.math.log(p_t)
-        return tf.reduce_mean(loss)
-    return focal_loss
-
-class CustomModelCheckpoint(callbacks.Callback):
-    def on_epoch_end(self, epoch, logs=False):
-        models.save_model(self.model, f"PYAS_Model_Epoch_{epoch + 1}.h5")
-        spec = (tf.TensorSpec((None,) + self.model.input.shape[1:], tf.float32),)
-        model_proto, _ = tf2onnx.convert.from_keras(self.model, input_signature=spec, opset=17)
-        with open(f"PYAS_Model_Epoch_{epoch + 1}.onnx", "wb") as f:
-            f.write(model_proto.SerializeToString())
-
-####################################################################################################
-
-train_ds, val_ds = load_dataset(r'.\Image_Full_Pefile')
-for imgs, _ in train_ds.take(1):
-    train_ds.image_shape = imgs.shape[1:]
-    break
-
-try:
-    model = models.load_model('PYAS_Model_Epoch_0.h5', compile=False)
-    print("Load model from disk")
-except:
-    print("Creating a new model")
-    model = build_model(train_ds.image_shape)
-
-print(f"Total parameters: {model.count_params()}")
-model.compile(optimizer='adam', loss=binary_focal_loss(gamma=2.0, alpha=0.25), 
-    metrics=[metrics.BinaryAccuracy(name='accuracy'), metrics.AUC(name='auc'),
-    metrics.Precision(name='precision'), metrics.Recall(name='recall'),
-    metrics.FalsePositives(name='fp'), metrics.TrueNegatives(name='tn')])
-
-model.fit(train_ds, epochs=30, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds, class_weight={0: 10.0, 1: 1.0})
-input('Training Complete')

Engine/Properties/train_server.py

@@ -12,9 +12,9 @@ from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
 
 DB_PATH = "pe_features.db"
 MODEL_FILE = "model.txt"
-ONNX_FILE = "model.onnx"
+ONNX_FILE = "Pefile_General_S1.onnx"
 FEATURE_FILE = "features.json"
-TEST_SIZE = 0.0001
+TEST_SIZE = 0.1
 RANDOM_SEED = 42
 
 LGBM_PARAMS = {
@@ -31,8 +31,8 @@ LGBM_PARAMS = {
     'n_jobs': -1,
     'max_depth': -1,
     'min_data_in_leaf': 10,
-    'lambda_l1': 0.1,
-    'lambda_l2': 0.1,
+    'lambda_l1': 0.05,
+    'lambda_l2': 0.05,
 }
 
 ####################################################################################################
@@ -114,7 +114,7 @@ def train_process(X, y):
     n_neg = (y_train == 0).sum()
     
     base_weight = n_neg / n_pos if n_pos > 0 else 1.0
-    weight_ratio_target = 0.1
+    weight_ratio_target = 0.005
     final_pos_weight = base_weight * weight_ratio_target
     
     print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
@@ -170,11 +170,24 @@ def evaluate_and_save(model, X_test, y_test):
     acc = accuracy_score(y_test, y_pred)
     auc = roc_auc_score(y_test, y_prob)
     
+    tp = np.sum((y_test == 1) & (y_pred == 1))
+    fn = np.sum((y_test == 1) & (y_pred == 0))
+    tn = np.sum((y_test == 0) & (y_pred == 0))
+    fp = np.sum((y_test == 0) & (y_pred == 1))
+    
+    total_malware = tp + fn
+    total_safe = tn + fp
+    
+    detection_rate = (tp / total_malware * 100) if total_malware > 0 else 0.0
+    fpr = (fp / total_safe * 100) if total_safe > 0 else 0.0
+    
     print(f"Accuracy : {acc:.4f}")
-    print(f"ROC AUC  : {auc:.4f}")
-    print("\n" + classification_report(y_test, y_pred, zero_division=0))
+    print(f"ROC AUC  : {auc:.4f}\n")
+    
+    print(f"True Positive (Class 1) : {detection_rate:.3f}% ({tp}/{total_malware})")
+    print(f"False Positive (Class 0) : {fpr:.3f}% ({fp}/{total_safe})")
 
-    print("---------------------------------------------------------\n")
+    print("\n---------------------------------------------------------\n")
     print("[*] Top 20 Features (Importance by Gain):")
     
     feature_names = model.feature_name()

Engine/Properties/train_user.py

@@ -14,14 +14,14 @@ DB_PATH = "pe_features.db"
 MODEL_FILE = "model.txt"
 ONNX_FILE = "Pefile_General_T1.onnx"
 FEATURE_FILE = "features.json"
-TEST_SIZE = 0.0001
+TEST_SIZE = 0.1
 RANDOM_SEED = 42
 
 LGBM_PARAMS = {
     'objective': 'binary',
     'metric': ['binary_logloss', 'auc'],
     'boosting_type': 'gbdt',
-    'num_leaves': 63,
+    'num_leaves': 64,
     'learning_rate': 0.05,
     'feature_fraction': 0.8,
     'bagging_fraction': 0.8,
@@ -31,8 +31,8 @@ LGBM_PARAMS = {
     'n_jobs': -1,
     'max_depth': -1,
     'min_data_in_leaf': 10,
-    'lambda_l1': 0.1,
-    'lambda_l2': 0.1,
+    'lambda_l1': 0.05,
+    'lambda_l2': 0.05,
 }
 
 ####################################################################################################
@@ -170,11 +170,24 @@ def evaluate_and_save(model, X_test, y_test):
     acc = accuracy_score(y_test, y_pred)
     auc = roc_auc_score(y_test, y_prob)
     
+    tp = np.sum((y_test == 1) & (y_pred == 1))
+    fn = np.sum((y_test == 1) & (y_pred == 0))
+    tn = np.sum((y_test == 0) & (y_pred == 0))
+    fp = np.sum((y_test == 0) & (y_pred == 1))
+    
+    total_malware = tp + fn
+    total_safe = tn + fp
+    
+    detection_rate = (tp / total_malware * 100) if total_malware > 0 else 0.0
+    fpr = (fp / total_safe * 100) if total_safe > 0 else 0.0
+    
     print(f"Accuracy : {acc:.4f}")
-    print(f"ROC AUC  : {auc:.4f}")
-    print("\n" + classification_report(y_test, y_pred, zero_division=0))
+    print(f"ROC AUC  : {auc:.4f}\n")
+    
+    print(f"True Positive (Class 1) : {detection_rate:.3f}% ({tp}/{total_malware})")
+    print(f"False Positive (Class 0) : {fpr:.3f}% ({fp}/{total_safe})")
 
-    print("---------------------------------------------------------\n")
+    print("\n---------------------------------------------------------\n")
     print("[*] Top 20 Features (Importance by Gain):")
     
     feature_names = model.feature_name()

Interface/static/css/style.css

@@ -0,0 +1,803 @@
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+    font-family: -apple-system, BlinkMacSystemFont, "SF Pro Text", "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    -webkit-tap-highlight-color: transparent;
+    outline: none;
+}
+
+:root {
+    --bg-window: rgb(245, 245, 247);
+    --bg-nav: rgb(255, 255, 255);
+    --bg-panel: rgb(255, 255, 255);
+    --bg-hover: rgba(0, 0, 0, 0.05);
+    --text-primary: rgb(29, 29, 31);
+    --text-secondary: rgb(134, 134, 139);
+    --border-color: rgb(210, 210, 215);
+    --accent-color: rgb(0, 122, 255);
+    --accent-alpha: rgba(0, 122, 255, 0.1);
+    --accent-shadow: rgba(0, 122, 255, 0.2);
+    --accent-hover: rgba(0, 122, 255, 0.3);
+    --shadow-sm: 0 2px 12px rgba(0, 0, 0, 0.04);
+}
+
+body {
+    background-color: transparent;
+    margin: 0;
+    padding: 0;
+    width: 100vw;
+    height: 100vh;
+    overflow: hidden;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    color: var(--text-primary);
+}
+
+.app-container {
+    width: 100vw;
+    height: 100vh;
+    display: flex;
+    flex-direction: column;
+    overflow: hidden;
+    background-color: var(--bg-window);
+}
+
+.navigate-window {
+    height: 44px;
+    background-color: var(--bg-nav);
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 0 10px 0 20px;
+    border-bottom: 1px solid var(--border-color);
+    transition: background-color 0.3s;
+}
+
+.navigate-title {
+    font-size: 16px;
+    font-weight: 600;
+    letter-spacing: -0.2px;
+}
+
+.window-controls {
+    display: flex;
+    gap: 4px;
+    -webkit-app-region: no-drag;
+}
+
+.ctrl-btn {
+    width: 46px;
+    height: 32px;
+    border: none;
+    background: transparent;
+    border-radius: 6px;
+    cursor: pointer;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    transition: background-color 0.15s;
+    color: var(--text-secondary);
+}
+
+.ctrl-btn:hover { background-color: var(--bg-hover); color: var(--text-primary); }
+#close_button:hover { background-color: #ff3b30; color: white; }
+
+.theme-svg {
+    width: 16px;
+    height: 16px;
+}
+
+.main-layout {
+    display: flex;
+    height: calc(100% - 44px);
+}
+
+.options-window {
+    width: 64px;
+    background-color: var(--bg-nav);
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 16px 0;
+    gap: 12px;
+    border-right: 1px solid var(--border-color);
+    transition: background-color 0.3s;
+}
+
+.nav-btn {
+    width: 44px;
+    height: 44px;
+    border: none;
+    background: transparent;
+    border-radius: 10px;
+    cursor: pointer;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    color: var(--text-secondary);
+    transition: all 0.2s;
+    position: relative;
+}
+
+.nav-btn svg { width: 22px; height: 22px; }
+.nav-btn:hover { background-color: var(--bg-hover); color: var(--text-primary); }
+.nav-btn.active { background-color: var(--accent-alpha); color: var(--accent-color); }
+
+.spacer { flex-grow: 1; }
+
+.content-window {
+    flex-grow: 1;
+    position: relative;
+    overflow: hidden;
+}
+
+.page {
+    position: absolute;
+    top: 0;
+    left: 0;
+    width: 100%;
+    height: 100%;
+    padding: 28px 32px;
+    opacity: 0;
+    visibility: hidden;
+    transform: translateY(8px);
+    transition: opacity 0.25s ease, transform 0.25s ease;
+    display: flex;
+    flex-direction: column;
+}
+
+.page.active {
+    opacity: 1;
+    visibility: visible;
+    transform: translateY(0);
+}
+
+.state-widget {
+    flex: 1;
+    height: 100%;
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    gap: 16px;
+    color: var(--accent-color);
+}
+
+.state-title {
+    font-size: 24px;
+    font-weight: 600;
+    color: var(--text-primary);
+    letter-spacing: -0.5px;
+}
+
+.log-widget {
+    flex-grow: 1;
+    margin-top: 20px;
+}
+
+.license-widget {
+    flex-grow: 1;
+}
+
+.log-text, .license-text {
+    width: 100%;
+    height: 100%;
+    border: 1px solid var(--border-color);
+    border-radius: 12px;
+    background-color: var(--bg-panel);
+    color: var(--text-primary);
+    resize: none;
+    padding: 16px;
+    font-size: 13px;
+    line-height: 1.6;
+    white-space: pre; 
+    overflow-x: auto;
+}
+
+.progress-widget {
+    height: 70px;
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 20px;
+    gap: 16px;
+}
+
+.header-group {
+    flex: 1;
+    min-width: 0;
+}
+
+.header-group h2 {
+    font-size: 24px;
+    font-weight: 600;
+    letter-spacing: -0.5px;
+    white-space: nowrap;
+}
+
+.header-group p {
+    font-size: 14px;
+    color: var(--text-secondary);
+    margin-top: 4px;
+    white-space: nowrap;
+    overflow-x: auto;
+    padding-bottom: 4px;
+}
+
+.modern-action-group {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    flex-shrink: 0;
+}
+
+.modern-select {
+    appearance: none;
+}
+
+.modern-select:hover, .modern-select:focus { 
+    border-color: var(--accent-color); 
+    box-shadow: 0 0 0 2px rgba(0, 122, 255, 0.2); 
+}
+
+.modern-btn {
+    padding: 8px 20px;
+    border: 1px solid var(--border-color);
+    border-radius: 10px;
+    background-color: transparent;
+    color: var(--text-primary);
+    font-size: 14px;
+    font-weight: 500;
+    cursor: pointer;
+    transition: all 0.2s;
+}
+
+.modern-btn:hover { background-color: var(--bg-hover); }
+
+.primary-btn {
+    background-color: var(--accent-color);
+    color: white;
+    border: none;
+    box-shadow: 0 2px 4px var(--accent-shadow);
+}
+.primary-btn:hover {
+    box-shadow: 0 4px 8px var(--accent-hover);
+    transform: translateY(-1px);
+    background-color: var(--accent-color);
+    opacity: 0.95;
+}
+.primary-btn:active {
+    transform: translateY(0);
+    opacity: 0.8;
+}
+
+.danger-btn { color: #ff3b30; border-color: #ff3b30; }
+.danger-btn:hover { background-color: rgba(255, 59, 48, 0.1); }
+
+.hidden { display: none !important; }
+
+.scan-content {
+    flex-grow: 1;
+    min-height: 0;
+    display: flex;
+    flex-direction: column;
+}
+
+.virus-widget {
+    width: 100%;
+    flex-grow: 1;
+    min-height: 0;
+    border: 1px solid var(--border-color);
+    border-radius: 12px;
+    background-color: var(--bg-panel);
+    overflow-y: auto;
+    overflow-x: auto;
+}
+
+.virus-list {
+    list-style: none;
+    padding: 0;
+    margin: 0;
+    min-width: max-content;
+}
+
+.list-widget {
+    display: flex;
+    flex-direction: column;
+    height: 100%;
+    overflow-y: auto;
+    padding-right: 12px;
+    gap: 12px;
+}
+
+.list-item {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 18px 24px;
+    border-radius: 16px;
+    background-color: var(--bg-panel);
+    border: 1px solid var(--border-color);
+    transition: background-color 0.2s;
+    gap: 16px;
+}
+
+.item-info {
+    flex: 1;
+    min-width: 0;
+    overflow-x: auto;
+    padding-bottom: 2px;
+}
+
+.list-item[data-target]:hover, .list-item[data-action]:hover {
+    background-color: var(--bg-hover);
+}
+
+.item-info h2 { 
+    font-size: 16px; 
+    font-weight: 600; 
+    letter-spacing: -0.2px; 
+    white-space: nowrap; 
+}
+
+.item-info p { 
+    font-size: 13px; 
+    color: var(--text-secondary); 
+    margin-top: 4px; 
+    white-space: nowrap; 
+}
+
+.toggle-switch {
+    position: relative;
+    display: inline-block;
+    width: 50px;
+    height: 28px;
+}
+.toggle-switch input { opacity: 0; width: 0; height: 0; }
+.slider {
+    position: absolute;
+    cursor: pointer;
+    top: 0; left: 0; right: 0; bottom: 0;
+    background-color: var(--border-color);
+    transition: .3s;
+    border-radius: 28px;
+}
+.slider:before {
+    position: absolute;
+    content: "";
+    height: 24px; width: 24px;
+    left: 2px; bottom: 2px;
+    background-color: white;
+    transition: .3s;
+    border-radius: 50%;
+    box-shadow: 0 2px 4px rgba(0, 0, 0, 0.2);
+}
+.toggle-switch input:checked + .slider {
+    background-color: var(--accent-color);
+}
+.toggle-switch input:checked + .slider:before {
+    transform: translateX(22px);
+}
+
+.icon-action-btn {
+    width: 32px; height: 32px;
+    border-radius: 8px;
+    border: none;
+    background-color: transparent;
+    color: var(--text-secondary);
+    cursor: pointer;
+    display: flex; justify-content: center; align-items: center;
+    transition: background-color 0.2s;
+}
+.icon-action-btn:hover { background-color: var(--bg-hover); color: var(--text-primary); }
+.icon-action-btn svg { width: 20px; height: 20px; }
+
+.sub-header-toolbar {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    margin-bottom: 16px;
+    width: 100%;
+}
+
+.sub-header-toolbar h2 {
+    font-size: 24px;
+    font-weight: 600;
+    letter-spacing: -0.5px;
+    white-space: nowrap;
+}
+
+.icon-btn {
+    background: transparent;
+    border: none;
+    color: var(--text-secondary);
+    cursor: pointer;
+    padding: 6px;
+    border-radius: 8px;
+    display: flex; align-items: center; justify-content: center;
+    transition: background-color 0.2s;
+}
+.icon-btn:hover { background-color: var(--bg-hover); color: var(--text-primary); }
+.icon-btn svg { width: 24px; height: 24px; }
+
+.search-box {
+    display: flex;
+    align-items: center;
+    background-color: var(--bg-panel);
+    border: 1px solid var(--border-color);
+    border-radius: 10px;
+    padding: 0 14px;
+    width: 200px;
+    transition: border-color 0.2s, box-shadow 0.2s;
+}
+
+.search-box:focus-within {
+    border-color: var(--accent-color);
+    box-shadow: 0 0 0 2px var(--accent-shadow);
+}
+
+.search-box svg {
+    width: 18px; height: 18px;
+    color: var(--text-secondary);
+}
+
+.search-box input {
+    border: none;
+    background: transparent;
+    color: var(--text-primary);
+    padding: 10px;
+    outline: none;
+    width: 100%;
+    font-size: 14px;
+}
+
+.flex-grow {
+    flex-grow: 1;
+    min-height: 0;
+}
+
+.manage-widget {
+    border: 1px solid var(--border-color);
+    border-radius: 12px;
+    background-color: var(--bg-panel);
+    overflow-y: auto;
+    overflow-x: auto;
+}
+
+.manage-list { 
+    list-style: none; 
+    padding: 0; 
+    margin: 0; 
+    min-width: max-content; 
+}
+
+.manage-list-item {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 12px 16px;
+    border-bottom: 1px solid var(--border-color);
+    transition: background-color 0.2s;
+}
+
+.manage-list-item:last-child {
+    border-bottom: none;
+}
+
+.manage-list-item:hover {
+    background-color: var(--bg-hover);
+}
+
+.manage-list-item input[type="checkbox"] {
+    width: 16px;
+    height: 16px;
+    accent-color: var(--accent-color);
+    cursor: pointer;
+    flex-shrink: 0;
+}
+
+.manage-list-item-content {
+    flex-grow: 1;
+    min-width: 0;
+    font-size: 14px;
+    color: var(--text-primary);
+    white-space: nowrap;
+}
+
+.custom-select-wrapper {
+    position: relative;
+    min-width: 100px;
+    display: inline-grid;
+    vertical-align: middle;
+    user-select: none;
+}
+select.hidden + .custom-select-wrapper {
+    display: none !important;
+}
+.custom-select-trigger {
+    grid-area: 1 / 1;
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 8px 16px;
+    border-radius: 10px;
+    border: 1px solid var(--border-color);
+    background-color: var(--bg-panel);
+    color: var(--text-primary);
+    font-size: 14px;
+    font-weight: 500;
+    cursor: pointer;
+    transition: border-color 0.2s, box-shadow 0.2s;
+    gap: 12px;
+    box-sizing: border-box;
+}
+.custom-select-phantom {
+    grid-area: 1 / 1;
+    visibility: hidden;
+    pointer-events: none;
+    display: grid; 
+    padding: 8px 16px;
+    font-size: 14px;
+    font-weight: 500;
+    box-sizing: border-box;
+}
+.custom-select-phantom span {
+    grid-area: 1 / 1; 
+    white-space: nowrap;
+    padding-right: 28px; 
+}
+
+.custom-select-wrapper.open .custom-select-trigger,
+.custom-select-trigger:hover {
+    border-color: var(--accent-color); 
+    box-shadow: 0 0 0 2px var(--accent-shadow);
+}
+.custom-select-icon {
+    display: flex;
+    align-items: center;
+    color: var(--text-secondary);
+    transition: transform 0.3s ease;
+}
+.custom-select-wrapper.open .custom-select-icon {
+    transform: rotate(180deg);
+}
+.custom-select-icon svg { width: 16px; height: 16px; }
+.custom-select-options {
+    position: absolute;
+    top: calc(100% + 8px);
+    left: 0;
+    min-width: 100%;
+    width: max-content;
+    white-space: nowrap;
+    
+    background-color: var(--bg-panel);
+    border: 1px solid var(--border-color);
+    border-radius: 10px;
+    box-shadow: var(--shadow-sm);
+    z-index: 100;
+    list-style: none;
+    margin: 0;
+    max-height: 0;
+    padding: 0 6px;
+    border-width: 0;
+    overflow: hidden;
+    opacity: 0;
+    visibility: hidden;
+    transform: translateY(-10px);
+    transition: opacity 0.2s ease, transform 0.2s ease, visibility 0s 0.2s, max-height 0s 0.2s, padding 0s 0.2s, border-width 0s 0.2s, box-shadow 0s 0.2s;
+}
+.custom-select-wrapper.open .custom-select-options {
+    max-height: 260px;
+    padding: 6px;
+    border-width: 1px;
+    overflow-y: auto;
+    
+    opacity: 1;
+    visibility: visible;
+    transform: translateY(0);
+    transition: opacity 0.2s ease, transform 0.2s ease, visibility 0s 0s, max-height 0s 0s, padding 0s 0s, border-width 0s 0s, box-shadow 0s 0s;
+}
+.custom-select-option {
+    padding: 8px 12px;
+    border-radius: 6px;
+    cursor: pointer;
+    font-size: 14px;
+    color: var(--text-primary);
+    transition: background-color 0.2s, color 0.2s;
+    text-align: center;
+}
+.custom-select-option:hover {
+    background-color: var(--bg-hover);
+}
+.custom-select-option.selected {
+    background-color: var(--accent-alpha);
+    color: var(--accent-color);
+    font-weight: 600;
+}
+
+.home-top-widget {
+    display: flex;
+    align-items: center;
+    height: 200px;
+    gap: 24px;
+    width: 100%;
+}
+
+.quick-actions {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    height: 100%;
+    justify-content: center;
+}
+
+#loading_overlay {
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100vw;
+    height: 100vh;
+    background-color: #e0e0e0;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    z-index: 9999;
+    transition: opacity 0.4s ease, visibility 0.4s ease;
+}
+
+#loading_overlay.fade-out {
+    opacity: 0;
+    visibility: hidden;
+}
+
+.spinner {
+    animation: rotate 2s linear infinite;
+    width: 50px;
+    height: 50px;
+}
+
+.spinner .path {
+    stroke: #86868b;
+    stroke-linecap: round;
+    animation: dash 1.5s ease-in-out infinite;
+}
+
+@keyframes rotate {
+    100% { transform: rotate(360deg); }
+}
+
+@keyframes dash {
+    0% { stroke-dasharray: 1, 150; stroke-dashoffset: 0; }
+    50% { stroke-dasharray: 90, 150; stroke-dashoffset: -35; }
+    100% { stroke-dasharray: 90, 150; stroke-dashoffset: -124; }
+}
+
+.app-container.fade-in {
+    opacity: 1 !important;
+}
+
+.manage-list-header {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 12px 16px;
+    border-bottom: 1px solid var(--border-color);
+    background-color: var(--bg-panel);
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--text-secondary);
+    position: sticky;
+    top: 0;
+    z-index: 10;
+}
+
+.manage-list-header input[type="checkbox"] {
+    width: 16px;
+    height: 16px;
+    accent-color: var(--accent-color);
+    cursor: pointer;
+    flex-shrink: 0;
+}
+
+.header-cols-container, .manage-list-item-content {
+    display: flex;
+    flex-grow: 1;
+    min-width: 0;
+    gap: 16px;
+    align-items: center;
+}
+
+.col-header {
+    position: relative;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    padding: 0 8px;
+    border-right: 1px solid var(--border-color);
+    background-color: var(--bg-panel);
+    user-select: none;
+    -webkit-user-select: none;
+}
+
+.col-header:last-child {
+    border-right: none;
+}
+
+.header-text {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    flex-grow: 1;
+}
+
+.manage-list-header, .col-header, .col-resizer {
+    user-select: none;
+    -webkit-user-select: none;
+}
+
+.col-resizer {
+    position: absolute;
+    right: -5px;
+    top: 0;
+    bottom: 0;
+    width: 10px;
+    cursor: col-resize;
+    z-index: 10;
+    background-color: transparent !important; 
+}
+
+.col-resizer::after {
+    content: "";
+    position: absolute;
+    left: 50%;
+    top: 0;
+    bottom: 0;
+    width: 1px;
+    background-color: transparent;
+    transition: background-color 0.2s;
+}
+
+.col-resizer:hover::after,
+.col-resizer.resizing::after {
+    background-color: var(--text-secondary) !important;
+    opacity: 0.6;
+}
+
+body.resizing-active, 
+body.resizing-active * {
+    user-select: none !important;
+    -webkit-user-select: none !important;
+    cursor: col-resize !important;
+}
+
+.col-resizer:hover {
+    background-color: var(--accent-color);
+    opacity: 0.5;
+}
+
+.col-header:hover {
+    color: var(--text-primary);
+}
+
+.sort-icon {
+    font-size: 10px;
+    margin-left: 4px;
+    color: var(--accent-color);
+    width: 12px;
+}
+
+.row-col {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 14px;
+    color: var(--text-primary);
+}
+
+::-webkit-scrollbar { width: 6px; height: 6px; }
+::-webkit-scrollbar-track { background: transparent; }
+::-webkit-scrollbar-thumb { background: var(--border-color); border-radius: 10px; }
+::-webkit-scrollbar-thumb:hover { background: var(--text-secondary); }

