Add files via upload

2026-05-02 01:49:17 +08:00 · 2026-05-02 01:16:32 +08:00 · 2026-05-02 01:16:05 +08:00 · 2026-05-02 01:15:51 +08:00 · 2026-05-02 01:15:28 +08:00 · 2026-05-01 23:16:30 +08:00
22 changed files with 2450 additions and 2533 deletions
@@ -1,16 +0,0 @@
-FROM python:3.10-slim
-
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    libfuzzy-dev \
-    git \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-
-COPY . .
-
-CMD ["python", "-u", "predict_onnx_linux.py"]
@@ -1,211 +0,0 @@
-import os, time, uuid, logging, requests, hashlib
-
-from pathlib import Path
-from typing import Optional, List, Dict, Any
-
-####################################################################################################
-
-class PYAS_Client:
-    def __init__(self, api_key: str, host: str, timeout: int = 30):
-        self.base_url = host.rstrip('/')
-        self.timeout = timeout
-        self.logger = logging.getLogger("PYAS_API")
-        self.session = requests.Session()
-        self.session.headers.update({"X-API-Key": api_key, "User-Agent": "PYAS-API/1.1"})
-        self.logger.info(f"Initialized PYAS API Client targeting {self.base_url}")
-
-    def _request(self, method: str, endpoint: str, **kwargs) -> Optional[requests.Response]:
-        self.logger.debug(f"Request: {method} {endpoint}")
-        try:
-            r = self.session.request(method, f"{self.base_url}{endpoint}", timeout=self.timeout, **kwargs)
-            if r.status_code == 200:
-                return r
-
-            error_map = {401: "API Key invalid", 402: "Insufficient points", 404: "Not found", 500: "Server Error"}
-            self.logger.error(f"[{endpoint}] Failed: {error_map.get(r.status_code, f'HTTP {r.status_code}')}")
-
-        except Exception as e:
-            self.logger.error(f"Connection error: {e}")
-        return None
-
-####################################################################################################
-
-    def _calculate_sha256(self, path: Path) -> str:
-        self.logger.debug(f"Calculating SHA256 for {path}")
-        sha256_hash = hashlib.sha256()
-
-        with open(path, "rb") as f:
-            for byte_block in iter(lambda: f.read(1048576), b""):
-                sha256_hash.update(byte_block)
-
-        return sha256_hash.hexdigest()
-
-    def upload_file(self, file_path: str, chunk_size: int = 5242880) -> Optional[str]:
-        path = Path(file_path)
-        if not path.exists():
-            self.logger.error(f"File not found: {file_path}")
-            return None
-        
-        file_size = path.stat().st_size
-        self.logger.info(f"Initiating upload for {path.name} ({file_size} bytes)")
-
-        if file_size > 536870912:
-            self.logger.error(f"File size exceeds 512MB limit: {file_size} bytes")
-            return None
-
-        local_sha256 = self._calculate_sha256(path)
-        status_req = self._request("GET", f"/api/processing_status/{local_sha256}")
-        
-        if status_req and status_req.json().get('status') in ['done', 'processing', 'queued']:
-            self.logger.info(f"File already exists or processing on server: {local_sha256}")
-            return local_sha256
-
-        if file_size > chunk_size:
-            return self._upload_chunked(path, chunk_size, file_size)
-        return self._upload_standard(path)
-
-####################################################################################################
-
-    def _upload_standard(self, path: Path, max_retries: int = 3) -> Optional[str]:
-        self.logger.info(f"Starting standard upload for {path.name}")
-        with open(path, 'rb') as f:
-            file_data = f.read()
-
-        for attempt in range(max_retries):
-            r = self._request("POST", "/api/upload", files={'file': (path.name, file_data)})
-            if r and 'url' in r.json():
-                sha256 = r.json().get('url', '').split('/')[-1]
-                self.logger.info(f"Standard upload successful: {sha256}")
-                return sha256
-
-            self.logger.warning(f"Standard upload retry {attempt + 1}/{max_retries}")
-            time.sleep(1)
-        
-        self.logger.error("Standard upload failed after retries")
-        return None
-
-    def _upload_chunked(self, path: Path, chunk_size: int, file_size: int, max_retries: int = 3) -> Optional[str]:
-        total_chunks = (file_size + chunk_size - 1) // chunk_size
-        upload_id = uuid.uuid4().hex
-        self.logger.info(f"Starting chunked upload for {path.name} (Chunks: {total_chunks}, ID: {upload_id})")
-        
-        with open(path, 'rb') as f:
-            for i in range(total_chunks):
-                chunk_data = f.read(chunk_size)
-                headers = {"X-Chunk-Index": str(i), "X-Total-Chunks": str(total_chunks), "X-Upload-ID": upload_id}
-                
-                chunk_success = False
-                for attempt in range(max_retries):
-                    r = self._request("POST", "/api/upload", files={'file': (path.name, chunk_data)}, headers=headers)
-                    if r:
-                        chunk_success = True
-                        self.logger.debug(f"Uploaded chunk {i + 1}/{total_chunks}")
-
-                        if i == total_chunks - 1 and 'url' in r.json():
-                            sha256 = r.json().get('url', '').split('/')[-1]
-                            self.logger.info(f"Chunked upload successful: {sha256}")
-                            return sha256
-
-                        break
-
-                    self.logger.warning(f"Chunk upload retry {attempt + 1}/{max_retries} for chunk {i}")
-                    time.sleep(1)
-                
-                if not chunk_success:
-                    self.logger.error(f"Failed to upload chunk {i + 1}/{total_chunks}")
-                    return None
-        return None
-
-####################################################################################################
-
-    def wait_for_analysis(self, sha256: str, interval: int = 5, max_retries: int = 10) -> bool:
-        self.logger.info(f"Waiting for analysis completion: {sha256}")
-        for attempt in range(max_retries):
-            r = self._request("GET", f"/api/processing_status/{sha256}")
-            if r:
-                status = r.json().get('status')
-                self.logger.debug(f"Analysis status: {status}")
-
-                if status == 'done':
-                    self.logger.info(f"Analysis completed: {sha256}")
-                    return True
-
-                if status in ['missing', 'error', 'failed']:
-                    self.logger.error(f"Analysis failed with status: {status}")
-                    return False
-
-            time.sleep(interval)
-        
-        self.logger.error(f"Analysis polling timed out for {sha256}")
-        return False
-
-    def get_report(self, sha256: str) -> Optional[Dict[str, Any]]:
-        self.logger.info(f"Fetching report for {sha256}")
-        r = self._request("GET", f"/api/report/{sha256}")
-        if r:
-            return r.json()
-
-        self.logger.error(f"Failed to fetch report for {sha256}")
-        return None
-
-####################################################################################################
-
-    def rescan(self, sha256: str) -> bool:
-        self.logger.info(f"Triggering rescan for {sha256}")
-        r = self._request("POST", f"/api/rescan/{sha256}")
-
-        success = bool(r and r.json().get('status') == 'success')
-        if success:
-            self.logger.info(f"Rescan triggered successfully for {sha256}")
-        else:
-            self.logger.error(f"Rescan failed for {sha256}")
-        return success
-
-    def search_files(self, query: str, limit: int = 50, page: int = 0, snapshot: Optional[str] = None) -> List[Dict[str, Any]]:
-        self.logger.info(f"Searching files (Query: '{query}', Limit: {limit}, Page: {page})")
-        payload = {'query': query, 'page': page}
-        if snapshot:
-            payload['snapshot'] = snapshot
-
-        r = self._request("POST", "/api/search_more", data=payload)
-        results = r.json().get('results', [])[:limit] if r else []
-        self.logger.info(f"Search returned {len(results)} results")
-        return results
-
-    def download_sample(self, sha256: str, save_dir: str = "downloads") -> Optional[str]:
-        self.logger.info(f"Downloading sample {sha256}")
-        os.makedirs(save_dir, exist_ok=True)
-        path = os.path.join(save_dir, f"{sha256}.zip")
-
-        r = self._request("GET", f"/api/download/{sha256}", stream=True)
-        if r:
-            with open(path, 'wb') as f:
-                for chunk in r.iter_content(8192):
-                    if chunk:
-                        f.write(chunk)
-            self.logger.info(f"Sample downloaded successfully to {path}")
-            return path
-
-        self.logger.error(f"Failed to download sample {sha256}")
-        return None
-
-####################################################################################################
-
-if __name__ == "__main__":
-    logging.basicConfig(level=logging.DEBUG, format='[%(asctime)s] %(levelname)s [%(name)s] - %(message)s', datefmt='%Y-%m-%d %H:%M:%S')
-    
-    API_KEY = ""
-    HOST = "https://pyas-security.com/" 
-    
-    client = PYAS_Client(API_KEY, HOST)
-    target_file = r"test.exe"
-    
-    sha = client.upload_file(target_file)
-    if sha and client.wait_for_analysis(sha):
-        report = client.get_report(sha)
-        if report:
-            meta = report.get('data', {}).get('metadata', {})
-            logging.info(f"Result: {meta.get('label')} ({meta.get('score')}%)")
-            
-    for item in client.search_files('date>=2020; ext=exe | dll', limit=3):
-        client.download_sample(item['sha256'])
@@ -1 +0,0 @@
-["FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders", "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags", "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint", "BaseOfCode", "SectionAlignment", "FileAlignment", "MajorOperatingSystemVersion", "MinorOperatingSystemVersion", "MajorImageVersion", "MinorImageVersion", "MajorSubsystemVersion", "MinorSubsystemVersion", "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit", "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols", "SizeOfOptionalHeader", "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", "SectionCount", "ExecutableSections", "WritableSections", "ReadableSections", "SectionException", "Char_00000020_Count", "Char_00000020_MeanEntropy", "Char_00000040_Count", "Char_00000040_MeanEntropy", "Char_00000080_Count", "Char_00000080_MeanEntropy", "Char_02000000_Count", "Char_02000000_MeanEntropy", "Char_20000000_Count", "Char_20000000_MeanEntropy", "Char_40000000_Count", "Char_40000000_MeanEntropy", "Char_80000000_Count", "Char_80000000_MeanEntropy", "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount", "ImportCount", "ImportFunctionCount", "FileDescriptionLength", "FileVersionLength", "ProductNameLength", "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", "CommentsLength", "InternalNameLength", "LegalTrademarksLength", "SpecialBuildLength", "PrivateBuildLength", "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException", "Cat_AntiDebug", "Cat_Audio", "Cat_COM", "Cat_Camera", "Cat_Clipboard", "Cat_DataObfuscation", "Cat_DotNet", "Cat_Encryption", "Cat_FileIO", "Cat_Graphics", "Cat_Injection", "Cat_Input", "Cat_Keylogging", "Cat_Memory", "Cat_MultiThreading", "Cat_Native", "Cat_Network", "Cat_Privileges", "Cat_ProcessControl", "Cat_Registry", "Cat_Resource", "Cat_ScreenCapture", "Cat_Services", "Cat_Synchronization", "Cat_WindowControl", "Dll_advapi32_dll", "Dll_bcrypt_dll", "Dll_comctl32_dll", "Dll_crypt32_dll", "Dll_dbghelp_dll", "Dll_gdi32_dll", "Dll_hal_dll", "Dll_imagehlp_dll", "Dll_iphlpapi_dll", "Dll_kernel32_dll", "Dll_mscoree_dll", "Dll_netapi32_dll", "Dll_ntdll_dll", "Dll_ole32_dll", "Dll_oleaut32_dll", "Dll_psapi_dll", "Dll_shell32_dll", "Dll_shlwapi_dll", "Dll_urlmon_dll", "Dll_user32_dll", "Dll_vbscript_dll", "Dll_version_dll", "Dll_winhttp_dll", "Dll_wininet_dll", "Dll_winmm_dll", "Dll_ws2_32_dll", "Dll_wsock32_dll", "Dll_wtsapi32_dll", "Api_AdjustTokenPrivileges", "Api_Base64Decode", "Api_BitBlt", "Api_CallNextHookEx", "Api_CallWindowProcA", "Api_CapCreateCaptureWindowA", "Api_CapCreateCaptureWindowW", "Api_CharLowerA", "Api_CharUpperA", "Api_CheckRemoteDebuggerPresent", "Api_CloseClipboard", "Api_CloseHandle", "Api_CoCreateInstance", "Api_CoInitialize", "Api_CoUninitialize", "Api_CompareStringA", "Api_ConnectNamedPipe", "Api_ControlService", "Api_CopyFileA", "Api_CopyFileW", "Api_CreateCompatibleBitmap", "Api_CreateCompatibleDC", "Api_CreateDCA", "Api_CreateDCW", "Api_CreateEventA", "Api_CreateEventW", "Api_CreateFileA", "Api_CreateFileMappingA", "Api_CreateFileMappingW", "Api_CreateFileW", "Api_CreateMutexA", "Api_CreateMutexW", "Api_CreateProcessA", "Api_CreateProcessW", "Api_CreateRemoteThread", "Api_CreateServiceA", "Api_CreateServiceW", "Api_CreateThread", "Api_CreateThreadpoolWork", "Api_CreateWindowExA", "Api_CryptAcquireContextA", "Api_CryptAcquireContextW", "Api_CryptCreateHash", "Api_CryptDecodeObject", "Api_CryptDecrypt", "Api_CryptDeriveKey", "Api_CryptDestroyHash", "Api_CryptDestroyKey", "Api_CryptEncrypt", "Api_CryptExportKey", "Api_CryptGenKey", "Api_CryptHashData", "Api_CryptImportKey", "Api_CryptReleaseContext", "Api_D3D11CreateDevice", "Api_DecodePointer", "Api_DefWindowProcA", "Api_DeleteCriticalSection", "Api_DeleteDC", "Api_DeleteFileA", "Api_DeleteFileW", "Api_DeleteObject", "Api_DeleteService", "Api_DestroyWindow", "Api_DeviceIoControl", "Api_Direct3DCreate9", "Api_DispatchMessageA", "Api_DnsQuery_A", "Api_DnsQuery_W", "Api_EncodePointer", "Api_EnterCriticalSection", "Api_EnumChildWindows", "Api_EnumWindows", "Api_ExitProcess", "Api_ExitThread", "Api_FindClose", "Api_FindFirstFileA", "Api_FindNextFileA", "Api_FindResourceA", "Api_FindWindowA", "Api_FindWindowW", "Api_FlushFileBuffers", "Api_FreeEnvironmentStringsW", "Api_FreeLibrary", "Api_FreeResource", "Api_GdipSaveImageToFile", "Api_GetACP", "Api_GetActiveWindow", "Api_GetAsyncKeyState", "Api_GetCapture", "Api_GetClientRect", "Api_GetClipboardData", "Api_GetCommandLineA", "Api_Line truncated
@@ -1,611 +0,0 @@
-import os, sys, time, re, math, pefile, json, datetime, mmap
-import numpy as np
-import onnxruntime as ort
-from signify.authenticode.signed_file.pe import SignedPEFile
-from signify.authenticode.verification_result import AuthenticodeVerificationResult
-
-####################################################################################################
-
-MODEL_FILE = "model.onnx"
-FEATURE_FILE = "features.json"
-MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024
-
-####################################################################################################
-
-class WinTrust:
-    @staticmethod
-    def verify(file_path):
-        if not file_path or not os.path.exists(file_path) or os.path.getsize(file_path) == 0:
-            return 0
-        try:
-            with open(file_path, 'rb') as f:
-                with mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ) as mm:
-                    pe = SignedPEFile(mm)
-                    if not pe.signatures:
-                        return 0
-
-                    status, _ = pe.explain_verify()
-                    if status == AuthenticodeVerificationResult.OK:
-                        return 1
-        except Exception:
-            pass
-        return 0
-
-####################################################################################################
-
-class FeatureExtractor:
-    API_CAT_MAPPING = {
-        'ProcessControl': {
-            'CreateProcessA', 'CreateProcessW', 'WinExec', 'ShellExecuteA', 'ShellExecuteW',
-            'ShellExecuteExW', 'ExitProcess', 'TerminateProcess', 'OpenProcess', 'GetExitCodeProcess',
-            'SetThreadPriority', 'GetThreadPriority', 'GetCurrentProcess', 'GetCurrentProcessId',
-            'GetModuleFileNameA', 'GetCommandLineA', 'GetModuleFileNameW', 'GetStartupInfoW'
-        },
-        'Injection': {
-            'VirtualAlloc', 'VirtualAllocEx', 'VirtualProtect', 'VirtualProtectEx', 'WriteProcessMemory', 
-            'ReadProcessMemory', 'CreateRemoteThread', 'QueueUserAPC', 'SetThreadContext', 'GetThreadContext', 
-            'Wow64SetThreadContext', 'NtUnmapViewOfSection', 'ZwUnmapViewOfSection', 'RtlCreateUserThread', 
-            'SetWindowsHookExA', 'SetWindowsHookExW', 'UnhookWindowsHookEx', 'LoadLibraryA', 'LoadLibraryW', 
-            'LoadLibraryExA', 'LoadLibraryExW', 'GetProcAddress', 'GetModuleHandleA', 'GetModuleHandleW',
-            'FreeLibrary', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'UnmapViewOfSection',
-            'VirtualFree', 'VirtualQuery'
-        },
-        'Synchronization': {
-            'WaitForSingleObject', 'WaitForSingleObjectEx', 'WaitForMultipleObjects', 'WaitForMultipleObjectsEx',
-            'CreateMutexA', 'CreateMutexW', 'OpenMutexW', 'ReleaseMutex', 'CreateEventA', 'CreateEventW', 
-            'OpenEventW', 'SetEvent', 'ResetEvent', 'EnterCriticalSection', 'LeaveCriticalSection', 
-            'InitializeCriticalSection', 'DeleteCriticalSection', 'Sleep', 'SleepEx',
-            'InitializeCriticalSectionAndSpinCount', 'InterlockedDecrement', 'InterlockedIncrement', 
-            'InterlockedExchange', 'InterlockedCompareExchange', 'SetTimer', 'KillTimer'
-        },
-        'MultiThreading': {
-            'CreateThread', 'ResumeThread', 'SuspendThread', 'ExitThread', 'TerminateThread',
-            'GetCurrentThread', 'GetCurrentThreadId', 'TlsAlloc', 'TlsSetValue', 'TlsGetValue',
-            'CreateThreadpoolWork', 'SubmitThreadpoolWork', 'TlsFree'
-        },
-        'Network': {
-            'socket', 'connect', 'send', 'recv', 'bind', 'listen', 'accept', 'gethostbyname', 'getaddrinfo',
-            'WSAStartup', 'WSACleanup', 'WSAIoctl', 'WSASocketA', 'WSASocketW', 'closesocket', 'htons',
-            'InternetOpenA', 'InternetOpenW', 'InternetConnectA', 'InternetConnectW', 'InternetOpenUrlA', 
-            'InternetOpenUrlW', 'HttpOpenRequestA', 'HttpOpenRequestW', 'HttpSendRequestA', 'HttpSendRequestW',
-            'InternetReadFile', 'URLDownloadToFileA', 'URLDownloadToFileW', 'DnsQuery_A', 'DnsQuery_W'
-        },
-        'Encryption': {
-            'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptCreateHash', 'CryptHashData', 
-            'CryptDeriveKey', 'CryptEncrypt', 'CryptDecrypt', 'CryptDestroyKey', 'CryptDestroyHash',
-            'CryptReleaseContext', 'CryptGenKey', 'CryptImportKey', 'CryptExportKey'
-        },
-        'DataObfuscation': {
-            'RtlDecompressBuffer', 'MultiByteToWideChar', 'WideCharToMultiByte', 'Base64Decode', 
-            'CryptDecodeObject', 'IsDBCSLeadByte', 'CharUpperA', 'CharLowerA',
-            'GetStringTypeW', 'LCMapStringW', 'IsValidCodePage', 'DecodePointer', 'EncodePointer'
-        },
-        'FileIO': {
-            'CreateFileA', 'CreateFileW', 'WriteFile', 'ReadFile', 'DeleteFileA', 'DeleteFileW',
-            'CopyFileA', 'CopyFileW', 'MoveFileA', 'MoveFileW', 'FindFirstFileA', 'FindNextFileA',
-            'GetTempPathA', 'GetTempPathW', 'GetTempFileNameA', 'GetTempFileNameW', 'SetFileAttributesA', 
-            'SetFileAttributesW', 'DeviceIoControl', 'SetFileTime', 'GetFileSize', 'GetFileSizeEx',
-            'SetFilePointer', 'FlushFileBuffers', 'ConnectNamedPipe', 'PeekNamedPipe',
-            'CloseHandle', 'GetFileType', 'SetStdHandle', 'SetFilePointerEx', 'FindClose', 
-            'SetHandleCount', 'SetEndOfFile', 'GetFullPathNameA', 'GetFileAttributesA'
-        },
-        'Registry': {
-            'RegOpenKeyExA', 'RegOpenKeyExW', 'RegSetValueExA', 'RegSetValueExW', 
-            'RegCreateKeyExA', 'RegCreateKeyExW', 'RegDeleteKeyA', 'RegDeleteKeyW',
-            'RegEnumValueA', 'RegEnumValueW', 'RegQueryValueExA', 'RegQueryValueExW',
-            'RegDeleteValueA', 'RegDeleteValueW', 'RegCloseKey'
-        },
-        'Services': {
-            'OpenSCManagerA', 'OpenSCManagerW', 'CreateServiceA', 'CreateServiceW',
-            'StartServiceA', 'StartServiceW', 'ControlService', 'DeleteService'
-        },
-        'Privileges': {
-            'AdjustTokenPrivileges', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 
-            'OpenProcessToken', 'NetUserAdd', 'NetLocalGroupAddMembers', 'IsAdmin', 
-            'GetUserNameA', 'GetUserNameW'
-        },
-        'Native': {
-            'RtlUnwind', 'RtlVirtualUnwind', 'RtlCaptureContext', 'RtlLookupFunctionEntry',
-            'NtClose', 'NtQueryInformationProcess', 'RtlAllocateHeap', 'RtlFreeHeap',
-            'GetSystemTimeAsFileTime', 'GetLocalTime', 'GlobalMemoryStatus', 
-            'GetVersionExA', 'GetVersionExW', 'GetComputerNameA', 'GetComputerNameW',
-            'GetLastError', 'GetACP', 'RaiseException', 'SetLastError', 'GetEnvironmentStringsW', 
-            'FreeEnvironmentStringsW', 'GetLocaleInfoA', 'lstrlenA', 'GetVersion', 'GetSystemInfo', 
-            'CompareStringA'
-        },
-        'DotNet': {
-            '_CorExeMain', '_CorDllMain'
-        },
-        'AntiDebug': {
-            'IsDebuggerPresent', 'CheckRemoteDebuggerPresent', 'OutputDebugStringA', 'OutputDebugStringW',
-            'GetTickCount', 'GetTickCount64', 'QueryPerformanceCounter', 'FindWindowA', 'FindWindowW',
-            'EnumWindows', 'EnumChildWindows', 'GetWindowRect', 'GetClientRect', 'SetWindowDisplayAffinity',
-            'UnhandledExceptionFilter', 'SetUnhandledExceptionFilter', 'IsProcessorFeaturePresent', 
-            'SetErrorMode', 'GetTimeZoneInformation', 'GetDriveTypeW', 'GetDiskFreeSpaceA'
-        },
-        'Keylogging': {
-            'GetAsyncKeyState', 'GetKeyState', 'GetKeyboardState', 'MapVirtualKeyA', 'MapVirtualKeyW',
-            'ToAscii', 'ToAsciiEx', 'ToUnicode', 'ToUnicodeEx', 'GetKeyNameTextA', 'GetForegroundWindow',
-            'KeybdEvent', 'SendInput', 'MapVirtualKeyExA', 'MapVirtualKeyExW', 'CallNextHookEx'
-        },
-        'Input': {
-            'GetCursorPos', 'SetCursorPos', 'MouseEvent', 'GetDoubleClickTime', 
-            'GetCapture', 'SetCapture'
-        },
-        'ScreenCapture': {
-            'BitBlt', 'StretchBlt', 'GetDC', 'GetWindowDC', 'CreateCompatibleDC', 'CreateCompatibleBitmap',
-            'GdipSaveImageToFile', 'PrintWindow', 'GetDesktopWindow', 'CreateDCW', 'CreateDCA',
-            'SelectObject', 'DeleteDC', 'DeleteObject', 'GetDeviceCaps', 'GetSystemMetrics'
-        },
-        'Graphics': {
-            'Direct3DCreate9', 'D3D11CreateDevice'
-        },
-        'Audio': {
-            'WaveInOpen', 'WaveInClose', 'WaveInStart', 'WaveInStop'
-        },
-        'Clipboard': {
-            'OpenClipboard', 'CloseClipboard', 'GetClipboardData', 'SetClipboardData'
-        },