Interface/templates/index.html

@@ -0,0 +1,427 @@
+<!DOCTYPE html>
+<html lang="zh-TW">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>PYAS Security</title>
+    <link rel="stylesheet" href="/static/css/style.css">
+    <script defer src="/static/js/i18n.js"></script>
+    <script defer src="/static/js/main.js"></script>
+</head>
+<body>
+    <div id="loading_overlay">
+        <svg class="spinner" viewBox="0 0 50 50">
+            <circle class="path" cx="25" cy="25" r="20" fill="none" stroke-width="5"></circle>
+        </svg>
+    </div>
+    <div class="app-container" style="opacity: 0; transition: opacity 0.5s ease;">
+        <header class="navigate-window pywebview-drag-region">
+            <div class="navigate-title" data-i18n>PYAS Security</div>
+            <div class="window-controls">
+                <button class="ctrl-btn" id="about_button" data-target="about_window">
+                    <svg viewBox="0 0 24 24" class="theme-svg" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"></circle><line x1="12" y1="16" x2="12" y2="12"></line><line x1="12" y1="8" x2="12.01" y2="8"></line></svg>
+                </button>
+                <button class="ctrl-btn" id="minimize_button">
+                    <svg viewBox="0 0 24 24" class="theme-svg" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"></line></svg>
+                </button>
+                <button class="ctrl-btn" id="close_button">
+                    <svg viewBox="0 0 24 24" class="theme-svg" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"></line><line x1="6" y1="6" x2="18" y2="18"></line></svg>
+                </button>
+            </div>
+        </header>
+
+        <div class="main-layout">
+            <aside class="options-window pywebview-drag-region">
+                <button class="nav-btn active" data-target="home_window">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
+                </button>
+                <button class="nav-btn" data-target="scan_window">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                </button>
+                <button class="nav-btn" data-target="tool_window">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"></rect><rect x="14" y="3" width="7" height="7"></rect><rect x="14" y="14" width="7" height="7"></rect><rect x="3" y="14" width="7" height="7"></rect></svg>
+                </button>
+                <button class="nav-btn" data-target="protect_window">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>
+                </button>
+                <div class="spacer"></div>
+                <button class="nav-btn" data-target="setting_window">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"></circle><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z"></path></svg>
+                </button>
+            </aside>
+
+            <main class="content-window">
+                <section id="home_window" class="page active">
+                    <div class="home-top-widget">
+                        <div class="state-widget">
+                            <svg viewBox="0 0 24 24" class="state-icon theme-svg" style="width: 120px; height: 120px;" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path><polyline points="9 12 11 14 15 10"></polyline></svg>
+                            <h2 class="state-title" data-i18n>此裝置已受到防護</h2>
+                        </div>
+                        <div class="quick-actions">
+                            <div class="list-item" style="cursor: pointer;" id="quick_scan_btn" data-action="scan">
+                                <div class="item-info">
+                                    <h2 data-i18n>智能掃描</h2><p data-i18n>此選項可以快速掃描裝置安全性</p>
+                                </div>
+                                <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                            </div>
+                            <div class="list-item" style="cursor: pointer;" data-target="log_export_window">
+                                <div class="item-info">
+                                    <h2 data-i18n>日誌導出</h2><p data-i18n>此選項可以篩選日誌並匯出存檔</p>
+                                </div>
+                                <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="log-widget">
+                        <textarea class="log-text" readonly></textarea>
+                    </div>
+                </section>
+
+                <section id="scan_window" class="page">
+                    <div class="progress-widget">
+                        <div class="header-group">
+                            <h2 class="section-title" data-i18n>病毒掃描</h2>
+                            <p class="section-desc" id="progress_text" data-i18n>此選項可以選擇進階掃描方式</p>
+                        </div>
+                        <div class="action-group modern-action-group">
+                            <select id="scan_method_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n>選擇</option>
+                                <option value="smart" data-i18n>智能掃描</option>
+                                <option value="file" data-i18n>檔案掃描</option>
+                                <option value="path" data-i18n>路徑掃描</option>
+                                <option value="full" data-i18n>全盤掃描</option>
+                            </select>
+                            <button class="action-btn modern-btn hidden" id="stop_btn" data-i18n>停止</button>
+                        </div>
+                    </div>
+                    <div class="scan-content">
+                        <div class="virus-widget">
+                            <ul class="virus-list" id="virus_list"></ul>
+                        </div>
+                    </div>
+                </section>
+
+                <section id="protect_window" class="page">
+                    <div class="list-widget">
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>進程防護</h2><p data-i18n>此選項可以終止惡意進程運行</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>檔案防護</h2><p data-i18n>此選項可以隔離惡意檔案建立</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>系統防護</h2><p data-i18n>此選項可以實時修復系統異常</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>驅動防護</h2><p data-i18n>此選項可以實時攔截惡意行為</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>網路防護</h2><p data-i18n>此選項可以攔截惡意網路連接</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="custom_protect_window">
+                            <div class="item-info">
+                                <h2 data-i18n>自訂防護</h2><p data-i18n>此選項可以導入自訂防護規則</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                    </div>
+                </section>
+
+                <section id="tool_window" class="page">
+                    <div class="list-widget">
+                        <div class="list-item" style="cursor: pointer;" data-target="taskmgr_window">
+                            <div class="item-info">
+                                <h2 data-i18n>進程管理</h2><p data-i18n>此選項可以實時查看系統進程</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="junk_window">
+                            <div class="item-info">
+                                <h2 data-i18n>垃圾清理</h2><p data-i18n>此選項可以清理暫存垃圾檔案</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="repair_window">
+                            <div class="item-info">
+                                <h2 data-i18n>系統修復</h2><p data-i18n>此選項可以修復系統註冊項目</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="popup_window">
+                            <div class="item-info">
+                                <h2 data-i18n>彈窗攔截</h2><p data-i18n>此選項可以選擇指定窗口攔截</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="whitelist_window">
+                            <div class="item-info">
+                                <h2 data-i18n>白名單</h2><p data-i18n>此選項可以查看並管理白名單</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="quarantine_window">
+                            <div class="item-info">
+                                <h2 data-i18n>隔離區</h2><p data-i18n>此選項可以查看並管理隔離區</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
+                    </div>
+                </section>
+
+                <section id="setting_window" class="page">
+                    <div class="list-widget">
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>增強模式</h2><p data-i18n>此選項可以增強靜態掃描引擎</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox"><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>擴展引擎</h2><p data-i18n>此選項可以使用擴展規則引擎</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox"><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>雲端服務</h2><p data-i18n>此選項可以自動上報可疑檔案</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>選單掃描</h2><p data-i18n>此選項可以啟用右鍵掃描功能</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox"><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>顯色主題</h2><p data-i18n>此選項可以選擇主題顏色</p>
+                            </div>
+                            <select id="theme_select" class="modern-select">
+                                <option value="white_switch" data-i18n>白色主題</option>
+                                <option value="red_switch" data-i18n>紅色主題</option>
+                                <option value="yellow_switch" data-i18n>黃色主題</option>
+                                <option value="green_switch" data-i18n>綠色主題</option>
+                                <option value="blue_switch" data-i18n>藍色主題</option>
+                                <option value="black_switch" data-i18n>黑色主題</option>
+                            </select>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>顯示語言</h2><p data-i18n>此選項可以選擇顯示語言</p>
+                            </div>
+                            <select id="lang_select" class="modern-select">
+                                <option value="english_switch">English</option>
+                                <option value="traditional_switch">繁體中文</option>
+                                <option value="simplified_switch">简体中文</option>
+                                <option value="japanese_switch">日本語</option>
+                                <option value="korean_switch">한국어</option>
+                                <option value="french_switch">Français</option>
+                                <option value="spanish_switch">Español</option>
+                                <option value="hindi_switch">हिन्दी</option>
+                                <option value="arabic_switch">العربية</option>
+                                <option value="russian_switch">Русский</option>
+                                <option value="slovenian_switch">Slovenščina</option>
+                            </select>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>重置選項</h2><p data-i18n>此選項可以重置所有設定</p>
+                            </div>
+                            <button class="action-btn modern-btn danger-btn" data-i18n>執行</button>
+                        </div>
+                    </div>
+                </section>
+
+                <section id="about_window" class="page">
+                    <div class="list-widget">
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>產品金鑰</h2><p data-i18n>此選項可以啟用產品金鑰</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 2l-2 2m-7.61 7.61a5.5 5.5 0 1 1-7.778 7.778 5.5 5.5 0 0 1 7.777-7.777zm0 0L15.5 7.5m0 0l3 3L22 7l-3-3m-3.5 3.5L19 4"></path></svg></button>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>官方網站</h2><p data-i18n>此選項可以前往官方網站</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"></circle><line x1="2" y1="12" x2="22" y2="12"></line><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"></path></svg></button>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>檢查更新</h2><p data-i18n>此選項可以檢查可用更新</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="23 4 23 10 17 10"></polyline><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"></path></svg></button>
+                        </div>
+                        <div class="license-widget">
+                            <textarea class="license-text" readonly>87owo Publicly Available Source Code License Agreement
+Last updated: 2025-12-19
+
+1. License and Ownership
+   - This software and its source code are source available for public view.
+   - Access or execution of certain features may require an activation key.
+   - 87owo reserves all legal rights, no intellectual property is transferred.
+   - All project archives, source code, and binaries remain fully proprietary.
+
+2. Use and Prohibitions
+   - You may view, download, and modify the code for local and personal use.
+   - Redistribution of any original or modified code requires prior consent.
+   - Commercial hosting or SaaS deployment is prohibited without permission.
+   - Reverse engineering, license removal, or illegal use is strictly barred.
+
+3. Data and Privacy
+   - This project may collect operational data for optimization and analysis.
+   - All collected data is strictly anonymized to ensure the user's privacy.
+   - Transmission of information is encrypted to prevent unauthorized access.
+
+4. Updates and Terms
+   - New releases may include critical patches, enhancements, or UI changes.
+   - Continued use of these services constitutes acceptance of updated terms.
+   - The author reserves the right to modify these license terms at any time.
+
+5. Warranty and Liability
+   - All services and assets are provided "as is" without any form of warranty.
+   - 87owo is not liable for any direct or indirect damages from software use.
+   - Users assume all risks regarding performance, data, and system integrity.
+
+© 2020-2026 87owo (PYAS Security). All rights reserved.</textarea>
+                        </div>
+                    </div>
+                </section>
+
+                <section id="taskmgr_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>進程管理</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋進程..." placeholder="搜尋進程...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>查看</button>
+                        <button class="action-btn modern-btn danger-btn" data-i18n>結束</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="whitelist_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>白名單管理</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
+                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="quarantine_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>隔離區管理</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
+                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="junk_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>垃圾清理</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>掃描</button>
+                        <button class="action-btn modern-btn danger-btn" data-i18n>刪除</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="repair_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>系統修復</h2>
+                        <div class="spacer"></div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>掃描</button>
+                        <button class="action-btn modern-btn danger-btn" data-i18n>修復</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="popup_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>彈窗攔截</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋窗口..." placeholder="搜尋窗口...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
+                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="custom_protect_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="protect_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>自訂防護</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋規則..." placeholder="搜尋規則...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
+                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+                
+                <section id="log_export_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="home_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>日誌導出</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋日誌..." placeholder="搜尋日誌...">
+                        </div>
+                        <button class="action-btn modern-btn primary-btn" data-i18n>導出</button>
+                        <button class="action-btn modern-btn danger-btn" data-i18n>刪除</button>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+            </main>
+        </div>
+    </div>
+</body>
+</html>

PYAS_Config.py

@@ -1,555 +0,0 @@
-translate_dict = {
-    "traditional_switch": {"开启":"開啟","关闭":"關閉","On":"開啟","Off":"關閉"},
-
-    "simplified_switch": {"開啟":"开启","關閉":"关闭","On":"开启","Off":"关闭",
-              "錯誤":"错误","發現":"发现","關閉":"关闭","裝置":"设备","記憶體":"内存",
-              "軟體":"软件","檔案":"文件","確定":"确认","設定":"设置","關於":"关于",
-              "總數":"总数","註冊":"注册","圖標":"图标","路徑":"路径","網路":"网络",
-              "位元":"字节","靈敏":"敏感","複製":"复制","開啟":"开启","靜態":"静态",
-              "訊":"讯","項":"项","掃":"扫","試":"试","黃":"黄","嗎":"吗","防":"保",
-              "鑰":"钥","當":"当","後":"后","護":"护","導":"导","區":"区","復":"复",
-              "攔":"拦","請":"请","統":"统","刪":"删","進":"进","個":"个","選":"选",
-              "啟":"启","監":"监","並":"并","徑":"径","盤":"盘","隱":"隐","動":"动",
-              "狀":"状","誌":"志","這":"这","會":"会","題":"题","擇":"择","語":"语",
-              "無":"无","顯":"显","變":"变","戶":"户","碼":"码","雲":"云","介":"界",
-              "稱":"称","類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网",
-              "詢":"询","製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红",
-              "綠":"绿","態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关",
-              "強":"强","驅":"驱","為":"为","腳":"脚","單":"单","開":"开","擴":"扩",
-              "惡":"恶","據":"据","庫":"库","經":"经","敗":"败","謝":"谢","別":"别",
-              "載":"载","誤":"误","報":"报","鏈":"链","竄":"窜","蹤":"踪","與":"与",
-              "異":"异","實":"实","時":"时","彈":"弹","窗":"窗","暫":"暂","訂":"订",
-              "資":"资","產":"产","金":"密","離":"离","規":"规","則":"则","來":"来",
-              "殼":"壳","碼":"码","線":"线","餘":"余",},
-
-    "english_switch": {"開啟":"On","關閉":"Off","开启":"On","关闭":"Off","，":", ",
-              "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Official Website ",
-              "腳本":"Script ","鏈式":"Chain ","記憶體":"Memory ","正在加載":"Loading ","加載":"Load ",
-              "行為":"Behavior ","可疑":"Suspicious ","勒索":"Ransom ","主要":"Main ",
-              "許可條款":"License Terms ","惡意":"Malicious", "開發":"Developers ",
-              "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ","初始化":"initialize ",
-              "正在掃描":"Scanning ","正在刪除":"Deleting ","正在追蹤":"Tracking ",
-              "最小化到":"Minimize To ","靈敏度":"Sensitivity ","正在檢查":"Checking ",
-              "確定要":"Sure Want To ","引擎靈敏度":"Sensitivity ","更新":"Update ",
-              "白色主題":"White","黃色主題":"Yellow","紅色主題":"Red","語言":"Language ",
-              "藍色主題":"Blue","綠色主題":"Green","自訂主題":"Custom","黑色主題":"Black",
-              "特別感謝":"Contributors ","版本資訊":"Information","通訊":"Connect ",
-              "註冊":"Registry ","退出":"Quit ","檔案":"File ","當前":"Currently ",
-              "狀態":"State ","掃描":"Scan ","工具":"Tools ","防護":"Protect ",
-              "失敗":"Failed ","請":"Please ","路徑":"Path ","方式":"Method ",
-              "需要":"Need ","病毒":"Virus ","選擇":"Select ","返回":"Back",
-              "受到":"Been ","錯誤":"Error","完成":"Complete ","引擎":"Engine ",
-              "托盤":"Tray ","圖標":"Icon ","不安全":"Unsafe","增強":"Enhance ",
-              "系統":"System ","雲端":"Cloud ","重啟":"Reboot ","修復":"Repair ",
-              "裝置":"Device ","發現":"Found ","成功":"Success ","清理":"Cleanup ",
-              "確定":"OK","執行":"Execute ","警告":"Warning ","使用":"Use ",
-              "網路":"Network ","變更":"Change ","總數":"Total","結束":"End ",
-              "選項":"Options ","監控":"Monitor ","連接":"Connect ","可以":"Can ",
-              "進程":"Process ","攔截":"Block ","引導":"Boot ","刪除":"Delete ",
-              "分區":"Partition ","設定":"Setting ","關於":"About","模式":"Mode ",
-              "提高":"Improve ","安全":"Security ","顯色":"Color ","顏色":"Color ",
-              "主題":"Theme ", "回收":"Collect ", "無用":"Useless ","導入":"Import ",
-              "風險":"Risk ","介面":"UI ","核心":"Core ","服務":"Services ",
-              "管理":"Manage","所有":"All ","您":"You ","取消":"Cancel ","未":"Not ",
-              "垃圾":"Junk ","位元":"byte ","本機":"Computer ","停止":"Stop ",
-              "到":"To ","白名單":"White List ","軟體":"Software ","正在":"",
-              "增加":"Add ","移除":"Delete ","項目":"Items ","生成":"Create ","稱":"",
-              "複製":"Copy ","此":"This ","並":"And ","全盤":"Full ","最新":"Latest ",
-              "已存在":"Already ","數據庫":"Database ","誤報":"False Positive ",
-              "高":"High ","新":"New ","和":"And ","可能會":"Possible ","會":"Can ",
-              "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Driver ",
-              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Rule ",
-              "密鑰":"Key ","檢測":"Detect ","製作":"Maker ","運行":"Running",
-              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Report ",
-              "分析":"Analysis ","自身":"Self ","其他":"Other ","配置":"Config ",
-              "丟失":"Lost ","網站":"Website ","不兼容":"Not Compatible ","列表":"List ",
-              "竄改":"Tamper ","第三方":"Other ","實時":"Real Time ","查看":"View ",
-              "指定":"Specify ","清空":"Empty ","資源回收桶":"Recycle Bin ", "無法":"Cannot ",
-              "與":"With ","當":"When ","功能":"Function ","異常":"Abnormal ", "來":"To ",
-              "重置":"Reset ","窗口":"Window ","暫存":"Temp ","自訂":"Custom ",
-              "不支持":"Not Support ","共":"Total ","秒":"Seconds ","耗時":"Takes ",
-              "沙箱":"Sandbox ", "虛擬":"Virtual ", "隔離":"Quarantine ", "時":"",
-              "建立":"Create ","環境":"Environment ","化":"","表":"",
-              "達":"Reached ", "上限":"Limit ", "區":"", "金鑰":"Key ", "產品":"Product ",
-              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Inject ",
-              "前往":"Go ","檢查":"Check ","可用":"Available ","靜態":"Static ",
-              "版本":"Version ","是":"","剩餘":"Remain ","遠控":"Remote ","  ":" "},
-
-    "japanese_switch": {"開啟":"オン","關閉":"オフ","开启":"オン","关闭":"オフ","，":", ",
-              "立即刪除":"即時削除","安全模式":"セーフモード","官方網站":"公式サイト",
-              "腳本":"スクリプト","鏈式":"チェーン","記憶體":"メモリ","正在加載":"読み込み中","加載":"ロード",
-              "行為":"振る舞い","可疑":"疑わしい","勒索":"ランサム","主要":"メイン",
-              "許可條款":"ライセンス条項","惡意":"悪意のある","開發":"開発",
-              "啟用":"有効化","禁用":"無効化","正在初始化中":"初期化中","初始化":"初期化",
-              "正在掃描":"スキャン中","正在刪除":"削除中","正在追蹤":"追跡中",
-              "最小化到":"最小化先","靈敏度":"感度","正在檢查":"確認中",
-              "確定要":"本当によろしいですか","引擎靈敏度":"エンジン感度","更新":"更新",
-              "白色主題":"ホワイト","黃色主題":"イエロー","紅色主題":"レッド","語言":"言語",
-              "藍色主題":"ブルー","綠色主題":"グリーン","自訂主題":"カスタム","黑色主題":"ブラック",
-              "特別感謝":"貢献者","版本資訊":"バージョン情報","通訊":"通信",
-              "註冊":"レジストリ","退出":"終了","檔案":"ファイル","當前":"現在の",
-              "狀態":"状態","掃描":"スキャン","工具":"ツール","防護":"保護",
-              "失敗":"失敗","請":"してください","路徑":"パス","方式":"方式",
-              "需要":"必要","病毒":"ウイルス","選擇":"選択","返回":"戻る",
-              "受到":"受けた","錯誤":"エラー","完成":"完了","引擎":"エンジン",
-              "托盤":"トレイ","圖標":"アイコン","不安全":"非セキュア","增強":"強化",
-              "系統":"システム","雲端":"クラウド","重啟":"再起動","修復":"修復",
-              "裝置":"デバイス","發現":"検出","成功":"成功","清理":"クリーンアップ",
-              "確定":"確定","執行":"実行","警告":"警告","使用":"使用",
-              "網路":"ネットワーク","變更":"変更","總數":"合計","結束":"終了",
-              "選項":"オプション","監控":"監視","連接":"接続","可以":"可能",
-              "進程":"プロセス","攔截":"ブロック","引導":"ブート","刪除":"削除",
-              "分區":"パーティション","設定":"設定","關於":"情報","模式":"モード",
-              "提高":"向上","安全":"セキュリティ","顯色":"色","顏色":"色",
-              "主題":"テーマ","回收":"回収","無用":"不要な","導入":"インポート",
-              "風險":"リスク","介面":"インターフェース","核心":"コア","服務":"サービス",
-              "管理":"管理","所有":"すべての","您":"あなた","取消":"キャンセル","未":"未",
-              "垃圾":"ジャンク","位元":"バイト","本機":"PC","停止":"停止",
-              "到":"へ","白名單":"ホワイトリスト","軟體":"ソフトウェア","正在":"",
-              "增加":"追加","移除":"削除","項目":"項目","生成":"生成","稱":"",
-              "複製":"コピー","此":"この","並":"および","全盤":"フル","最新":"最新",
-              "已存在":"既に存在します","數據庫":"データベース","誤報":"誤検知",
-              "高":"高","新":"新","和":"と","可能會":"可能性があります","會":"します",
-              "日誌":"ログ","已":"済み","彈窗":"ポップアップ","要":"する","驅動":"ドライバ",
-              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"ルール",
-              "密鑰":"キー","檢測":"検知","製作":"作成","運行":"実行中",
-              "擴展":"拡張","套件":"キット","自動":"自動","上報":"報告",
-              "分析":"分析","自身":"自身","其他":"その他","配置":"設定",
-              "丟失":"紛失","網站":"ウェブサイト","不兼容":"非互換","列表":"リスト",
-              "竄改":"改ざん","第三方":"サードパーティ","實時":"リアルタイム","查看":"表示",
-              "指定":"指定","清空":"空にする","資源回收桶":"ごみ箱","無法":"できません",
-              "與":"と","當":"時","功能":"機能","異常":"異常","來":"へ",
-              "重置":"リセット","窗口":"ウィンドウ","暫存":"一時","自訂":"カスタム",
-              "不支持":"未対応","共":"合計","秒":"秒","耗時":"所要時間",
-              "沙箱":"サンドボックス","虛擬":"仮想","隔離":"隔離","時":"",
-              "建立":"作成","環境":"環境","化":"","表":"",
-              "達":"到達","上限":"上限","區":"","金鑰":"キー","產品":"製品",
-              "運行庫":".NET CLR","殼碼":"シェルコード","線程":"スレッド","注入":"インジェクション",
-              "前往":"移動","檢查":"確認","可用":"利用可能","靜態":"静的",
-              "版本":"バージョン","是":"","剩餘":"残り","遠控":"遠隔操作","  ":" "},
-
-    "korean_switch": {"開啟":"켜기","關閉":"끄기","开启":"켜기","关闭":"끄기","，":", ",
-              "立即刪除":"즉시 삭제","安全模式":"안전 모드","官方網站":"공식 웹사이트",
-              "腳本":"스크립트","鏈式":"체인","記憶體":"메모리","正在加載":"로딩 중","加載":"로드",
-              "行為":"행위","可疑":"의심스러운","勒索":"랜섬웨어","主要":"주요",
-              "許可條款":"라이선스 약관","惡意":"악성","開發":"개발",
-              "啟用":"활성화","禁用":"비활성화","正在初始化中":"초기화 중","初始化":"초기화",
-              "正在掃描":"스캔 중","正在刪除":"삭제 중","正在追蹤":"추적 중",
-              "最小化到":"최소화","靈敏度":"민감도","正在檢查":"검사 중",
-              "確定要":"정말","引擎靈敏度":"엔진 민감도","更新":"업데이트",
-              "白色主題":"화이트","黃色主題":"옐로우","紅色主題":"레드","語言":"언어",
-              "藍色主題":"블루","綠色主題":"그린","自訂主題":"사용자 지정","黑色主題":"블랙",
-              "特別感謝":"기여자","版本資訊":"버전 정보","通訊":"통신",
-              "註冊":"레지스트리","退出":"종료","檔案":"파일","當前":"현재",
-              "狀態":"상태","掃描":"스캔","工具":"도구","防護":"보호",
-              "失敗":"실패","請":"부탁합니다","路徑":"경로","方式":"방식",
-              "需要":"필요","病毒":"바이러스","選擇":"선택","返回":"뒤로",
-              "受到":"받음","錯誤":"오류","完成":"완료","引擎":"엔진",
-              "托盤":"트레이","圖標":"아이콘","不安全":"안전하지 않음","增強":"강화",
-              "系統":"시스템","雲端":"클라우드","重啟":"재부팅","修復":"복구",
-              "裝置":"장치","發現":"발견","成功":"성공","清理":"정리",
-              "確定":"확인","執行":"실행","警告":"경고","使用":"사용",
-              "網路":"네트워크","變更":"변경","總數":"총계","結束":"종료",
-              "選項":"옵션","監控":"모니터링","連接":"연결","可以":"가능",
-              "進程":"프로세스","攔截":"차단","引導":"부트","刪除":"삭제",
-              "分區":"파티션","設定":"설정","關於":"정보","模式":"모드",
-              "提高":"향상","安全":"보안","顯色":"색상","顏色":"색상",
-              "主題":"테마","回收":"회수","無用":"불필요한","導入":"가져오기",
-              "風險":"위험","介面":"인터페이스","核心":"코어","服務":"서비스",
-              "管理":"관리","所有":"모든","您":"귀하","取消":"취소","未":"미",
-              "垃圾":"정크","位元":"바이트","本機":"PC","停止":"중지",
-              "到":"로","白名單":"화이트리스트","軟體":"소프트웨어","正在":"",
-              "增加":"추가","移除":"제거","項目":"항목","生成":"생성","稱":"",
-              "複製":"복사","此":"이","並":"및","全盤":"전체","最新":"최신",
-              "已存在":"이미 존재함","數據庫":"데이터베이스","誤報":"오탐지",
-              "高":"높음","新":"신규","和":"와","可能會":"할 수 있습니다","會":"합니다",
-              "日誌":"로그","已":"완료","彈窗":"팝업","要":"할","驅動":"드라이버",
-              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"규칙",
-              "密鑰":"키","檢測":"탐지","製作":"제작","運行":"실행 중",
-              "擴展":"확장","套件":"키트","自動":"자동","上報":"보고",
-              "分析":"분석","自身":"자신","其他":"기타","配置":"구성",
-              "丟失":"분실","網站":"웹사이트","不兼容":"호환되지 않음","列表":"목록",
-              "竄改":"변조","第三方":"서드파티","實時":"실시간","查看":"보기",
-              "指定":"지정","清空":"비우기","資源回收桶":"휴지통","無法":"할 수 없음",
-              "與":"와","當":"할 때","功能":"기능","異常":"이상","來":"오다",
-              "重置":"초기화","窗口":"창","暫存":"임시","自訂":"사용자 지정",
-              "不支持":"지원하지 않음","共":"총","秒":"초","耗時":"소요 시간",
-              "沙箱":"샌드박스","虛擬":"가상","隔離":"격리","時":"",
-              "建立":"생성","環境":"환경","化":"","表":"",
-              "達":"도달","上限":"제한","區":"","金鑰":"키","제품":"제품",
-              "運行庫":".NET CLR","殼碼":"셸코드","線程":"스레드","注入":"인젝션",
-              "前往":"이동","檢查":"검사","可用":"사용 가능","靜態":"정적",
-              "版本":"버전","是":"","剩餘":"남은","遠控":"원격 제어","  ":" "},
-
-    "french_switch": {"開啟":"On ","關閉":"Off ","开启":"On ","关闭":"Off ","，":", ",
-              "立即刪除":"Supprimer ","安全模式":"Mode sans échec ","官方網站":"Site officiel ",
-              "腳本":"Script ","鏈式":"Chaîne ","記憶體":"Mémoire ","正在加載":"Chargement ","加載":"Charger ",
-              "行為":"Comportement ","可疑":"Suspect ","勒索":"Ransomware ","主要":"Principal ",
-              "許可條款":"Licence ","惡意":"Malveillant ","開發":"Développeurs ",
-              "啟用":"Activer ","禁用":"Désactiver ","正在初始化中":"Initialisation ","初始化":"Initialiser ",
-              "正在掃描":"Analyse en cours ","正在刪除":"Suppression ","正在追蹤":"Suivi en cours ",
-              "最小化到":"Réduire vers ","靈敏度":"Sensibilité ","正在檢查":"Vérification ",
-              "確定要":"Êtes-vous sûr ","引擎靈敏度":"Sensibilité ","更新":"Mettre à jour ",
-              "白色主題":"Blanc","黃色主題":"Jaune","紅色主題":"Rouge","語言":"Langue ",
-              "藍色主題":"Bleu","綠色主題":"Vert","自訂主題":"Personnalisé","黑色主題":"Noir",
-              "特別感謝":"Contributeurs ","版本資訊":"Information ","通訊":"Connexion ",
-              "註冊":"Registre ","退出":"Quitter ","檔案":"Fichier ","當前":"Actuellement ",
-              "狀態":"État ","掃描":"Analyser ","工具":"Outils ","防護":"Protection ",
-              "失敗":"Échec ","請":"Veuillez ","路徑":"Chemin ","方式":"Méthode ",