-        'Camera': {
-            'CapCreateCaptureWindowA', 'CapCreateCaptureWindowW'
-        },
-        'Memory': {
-            'HeapAlloc', 'HeapFree', 'HeapSize', 'HeapCreate', 'GetProcessHeap',
-            'LocalAlloc', 'LocalFree', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock',
-            'HeapDestroy', 'GlobalLock', 'SysFreeString', 'SysAllocStringLen'
-        },
-        'Resource': {
-            'LoadResource', 'SizeofResource', 'LockResource', 'FreeResource', 'FindResourceA'
-        },
-        'WindowControl': {
-            'ShowWindow', 'DestroyWindow', 'TranslateMessage', 'DispatchMessageA', 'GetWindow',
-            'PeekMessageA', 'GetWindowLongA', 'CallWindowProcA', 'SetWindowLongA', 'GetWindowTextA',
-            'ScreenToClient', 'GetActiveWindow', 'CreateWindowExA', 'DefWindowProcA', 'GetMessageA',
-            'RegisterClassA', 'UnregisterClassA', 'MessageBoxA'
-        },
-        'COM': {
-            'CoCreateInstance', 'CoUninitialize', 'CoInitialize'
-        }
-    }
-
-    TARGET_DLLS = {
-        'kernel32.dll', 'user32.dll', 'gdi32.dll', 'advapi32.dll', 'shell32.dll', 'ntdll.dll', 'hal.dll',
-        'ws2_32.dll', 'wsock32.dll', 'wininet.dll', 'winhttp.dll', 'urlmon.dll', 'crypt32.dll', 'bcrypt.dll',
-        'psapi.dll', 'dbghelp.dll', 'imagehlp.dll', 'shlwapi.dll', 'ole32.dll', 'oleaut32.dll', 'comctl32.dll',
-        'mscoree.dll', 'vbscript.dll', 'netapi32.dll', 'iphlpapi.dll', 'wtsapi32.dll', 'version.dll', 'winmm.dll'
-    }
-
-    BASE_SCHEMA = [
-        "FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic",
-        "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders",
-        "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags",
-        "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", 
-        "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint",
-        "BaseOfCode", "SectionAlignment", "FileAlignment",
-        "MajorOperatingSystemVersion", "MinorOperatingSystemVersion",
-        "MajorImageVersion", "MinorImageVersion",
-        "MajorSubsystemVersion", "MinorSubsystemVersion",
-        "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit",
-        "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols",
-        "SizeOfOptionalHeader",
-        
-        "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", 
-        "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", 
-        "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", 
-        "SectionCount", "ExecutableSections", 
-        "WritableSections", "ReadableSections", "SectionException",
-
-        "Char_00000020_Count", "Char_00000020_MeanEntropy",
-        "Char_00000040_Count", "Char_00000040_MeanEntropy",
-        "Char_00000080_Count", "Char_00000080_MeanEntropy",
-        "Char_02000000_Count", "Char_02000000_MeanEntropy",
-        "Char_20000000_Count", "Char_20000000_MeanEntropy",
-        "Char_40000000_Count", "Char_40000000_MeanEntropy",
-        "Char_80000000_Count", "Char_80000000_MeanEntropy",
-        
-        "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount",
-        "ImportCount", "ImportFunctionCount",
-        
-        "FileDescriptionLength", "FileVersionLength", "ProductNameLength", 
-        "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", 
-        "CommentsLength", "InternalNameLength", "LegalTrademarksLength",
-        "SpecialBuildLength", "PrivateBuildLength",
-        
-        "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", 
-        "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", 
-        "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException"
-    ]
-
-    CAT_SCHEMA = [f"Cat_{k}" for k in sorted(API_CAT_MAPPING.keys())]
-    DLL_SCHEMA = [f"Dll_{d.replace('.', '_')}" for d in sorted(TARGET_DLLS)]
-    
-    _ALL_APIS = {api for apis in API_CAT_MAPPING.values() for api in apis}
-    API_SCHEMA = [f"Api_{api}" for api in sorted(_ALL_APIS)]
-    
-    SCHEMA = BASE_SCHEMA + CAT_SCHEMA + DLL_SCHEMA + API_SCHEMA
-    
-    _API_TO_CATS = {}
-    for _cat, _apis in API_CAT_MAPPING.items():
-        for _api in _apis:
-            if _api not in _API_TO_CATS:
-                _API_TO_CATS[_api] = []
-            _API_TO_CATS[_api].append(_cat)
-
-    PACKERS = {
-        'upx', 'aspack', 'asprotect', 'pecompact', 'upack', 'fsg', 'mew', 
-        'mpress', 'ezip', 'pklt', 'shrink', 'petite', 'telock',
-        'themida', 'winlicense', 'tmd', 'vmp', 'enigma', 'obsidium', 
-        'pelock', 'exestealth', 'yoda', 'armadillo', 'zprotect',
-        'sforce', 'starforce', 'qihoo', 'wisevec', 'megastop',
-    }
-    INSTALLER_SIGS = [b"Nullsoft.NSIS", b"Inno Setup", b"7-Zip.7zip", b"InstallShield"]
-
-####################################################################################################
-
-    @staticmethod
-    def _safe_float(val):
-        try:
-            f = float(val)
-            if math.isinf(f) or math.isnan(f): return 0.0
-            return f
-        except Exception:
-            return 0.0
-
-    @staticmethod
-    def _calc_entropy(data):
-        if not data: return 0.0
-        arr = np.frombuffer(data, dtype=np.uint8)
-        counts = np.bincount(arr, minlength=256)
-        probs = counts[counts > 0] / len(arr)
-        return float(-np.sum(probs * np.log2(probs)))
-
-    @staticmethod
-    def _safe_div(n, d):
-        return float(n) / d if d > 0 else 0.0
-
-####################################################################################################
-
-    @classmethod
-    def extract(cls, file_path):
-        fts = {k: 0.0 for k in cls.SCHEMA}
-        pe = None
-        try:
-            fsize = os.path.getsize(file_path)
-            if fsize == 0 or fsize > MAX_FILE_SIZE:
-                return None
-
-            with open(file_path, "rb") as f:
-                file_bytes = f.read()
-
-            pe = pefile.PE(data=file_bytes, fast_load=True)
-            fts['TrustSigned'] = WinTrust.verify(file_path)
-
-            fh = pe.FILE_HEADER
-            fts['Machine'] = fh.Machine
-            fts['NumberOfSections'] = fh.NumberOfSections
-            fts['TimeDateStamp'] = fh.TimeDateStamp
-            fts['PointerToSymbolTable'] = fh.PointerToSymbolTable
-            fts['NumberOfSymbols'] = fh.NumberOfSymbols
-            fts['SizeOfOptionalHeader'] = fh.SizeOfOptionalHeader
-            fts['Characteristics'] = fh.Characteristics
-
-            curr_ts = datetime.datetime.utcnow().timestamp()
-            fts['HasInvalidTimestamp'] = 1 if (fh.TimeDateStamp < 631152000 or fh.TimeDateStamp > curr_ts + 2592000) else 0
-            fts['FileTimeException'] = 1 if fh.TimeDateStamp == 0 else 0
-
-            if hasattr(pe, 'OPTIONAL_HEADER'):
-                op = pe.OPTIONAL_HEADER
-                fts['Magic'] = getattr(op, 'Magic', 0)
-                fts['MajorLinkerVersion'] = getattr(op, 'MajorLinkerVersion', 0)
-                fts['MinorLinkerVersion'] = getattr(op, 'MinorLinkerVersion', 0)
-                fts['SizeOfCode'] = getattr(op, 'SizeOfCode', 0)
-                fts['SizeOfInitializedData'] = getattr(op, 'SizeOfInitializedData', 0)
-                fts['SizeOfUninitializedData'] = getattr(op, 'SizeOfUninitializedData', 0)
-                fts['AddressOfEntryPoint'] = getattr(op, 'AddressOfEntryPoint', 0)
-                fts['BaseOfCode'] = getattr(op, 'BaseOfCode', 0)
-                fts['ImageBase'] = getattr(op, 'ImageBase', 0)
-                fts['SectionAlignment'] = getattr(op, 'SectionAlignment', 0)
-                fts['FileAlignment'] = getattr(op, 'FileAlignment', 0)
-                fts['MajorOperatingSystemVersion'] = getattr(op, 'MajorOperatingSystemVersion', 0)
-                fts['MinorOperatingSystemVersion'] = getattr(op, 'MinorOperatingSystemVersion', 0)
-                fts['MajorImageVersion'] = getattr(op, 'MajorImageVersion', 0)
-                fts['MinorImageVersion'] = getattr(op, 'MinorImageVersion', 0)
-                fts['MajorSubsystemVersion'] = getattr(op, 'MajorSubsystemVersion', 0)
-                fts['MinorSubsystemVersion'] = getattr(op, 'MinorSubsystemVersion', 0)
-                fts['SizeOfImage'] = getattr(op, 'SizeOfImage', 0)
-                fts['SizeOfHeaders'] = getattr(op, 'SizeOfHeaders', 0)
-                fts['CheckSum'] = getattr(op, 'CheckSum', 0)
-                fts['Subsystem'] = getattr(op, 'Subsystem', 0)
-                fts['DllCharacteristics'] = getattr(op, 'DllCharacteristics', 0)
-                fts['SizeOfStackReserve'] = getattr(op, 'SizeOfStackReserve', 0)
-                fts['SizeOfStackCommit'] = getattr(op, 'SizeOfStackCommit', 0)
-                fts['SizeOfHeapReserve'] = getattr(op, 'SizeOfHeapReserve', 0)
-                fts['SizeOfHeapCommit'] = getattr(op, 'SizeOfHeapCommit', 0)
-                fts['LoaderFlags'] = getattr(op, 'LoaderFlags', 0)
-                fts['NumberOfRvaAndSizes'] = getattr(op, 'NumberOfRvaAndSizes', 0)
-                fts['Is64Bit'] = 1 if fh.Machine in (0x8664, 0xAA64, 0x0200) else 0
-                fts['IsExe'] = 1 if pe.is_exe() else 0
-                fts['IsDll'] = 1 if pe.is_dll() else 0
-                fts['IsDriver'] = 1 if fts['Subsystem'] == 1 else 0
-
-                if hasattr(op, 'DATA_DIRECTORY'):
-                    reloc_idx = pefile.DIRECTORY_ENTRY.get('IMAGE_DIRECTORY_ENTRY_BASERELOC', 5)
-                    if len(op.DATA_DIRECTORY) > reloc_idx and op.DATA_DIRECTORY[reloc_idx].Size > 0:
-                        fts['HasRelocationDirectory'] = 1
-
-            try:
-                fts['FileEntropy'] = cls._calc_entropy(file_bytes)
-            except Exception:
-                pass
-
-            sec_entropies = []
-            text_entropies = []
-            data_entropies = []
-            rsrc_entropies = []
-            char_flags = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
-
-            if hasattr(pe, 'sections'):
-                fts['SectionCount'] = len(pe.sections)
-                for section in pe.sections:
-                    try: 
-                        name = section.Name.decode('ascii', 'ignore').strip('\x00')
-                    except Exception: 
-                        name = ""
-                        
-                    try: 
-                        s_data = section.get_data()
-                        s_entropy = cls._calc_entropy(s_data)
-                    except Exception: 
-                        s_data = b""
-                        s_entropy = 0.0
-
-                    sec_entropies.append(s_entropy)
-
-                    if any(p in name.lower() for p in cls.PACKERS): fts['HasPacked'] = 1
-                    if section.Characteristics & 0x20000000: fts['ExecutableSections'] += 1
-                    if section.Characteristics & 0x80000000: fts['WritableSections'] += 1
-                    if section.Characteristics & 0x40000000: fts['ReadableSections'] += 1
-                    if section.SizeOfRawData + section.PointerToRawData > fsize: fts['SectionException'] = 1
-
-                    for flag in char_flags:
-                        if section.Characteristics & flag:
-                            fts[f'Char_{flag:08X}_Count'] += 1
-                            fts[f'Char_{flag:08X}_MeanEntropy'] += s_entropy
-
-                    ratio = cls._safe_div(section.SizeOfRawData, fsize)
-                    if name.startswith('.text'):
-                        text_entropies.append(s_entropy)
-                        fts['TextSizeRatio'] += ratio
-                    elif name.startswith('.data'):
-                        data_entropies.append(s_entropy)
-                        fts['DataSizeRatio'] += ratio
-                    elif name.startswith('.rsrc'):
-                        rsrc_entropies.append(s_entropy)
-                        fts['RsrcSizeRatio'] += ratio
-                        if b"requireAdministrator" in s_data: fts['IsAdmin'] = 1
-                        for sig in cls.INSTALLER_SIGS:
-                            if sig in s_data:
-                                fts['IsInstall'] = 1
-                                break
-
-            fts['SectionMeanEntropy'] = cls._safe_div(sum(sec_entropies), len(sec_entropies))
-            fts['TextSectionMaxEntropy'] = max(text_entropies) if text_entropies else 0.0
-            fts['TextSectionMeanEntropy'] = cls._safe_div(sum(text_entropies), len(text_entropies))
-            fts['DataSectionMaxEntropy'] = max(data_entropies) if data_entropies else 0.0
-            fts['DataSectionMeanEntropy'] = cls._safe_div(sum(data_entropies), len(data_entropies))
-            fts['RsrcSectionMaxEntropy'] = max(rsrc_entropies) if rsrc_entropies else 0.0
-            fts['RsrcSectionMeanEntropy'] = cls._safe_div(sum(rsrc_entropies), len(rsrc_entropies))
-
-            for flag in char_flags:
-                fts[f'Char_{flag:08X}_MeanEntropy'] = cls._safe_div(fts[f'Char_{flag:08X}_MeanEntropy'], fts[f'Char_{flag:08X}_Count'])
-
-            try:
-                pe.parse_data_directories(directories=[
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG'],
-                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_TLS']
-                ])
-            except Exception:
-                pass
-
-            if hasattr(pe, 'DIRECTORY_ENTRY_TLS') and hasattr(pe.DIRECTORY_ENTRY_TLS, 'struct'):
-                if getattr(pe.DIRECTORY_ENTRY_TLS.struct, 'AddressOfCallBacks', 0) != 0:
-                    fts['HasTlsCallbacks'] = 1
-
-            if hasattr(pe, 'VS_FIXEDFILEINFO') and len(pe.VS_FIXEDFILEINFO) > 0:
-                flags = getattr(pe.VS_FIXEDFILEINFO[0], 'FileFlags', 0)
-                fts['IsDebug'] = 1 if flags & 0x1 else 0
-                fts['IsPreRelease'] = 1 if flags & 0x2 else 0
-                fts['IsPatched'] = 1 if flags & 0x4 else 0
-                fts['IsPrivateBuild'] = 1 if flags & 0x8 else 0
-                fts['IsSpecialBuild'] = 1 if flags & 0x20 else 0
-
-            if hasattr(pe, 'FileInfo'):
-                for fileinfo_list in pe.FileInfo:
-                    for fileinfo in fileinfo_list:
-                        if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
-                            for st in getattr(fileinfo, 'StringTable', []):
-                                for key, val in st.entries.items():
-                                    try:
-                                        k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
-                                        v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
-                                        length = len(v)
-                                        if k == 'FileDescription': fts['FileDescriptionLength'] = length
-                                        elif k == 'FileVersion': fts['FileVersionLength'] = length
-                                        elif k == 'ProductName': fts['ProductNameLength'] = length
-                                        elif k == 'ProductVersion': fts['ProductVersionLength'] = length
-                                        elif k == 'CompanyName': fts['CompanyNameLength'] = length
-                                        elif k == 'LegalCopyright': fts['LegalCopyrightLength'] = length
-                                        elif k == 'Comments': fts['CommentsLength'] = length