-              "需要":"Nécessaire ","病毒":"Virus ","選擇":"Sélectionner ","返回":"Retour ",
-              "受到":"Reçu ","錯誤":"Erreur ","完成":"Terminé ","引擎":"Moteur ",
-              "托盤":"Barre ","圖標":"Icône ","不安全":"Non sécurisé ","增強":"Améliorer ",
-              "系統":"Système ","雲端":"Cloud ","重啟":"Redémarrer ","修復":"Réparer ",
-              "裝置":"Appareil ","發現":"Trouvé ","成功":"Succès ","清理":"Nettoyer ",
-              "確定":"OK ","執行":"Exécuter ","警告":"Avertissement ","使用":"Utiliser ",
-              "網路":"Réseau ","變更":"Modifier ","總數":"Total ","結束":"Fin ",
-              "選項":"Options ","監控":"Surveiller ","連接":"Connecter ","可以":"Peut ",
-              "進程":"Processus ","攔截":"Bloquer ","引導":"Amorçage ","刪除":"Supprimer ",
-              "分區":"Partition ","設定":"Paramètres ","關於":"À propos ","模式":"Mode ",
-              "提高":"Améliorer ","安全":"Sécurité ","顯色":"Couleur ","顏色":"Couleur ",
-              "主題":"Thème ","回收":"Corbeille ","無用":"Inutile ","導入":"Importer ",
-              "風險":"Risque ","介面":"UI ","核心":"Cœur ","服務":"Services ",
-              "管理":"Gérer ","所有":"Tout ","您":"Vous ","取消":"Annuler ","未":"Non ",
-              "垃圾":"Déchet ","位元":"octets ","本機":"PC ","停止":"Arrêter ",
-              "到":"Vers ","白名單":"Liste blanche ","軟體":"Logiciel ","正在":"",
-              "增加":"Ajouter ","移除":"Retirer ","項目":"Éléments ","生成":"Créer ","稱":"",
-              "複製":"Copier ","此":"Ce ","並":"Et ","全盤":"Complet ","最新":"Dernier ",
-              "已存在":"Existe déjà ","數據庫":"Base de données ","誤報":"Faux positif ",
-              "高":"Haut ","新":"Nouveau ","和":"Et ","可能會":"Possible ","會":"Peut ",
-              "日誌":"Journal ","已":"Déjà ","彈窗":"Fenêtre ","要":"À ","驅動":"Pilote ",
-              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Règle ",
-              "密鑰":"Clé ","檢測":"Détecter ","製作":"Créateur ","運行":"En cours ",
-              "擴展":"Extension ","套件":"Kit ","自動":"Auto ","上報":"Signaler ",
-              "分析":"Analyse ","自身":"Soi-même ","其他":"Autre ","配置":"Config ",
-              "丟失":"Perdu ","網站":"Site ","不兼容":"Incompatible ","列表":"Liste ",
-              "竄改":"Altérer ","第三方":"Tiers ","實時":"Temps réel ","查看":"Voir ",
-              "指定":"Spécifier ","清空":"Vider ","資源回收桶":"Corbeille ","無法":"Impossible ",
-              "與":"Avec ","當":"Quand ","功能":"Fonction ","異常":"Anormal ","來":"Pour ",
-              "重置":"Réinitialiser ","窗口":"Fenêtre ","暫存":"Temp ","自訂":"Personnalisé ",
-              "不支持":"Non supporté ","共":"Total ","秒":"Secondes ","耗時":"Prend ",
-              "沙箱":"Sandbox ","虛擬":"Virtuel ","隔離":"Quarantaine ","時":"",
-              "建立":"Créer ","環境":"Environnement ","化":"","表":"",
-              "達":"Atteint ","上限":"Limite ","區":"","金鑰":"Clé ","產品":"Produit ",
-              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Thread ","注入":"Injecter ",
-              "前往":"Aller ","檢查":"Vérifier ","可用":"Disponible ","靜態":"Statique ",
-              "版本":"Version ","是":"","剩餘":"Restant ","遠控":"Distant ","  ":" "},
-
-    "spanish_switch": {"開啟":"On ","關閉":"Off ","开启":"On ","关闭":"Off ","，":", ",
-              "立即刪除":"Eliminar ","安全模式":"Modo seguro ","官方網站":"Sitio web ",
-              "腳本":"Script ","鏈式":"Cadena ","記憶體":"Memoria ","正在加載":"Cargando ","加載":"Cargar ",
-              "行為":"Comportamiento ","可疑":"Sospechoso ","勒索":"Ransomware ","主要":"Principal ",
-              "許可條款":"Licencia ","惡意":"Malicioso ","開發":"Desarrolladores ",
-              "啟用":"Activar ","禁用":"Desactivar ","正在初始化中":"Inicializando ","初始化":"Inicializar ",
-              "正在掃描":"Escaneando ","正在刪除":"Eliminando ","正在追蹤":"Rastreando ",
-              "最小化到":"Minimizar a ","靈敏度":"Sensibilidad ","正在檢查":"Comprobando ",
-              "確定要":"Seguro que ","引擎靈敏度":"Sensibilidad ","更新":"Actualizar ",
-              "白色主題":"Blanco","黃色主題":"Amarillo","紅色主題":"Rojo","語言":"Idioma ",
-              "藍色主題":"Azul","綠色主題":"Verde","自訂主題":"Personalizado","黑色主題":"Negro",
-              "特別感謝":"Colaboradores ","版本資訊":"Información ","通訊":"Conectar ",
-              "註冊":"Registro ","退出":"Salir ","檔案":"Archivo ","當前":"Actualmente ",
-              "狀態":"Estado ","掃描":"Escanear ","工具":"Herramientas ","防護":"Protección ",
-              "失敗":"Fallido ","請":"Por favor ","路徑":"Ruta ","方式":"Método ",
-              "需要":"Necesita ","病毒":"Virus ","選擇":"Seleccionar ","返回":"Volver ",
-              "受到":"Recibido ","錯誤":"Error ","完成":"Completado ","引擎":"Motor ",
-              "托盤":"Bandeja ","圖標":"Icono ","不安全":"Inseguro ","增強":"Mejorar ",
-              "系統":"Sistema ","雲端":"Nube ","重啟":"Reiniciar ","修復":"Reparar ",
-              "裝置":"Dispositivo ","發現":"Encontrado ","成功":"Éxito ","清理":"Limpiar ",
-              "確定":"OK ","執行":"Ejecutar ","警告":"Advertencia ","使用":"Usar ",
-              "網路":"Red ","變更":"Cambiar ","總數":"Total ","結束":"Fin ",
-              "選項":"Opciones ","監控":"Monitor ","連接":"Conectar ","可以":"Puede ",
-              "進程":"Proceso ","攔截":"Bloquear ","引導":"Arranque ","刪除":"Eliminar ",
-              "分區":"Partición ","設定":"Ajustes ","關於":"Acerca de ","模式":"Modo ",
-              "提高":"Mejorar ","安全":"Seguridad ","顯色":"Color ","顏色":"Color ",
-              "主題":"Tema ","回收":"Papelera ","無用":"Inútil ","導入":"Importar ",
-              "風險":"Riesgo ","介面":"UI ","核心":"Núcleo ","服務":"Servicios ",
-              "管理":"Gestionar ","所有":"Todo ","您":"Tú ","取消":"Cancelar ","未":"No ",
-              "垃圾":"Basura ","位元":"bytes ","本機":"PC ","停止":"Detener ",
-              "到":"A ","白名單":"Lista blanca ","軟體":"Software ","正在":"",
-              "增加":"Añadir ","移除":"Eliminar ","項目":"Elementos ","生成":"Crear ","稱":"",
-              "複製":"Copiar ","此":"Este ","並":"Y ","全盤":"Completo ","最新":"Último ",
-              "已存在":"Ya existe ","數據庫":"Base de datos ","誤報":"Falso positivo ",
-              "高":"Alto ","新":"Nuevo ","和":"Y ","可能會":"Posible ","會":"Puede ",
-              "日誌":"Registro ","已":"Ya ","彈窗":"Ventana ","要":"A ","驅動":"Controlador ",
-              "的":"","顯示":"","個":"","嗎":"","了":"","行":"","立即":"","規則":"Regla ",
-              "密鑰":"Clave ","檢測":"Detectar ","製作":"Creador ","運行":"Ejecutando ",
-              "擴展":"Extensión ","套件":"Kit ","自動":"Auto ","上報":"Reportar ",
-              "分析":"Análisis ","自身":"Sí mismo ","其他":"Otro ","配置":"Config ",
-              "丟失":"Perdido ","網站":"Sitio ","不兼容":"Incompatible ","列表":"Lista ",
-              "竄改":"Manipular ","第三方":"Terceros ","實時":"Tiempo real ","查看":"Ver ",
-              "指定":"Especificar ","清空":"Vaciar ","資源回收桶":"Papelera ","無法":"No puede ",
-              "與":"Con ","當":"Cuando ","功能":"Función ","異常":"Anormal ","來":"Para ",
-              "重置":"Restablecer ","窗口":"Ventana ","暫存":"Temp ","自訂":"Personalizado ",
-              "不支持":"No soportado ","共":"Total ","秒":"Segundos ","耗時":"Tarda ",
-              "沙箱":"Sandbox ","虛擬":"Virtual ","隔離":"Cuarentena ","時":"",
-              "建立":"Crear ","環境":"Entorno ","化":"","表":"",
-              "達":"Alcanzado ","上限":"Límite ","區":"","金鑰":"Clave ","產品":"Producto ",
-              "運行庫":".NET CLR ","殼碼":"Shellcode ","線程":"Hilo ","注入":"Inyectar ",
-              "前往":"Ir ","檢查":"Comprobar ","可用":"Disponible ","靜態":"Estático ",
-              "版本":"Versión ","是":"","剩餘":"Restante ","遠控":"Remoto ","  ":" "},
-
-    "hindi_switch": {"開啟":"चालू ", "關閉":"बंद ", "开启":"चालू ", "关闭":"बंद ", "，":", ",
-              "立即刪除":"अभी हटाएं ", "安全模式":"सुरक्षित मोड ", "官方網站":"आधिकारिक वेबसाइट ",
-              "腳本":"स्क्रिप्ट ", "鏈式":"चेन ", "記憶體":"मेमोरी ", "正在加載":"लोड हो रहा है ", "加載":"लोड करें ",
-              "行為":"व्यवहार ", "可疑":"संदिग्ध ", "勒索":"रैनसमवेयर ", "主要":"मुख्य ",
-              "許可條款":"लाइसेंस शर्तें ", "惡意":"दुर्भावनापूर्ण ", "開發":"डेवलपर्स ",
-              "啟用":"सक्षम करें ", "禁用":"अक्षम करें ", "正在初始化中":"प्रारंभ हो रहा है ", "初始化":"प्रारंभ करें ",
-              "正在掃描":"स्कैन हो रहा है ", "正在刪除":"हटाया जा रहा है ", "正在追蹤":"ट्रैक किया जा रहा है ",
-              "最小化到":"इसमें छोटा करें ", "靈敏度":"संवेदनशीलता ", "正在檢查":"जांच हो रही है ",
-              "確定要":"क्या आप सुनिश्चित हैं ", "引擎靈敏度":"इंजन संवेदनशीलता ", "更新":"अपडेट करें ",
-              "白色主題":"सफ़ेद", "黃色主題":"पीला", "紅色主題":"लाल", "語言":"भाषा ",
-              "藍色主題":"नीला", "綠色主題":"हरा", "自訂主題":"कस्टम", "黑色主題":"काला",
-              "特別感謝":"योगदानकर्ता ", "版本資訊":"संस्करण जानकारी ", "通訊":"संचार ",
-              "註冊":"रजिस्ट्री ", "退出":"बाहर निकलें ", "檔案":"फ़ाइल ", "當前":"वर्तमान ",
-              "狀態":"स्थिति ", "掃描":"स्कैन ", "工具":"उपकरण ", "防護":"सुरक्षा ",
-              "失敗":"विफल ", "請":"कृपया ", "路徑":"पथ ", "方式":"तरीका ",
-              "需要":"आवश्यक ", "病毒":"वायरस ", "選擇":"चुनें ", "返回":"वापस",
-              "受到":"प्राप्त हुआ ", "錯誤":"त्रुटि ", "完成":"पूरा हुआ ", "引擎":"इंजन ",
-              "托盤":"ट्रे ", "圖標":"आइकन ", "不安全":"असुरक्षित ", "增強":"बढ़ाना ",
-              "系統":"सिस्टम ", "雲端":"क्लाउड ", "重啟":"रीबूट ", "修復":"मरम्मत ",
-              "裝置":"डिवाइस ", "發現":"मिला ", "成功":"सफल ", "清理":"सफाई ",
-              "確定":"ठीक ", "執行":"निष्पादित करें ", "警告":"चेतावनी ", "使用":"उपयोग ",
-              "網路":"नेटवर्क ", "變更":"बदलें ", "總數":"कुल ", "結束":"समाप्त ",
-              "選項":"विकल्प ", "監控":"मॉनिटर ", "連接":"कनेक्ट ", "可以":"सकता है ",
-              "進程":"प्रक्रिया ", "攔截":"ब्लॉक ", "引導":"बूट ", "刪除":"हटाएं ",
-              "分區":"पार्टीशन ", "設定":"सेटिंग्स ", "關於":"के बारे में ", "模式":"मोड ",
-              "提高":"सुधारें ", "安全":"सुरक्षा ", "顯色":"रंग ", "顏色":"रंग ",
-              "主題":"थीम ", "回收":"रीसायकल ", "無用":"बेकार ", "導入":"आयात ",
-              "風險":"जोखिम ", "介面":"यूआई ", "核心":"कोर ", "服務":"सेवाएं ",
-              "管理":"प्रबंधित करें ", "所有":"सभी ", "您":"आप ", "取消":"रद्द करें ", "未":"नहीं ",
-              "垃圾":"कचरा ", "位元":"बाइट ", "本機":"पीसी ", "停止":"रोकें ",
-              "到":"तक ", "白名單":"श्वेत सूची ", "軟體":"सॉफ़्टवेयर ", "正在":"",
-              "增加":"जोड़ें ", "移除":"हटाएं ", "項目":"आइटम ", "生成":"बनाएं ", "稱":"",
-              "複製":"कॉपी ", "此":"यह ", "並":"और ", "全盤":"पूर्ण ", "最新":"नवीनतम ",
-              "已存在":"पहले से मौजूद ", "數據庫":"डेटाबेस ", "誤報":"गलत सूचना ",
-              "高":"उच्च ", "新":"नया ", "和":"और ", "可能會":"संभव ", "會":"सकता है ",
-              "日誌":"लॉग ", "已":"हो चुका ", "彈窗":"विंडो ", "要":"को ", "驅動":"ड्राइवर ",
-              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"नियम ",
-              "密鑰":"कुंजी ", "檢測":"पता लगाएं ", "製作":"निर्माता ", "運行":"चल रहा है ",
-              "擴展":"एक्सटेंशन ", "套件":"किट ", "自動":"ऑटो ", "上報":"रिपोर्ट ",
-              "分析":"विश्लेषण ", "自身":"स्वयं ", "其他":"अन्य ", "配置":"कॉन्फ़िगर ",
-              "丟失":"खो गया ", "網站":"वेबसाइट ", "不兼容":"असंगत ", "列表":"सूची ",
-              "竄改":"छेड़छाड़ ", "第三方":"थर्ड पार्टी ", "實時":"वास्तविक समय ", "查看":"देखें ",
-              "指定":"निर्दिष्ट करें ", "清空":"खाली करें ", "資源回收桶":"रीसायकल बिन ", "無法":"असमर्थ ",
-              "與":"के साथ ", "當":"जब ", "功能":"कार्य ", "異常":"असामान्य ", "來":"के लिए ",
-              "重置":"रीसेट ", "窗口":"विंडो ", "暫存":"अस्थायी ", "自訂":"कस्टम ",
-              "不支持":"समर्थित नहीं ", "共":"कुल ", "秒":"सेकंड ", "耗時":"लगा समय ",
-              "沙箱":"सैंडबॉक्स ", "虛擬":"आभासी ", "隔離":"संगरोध ", "時":"",
-              "建立":"बनाएं ", "環境":"वातावरण ", "化":"", "表":"",
-              "達":"पहुंच गया ", "上限":"सीमा ", "區":"", "金鑰":"कुंजी ", "產品":"उत्पाद ",
-              "運行庫":".NET CLR ", "殼碼":"शेलकोड ", "線程":"थ्रेड ", "注入":"इंजेक्टर ",
-              "前往":"जाएं ", "檢查":"जांचें ", "可用":"उपलब्ध ", "靜態":"स्थैतिक ",
-              "版本":"संस्करण ", "是":"", "剩餘":"शेष ", "遠控":"रिमोट ", "  ":" "},
-
-    "arabic_switch": {"開啟":"تشغيل ", "關閉":"إيقاف ", "开启":"تشغيل ", "关闭":"إيقاف ", "，":", ",
-              "立即刪除":"حذف الآن ", "安全模式":"الوضع الآمن ", "官方網站":"الموقع الرسمي ",
-              "腳本":"برنامج نصي ", "鏈式":"سلسلة ", "記憶體":"الذاكرة ", "正在加載":"جار التحميل ", "加載":"تحميل ",
-              "行為":"سلوك ", "可疑":"مشبوه ", "勒索":"فدية ", "主要":"رئيسي ",
-              "許可條款":"شروط الترخيص ", "惡意":"ضار ", "開發":"المطورين ",
-              "啟用":"تفعيل ", "禁用":"تعطيل ", "正在初始化中":"جار التهيئة ", "初始化":"تهيئة ",
-              "正在掃描":"جار الفحص ", "正在刪除":"جار الحذف ", "正在追蹤":"جار التتبع ",
-              "最小化到":"تصغير إلى ", "靈敏度":"حساسية ", "正在檢查":"جار التحقق ",
-              "確定要":"هل أنت متأكد ", "引擎靈敏度":"حساسية المحرك ", "更新":"تحديث ",
-              "白色主題":"أبيض", "黃色主題":"أصفر", "紅色主題":"أحمر", "語言":"اللغة ",
-              "藍色主題":"أزرق", "綠色主題":"أخضر", "自訂主題":"مخصص", "黑色主題":"أسود",
-              "特別感謝":"المساهمون ", "版本資訊":"معلومات الإصدار ", "通訊":"اتصال ",
-              "註冊":"السجل ", "退出":"خروج ", "檔案":"ملف ", "當前":"الحالي ",
-              "狀態":"الحالة ", "掃描":"فحص ", "工具":"أدوات ", "防護":"حماية ",
-              "失敗":"فشل ", "請":"يرجى ", "路徑":"مسار ", "方式":"طريقة ",
-              "需要":"يحتاج ", "病毒":"فيروس ", "選擇":"تحديد ", "返回":"رجوع",
-              "受到":"تم الاستلام ", "錯誤":"خطأ ", "完成":"مكتمل ", "引擎":"محرك ",
-              "托盤":"صينية ", "圖標":"أيقونة ", "不安全":"غير آمن ", "增強":"تحسين ",
-              "系統":"النظام ", "雲端":"سحابة ", "重啟":"إعادة تشغيل ", "修復":"إصلاح ",
-              "裝置":"جهاز ", "發現":"تم العثور ", "成功":"نجاح ", "清理":"تنظيف ",
-              "確定":"موافق ", "執行":"تنفيذ ", "警告":"تحذير ", "使用":"استخدام ",