-                                        elif k == 'InternalName': fts['InternalNameLength'] = length
-                                        elif k == 'LegalTrademarks': fts['LegalTrademarksLength'] = length
-                                        elif k == 'SpecialBuild': fts['SpecialBuildLength'] = length
-                                        elif k == 'PrivateBuild': fts['PrivateBuildLength'] = length
-                                    except Exception:
-                                        continue
-
-            if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
-                fts['ImportCount'] = len(pe.DIRECTORY_ENTRY_IMPORT)
-                for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                    if getattr(entry, 'dll', None):
-                        try:
-                            dll_name = entry.dll.decode('ascii', 'ignore').lower()
-                            if dll_name in cls.TARGET_DLLS: 
-                                fts[f"Dll_{dll_name.replace('.', '_')}"] = 1.0
-                        except Exception: 
-                            pass
-                    
-                    imports = getattr(entry, 'imports', [])
-                    for imp in imports:
-                        fts['ImportFunctionCount'] += 1
-                        if not getattr(imp, 'name', None): continue
-                        try:
-                            func_name = imp.name.decode('ascii', 'ignore')
-                            if func_name in cls._ALL_APIS:
-                                fts[f'Api_{func_name}'] += 1
-                                fts['ApiCount'] += 1
-                            for cat in cls._API_TO_CATS.get(func_name, []):
-                                fts[f'Cat_{cat}'] += 1
-                        except Exception: 
-                            continue
-
-            if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols'):
-                fts['ExportCount'] = len(pe.DIRECTORY_ENTRY_EXPORT.symbols)
-            
-            if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
-                for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
-                    if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
-                        fts['IconCount'] += len(getattr(entry.directory, 'entries', []))
-                        
-            if hasattr(pe, 'OPTIONAL_HEADER') and hasattr(pe.OPTIONAL_HEADER, 'DATA_DIRECTORY') and len(pe.OPTIONAL_HEADER.DATA_DIRECTORY) > 3:
-                exc_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[3]
-                if exc_dir.Size > 0:
-                    fts['ExceptionCount'] = exc_dir.Size // 12 if fts['Machine'] in (0x8664, 0xAA64) else 0
-                
-            if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'): 
-                fts['DebugCount'] = len(pe.DIRECTORY_ENTRY_DEBUG)
-
-            for k in fts: 
-                fts[k] = cls._safe_float(fts[k])
-                
-            return fts
-
-        except Exception:
-            return None
-        finally:
-            if pe: 
-                pe.close()
-
-####################################################################################################
-
-class ModelPredictor:
-    def __init__(self, model_path, feature_path):
-        self.sess = None
-        self.input_name = None
-        self.feature_order = [] 
-        self.model_features = self._load_features(feature_path)
-        self._load_model(model_path)
-        self._build_input_map()
-
-    def _load_features(self, path):
-        if os.path.exists(path):
-            try:
-                with open(path, 'r') as f:
-                    return json.load(f)
-            except Exception:
-                pass
-        return [re.sub(r'[^A-Za-z0-9_]+', '', f) for f in FeatureExtractor.SCHEMA]
-
-    def _load_model(self, model_path):
-        if not os.path.exists(model_path):
-            raise FileNotFoundError(f"Model missing: {model_path}")
-
-        self.sess = ort.InferenceSession(model_path, providers=['CPUExecutionProvider'])
-        model_inputs = self.sess.get_inputs()
-        self.input_name = model_inputs[0].name
-        expected_dim = model_inputs[0].shape[1]
-        
-        current_dim = len(self.model_features)
-        if current_dim != expected_dim:
-            raise ValueError(f"Dimension Mismatch: Expected {expected_dim}, got {current_dim}.")
-
-    def _build_input_map(self):
-        local_map = {re.sub(r'[^A-Za-z0-9_]+', '', raw_name): raw_name for raw_name in FeatureExtractor.SCHEMA}
-        self.feature_order = [local_map.get(req_feat) for req_feat in self.model_features]
-
-    def predict(self, raw_data):
-        vec_data = [raw_data.get(key, 0.0) if key else 0.0 for key in self.feature_order]
-        vec = np.array(vec_data, dtype=np.float32).reshape(1, -1)
-        outputs = self.sess.run(None, {self.input_name: vec})
-        
-        if len(outputs) > 1:
-            result = outputs[1]
-            if isinstance(result, list) and len(result) > 0:
-                prob_dict = result[0]
-                if hasattr(prob_dict, 'get'):
-                    return float(prob_dict.get(1, prob_dict.get('1', 0.0)))
-            elif isinstance(result, np.ndarray):
-                if result.ndim == 2 and result.shape[1] > 1:
-                    return float(result[0][1])
-        return 0.0
-
-####################################################################################################
-
-def get_threat_name(prob_float):
-    prob_pct = min(int(prob_float * 100), 99)
-    
-    if prob_pct >= 80:
-        return f"General:WinPE/Malware.{prob_pct}!ml"
-    elif prob_pct >= 50:
-        return f"General:WinPE/Suspicious.{prob_pct}!ml"
-    else:
-        return "Undetected"
-
-def scan_target(target, predictor):
-    if not os.path.exists(target):
-        print(json.dumps({"result": "error", "prob": 0.0, "file": target, "details": "Path not found"}))
-        sys.stdout.flush()
-        return
-
-    try:
-        data = FeatureExtractor.extract(target)
-        if not data:
-            print(json.dumps({"result": "error", "prob": 0.0, "file": target, "details": "Extraction failed"}))
-            sys.stdout.flush()
-            return
-        
-        prob = predictor.predict(data)
-        label = get_threat_name(prob)
-        
-        print(json.dumps({"result": label, "prob": round(prob, 4), "file": target}))
-        sys.stdout.flush()
-        
-    except Exception as e:
-        print(json.dumps({"result": "error", "prob": 0.0, "file": target, "details": str(e)}))
-        sys.stdout.flush()
-
-####################################################################################################
-
-if __name__ == "__main__":
-    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
-    model_path = os.path.join(base_dir, MODEL_FILE)
-    feature_path = os.path.join(base_dir, FEATURE_FILE)
-
-    try:
-        predictor = ModelPredictor(model_path, feature_path)
-    except Exception as e:
-        print(json.dumps({"result": "fatal", "details": str(e)}))
-        sys.stdout.flush()
-        sys.exit(1)
-
-    if len(sys.argv) > 1:
-        for path in sys.argv[1:]:
-            scan_target(path.strip(), predictor)
-    else:
-        for line in sys.stdin:
-            target = line.strip()
-            if not target or target.lower() in ['q', 'exit']:
-                break
-            scan_target(target, predictor)
@@ -1,4 +0,0 @@
-onnxruntime
-numpy
-pefile
-signify[full]
@@ -114,7 +114,7 @@ def train_process(X, y):
    n_neg = (y_train == 0).sum()
    