-              "網路":"الشبكة ", "變更":"تغيير ", "總數":"الإجمالي ", "結束":"إنهاء ",
-              "選項":"خيارات ", "監控":"مراقبة ", "連接":"اتصال ", "可以":"يمكن ",
-              "進程":"عملية ", "攔截":"حظر ", "引導":"إقلاع ", "刪除":"حذف ",
-              "分區":"قسم ", "設定":"إعدادات ", "關於":"حول ", "模式":"وضع ",
-              "提高":"تحسين ", "安全":"أمان ", "顯色":"لون ", "顏色":"لون ",
-              "主題":"سمة ", "回收":"استرجاع ", "無用":"غير مفيد ", "導入":"استيراد ",
-              "風險":"خطر ", "介面":"واجهة ", "核心":"نواة ", "服務":"خدمات ",
-              "管理":"إدارة ", "所有":"الكل ", "您":"أنت ", "取消":"إلغاء ", "未":"غير ",
-              "垃圾":"مهملات ", "位元":"بايت ", "本機":"الكمبيوتر ", "停止":"إيقاف ",
-              "到":"إلى ", "白名單":"القائمة البيضاء ", "軟體":"برنامج ", "正在":"",
-              "增加":"إضافة ", "移除":"إزالة ", "項目":"عناصر ", "生成":"إنشاء ", "稱":"",
-              "複製":"نسخ ", "此":"هذا ", "並":"و ", "全盤":"كامل ", "最新":"الأحدث ",
-              "已存在":"موجود بالفعل ", "數據庫":"قاعدة البيانات ", "誤報":"إيجابي كاذب ",
-              "高":"عالي ", "新":"جديد ", "和":"و ", "可能會":"محتمل ", "會":"سوف ",
-              "日誌":"سجل ", "已":"بالفعل ", "彈窗":"نافذة ", "要":"إلى ", "驅動":"برنامج تشغيل ",
-              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"قاعدة ",
-              "密鑰":"مفتاح ", "檢測":"اكتشاف ", "製作":"صانع ", "運行":"قيد التشغيل ",
-              "擴展":"امتداد ", "套件":"مجموعة ", "自動":"تلقائي ", "上報":"إبلاغ ",
-              "分析":"تحليل ", "自身":"نفسه ", "其他":"آخر ", "配置":"تكوين ",
-              "丟失":"مفقود ", "網站":"موقع ", "不兼容":"غير متوافق ", "列表":"قائمة ",
-              "竄改":"تلاعب ", "第三方":"جهة خارجية ", "實時":"الوقت الفعلي ", "查看":"عرض ",
-              "指定":"تحديد ", "清空":"إفراغ ", "資源回收桶":"سلة المهملات ", "無法":"غير قادر ",
-              "與":"مع ", "當":"عندما ", "功能":"وظيفة ", "異常":"شاذ ", "來":"ل ",
-              "重置":"إعادة ضبط ", "窗口":"نافذة ", "暫存":"مؤقت ", "自訂":"مخصص ",
-              "不支持":"غير مدعوم ", "共":"إجمالي ", "秒":"ثواني ", "耗時":"استغرق ",
-              "沙箱":"صندوق الحماية ", "虛擬":"افتراضي ", "隔離":"عزل ", "時":"",
-              "建立":"إنشاء ", "環境":"بيئة ", "化":"", "表":"",
-              "達":"وصل ", "上限":"الحد ", "區":"", "金鑰":"مفتاح ", "產品":"منتج ",
-              "運行庫":".NET CLR ", "殼碼":"رمز قشرة ", "線程":"سلسلة ", "注入":"حقن ",
-              "前往":"الذهاب ", "檢查":"فحص ", "可用":"متاح ", "靜態":"ثابت ",
-              "版本":"إصدار ", "是":"", "剩餘":"المتبقي ", "遠控":"عن بعد ", "  ":" "},
-
-    "russian_switch": {"開啟":"Вкл ", "關閉":"Выкл ", "开启":"Вкл ", "关闭":"Выкл ", "，":", ",
-              "立即刪除":"Удалить сейчас ", "安全模式":"Безопасный режим ", "官方網站":"Официальный сайт ",
-              "腳本":"Скрипт ", "鏈式":"Цепочка ", "記憶體":"Память ", "正在加載":"Загрузка ", "加載":"Загрузить ",
-              "行為":"Поведение ", "可疑":"Подозрительный ", "勒索":"Вымогатель ", "主要":"Главный ",
-              "許可條款":"Условия лицензии ", "惡意":"Вредоносный ", "開發":"Разработчики ",
-              "啟用":"Включить ", "禁用":"Отключить ", "正在初始化中":"Инициализация ", "初始化":"Инициализировать ",
-              "正在掃描":"Сканирование ", "正在刪除":"Удаление ", "正在追蹤":"Отслеживание ",
-              "最小化到":"Свернуть в ", "靈敏度":"Чувствительность ", "正在檢查":"Проверка ",
-              "確定要":"Вы уверены, что ", "引擎靈敏度":"Чувствительность движка ", "更新":"Обновить ",
-              "白色主題":"Белый", "黃色主題":"Желтый", "紅色主題":"Красный", "語言":"Язык ",
-              "藍色主題":"Синий", "綠色主題":"Зеленый", "自訂主題":"Пользовательский", "黑色主題":"Черный",
-              "特別感謝":"Участники ", "版本資訊":"Информация о версии ", "通訊":"Связь ",
-              "註冊":"Реестр ", "退出":"Выход ", "檔案":"Файл ", "當前":"Текущий ",
-              "狀態":"Статус ", "掃描":"Сканировать ", "工具":"Инструменты ", "防護":"Защита ",
-              "失敗":"Ошибка ", "請":"Пожалуйста ", "路徑":"Путь ", "方式":"Метод ",
-              "需要":"Требуется ", "病毒":"Вирус ", "選擇":"Выбрать ", "返回":"Назад",
-              "受到":"Получено ", "錯誤":"Ошибка ", "完成":"Завершено ", "引擎":"Движок ",
-              "托盤":"Трей ", "圖標":"Значок ", "不安全":"Небезопасно ", "增強":"Улучшить ",
-              "系統":"Система ", "雲端":"Облако ", "重啟":"Перезагрузка ", "修復":"Восстановить ",
-              "裝置":"Устройство ", "發現":"Найдено ", "成功":"Успех ", "清理":"Очистка ",
-              "確定":"ОК ", "執行":"Выполнить ", "警告":"Предупреждение ", "使用":"Использовать ",
-              "網路":"Сеть ", "變更":"Изменить ", "總數":"Всего ", "結束":"Завершить ",
-              "選項":"Опции ", "監控":"Монитор ", "連接":"Подключить ", "可以":"Можно ",
-              "進程":"Процесс ", "攔截":"Блокировать ", "引導":"Загрузка ", "刪除":"Удалить ",
-              "分區":"Раздел ", "設定":"Настройки ", "關於":"О программе ", "模式":"Режим ",
-              "提高":"Улучшить ", "安全":"Безопасность ", "顯色":"Цвет ", "顏色":"Цвет ",
-              "主題":"Тема ", "回收":"Корзина ", "無用":"Бесполезно ", "導入":"Импорт ",
-              "風險":"Риск ", "介面":"Интерфейс ", "核心":"Ядро ", "服務":"Службы ",
-              "管理":"Управление ", "所有":"Все ", "您":"Вы ", "取消":"Отмена ", "未":"Не ",
-              "垃圾":"Мусор ", "位元":"байт ", "本機":"ПК ", "停止":"Остановить ",
-              "到":"К ", "白名單":"Белый список ", "軟體":"ПО ", "正在":"",
-              "增加":"Добавить ", "移除":"Удалить ", "項目":"Элементы ", "生成":"Создать ", "稱":"",
-              "複製":"Копировать ", "此":"Этот ", "並":"И ", "全盤":"Полный ", "最新":"Последний ",
-              "已存在":"Уже существует ", "數據庫":"База данных ", "誤報":"Ложное срабатывание ",
-              "高":"Высокий ", "新":"Новый ", "和":"И ", "可能會":"Возможно ", "會":"Может ",
-              "日誌":"Журнал ", "已":"Уже ", "彈窗":"Окно ", "要":"Нужно ", "驅動":"Драйвер ",
-              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"Правило ",
-              "密鑰":"Ключ ", "檢測":"Обнаружить ", "製作":"Создатель ", "運行":"Работает ",
-              "擴展":"Расширение ", "套件":"Набор ", "自動":"Авто ", "上報":"Отчет ",
-              "分析":"Анализ ", "自身":"Сам ", "其他":"Другое ", "配置":"Конфиг ",
-              "丟失":"Утерян ", "網站":"Сайт ", "不兼容":"Несовместимо ", "列表":"Список ",
-              "竄改":"Вмешательство ", "第三方":"Сторонний ", "實時":"Реальное время ", "查看":"Просмотр ",
-              "指定":"Указать ", "清空":"Очистить ", "資源回收桶":"Корзина ", "無法":"Невозможно ",
-              "與":"С ", "當":"Когда ", "功能":"Функция ", "異常":"Аномалия ", "來":"Для ",
-              "重置":"Сброс ", "窗口":"Окно ", "暫存":"Временный ", "自訂":"Пользовательский ",
-              "不支持":"Не поддерживается ", "共":"Всего ", "秒":"Секунд ", "耗時":"Заняло ",
-              "沙箱":"Песочница ", "虛擬":"Виртуальный ", "隔離":"Карантин ", "時":"",
-              "建立":"Создать ", "環境":"Среда ", "化":"", "表":"",
-              "達":"Достигнут ", "上限":"Лимит ", "區":"", "金鑰":"Ключ ", "產品":"Продукт ",
-              "運行庫":".NET CLR ", "殼碼":"Шелл-код ", "線程":"Поток ", "注入":"Инъекция ",
-              "前往":"Перейти ", "檢查":"Проверить ", "可用":"Доступно ", "靜態":"Статический ",
-              "版本":"Версия ", "是":"", "剩餘":"Осталось ", "遠控":"Удаленный ", "  ":" "},
-
-    "slovenian_switch": {"開啟":"Vklop ", "關閉":"Izklop ", "开启":"Vklop ", "关闭":"Izklop ", "，":", ",
-              "立即刪除":"Izbriši zdaj ", "安全模式":"Varni način ", "官方網站":"Uradna spletna stran ",
-              "腳本":"Skripta ", "鏈式":"Veriga ", "記憶體":"Pomnilnik ", "正在加載":"Nalaganje ", "加載":"Naloži ",
-              "行為":"Vedenje ", "可疑":"Sumljivo ", "勒索":"Izsiljevalska ", "主要":"Glavni ",
-              "許可條款":"Licenčni pogoji ", "惡意":"Zlonamerno ", "開發":"Razvijalci ",
-              "啟用":"Omogoči ", "禁用":"Onemogoči ", "正在初始化中":"Inicializacija ", "初始化":"Inicializiraj ",
-              "正在掃描":"Skeniranje ", "正在刪除":"Brisanje ", "正在追蹤":"Sledenje ",
-              "最小化到":"Minimiziraj v ", "靈敏度":"Občutljivost ", "正在檢查":"Preverjanje ",
-              "確定要":"Ali ste prepričani ", "引擎靈敏度":"Občutljivost mehanizma ", "更新":"Posodobi ",
-              "白色主題":"Bela", "黃色主題":"Rumena", "紅色主題":"Rdeča", "語言":"Jezik ",
-              "藍色主題":"Modra", "綠色主題":"Zelena", "自訂主題":"Po meri", "黑色主題":"Črna",
-              "特別感謝":"Sodelavci ", "版本資訊":"Informacije o različici ", "通訊":"Povezava ",
-              "註冊":"Register ", "退出":"Izhod ", "檔案":"Datoteka ", "當前":"Trenutno ",
-              "狀態":"Stanje ", "掃描":"Skeniraj ", "工具":"Orodja ", "防護":"Zaščita ",
-              "失敗":"Neuspešno ", "請":"Prosim ", "路徑":"Pot ", "方式":"Način ",
-              "需要":"Potrebno ", "病毒":"Virus ", "選擇":"Izberi ", "返回":"Nazaj",
-              "受到":"Prejeto ", "錯誤":"Napaka ", "完成":"Končano ", "引擎":"Mehanizem ",
-              "托盤":"Pladenj ", "圖標":"Ikona ", "不安全":"Nevarno ", "增強":"Izboljšaj ",
-              "系統":"Sistem ", "雲端":"Oblak ", "重啟":"Ponovni zagon ", "修復":"Popravi ",
-              "裝置":"Naprava ", "發現":"Najdeno ", "成功":"Uspeh ", "清理":"Čiščenje ",
-              "確定":"V redu ", "執行":"Izvedi ", "警告":"Opozorilo ", "使用":"Uporabi ",
-              "網路":"Omrežje ", "變更":"Spremeni ", "總數":"Skupaj ", "結束":"Konec ",
-              "選項":"Možnosti ", "監控":"Nadzor ", "連接":"Poveži ", "可以":"Lahko ",
-              "進程":"Proces ", "攔截":"Blokiraj ", "引導":"Zagon ", "刪除":"Izbriši ",
-              "分區":"Particija ", "設定":"Nastavitve ", "關於":"O programu ", "模式":"Način ",
-              "提高":"Povečaj ", "安全":"Varnost ", "顯色":"Barva ", "顏色":"Barva ",
-              "主題":"Tema ", "回收":"Koš ", "無用":"Nekoristno ", "導入":"Uvozi ",
-              "風險":"Tveganje ", "介面":"Vmesnik ", "核心":"Jedro ", "服務":"Storitve ",
-              "管理":"Upravljaj ", "所有":"Vse ", "您":"Vi ", "取消":"Prekliči ", "未":"Ne ",
-              "垃圾":"Smeti ", "位元":"bajtov ", "本機":"PC ", "停止":"Ustavi ",
-              "到":"V ", "白名單":"Beli seznam ", "軟體":"Programska oprema ", "正在":"",
-              "增加":"Dodaj ", "移除":"Odstrani ", "項目":"Predmeti ", "生成":"Ustvari ", "稱":"",
-              "複製":"Kopiraj ", "此":"To ", "並":"In ", "全盤":"Popolno ", "最新":"Najnovejše ",
-              "已存在":"Že obstaja ", "數據庫":"Podatkovna baza ", "誤報":"Lažni alarm ",
-              "高":"Visoko ", "新":"Novo ", "和":"In ", "可能會":"Možno ", "會":"Bo ",
-              "日誌":"Dnevnik ", "已":"Že ", "彈窗":"Okno ", "要":"V ", "驅動":"Gonilnik ",
-              "的":"", "顯示":"", "個":"", "嗎":"", "了":"", "行":"", "立即":"", "規則":"Pravilo ",
-              "密鑰":"Ključ ", "檢測":"Zaznaj ", "製作":"Ustvarjalec ", "運行":"Se izvaja ",
-              "擴展":"Razširitev ", "套件":"Komplet ", "自動":"Samodejno ", "上報":"Prijavi ",
-              "分析":"Analiza ", "自身":"Samo ", "其他":"Drugo ", "配置":"Konfiguracija ",
-              "丟失":"Izgubljeno ", "網站":"Spletno mesto ", "不兼容":"Nezdružljivo ", "列表":"Seznam ",
-              "竄改":"Spreminjanje ", "第三方":"Tretja oseba ", "實時":"V realnem času ", "查看":"Poglej ",
-              "指定":"Določi ", "清空":"Izprazni ", "資源回收桶":"Koš ", "無法":"Ni mogoče ",
-              "與":"Z ", "當":"Ko ", "功能":"Funkcija ", "異常":"Nenormalno ", "來":"Za ",
-              "重置":"Ponastavi ", "窗口":"Okno ", "暫存":"Začasno ", "自訂":"Po meri ",
-              "不支持":"Ni podprto ", "共":"Skupaj ", "秒":"Sekund ", "耗時":"Trajalo ",
-              "沙箱":"Peskovnik ", "虛擬":"Virtualno ", "隔離":"Karantena ", "時":"",
-              "建立":"Ustvari ", "環境":"Okolje ", "化":"", "表":"",
-              "達":"Doseženo ", "上限":"Omejitev ", "區":"", "金鑰":"Ključ ", "產品":"Izdelek ",
-              "運行庫":".NET CLR ", "殼碼":"Zlonamerna koda ", "線程":"Nit ", "注入":"Vbrizgavanje ",
-              "前往":"Pojdi ", "檢查":"Preveri ", "可用":"Na voljo ", "靜態":"Statično ",
-              "版本":"Različica ", "是":"", "剩餘":"Preostalo ", "遠控":"Oddaljeno ", "  ":" "},
-
-    "custom_language_switch": {},
-
-    "white_switch": {
-        "_white": "_black",},
-    "red_switch": {
-        "235, 235, 235": "255, 235, 235",
-        "245, 245, 245": "255, 225, 225",
-        "255, 255, 255": "255, 245, 245",
-        "240, 240, 240": "255, 220, 220",
-        "250, 250, 250": "255, 210, 210",
-        "220, 255, 220": "255, 220, 220",
-        "210, 255, 210": "255, 210, 210",
-        "_white": "_black"
-    },
-    "yellow_switch": {
-        "235, 235, 235": "255, 255, 235",
-        "245, 245, 245": "255, 255, 225",
-        "255, 255, 255": "255, 255, 245",
-        "240, 240, 240": "255, 255, 220",
-        "250, 250, 250": "255, 255, 210",
-        "220, 255, 220": "255, 255, 220",
-        "210, 255, 210": "255, 255, 210",
-        "_white": "_black"
-    },
-    "green_switch": {
-        "235, 235, 235": "235, 255, 235",
-        "245, 245, 245": "225, 255, 225",
-        "255, 255, 255": "245, 255, 245",
-        "240, 240, 240": "220, 255, 220",
-        "250, 250, 250": "210, 255, 210",
-        "_white": "_black"
-    },
-    "blue_switch": {
-        "235, 235, 235": "235, 235, 255",
-        "245, 245, 245": "225, 225, 255",
-        "255, 255, 255": "245, 245, 255",
-        "240, 240, 240": "220, 220, 255",
-        "250, 250, 250": "210, 210, 255",
-        "220, 255, 220": "220, 220, 255",
-        "210, 255, 210": "210, 210, 255",
-        "_white": "_black"
-    },
-    "black_switch": {
-        "255, 255, 255": "20, 20, 20", 
-        "245, 245, 245": "40, 40, 40",
-        "235, 235, 235": "30, 30, 30", 
-        "240, 240, 240": "70, 70, 70",
-        "250, 250, 250": "80, 80, 80",
-        "220, 255, 220": "70, 70, 70",
-        "210, 255, 210": "80, 80, 80",
-        "0, 0, 0": "255, 255, 255",
-        "_black": "_white"
-    }
-}