    base_weight = n_neg / n_pos if n_pos > 0 else 1.0
-    weight_ratio_target = 0.01
+    weight_ratio_target = 0.005
    final_pos_weight = base_weight * weight_ratio_target
    
    print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
@@ -21,7 +21,7 @@ LGBM_PARAMS = {
    'objective': 'binary',
    'metric': ['binary_logloss', 'auc'],
    'boosting_type': 'gbdt',
-    'num_leaves': 63,
+    'num_leaves': 64,
    'learning_rate': 0.05,
    'feature_fraction': 0.8,
    'bagging_fraction': 0.8,
@@ -292,17 +292,14 @@ body {
    border: 1px solid var(--border-color);
    border-radius: 12px;
    background-color: var(--bg-panel);
+    overflow-y: auto;
+    overflow-x: auto;
 }

 .virus-list {
    list-style: none;
-    height: 100%;
-    overflow-y: auto;
-    overflow-x: auto;
-    padding: 12px;
-}
-
-.virus-list .manage-list-item {
+    padding: 0;
+    margin: 0;
    min-width: max-content;
 }

@@ -498,6 +495,7 @@ body {
    height: 16px;
    accent-color: var(--accent-color);
    cursor: pointer;
+    flex-shrink: 0;
 }

 .manage-list-item-content {
@@ -510,13 +508,16 @@ body {

 .custom-select-wrapper {
    position: relative;
-    min-width: 120px;
+    min-width: 100px;
+    display: inline-grid;
+    vertical-align: middle;
    user-select: none;
 }
 select.hidden + .custom-select-wrapper {
    display: none !important;
 }
 .custom-select-trigger {
+    grid-area: 1 / 1;
    display: flex;
    justify-content: space-between;
    align-items: center;
@@ -530,7 +531,24 @@ select.hidden + .custom-select-wrapper {
    cursor: pointer;
    transition: border-color 0.2s, box-shadow 0.2s;
    gap: 12px;
+    box-sizing: border-box;
 }
+.custom-select-phantom {
+    grid-area: 1 / 1;
+    visibility: hidden;
+    pointer-events: none;
+    display: grid; 
+    padding: 8px 16px;
+    font-size: 14px;
+    font-weight: 500;
+    box-sizing: border-box;
+}
+.custom-select-phantom span {
+    grid-area: 1 / 1; 
+    white-space: nowrap;
+    padding-right: 28px; 
+}
+
 .custom-select-wrapper.open .custom-select-trigger,
 .custom-select-trigger:hover {
    border-color: var(--accent-color); 
@@ -550,7 +568,10 @@ select.hidden + .custom-select-wrapper {
    position: absolute;
    top: calc(100% + 8px);
    left: 0;
-    right: 0;
+    min-width: 100%;
+    width: max-content;
+    white-space: nowrap;
+    
    background-color: var(--bg-panel);
    border: 1px solid var(--border-color);
    border-radius: 10px;
@@ -558,12 +579,10 @@ select.hidden + .custom-select-wrapper {
    z-index: 100;
    list-style: none;
    margin: 0;
-    
    max-height: 0;
    padding: 0 6px;
    border-width: 0;
    overflow: hidden;
-    
    opacity: 0;
    visibility: hidden;
    transform: translateY(-10px);
@@ -660,6 +679,124 @@ select.hidden + .custom-select-wrapper {
    opacity: 1 !important;
 }

+.manage-list-header {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 12px 16px;
+    border-bottom: 1px solid var(--border-color);
+    background-color: var(--bg-panel);
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--text-secondary);
+    position: sticky;
+    top: 0;
+    z-index: 10;
+}
+
+.manage-list-header input[type="checkbox"] {
+    width: 16px;
+    height: 16px;
+    accent-color: var(--accent-color);
+    cursor: pointer;
+    flex-shrink: 0;
+}
+
+.header-cols-container, .manage-list-item-content {
+    display: flex;
+    flex-grow: 1;
+    min-width: 0;
+    gap: 16px;
+    align-items: center;
+}
+
+.col-header {
+    position: relative;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    padding: 0 8px;
+    border-right: 1px solid var(--border-color);
+    background-color: var(--bg-panel);
+    user-select: none;
+    -webkit-user-select: none;
+}
+
+.col-header:last-child {
+    border-right: none;
+}
+
+.header-text {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    flex-grow: 1;
+}
+
+.manage-list-header, .col-header, .col-resizer {
+    user-select: none;
+    -webkit-user-select: none;
+}
+
+.col-resizer {
+    position: absolute;
+    right: -5px;
+    top: 0;
+    bottom: 0;
+    width: 10px;
+    cursor: col-resize;
+    z-index: 10;
+    background-color: transparent !important; 
+}
+
+.col-resizer::after {
+    content: "";
+    position: absolute;
+    left: 50%;
+    top: 0;
+    bottom: 0;
+    width: 1px;
+    background-color: transparent;
+    transition: background-color 0.2s;
+}
+
+.col-resizer:hover::after,
+.col-resizer.resizing::after {
+    background-color: var(--text-secondary) !important;
+    opacity: 0.6;
+}
+
+body.resizing-active, 
+body.resizing-active * {
+    user-select: none !important;
+    -webkit-user-select: none !important;
+    cursor: col-resize !important;
+}
+
+.col-resizer:hover {
+    background-color: var(--accent-color);
+    opacity: 0.5;
+}
+
+.col-header:hover {
+    color: var(--text-primary);
+}
+
+.sort-icon {
+    font-size: 10px;
+    margin-left: 4px;
+    color: var(--accent-color);
+    width: 12px;
+}
+
+.row-col {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 14px;
+    color: var(--text-primary);
+}
+
 ::-webkit-scrollbar { width: 6px; height: 6px; }
 ::-webkit-scrollbar-track { background: transparent; }
 ::-webkit-scrollbar-thumb { background: var(--border-color); border-radius: 10px; }
@@ -5,6 +5,7 @@
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>PYAS Security</title>
    <link rel="stylesheet" href="/static/css/style.css">
+    <script defer src="/static/js/i18n.js"></script>
    <script defer src="/static/js/main.js"></script>
 </head>
 <body>
@@ -83,13 +84,12 @@
                            <p class="section-desc" id="progress_text" data-i18n>此選項可以選擇掃描方式</p>
                        </div>
                        <div class="action-group modern-action-group">
-                            <button class="action-btn modern-btn danger-btn hidden" id="solve_btn" data-i18n>刪除</button>
                            <select id="scan_method_select" class="modern-select">
                                <option value="none" selected disabled data-i18n>選擇</option>
-                                <option value="smart" data-i18n>智能</option>
-                                <option value="file" data-i18n>檔案</option>
-                                <option value="path" data-i18n>路徑</option>
-                                <option value="full" data-i18n>全盤</option>
+                                <option value="smart" data-i18n>智能掃描</option>
+                                <option value="file" data-i18n>檔案掃描</option>
+                                <option value="path" data-i18n>路徑掃描</option>
+                                <option value="full" data-i18n>全盤掃描</option>
                            </select>
                            <button class="action-btn modern-btn hidden" id="stop_btn" data-i18n>停止</button>
                        </div>
@@ -124,7 +124,16 @@ class WindowAPI:
        if not self.check_singleton("PYAS_Security_Mutex"):
            hwnd = self.user32.FindWindowW(None, "PYAS Security")
            if hwnd:
-                if "-scan" in self.args_pyas:
+                if "-quit" in self.args_pyas:
+                    try:
+                        cds = COPYDATASTRUCT()
+                        cds.dwData = 3
+                        cds.cbData = 0
+                        cds.lpData = None
+                        self.user32.SendMessageTimeoutW(hwnd, 0x004A, 0, ctypes.byref(cds), 0x0002, 3000, None)
+                    except Exception:
+                        pass
+                elif "-scan" in self.args_pyas:
                    try:
                        idx = self.args_pyas.index("-scan")
                        target = self.args_pyas[idx+1]
@@ -135,6 +144,7 @@ class WindowAPI:
                        buffer = ctypes.create_string_buffer(encoded)
                        cds.lpData = ctypes.cast(buffer, ctypes.c_void_p)
                        self.user32.SendMessageTimeoutW(hwnd, 0x004A, 0, ctypes.byref(cds), 0x0002, 3000, None)
+                        self.user32.SetForegroundWindow(hwnd)
                    except Exception:
                        pass
                else:
@@ -144,9 +154,12 @@ class WindowAPI:
                        cds.cbData = 0
                        cds.lpData = None
                        self.user32.SendMessageTimeoutW(hwnd, 0x004A, 0, ctypes.byref(cds), 0x0002, 3000, None)
+                        self.user32.SetForegroundWindow(hwnd)
                    except Exception:
                        pass
-                self.user32.SetForegroundWindow(hwnd)
+            os._exit(0)
+            
+        if "-quit" in self.args_pyas:
            os._exit(0)
            