PYAS_Engine.py

@@ -1,8 +1,5 @@
-import os, yara, time, numpy, base64, requests, pefile, math, json, re, datetime
-import ctypes, ctypes.wintypes, hashlib, onnxruntime
-
-from PIL import Image
-from io import BytesIO
+import os, re, yara, time, math, json, numpy, base64, datetime, requests
+import ctypes, ctypes.wintypes, hashlib, pefile, threading, onnxruntime
 
 ####################################################################################################
 
@@ -164,114 +161,6 @@ class rule_scanner:
 
 ####################################################################################################
 
-class cnn_scanner:
-    def __init__(self):
-        self.models = []
-        self.labels = ["White:WinPE/Unknown", "General:WinPE/Unknown"]
-        self.detect_set = {"General:WinPE/Unknown"}
-        self.resize = (224, 224)
-
-    def load_path(self, path, callback=None):
-        for root, _, files in os.walk(path):
-            for file in files:
-                full_path = os.path.join(root, file)
-                if callback:
-                    callback(full_path)
-                self.load_file(full_path)
-
-    def load_file(self, file):
-        if file.lower().endswith('.onnx'):
-            try:
-                session = onnxruntime.InferenceSession(file, providers=['CPUExecutionProvider'])
-                self.models.append(session)
-            except Exception:
-                return False
-
-####################################################################################################
-
-    def model_scan(self, file_path, full_output=False):
-        if not self.models:
-            return (False, False) if not full_output else ([], str(file_path), None)
-
-        data = self.get_data(file_path)
-        if not data:
-            return (False, False) if not full_output else ([], str(file_path), None)
-
-        image = self.preprocess_image(data, self.resize)
-        if not image:
-            return (False, False) if not full_output else ([], str(file_path), None)
-
-        arr = numpy.asarray(image).astype('float32') / 255.0
-        arr = numpy.expand_dims(arr, axis=0)
-        if arr.ndim == 3:
-            arr = numpy.expand_dims(arr, axis=-1)
-
-        results = []
-        best_malicious = None
-
-        for model in self.models:
-            input_meta = model.get_inputs()[0]
-            input_name = input_meta.name
-            input_shape = input_meta.shape
-            
-            curr_arr = arr.copy()
-            if len(input_shape) == 4:
-                if input_shape[1] in (1, 3) and input_shape[3] not in (1, 3):
-                    curr_arr = curr_arr.transpose(0, 3, 1, 2)
-            
-            try:
-                probs = model.run(None, {input_name: curr_arr})[0]
-                pred_prob = float(probs[0][0]) if hasattr(probs[0], '__len__') else float(probs[0])
-            except Exception:
-                continue
-
-            is_malicious = pred_prob > 0.5
-            idx = 1 if is_malicious else 0
-            label = self.labels[idx]
-            
-            conf = pred_prob if is_malicious else (1.0 - pred_prob)
-            conf = round(conf * 100, 2)
-
-            if full_output:
-                results.append(("Whole File", label, conf, self.pil_to_base64(image)))
-            
-            if label in self.detect_set:
-                if best_malicious is None or conf > best_malicious[1]:
-                    best_malicious = (f"{label}.{int(conf)}!dl", int(conf))
-
-        if full_output:
-            results.sort(key=lambda x: (x[1] not in self.detect_set, -x[2]))
-            malicious_count = sum(1 for _, lbl, _, _ in results if lbl in self.detect_set)
-            total = len(results)
-            return results, str(file_path), f"{malicious_count}/{total}"
-
-        return best_malicious if best_malicious else (False, False)
-
-####################################################################################################
-
-    def pil_to_base64(self, img):
-        buf = BytesIO()
-        img.save(buf, format='PNG')
-        return base64.b64encode(buf.getvalue()).decode()
-
-    def preprocess_image(self, data, size, channels=1):
-        width, height = size
-        wah = int(numpy.ceil(numpy.sqrt(len(data) / channels)))
-        arr = numpy.frombuffer(data, dtype=numpy.uint8)
-        imgbuf = numpy.zeros(wah * wah * channels, dtype=numpy.uint8)
-        imgbuf[:len(arr)] = arr
-        image = Image.fromarray(imgbuf.reshape((wah, wah)), 'L')
-        return image.resize((width, height), Image.Resampling.NEAREST)
-
-    def get_data(self, file_path):
-        try:
-            with open(file_path, 'rb') as f:
-                return f.read()
-        except Exception:
-            return None
-
-####################################################################################################
-
 class pe_scanner:
     API_CAT_MAPPING = {
         'ProcessControl': {
@@ -762,7 +651,7 @@ class pe_scanner:
 
 ####################################################################################################
 
-    def pe_scan(self, file_path):
+    def pe_scan(self, file_path, enhanced_mode=False):
         if not self.model:
             return False, False
         try:
@@ -792,8 +681,12 @@ class pe_scanner:
                     prob = float(result[0][1])
 
             score = int(prob * 100)
-            if prob > 0.5:
-                return f"General:WinPE/Unknown.{score}!ml", score
+            
+            if score >= 80:
+                return f"General:WinPE/Malware.{score}!ml", score
+            elif enhanced_mode and score >= 50:
+                return f"General:WinPE/Suspicious.{score}!ml", score
+
             return False, False
         except Exception:
             return False, False
@@ -806,17 +699,26 @@ class cloud_scanner:
         self.api_host = None
         self.api_key = None
         self.timeout = 30
+        self.lock = threading.RLock()
 
     def _init_session(self, api_host, api_key):
-        if self.session is None or self.api_host != api_host or self.api_key != api_key:
-            self.api_host = api_host.rstrip('/')
-            self.api_key = api_key
-            self.session = requests.Session()
-            self.session.headers.update({"X-API-Key": api_key, "User-Agent": "PYAS-Engine/1.2"})
+        with self.lock:
+            if self.session is None or self.api_host != api_host or self.api_key != api_key:
+                self.api_host = api_host.rstrip('/')
+                self.api_key = api_key
+                self.session = requests.Session()
+                self.session.headers.update({"X-API-Key": api_key, "User-Agent": "PYAS-Engine/1.1"})
 
     def _request(self, method, endpoint, **kwargs):
+        with self.lock:
+            current_session = self.session
+            current_host = self.api_host
+            
+        if not current_session:
+            return None
+            
         try:
-            r = self.session.request(method, f"{self.api_host}{endpoint}", timeout=self.timeout, **kwargs)
+            r = current_session.request(method, f"{current_host}{endpoint}", timeout=self.timeout, **kwargs)
             if r.status_code == 200:
                 return r
         except Exception:
@@ -840,7 +742,7 @@ class cloud_scanner:
         r = self._request("POST", f"/api/rescan/{sha256}")
         return r is not None and r.json().get('status') == 'success'
 
-    def upload_file(self, file_path, api_host, api_key, chunk_size=5242880):
+    def upload_file(self, file_path, api_host, api_key, chunk_size=5242880, need_rescan=False):
         try:
             self._init_session(api_host, api_key)
             sha256 = self.calc_hash(file_path)
@@ -848,9 +750,16 @@ class cloud_scanner:
                 return False, None
 
             status_req = self._request("GET", f"/api/processing_status/{sha256}")
-            if status_req and status_req.json().get('status') != 'missing':
-                self.rescan(sha256, api_host, api_key)
-                return True, sha256
+            if status_req:
+                status_data = status_req.json()
+                current_status = status_data.get('status')
+                
+                if current_status == 'done':
+                    if need_rescan:
+                        self.rescan(sha256, api_host, api_key)
+                    return True, sha256
+                elif current_status in ('queued', 'processing'):
+                    return True, sha256
 
             file_size = os.path.getsize(file_path)
             if file_size > 104857600:

PYAS_Version.py

@@ -2,9 +2,9 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.4.6',
+version='3.5.3.0',
 company_name="PYAS Security",
-file_description="Python Antivirus Software",
+file_description="PYAS Security Antivirus",
 internal_name="PYAS",
 legal_copyright="PYAS Security",
 original_filename="PYAS.exe",

Plugins/Filter/DriverCommon.h

@@ -101,6 +101,11 @@ typedef struct _PYAS_MESSAGE {
     WCHAR Path[MAX_PATH_LEN];
 } PYAS_MESSAGE, * PPYAS_MESSAGE;
 
+typedef struct _PYAS_USER_MESSAGE {
+    ULONG Command;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+
 typedef struct _DRIVER_DATA {
     PDRIVER_OBJECT DriverObject;
     PFLT_FILTER FilterHandle;
@@ -109,8 +114,8 @@ typedef struct _DRIVER_DATA {
     PEPROCESS PyasProcess;
     ULONG PyasPid;
     LARGE_INTEGER Cookie;
-    FAST_MUTEX PortMutex;
-    FAST_MUTEX TrackerMutex;
+    KSPIN_LOCK PortMutex;
+    KSPIN_LOCK TrackerMutex;
     EX_RUNDOWN_REF PortRundown;
 } DRIVER_DATA, * PDRIVER_DATA;
 
@@ -139,6 +144,9 @@ VOID UnloadRules();
 VOID InitializeRulesEngine();
 VOID UninitializeRulesEngine();
 
+VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
+VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
+
 VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
 
 NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);

Plugins/Filter/DriverEntry.cpp

@@ -53,13 +53,45 @@ static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
     return STATUS_SUCCESS;
 }
 
+static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength) {
+    UNREFERENCED_PARAMETER(PortCookie);
+    UNREFERENCED_PARAMETER(OutputBuffer);
+    UNREFERENCED_PARAMETER(OutputBufferLength);
+
+    if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
+        PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
+        if (msg->Command == 1 || msg->Command == 2) {
+
+            msg->Path[MAX_PATH_LEN - 1] = L'\0';
+
+            UNICODE_STRING us;
+            RtlInitUnicodeString(&us, msg->Path);
+
+            if (us.Length > 0) {
+                if (msg->Command == 1) {
+                    AddDynamicWhitelist(&us);
+                }
+                else {
+                    RemoveDynamicWhitelist(&us);
+                }
+            }
+        }
+    }
+
+    if (ReturnOutputBufferLength) {
+        *ReturnOutputBufferLength = 0;
+    }
+    return STATUS_SUCCESS;
+}
+
 static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID* ConnectionPortCookie) {
     UNREFERENCED_PARAMETER(ServerPortCookie);
     UNREFERENCED_PARAMETER(ConnectionContext);
     UNREFERENCED_PARAMETER(SizeOfContext);
     UNREFERENCED_PARAMETER(ConnectionPortCookie);
 
-    ExAcquireFastMutex(&GlobalData.PortMutex);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
 
     GlobalData.ClientPort = ClientPort;
     GlobalData.PyasPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
@@ -67,7 +99,7 @@ static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID
 
     ExReInitializeRundownProtection(&GlobalData.PortRundown);
 
-    ExReleaseFastMutex(&GlobalData.PortMutex);
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
 
     return STATUS_SUCCESS;
 }
@@ -75,9 +107,14 @@ static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID
 static VOID PortDisconnect(PVOID ConnectionCookie) {
     UNREFERENCED_PARAMETER(ConnectionCookie);
 
-    ExAcquireFastMutex(&GlobalData.PortMutex);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
     GlobalData.ClientPort = NULL;
-    ExReleaseFastMutex(&GlobalData.PortMutex);
+    GlobalData.PyasPid = 0;
+    GlobalData.PyasProcess = NULL;
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
 
     ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
 }
@@ -116,8 +153,8 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
 
     RtlZeroMemory(&GlobalData, sizeof(GlobalData));
     GlobalData.DriverObject = DriverObject;
-    ExInitializeFastMutex(&GlobalData.PortMutex);
-    ExInitializeFastMutex(&GlobalData.TrackerMutex);
+    KeInitializeSpinLock(&GlobalData.PortMutex);
+    KeInitializeSpinLock(&GlobalData.TrackerMutex);
 
     ExInitializeRundownProtection(&GlobalData.PortRundown);
 
@@ -136,7 +173,7 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     if (NT_SUCCESS(status)) {
         RtlInitUnicodeString(&name, PYAS_PORT_NAME);
         InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, sd);
-        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, NULL, 1);
+        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, PortMessage, 1);
         FltFreeSecurityDescriptor(sd);
     }
 

Plugins/Filter/PYAS_Driver.inf

@@ -3,7 +3,7 @@ Signature   = "$WINDOWS NT$"
 Class       = ActivityMonitor
 ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}
 Provider    = %ManufacturerName%
-DriverVer   = 12/29/2025,1.0.0.0
+DriverVer   = 04/26/2026,3.5.1.0
 CatalogFile = PYAS_Driver.cat
 PnpLockdown = 1
 

Plugins/Filter/ProtectFile.cpp

@@ -199,6 +199,7 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
     UNREFERENCED_PARAMETER(FltObjects);
 
     if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) {
         return FLT_PREOP_SUCCESS_NO_CALLBACK;
@@ -235,12 +236,10 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
                 SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
             }
 
-            if (SystemBuffer) {
-                if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
-                    SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                    Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                    callbackStatus = FLT_PREOP_COMPLETE;
-                }
+            if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
+                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                callbackStatus = FLT_PREOP_COMPLETE;
             }
         }
     }

Plugins/Filter/ProtectProcess.cpp

@@ -34,6 +34,36 @@ VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INF
     }
 }
 
+static BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId) {
+    if (ProcessId == (HANDLE)4) return TRUE;
+
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    NTSTATUS status;
+    BOOLEAN isCritical = FALSE;
+    PEPROCESS Process = NULL;
+    PUNICODE_STRING imageFileName = NULL;
+
+    status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(status)) return FALSE;
+
+    status = SeLocateProcessImageName(Process, &imageFileName);
+
+    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
+        if (WildcardMatch(L"*\\Windows\\System32\\csrss.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\lsass.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\services.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\wininit.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\smss.exe", imageFileName->Buffer, imageFileName->Length)) {
+            isCritical = TRUE;
+        }
+        ExFreePool(imageFileName);
+    }
+
+    ObDereferenceObject(Process);
+    return isCritical;
+}
+
 static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
     if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
 
@@ -79,6 +109,8 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
     if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
 
     if (IsTargetProtected(TargetPid)) {
+        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
+
         BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
 
         if (bIsTrusted) {
@@ -99,10 +131,10 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
             PROCESS_SET_INFORMATION |
             PROCESS_SET_QUOTA;
 
-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
 
         if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
         }
     }
 
@@ -128,6 +160,8 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
     if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
 
     if (IsTargetProtected(TargetPid)) {
+        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
+
         BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
 
         if (bIsTrusted) {
@@ -144,10 +178,10 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
             THREAD_SET_INFORMATION |
             THREAD_SET_THREAD_TOKEN;
 
-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
 
         if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
         }
     }
 

Plugins/Filter/ProtectRegistry.cpp

@@ -149,30 +149,32 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
                             (Info->ValueName ? Info->ValueName->Length : 0) +
                             sizeof(WCHAR);
 
-                        PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                        if (Buffer) {
-                            UNICODE_STRING FullPath;
-                            FullPath.Buffer = Buffer;
-                            FullPath.Length = 0;
-                            FullPath.MaximumLength = (USHORT)FullSize;
+                        if (FullSize <= 0xFFFF) {
+                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                            if (Buffer) {
+                                UNICODE_STRING FullPath;
+                                FullPath.Buffer = Buffer;
+                                FullPath.Length = 0;
+                                FullPath.MaximumLength = (USHORT)FullSize;
 
-                            RtlCopyUnicodeString(&FullPath, KeyName);
+                                RtlCopyUnicodeString(&FullPath, KeyName);
 
-                            if (Info->ValueName && Info->ValueName->Length > 0) {
-                                if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                    RtlAppendUnicodeToString(&FullPath, L"\\");
+                                if (Info->ValueName && Info->ValueName->Length > 0) {
+                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                        RtlAppendUnicodeToString(&FullPath, L"\\");
+                                    }
+                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                                 }
-                                RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                            }
 
-                            if (CheckRegistryRule(&FullPath)) {
-                                HANDLE Pid = PsGetCurrentProcessId();
-                                if (!IsProcessTrusted(Pid)) {
-                                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                    status = STATUS_ACCESS_DENIED;
+                                if (CheckRegistryRule(&FullPath)) {
+                                    HANDLE Pid = PsGetCurrentProcessId();
+                                    if (!IsProcessTrusted(Pid)) {
+                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                        status = STATUS_ACCESS_DENIED;
+                                    }
                                 }
+                                PyasFree(Buffer);
                             }
-                            PyasFree(Buffer);
                         }
                     }
                 }
@@ -194,30 +196,32 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
                             (Info->ValueName ? Info->ValueName->Length : 0) +
                             sizeof(WCHAR);
 
-                        PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                        if (Buffer) {
-                            UNICODE_STRING FullPath;
-                            FullPath.Buffer = Buffer;
-                            FullPath.Length = 0;
-                            FullPath.MaximumLength = (USHORT)FullSize;
+                        if (FullSize <= 0xFFFF) {
+                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                            if (Buffer) {
+                                UNICODE_STRING FullPath;
+                                FullPath.Buffer = Buffer;
+                                FullPath.Length = 0;
+                                FullPath.MaximumLength = (USHORT)FullSize;
 
-                            RtlCopyUnicodeString(&FullPath, KeyName);
+                                RtlCopyUnicodeString(&FullPath, KeyName);
 
-                            if (Info->ValueName && Info->ValueName->Length > 0) {
-                                if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                    RtlAppendUnicodeToString(&FullPath, L"\\");
+                                if (Info->ValueName && Info->ValueName->Length > 0) {
+                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                        RtlAppendUnicodeToString(&FullPath, L"\\");
+                                    }
+                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                                 }
-                                RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                            }
 
-                            if (CheckRegistryRule(&FullPath)) {
-                                HANDLE Pid = PsGetCurrentProcessId();
-                                if (!IsProcessTrusted(Pid)) {
-                                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                    status = STATUS_ACCESS_DENIED;
+                                if (CheckRegistryRule(&FullPath)) {
+                                    HANDLE Pid = PsGetCurrentProcessId();
+                                    if (!IsProcessTrusted(Pid)) {
+                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                        status = STATUS_ACCESS_DENIED;
+                                    }
                                 }
+                                PyasFree(Buffer);
                             }
-                            PyasFree(Buffer);
                         }
                     }
                 }

Plugins/Filter/ProtectRules.cpp

@@ -10,19 +10,21 @@ constexpr auto TRUST_CACHE_TTL_SEC = 300;
 
 typedef struct _RANSOM_TRACKER {
     PEPROCESS Process;
+    LARGE_INTEGER ProcessCreateTime;
     ULONG ActivityCount;
     LARGE_INTEGER LastActivityTime;
 } RANSOM_TRACKER, * PRANSOM_TRACKER;
 
 typedef struct _TRUST_CACHE_ENTRY {
     PEPROCESS Process;
+    LARGE_INTEGER ProcessCreateTime;
     BOOLEAN IsTrusted;
     LARGE_INTEGER CacheTime;
 } TRUST_CACHE_ENTRY, * PTRUST_CACHE_ENTRY;
 
 static RANSOM_TRACKER RansomTrackers[MAX_TRACKERS];
 static TRUST_CACHE_ENTRY TrustCache[TRUST_CACHE_SIZE];
-static FAST_MUTEX TrustCacheLock;
+static KSPIN_LOCK TrustCacheLock;
 static BOOLEAN g_CacheInitialized = FALSE;
 
 static ERESOURCE RuleLock;
@@ -57,6 +59,14 @@ static VOID FreeList(PRULE_NODE* Head) {
 static VOID AddRule(PRULE_NODE* Head, PUNICODE_STRING RuleStr) {
     if (!RuleStr || !RuleStr->Buffer) return;
 
+    PRULE_NODE Check = *Head;
+    while (Check) {
+        if (RtlEqualUnicodeString(&Check->Pattern, RuleStr, TRUE)) {
+            return;
+        }
+        Check = Check->Next;
+    }
+
     PRULE_NODE Node = (PRULE_NODE)PyasAllocate(sizeof(RULE_NODE));
     if (!Node) return;
 
@@ -99,7 +109,7 @@ static BOOLEAN HasSuffix(PCUNICODE_STRING String, PCWSTR Suffix) {
 }
 
 BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
-    if (!Pattern || !String) return FALSE;
+    if (Pattern == NULL || String == NULL) return FALSE;
 
     USHORT StringLenChars = StringLengthBytes / sizeof(WCHAR);
     PCWSTR mp = NULL;
@@ -115,7 +125,7 @@ BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
             Pattern++;
             String++;
         }
-        else if (mp) {
+        else if (mp != NULL) {
             Pattern = mp;
             String = cp++;
         }
@@ -126,7 +136,8 @@ BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
     while (*Pattern == L'*') {
         Pattern++;
     }
-    return !*Pattern;
+
+    return (*Pattern == L'\0') ? TRUE : FALSE;
 }
 
 static ULONG ProcessJsonUnescape(PWCHAR Buffer, ULONG LengthChars) {
@@ -194,17 +205,23 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN
 
                     while (Ptr < End) {
                         SkipWhitespace(&Ptr, End);
-                        if (Ptr >= End) break;
-
-                        if (*Ptr == ']') {
-                            Ptr++;
+                        if (Ptr >= End || *Ptr == ']') {
+                            if (Ptr < End) Ptr++;
                             return;
                         }
 
                         if (*Ptr == '"') {
                             PCHAR StartQuote = ++Ptr;
+                            BOOLEAN Escaped = FALSE;
+
                             while (Ptr < End) {
-                                if (*Ptr == '"' && *(Ptr - 1) != '\\') break;
+                                if (*Ptr == '"' && Escaped == FALSE) break;
+                                if (*Ptr == '\\') {
+                                    Escaped = (Escaped == FALSE) ? TRUE : FALSE;
+                                }
+                                else {
+                                    Escaped = FALSE;
+                                }
                                 Ptr++;
                             }
 
@@ -234,9 +251,6 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN
                                 Ptr++;
                             }
                         }
-                        else if (*Ptr == ',') {
-                            Ptr++;
-                        }
                         else {
                             Ptr++;
                         }
@@ -251,7 +265,7 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN
 
 VOID InitializeRulesEngine() {
     ExInitializeResourceLite(&RuleLock);
-    ExInitializeFastMutex(&TrustCacheLock);
+    KeInitializeSpinLock(&TrustCacheLock);
     RtlZeroMemory(TrustCache, sizeof(TrustCache));
     g_CacheInitialized = TRUE;
 }
@@ -261,6 +275,64 @@ VOID UninitializeRulesEngine() {
     g_CacheInitialized = FALSE;
 }
 
+static VOID RemoveRule(PRULE_NODE* Head, PUNICODE_STRING RuleStr) {
+    if (!RuleStr || !RuleStr->Buffer) return;
+    PRULE_NODE Current = *Head;
+    PRULE_NODE Previous = NULL;
+
+    while (Current) {
+        if (RtlEqualUnicodeString(&Current->Pattern, RuleStr, TRUE)) {
+            PRULE_NODE ToDelete = Current;
+
+            if (Previous) {
+                Previous->Next = Current->Next;
+            }
+            else {
+                *Head = Current->Next;
+            }
+
+            Current = Current->Next;
+
+            if (ToDelete->Pattern.Buffer) PyasFree(ToDelete->Pattern.Buffer);
+            PyasFree(ToDelete);
+        }
+        else {
+            Previous = Current;
+            Current = Current->Next;
+        }
+    }
+}
+
+VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr) {
+    KeEnterCriticalRegion();
+    ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
+    AddRule(&g_ProcessTrustedPaths, RuleStr);
+    AddRule(&g_FileExceptionPaths, RuleStr);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
+    RtlZeroMemory(TrustCache, sizeof(TrustCache));
+    KeReleaseSpinLock(&TrustCacheLock, OldIrql);
+
+    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
+}
+
+VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr) {
+    KeEnterCriticalRegion();
+    ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
+    RemoveRule(&g_ProcessTrustedPaths, RuleStr);
+    RemoveRule(&g_FileExceptionPaths, RuleStr);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
+    RtlZeroMemory(TrustCache, sizeof(TrustCache));
+    KeReleaseSpinLock(&TrustCacheLock, OldIrql);
+
+    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
+}
+
 NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
     NTSTATUS status = STATUS_SUCCESS;
     HANDLE FileHandle = NULL;
@@ -301,58 +373,58 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
     }
 
     if (Info->Type == REG_EXPAND_SZ || Info->Type == REG_SZ) {
-        PathBufferSize = ResultLength + 1024;
+        PathBufferSize = Info->DataLength + 1024;
         PathBuffer = (PWCHAR)PyasAllocate(PathBufferSize);
 
         if (PathBuffer) {
             RtlZeroMemory(PathBuffer, PathBufferSize);
-            PWCHAR Src = (PWCHAR)Info->Data;
+            if (Info->DataLength > 0) {
+                RtlCopyMemory(PathBuffer, Info->Data, Info->DataLength);
+            }
 
-            if (NT_SUCCESS(RtlStringCbCopyW(PathBuffer, PathBufferSize, Src))) {
-                PWCHAR LastSlash = NULL;
-                PWCHAR Current = PathBuffer;
-                while (*Current) {
-                    if (*Current == L'\\') LastSlash = Current;
-                    Current++;
-                }
+            PWCHAR LastSlash = NULL;
+            PWCHAR Current = PathBuffer;
+            while (*Current) {
+                if (*Current == L'\\') LastSlash = Current;
+                Current++;
+            }
 
-                if (LastSlash) {
-                    *LastSlash = L'\0';
+            if (LastSlash) {
+                *LastSlash = L'\0';
 
-                    SIZE_T CurrentPathLen = wcslen(PathBuffer);
-                    const WCHAR FilterSuffix[] = L"\\Filter";
-                    SIZE_T FilterLen = (sizeof(FilterSuffix) / sizeof(WCHAR)) - 1;
+                SIZE_T CurrentPathLen = wcslen(PathBuffer);
+                const WCHAR FilterSuffix[] = L"\\Filter";
+                SIZE_T FilterLen = (sizeof(FilterSuffix) / sizeof(WCHAR)) - 1;
 
-                    if (CurrentPathLen >= FilterLen) {
-                        PWCHAR SuffixStart = PathBuffer + CurrentPathLen - FilterLen;
-                        BOOLEAN Match = TRUE;
-                        for (SIZE_T i = 0; i < FilterLen; i++) {
-                            if (RtlDowncaseUnicodeChar(SuffixStart[i]) != RtlDowncaseUnicodeChar(FilterSuffix[i])) {
-                                Match = FALSE;
-                                break;
-                            }
-                        }
-                        if (Match) {
-                            *SuffixStart = L'\0';
+                if (CurrentPathLen >= FilterLen) {
+                    PWCHAR SuffixStart = PathBuffer + CurrentPathLen - FilterLen;
+                    BOOLEAN Match = TRUE;
+                    for (SIZE_T i = 0; i < FilterLen; i++) {
+                        if (RtlDowncaseUnicodeChar(SuffixStart[i]) != RtlDowncaseUnicodeChar(FilterSuffix[i])) {
+                            Match = FALSE;
+                            break;
                         }
                     }
-
-                    RtlStringCbCatW(PathBuffer, PathBufferSize, L"\\Rules\\Rules_Driver_P1.json");
-
-                    if (wcsncmp(PathBuffer, L"\\??\\", 4) != 0 &&
-                        wcsncmp(PathBuffer, L"\\SystemRoot", 11) != 0 &&
-                        wcsncmp(PathBuffer, L"\\DosDevices\\", 12) != 0) {
-
-                        PWCHAR TmpBuffer = (PWCHAR)PyasAllocate(PathBufferSize + 16);
-                        if (TmpBuffer) {
-                            RtlStringCbCopyW(TmpBuffer, PathBufferSize + 16, L"\\??\\");
-                            RtlStringCbCatW(TmpBuffer, PathBufferSize + 16, PathBuffer);
-                            PyasFree(PathBuffer);
-                            PathBuffer = TmpBuffer;
-                        }
+                    if (Match) {
+                        *SuffixStart = L'\0';
                     }
-                    RtlInitUnicodeString(&FinalPath, PathBuffer);
                 }
+
+                RtlStringCbCatW(PathBuffer, PathBufferSize, L"\\Rules\\Rules_Driver_P1.json");
+
+                if (wcsncmp(PathBuffer, L"\\??\\", 4) != 0 &&
+                    wcsncmp(PathBuffer, L"\\SystemRoot", 11) != 0 &&
+                    wcsncmp(PathBuffer, L"\\DosDevices\\", 12) != 0) {
+
+                    PWCHAR TmpBuffer = (PWCHAR)PyasAllocate(PathBufferSize + 16);
+                    if (TmpBuffer) {
+                        RtlStringCbCopyW(TmpBuffer, PathBufferSize + 16, L"\\??\\");
+                        RtlStringCbCatW(TmpBuffer, PathBufferSize + 16, PathBuffer);
+                        PyasFree(PathBuffer);
+                        PathBuffer = TmpBuffer;
+                    }
+                }
+                RtlInitUnicodeString(&FinalPath, PathBuffer);
             }
         }
     }
@@ -377,6 +449,7 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
                 if (NT_SUCCESS(status)) {
                     ((PCHAR)FileBuffer)[FileInfo.EndOfFile.LowPart] = '\0';
 
+                    KeEnterCriticalRegion();
                     ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
                     ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_Registry_BlockList", &g_RegistryBlockList);
                     ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_Registry_TrustedList", &g_RegistryTrustedList);
@@ -386,6 +459,7 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
                     ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_File_ExceptionPaths", &g_FileExceptionPaths);
                     ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_File_RansomwareExtensions", &g_FileRansomExts);
                     ExReleaseResourceLite(&RuleLock);
+                    KeLeaveCriticalRegion();
                 }
                 PyasFree(FileBuffer);
             }
@@ -398,6 +472,7 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
 }
 
 VOID UnloadRules() {
+    KeEnterCriticalRegion();
     ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
     FreeList(&g_RegistryBlockList);
     FreeList(&g_RegistryTrustedList);
@@ -407,9 +482,14 @@ VOID UnloadRules() {
     FreeList(&g_FileExceptionPaths);
     FreeList(&g_FileRansomExts);
     ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
 }
 
 NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName) {
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) {
+        return STATUS_UNSUCCESSFUL;
+    }
+
     NTSTATUS status;
     PEPROCESS Process = NULL;
 
@@ -434,74 +514,83 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
     if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
     if (ProcessId == (HANDLE)4) return TRUE;
 
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
-
     PEPROCESS Process = NULL;
     if (!NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &Process))) {
         return FALSE;
     }
 
+    LARGE_INTEGER createTime;
+    createTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+
     if (g_CacheInitialized) {
-        ExAcquireFastMutex(&TrustCacheLock);
+        KIRQL OldIrql;
+        KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
         ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
-        if (TrustCache[Hash].Process == Process) {
+
+        if (TrustCache[Hash].Process == Process && TrustCache[Hash].ProcessCreateTime.QuadPart == createTime.QuadPart) {
             LARGE_INTEGER Now;
             KeQuerySystemTime(&Now);
             if ((Now.QuadPart - TrustCache[Hash].CacheTime.QuadPart) < (TRUST_CACHE_TTL_SEC * 10000000LL)) {
                 BOOLEAN cachedResult = TrustCache[Hash].IsTrusted;
-                ExReleaseFastMutex(&TrustCacheLock);
+                KeReleaseSpinLock(&TrustCacheLock, OldIrql);
                 ObDereferenceObject(Process);
                 return cachedResult;
             }
         }
-        ExReleaseFastMutex(&TrustCacheLock);
+        KeReleaseSpinLock(&TrustCacheLock, OldIrql);
+    }
+
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) {
+        ObDereferenceObject(Process);
+        return FALSE;
     }
 
     PUNICODE_STRING imageFileName = NULL;
     NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);
     BOOLEAN isTrusted = FALSE;
 
-    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
-        ExAcquireResourceSharedLite(&RuleLock, TRUE);
+    KeEnterCriticalRegion();
+    ExAcquireResourceSharedLite(&RuleLock, TRUE);
 
+    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
         PRULE_NODE Node = g_ProcessExploitable;
         while (Node) {
             if (WildcardMatch(Node->Pattern.Buffer, imageFileName->Buffer, imageFileName->Length)) {
-                ExReleaseResourceLite(&RuleLock);
-                goto cleanup;
+                goto update_cache;
             }
             Node = Node->Next;
         }
 
         if (IsWindowsSystemApp(imageFileName->Buffer, imageFileName->Length)) {
             isTrusted = TRUE;
-            ExReleaseResourceLite(&RuleLock);
-            goto cleanup;
+            goto update_cache;
         }
 
         Node = g_ProcessTrustedPaths;
         while (Node) {
             if (WildcardMatch(Node->Pattern.Buffer, imageFileName->Buffer, imageFileName->Length)) {
                 isTrusted = TRUE;
-                ExReleaseResourceLite(&RuleLock);
-                goto cleanup;
+                goto update_cache;
             }
             Node = Node->Next;
         }
-
-        ExReleaseResourceLite(&RuleLock);
     }
 
-cleanup:
+update_cache:
     if (g_CacheInitialized) {
-        ExAcquireFastMutex(&TrustCacheLock);
+        KIRQL OldIrql;
+        KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
         ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
         TrustCache[Hash].Process = Process;
+        TrustCache[Hash].ProcessCreateTime = createTime;
         TrustCache[Hash].IsTrusted = isTrusted;
         KeQuerySystemTime(&TrustCache[Hash].CacheTime);
-        ExReleaseFastMutex(&TrustCacheLock);
+        KeReleaseSpinLock(&TrustCacheLock, OldIrql);
     }
 
+    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
+
     if (imageFileName) ExFreePool(imageFileName);
     ObDereferenceObject(Process);
     return isTrusted;
@@ -520,12 +609,14 @@ BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName) {
         return FALSE;
     }
 
+    KeEnterCriticalRegion();
     ExAcquireResourceSharedLite(&RuleLock, TRUE);
 
     PRULE_NODE AllowNode = g_RegistryTrustedList;
     while (AllowNode) {
         if (WildcardMatch(AllowNode->Pattern.Buffer, KeyName->Buffer, KeyName->Length)) {
             ExReleaseResourceLite(&RuleLock);
+            KeLeaveCriticalRegion();
             return FALSE;
         }
         AllowNode = AllowNode->Next;
@@ -541,18 +632,21 @@ BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName) {
         Node = Node->Next;
     }
     ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
     return Match;
 }
 
 BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName) {
     if (!FileName || !FileName->Buffer) return FALSE;
 
+    KeEnterCriticalRegion();
     ExAcquireResourceSharedLite(&RuleLock, TRUE);
 
     PRULE_NODE ExNode = g_FileExceptionPaths;
     while (ExNode) {
         if (WildcardMatch(ExNode->Pattern.Buffer, FileName->Buffer, FileName->Length)) {
             ExReleaseResourceLite(&RuleLock);
+            KeLeaveCriticalRegion();
             return FALSE;
         }
         ExNode = ExNode->Next;
@@ -568,6 +662,7 @@ BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName) {
         Node = Node->Next;
     }
     ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
     return Match;
 }
 
@@ -578,12 +673,14 @@ BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName) {
         return FALSE;
     }
 
+    KeEnterCriticalRegion();
     ExAcquireResourceSharedLite(&RuleLock, TRUE);
 
     PRULE_NODE ExNode = g_FileExceptionPaths;
     while (ExNode) {
         if (WildcardMatch(ExNode->Pattern.Buffer, FileName->Buffer, FileName->Length)) {
             ExReleaseResourceLite(&RuleLock);
+            KeLeaveCriticalRegion();
             return FALSE;
         }
         ExNode = ExNode->Next;
@@ -599,13 +696,16 @@ BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName) {
         Node = Node->Next;
     }
     ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
     return Match;
 }
 
 static BOOLEAN IsHighEntropy(PVOID Buffer, ULONG Length) {
     if (!Buffer || Length < 256) return FALSE;
 
-    ULONG Histogram[256] = { 0 };
+    PUSHORT Histogram = (PUSHORT)PyasAllocate(256 * sizeof(USHORT));
+    if (!Histogram) return FALSE;
+
     PUCHAR Ptr = (PUCHAR)Buffer;
     ULONG ScanLen = (Length > 1024) ? 1024 : Length;
 
@@ -615,16 +715,20 @@ static BOOLEAN IsHighEntropy(PVOID Buffer, ULONG Length) {
         }
     }
     __except (EXCEPTION_EXECUTE_HANDLER) {
+        PyasFree(Histogram);
         return FALSE;
     }
 
-    ULONG MaxFreq = 0;
+    USHORT MaxFreq = 0;
     for (int i = 0; i < 256; i++) {
         if (Histogram[i] > MaxFreq) MaxFreq = Histogram[i];
     }
 
     ULONG ExpectedAvg = ScanLen / 256;
-    return (MaxFreq < (ExpectedAvg + HIGH_ENTROPY_THRESHOLD));
+    BOOLEAN Result = (MaxFreq < (ExpectedAvg + HIGH_ENTROPY_THRESHOLD));
+
+    PyasFree(Histogram);
+    return Result;
 }
 
 static BOOLEAN IsNaturallyCompressed(PCUNICODE_STRING FileName) {
@@ -652,19 +756,33 @@ static BOOLEAN IsNoisyRansomPath(PCUNICODE_STRING FileName) {
     return FALSE;
 }
 
+static BOOLEAN IsUserDirectoryPath(PCUNICODE_STRING FileName) {
+    if (!FileName || !FileName->Buffer) return FALSE;
+    return WildcardMatch(L"*\\Users\\*", FileName->Buffer, FileName->Length);
+}
+
 static BOOLEAN IsExplorerProcess(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
     PUNICODE_STRING imageFileName = NULL;
     NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);
     BOOLEAN isExplorer = FALSE;
-    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
-        if (HasSuffix(imageFileName, L"\\explorer.exe")) isExplorer = TRUE;
+
+    if (NT_SUCCESS(status) && imageFileName) {
+        if (imageFileName->Buffer && HasSuffix(imageFileName, L"\\explorer.exe")) {
+            isExplorer = TRUE;
+        }
         ExFreePool(imageFileName);
     }
+
     return isExplorer;
 }
 
 BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID WriteBuffer, ULONG WriteLength, BOOLEAN IsWrite) {
+    if (!IsUserDirectoryPath(FileName)) {
+        return FALSE;
+    }
+
     if (IsNoisyRansomPath(FileName)) {
         return FALSE;
     }
@@ -691,9 +809,12 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
 
     LARGE_INTEGER Now = { 0 };
     KeQuerySystemTime(&Now);
+    LARGE_INTEGER createTime;
+    createTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
     BOOLEAN Result = FALSE;
 
-    ExAcquireFastMutex(&GlobalData.TrackerMutex);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.TrackerMutex, &OldIrql);
 
     PRANSOM_TRACKER Tracker = NULL;
     PRANSOM_TRACKER CandidateSlot = NULL;
@@ -706,7 +827,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
             LruSlot = Current;
         }
 
-        if (Current->Process == Process) {
+        if (Current->Process == Process && Current->ProcessCreateTime.QuadPart == createTime.QuadPart) {
             Tracker = Current;
             break;
         }
@@ -734,6 +855,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
         }
 
         Tracker->Process = Process;
+        Tracker->ProcessCreateTime = createTime;
         Tracker->ActivityCount = 0;
         Tracker->LastActivityTime = Now;
     }
@@ -753,7 +875,8 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
     if (Tracker->ActivityCount >= RANSOM_COUNT_THRESHOLD) {
         Result = TRUE;
     }
-    ExReleaseFastMutex(&GlobalData.TrackerMutex);
+
+    KeReleaseSpinLock(&GlobalData.TrackerMutex, OldIrql);
     ObDereferenceObject(Process);
     return Result;
 }
@@ -761,34 +884,48 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
 NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize) {
     if (KeGetCurrentIrql() > APC_LEVEL) return STATUS_UNSUCCESSFUL;
 
-    PYAS_MESSAGE msg;
-    RtlZeroMemory(&msg, sizeof(msg));
-    msg.MessageCode = Code;
-    msg.ProcessId = Pid;
-
-    if (Path && PathSize > 0) {
-        size_t MaxSize = sizeof(msg.Path) - sizeof(WCHAR);
-        size_t BytesToCopy = PathSize;
-        if (BytesToCopy > MaxSize) BytesToCopy = MaxSize;
-
-        __try {
-            RtlCopyMemory(msg.Path, Path, BytesToCopy);
-            msg.Path[BytesToCopy / sizeof(WCHAR)] = L'\0';
-        }
-        __except (EXCEPTION_EXECUTE_HANDLER) {
-            return STATUS_ACCESS_VIOLATION;
-        }
-    }
-
     if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
         return STATUS_PORT_DISCONNECTED;
     }
 
     NTSTATUS status = STATUS_PORT_DISCONNECTED;
+
     if (GlobalData.ClientPort) {
-        LARGE_INTEGER timeout;
-        timeout.QuadPart = -(5 * 10000);
-        status = FltSendMessage(GlobalData.FilterHandle, &GlobalData.ClientPort, &msg, sizeof(msg), NULL, NULL, &timeout);
+        PPYAS_MESSAGE msg = (PPYAS_MESSAGE)PyasAllocate(sizeof(PYAS_MESSAGE));
+        if (msg) {
+            msg->MessageCode = Code;
+            msg->ProcessId = Pid;
+
+            if (Path && PathSize > 0) {
+                size_t MaxSize = sizeof(msg->Path) - sizeof(WCHAR);
+                size_t BytesToCopy = PathSize > MaxSize ? MaxSize : PathSize;
+
+                __try {
+                    RtlCopyMemory(msg->Path, Path, BytesToCopy);
+                    msg->Path[BytesToCopy / sizeof(WCHAR)] = L'\0';
+                }
+                __except (EXCEPTION_EXECUTE_HANDLER) {
+                    PyasFree(msg);
+                    ExReleaseRundownProtection(&GlobalData.PortRundown);
+                    return STATUS_ACCESS_VIOLATION;
+                }
+            }
+
+            LARGE_INTEGER timeout;
+            if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+                timeout.QuadPart = -(5 * 10000);
+            }
+            else {
+                timeout.QuadPart = 0;
+            }
+
+            status = FltSendMessage(GlobalData.FilterHandle, &GlobalData.ClientPort, msg, sizeof(PYAS_MESSAGE), NULL, NULL, &timeout);
+
+            PyasFree(msg);
+        }
+        else {
+            status = STATUS_INSUFFICIENT_RESOURCES;
+        }
     }
 
     ExReleaseRundownProtection(&GlobalData.PortRundown);

Plugins/Filter/Resource.rc

@@ -0,0 +1,20 @@
+#include <windows.h>
+#include <ntverp.h>
+
+#define VER_FILETYPE                VFT_DRV
+#define VER_FILESUBTYPE             VFT2_DRV_SYSTEM
+#define VER_FILEDESCRIPTION_STR     "PYAS Security Driver Protect"
+#define VER_INTERNALNAME_STR        "PYAS"
+#define VER_LEGALCOPYRIGHT_STR      "PYAS Security"
+#define VER_ORIGINALFILENAME_STR    "PYAS_Driver.sys"
+#define VER_PRODUCTNAME_STR         "PYAS"
+
+#define VER_FILEVERSION             3,5,1,0
+#define VER_FILEVERSION_STR         "3,5,1,0"
+
+#define VER_PRODUCTVERSION          3,5,1,0
+#define VER_PRODUCTVERSION_STR      "3,5,1,0"
+
+#define VER_COMPANYNAME_STR         "PYAS Security"
+
+#include "common.ver"

Plugins/Rules/Rules_Driver_P1.json

@@ -47,7 +47,6 @@
     "*\\DisableTaskMgr",
     "*\\DisableRegistryTools",
     "*\\DisableChangePassword",
-    "*\\Wallpaper",
     "*\\NoComponents",
     "*\\NoStartMenuMorePrograms",
     "*\\NoActiveDesktop",
@@ -125,6 +124,9 @@
     "*\\XLLiveUD.exe",
     "*\\PC4399_WPFLauncher.exe",
     "*\\bin\\APlayer.exe",
+    "*\\hrkill-*.exe",
+    "*\\bin\\HipsDaemon.exe",
+    "*\\360Safe.exe",
   ],
   "Rule_Process_ExploitableBlacklist": [
     "*\\cmd.exe",
@@ -163,9 +165,9 @@
   ],
   "Rule_File_ProtectedPaths": [
     "*\\PYAS.exe",
-    "*\\PYAS_Driver.sys",
-    "*\\ProgramData\\PYAS\\*.json",
+    "*\\Plugins\\Filter\\PYAS_Driver.sys",
     "*\\Plugins\\Rules\\Rules_Driver_P1.json",
+    "*\\ProgramData\\PYAS\\*.json",
     "*\\Engine\\Pattern\\*.onnx",
     "*\\Engine\\Properties\\*.onnx",
     
@@ -203,6 +205,7 @@
     "*\\ventoy\\Boot\\*",
     "*\\AdminRegionConfig.*",
     "*\\nt_qq\\nt_*\\*",
+    "*\\cache\\*",
   ],
   "Rule_File_RansomwareExtensions": [
     ".zip", ".7z", ".rar", ".tar", ".gz",

README.md

@@ -1,23 +1,31 @@
-# PYAS
+# PYAS Security
 
-Antivirus software written in Python and C++ that blocks threats through deep learning and behavioral monitoring!
+Antivirus software written in Python and C++ that blocks threats through Machine Learning and behavioral monitoring!
 
-<img width="2245" height="1477" alt="PYAS_UI" src="https://github.com/user-attachments/assets/87d40261-7655-49ad-a19c-1ffcca60584f" />
+<img width="2440" height="1600" alt="PYAS_All" src="https://github.com/user-attachments/assets/1991aad3-64cc-4266-ac67-dab70c891ce7" />
 
 ## Requirements
 
 Python 3.10 is recommended. Other Python versions may require different pip commands.
 
 ```
-pip install requests==2.32.4
-pip install PySide6==6.9.1
-pip install yara-python==4.5.4
-pip install Pillow==11.0.0
-pip install numpy==1.26.4
-pip install tensorflow==2.10.0
-pip install tf2onnx==1.13.0
-pip install lightgbm==4.6.0
-pip install onnxruntime==1.18.1
+pip install pystray
+pip install pefile
+pip install requests
+pip install pywebview
+pip install Pillow
+pip install yara-python
+pip install numpy
+pip install onnxruntime
+```
+
+Non-essential requirements installation, only used for model training or other functions.
+
+```
+pip install pandas
+pip install scikit-learn
+pip install lightgbm
+pip install onnxmltools
 ```
 
 ## File Information
@@ -26,41 +34,28 @@ The following lists the storage locations of all relevant code and other related
 
 ```
 PYAS/
-├── Embed/
-│   ├── Dockerfile                   # Deploy an embedded command line antivirus engine
-│   └── ...                          # Other microservice for VirusTotal Integration
-│
-├── Engine/
-│   ├── Pattern/
-│   │   ├── convert.py               # Convert executable files or other files to images
-│   │   ├── train.py                 # TensorFlow CNN model training complete code
-│   │   └── ...                      # Other models folders and files
-│   │
+├── Engine/                          # Complete code for Yara signatures and AI model training
 │   ├── Heuristic/
-│   │   ├── rules.yar                # Yara virus signature rule matching
-│   │   └── ...                      # Other rules folders and files
-│   │
+│   │   └── ...                      # Yara Rules
 │   └── Properties/
-│       ├── convert.py               # Convert executable files to sql database
-│       ├── train.py                 # Lightgbm model training complete code
-│       └── ...                      # Other models folders and files
+│       └── ...                      # LightGBM Model
 │
-├── Plugins/
-│   └── Filter/
-│   │   ├── DriverEntry.cpp          # Main driver entry and initialization logic
-│   │   ├── DriverCommon.h           # Global driver definitions, constants, and functions
-│   │   └── ...                      # Other driver folders and files
-│   │
+├── Interface/                       # Interface Interaction and Icons with WebView2
+│   ├── static/
+│   │   └── ...                      # style.css, main.js, icon.ico
+│   └── templates/
+│       └── ...                      # index.html
+│
+├── Plugins/                         # Main filter driver protect and rules
+│   ├── Filter/
+│   │   └── ...                      # DriverCommon.h, DriverEntry.cpp, ProtectRegistry.cpp, ...
 │   └── Rules/
-│       └── rules.json               # White, block list, and matching logic for files registry
+│       └── ...                      # Rules_Driver_P1.json
 |
-├── PYAS.py                          # Main application entry point and UI to engine interface
-├── PYAS_Config.py                   # Configuration loading, saving, and global parameters
-├── PYAS_Engine.py                   # Core scanning engine: YARA, IP, ONNX model execution
-├── PYAS_Interface.py                # User interface components and event handling
-├── PYAS_Resource.py                 # Static image and icon resource management
+├── PYAS.py                          # Main antivirus application entry point
+├── PYAS_Engine.py                   # Core scanning engine algorithm
 ├── PYAS_Version.py                  # Version metadata for packaging and updates
-└── ...                              # Other supplementary folders and files
+└── ...
 ```
 
 ## Architecture diagram
@@ -75,117 +70,78 @@ graph TD
     classDef storage fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px,color:#4a148c
     classDef interaction fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,stroke-dasharray: 5 5,color:#1b5e20
 
-    subgraph UserSpace [User Mode Application - PYAS.exe]
-        direction TB
+    subgraph UserMode ["User Mode (Python / Web)"]
+        UI["Web UI (pywebview)"]:::userMode
+        PYASCore["PYAS Core (PYAS.py)"]:::userMode
         
-        GUI[MainWindow_Controller / UI]:::userMode
-        ConfigMgr[Configuration & Rule Manager]:::userMode
+        subgraph Engines ["Scanning Engines (PYAS_Engine.py)"]
+            PEScanner["PE/ML Scanner (pe_scanner)"]:::userMode
+            RuleScanner["YARA Scanner (rule_scanner)"]:::userMode
+            CloudScanner["Cloud API (cloud_scanner)"]:::userMode
+            SignScanner["Signature Verify (sign_scanner)"]:::userMode
+        end
         
-        subgraph DetectionEngine [Analysis Engine - PYAS_Engine.py]
-            direction TB
-            SignScanner[Digital Signature Scanner]:::userMode
-            PEScanner[PE Feature & Entropy Analysis]:::userMode
-            YaraScanner[Heuristic / YARA Scanner]:::userMode
-            CNNScanner[AI / CNN Model Scanner]:::userMode
-            CloudScanner[Cloud API / Hash Check]:::userMode
-        end
-
-        subgraph UserMonitors [User-Mode Protection Threads]
-            direction TB
-            ProcMon[Process Monitor - CreateToolhelp32Snapshot]:::userMode
-            FileMon[File Monitor - ReadDirectoryChangesW]:::userMode
-            NetMon[Network Monitor - GetExtendedTcpTable]:::userMode
-            SysRep[System Repair - MBR/Reg/Wallpaper]:::userMode
-            PopupBlock[Popup Blocker - EnumWindows]:::userMode
-            PipeClient[IPC Client Thread]:::userMode
-        end
-
-        GUI --> ConfigMgr
-        GUI --> DetectionEngine
-        GUI --> UserMonitors
-        UserMonitors --> DetectionEngine
+        CommClient["Filter Communication Client"]:::interaction
     end
 
-    subgraph StorageLayer [File System / Configuration]
-        direction LR
-        JSONRules[JSON Rules Files]:::storage
-        ConfigJSON[Config.json]:::storage
-        Quarantine[Quarantine Folder]:::storage
-    end
+    subgraph KernelMode ["Kernel Mode (C++ Minifilter Driver)"]
+        CommServer["ALPC Port (\\PYAS_Output_Pipe)"]:::interaction
+        DriverCore["Driver Entry (DriverEntry.cpp)"]:::kernelMode
+        RuleEngine["Rules & Trust Cache (ProtectRules.cpp)"]:::kernelMode
 
-    subgraph KernelSpace [Kernel Mode Driver - PYAS_Driver.sys]
-        direction TB
-        
-        DriverEntry[DriverEntry / Initialization]:::kernelMode
-        GlobalData[Global Data & State]:::kernelMode
-        CommServer[Communication Port Server]:::kernelMode
-
-        subgraph KernelLogic [Core Protection Logic]
-            RuleLoader[Rule Loader & Parser]:::kernelMode
-            TrustCache[Trust Cache & Ransom Tracker]:::kernelMode
-            
-            subgraph MiniFilter [File System MiniFilter]
-                PreCreate[PreCreate: HoneyToken / Access Control]:::kernelMode
-                PreWrite[PreWrite: Ransomware / Entropy Check]:::kernelMode
-                PreSetInfo[PreSetInfo: Anti-Rename / Extension]:::kernelMode
-                PreDevCtrl[PreDeviceControl: Boot / Disk Wipe Protect]:::kernelMode
-            end
-
-            subgraph ObjectCallbacks [Object Manager Callbacks]
-                ProcProtect[ObRegisterCallbacks: Handle Stripping]:::kernelMode
-                ImageLoad[PsSetLoadImageNotifyRoutine: Image Blocking]:::kernelMode
-            end
-
-            subgraph RegistryCallbacks [Configuration Manager Callbacks]
-                RegFilter[CmRegisterCallbackEx: Registry Guard]:::kernelMode
-            end
+        subgraph Protections ["Protection Subsystems"]
+            FileProtect["File Minifilter (ProtectFile.cpp)"]:::kernelMode
+            ProcessProtect["ObRegisterCallbacks (ProtectProcess.cpp)"]:::kernelMode
+            RegProtect["CmRegisterCallbackEx (ProtectRegistry.cpp)"]:::kernelMode
+            BootProtect["IRP_MJ_DEVICE_CONTROL (ProtectBoot.cpp)"]:::kernelMode
         end
-
-        DriverEntry --> GlobalData
-        DriverEntry --> CommServer
-        DriverEntry --> MiniFilter
-        DriverEntry --> ProcProtect
-        DriverEntry --> ImageLoad
-        DriverEntry --> RegFilter
-        
-        MiniFilter --> RuleLoader
-        ProcProtect --> RuleLoader
-        RegFilter --> RuleLoader
-        
-        PreWrite --> TrustCache
-        PreCreate --> TrustCache
     end
 
-    %% Cross-Boundary Interactions
-    ConfigMgr -- Writes --> JSONRules
-    ConfigMgr -- Writes --> ConfigJSON
-    RuleLoader -- Reads --> JSONRules
-    
-    GUI -- Service Control (SCM) --> DriverEntry
-    PipeClient -- FltSendMessage (IPC) --> CommServer
-    CommServer -- Notifications --> PipeClient
-    
-    FileMon -- Moves Malicious Files --> Quarantine
-    
-    %% Logic Flow Details
-    ProcProtect -- Protects --> UserSpace
-    RegFilter -- Protects --> StorageLayer
-    PreDevCtrl -- Protects --> StorageLayer
+    subgraph OS ["Windows OS & Storage"]
+        FS["File System (FltMgr)"]:::storage
+        Reg["Registry (CmMgr)"]:::storage
+        ProcMgr["Process/Thread Manager (ObMgr)"]:::storage
+        Disk["Physical Disk / MBR"]:::storage
+    end
+
+    CloudAPI["PYAS Cloud Server"]:::storage
+
+    %% User Mode Internal
+    UI <-->|JS Evaluate / JSON| PYASCore
+    PYASCore -->|Extract Features & Scan| Engines
+    CloudScanner -.->|HTTPS REST API| CloudAPI
+    PYASCore <-->|FilterSendMessage / FilterGetMessage| CommClient
+
+    %% User-Kernel Boundary
+    CommClient <-->|PYAS_MESSAGE / PYAS_USER_MESSAGE| CommServer
+
+    %% Kernel Mode Internal
+    CommServer <-->|Message Dispatch| DriverCore
+    DriverCore --> RuleEngine
+    RuleEngine --> Protections
+
+    %% Kernel-OS Boundary
+    FileProtect -->|IRP_MJ_CREATE, IRP_MJ_WRITE...| FS
+    ProcessProtect -->|PreOpenProcess, PreOpenThread| ProcMgr
+    RegProtect -->|RegNtPreCreateKey, RegNtPreSetValueKey...| Reg
+    BootProtect -->|IOCTL_DISK_FORMAT_TRACKS...| Disk
 ```
 
+## Machine Learning
+
+The machine learning-based virus scanning engine training achieved extremely high accuracy.
+
+<img width="1191" height="1323" alt="train" src="https://github.com/user-attachments/assets/2eea8426-1f82-44e3-9a38-f96f9257cf50" />
+
 ## Support System
 
+Please ensure your computer supports Microsoft Visual C++ 2015-2022 Redistributable and Edge Webview2.
+
 | Config    | Permissions   | System version       | Processor | Memory | Storage |
 |-----------|---------------|----------------------|-----------|--------|---------|
-| Minimum   | Administrator | >= Windows 10 (20H1) | 1 GHz     | 200MB  | 100MB   |
+| Minimum   | Administrator | >= Windows 10 (20H1) | 1 GHz     | 300MB  | 100MB   |
 | Recommend | Administrator | >= Windows 10 (21H2) | 3 GHz     | 500MB  | 200MB   |
 
-## Packaged Releases
-
-Download the installer. If it is incompatible with your system, you can repackage it yourself.
-
-Packaged Download: https://github.com/87owo/PYAS/releases
-
 ## Official Website
 
 If you are interested in this project, you can visit the website to see other related content.
@@ -196,6 +152,8 @@ Official Website : https://pyas-security.com/antivirus
 
 Online Analyze : https://pyas-security.com/analyze
 
+Packaged Download: https://github.com/87owo/PYAS/releases
+
 ## Project License
 
 For any questions, needs, or bug feedback, please contact us through the following website.