        self.init_variables()
@@ -411,6 +424,7 @@ class WindowAPI:
        self.cloud_queue = queue.Queue()
        
        self.lock_driver = threading.RLock()
+        self.lock_update = threading.RLock()
        self.driver_port = None
        self.scan_running = False
        self.scan_finished = False
@@ -426,7 +440,7 @@ class WindowAPI:
        self.lock_net = threading.RLock()

        self.pyas_default = {
-            "version": "3.5.1",
+            "version": "3.5.2",
            "api_host": "https://pyas-security.com/",
            "api_key": "fBRZxYS1UxykM-qzNOlKOEl63WILzlvgNMn6QfsG6FXCAAIktCrOPTAfY5_hEyuZ",
            "suffix": [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd"],
@@ -490,36 +504,47 @@ class WindowAPI:
                self.write_log("WARN", "save_config", detail=str(e), success=False)

    def update_config(self, key, value):
-        with self.lock_config:
-            old_value = self.pyas_config.get(key)
-            if old_value != value:
+        with self.lock_update:
+            with self.lock_config:
+                old_value = self.pyas_config.get(key)
+                if old_value == value:
+                    return value
                self.pyas_config[key] = value
                self.write_log("INFO", "Config Update", detail=f"[{key}] {old_value} -> {value}")
                self.save_config()
-            
-        if key == "process_switch" and value:
-            self.start_daemon_thread(self.protect_proc_thread)
-        elif key == "document_switch" and value:
-            self.start_daemon_thread(self.protect_file_thread)
-        elif key == "system_switch" and value:
-            self.start_daemon_thread(self.protect_system_thread)
-        elif key == "network_switch" and value:
-            self.start_daemon_thread(self.protect_net_thread)
-        elif key == "context_switch":
-            self.register_context_menu(value)
-        elif key == "driver_switch":
-            if value:
-                if self.install_system_driver():
-                    self.start_daemon_thread(self.pipe_server_thread)
+                
+            if key == "process_switch" and value:
+                self.start_daemon_thread(self.protect_proc_thread)
+            elif key == "document_switch" and value:
+                self.start_daemon_thread(self.protect_file_thread)
+            elif key == "system_switch" and value:
+                self.start_daemon_thread(self.protect_system_thread)
+            elif key == "network_switch" and value:
+                self.start_daemon_thread(self.protect_net_thread)
+            elif key == "context_switch":
+                self.register_context_menu(value)
+            elif key == "language":
+                if self.tray_icon:
+                    try:
+                        self.tray_icon.update_menu()
+                    except Exception:
+                        pass
+            elif key == "driver_switch":
+                if value:
+                    if self.install_system_driver():
+                        self.start_daemon_thread(self.pipe_server_thread)
+                    else:
+                        with self.lock_config:
+                            self.pyas_config[key] = False
+                            self.write_log("INFO", "Config Update", detail=f"[{key}] True -> False")
+                            self.save_config()
+                        if self._window:
+                            self._window.evaluate_js(f"if(window.revertSwitch) window.revertSwitch('{key}');")
+                        return False
                else:
-                    with self.lock_config:
-                        self.pyas_config[key] = False
-                        self.write_log("INFO", "Config Update", detail=f"[{key}] True -> False")
-                        self.save_config()
-                    if self._window:
-                        self._window.evaluate_js(f"if(window.revertSwitch) window.revertSwitch('{key}');")
-            else:
-                self.stop_system_driver()
+                    self.stop_system_driver()
+            
+            return value

    def get_config(self):
        with self.lock_config:
@@ -800,9 +825,9 @@ class WindowAPI:

    def init_engine_thread(self):
        try:
-            self.backup_mbr()
-            self.relock_file()
-            self.init_whitelist()
+            self.start_daemon_thread(self.backup_mbr)
+            self.start_daemon_thread(self.relock_file)
+            self.start_daemon_thread(self.init_whitelist)
            self.start_daemon_thread(self.popup_intercept_thread)
            
            def log_callback(x):
@@ -1658,6 +1683,15 @@ class WindowAPI:
        if isinstance(norm_paths, str):
            norm_paths = [norm_paths] if norm_paths else []

+        if not norm_paths:
+            return 0
+
+        if action == "add":
+            if list_key == "white_list":
+                self.remove_list_items("quarantine", norm_paths)
+            elif list_key == "quarantine":
+                self.remove_list_items("white_list", norm_paths)
+
        acted_items = []
        with self.lock_config:
            target_list = self.pyas_config.setdefault(list_key, [])
@@ -2367,7 +2401,9 @@ class WindowAPI:
                time.sleep(0.5)
                with self.lock_config:
                    rules = self.pyas_config.get("block_list", [])
-                    cur_ver = self.pyas_config.get("version", "0.0.0")
+
+                if not rules:
+                    continue

                hwnd_list.clear()
                self.user32.EnumWindows(enum_cb, 0)
@@ -2379,10 +2415,7 @@ class WindowAPI:
                    if pid.value <= 4:
                        continue
                        
-                    proc_name, file_path = self.get_exe_info(pid.value)
-
-                    if proc_name != "PYAS_Setup.exe" and not rules:
-                        continue
+                    proc_name, _ = self.get_exe_info(pid.value)
                    
                    length = self.user32.GetWindowTextLengthW(hWnd)
                    title = ctypes.create_unicode_buffer(length + 1)
@@ -2393,15 +2426,6 @@ class WindowAPI:
                    t_str = str(title.value)
                    c_str = str(class_name.value)

-                    if proc_name == "PYAS_Setup.exe" and c_str == "WindowClass_0" and t_str == "PYAS Setup":
-                        if file_path:
-                            setup_ver = self.get_file_version(file_path)
-                            if self.compare_versions(setup_ver, cur_ver):
-                                self.close()
-
-                    if not rules:
-                        continue
-
                    is_pass = any(item.get("exe") == proc_name or item.get("class") == c_str for item in self.pass_windows)
                    if is_pass:
                        continue
@@ -2529,6 +2553,9 @@ class WindowHook:
                    if self.api_ref and self.api_ref._window:
                        self.api_ref._window.restore()
                        self.api_ref._window.show()
+                elif cds.dwData == 3:
+                    if self.api_ref:
+                        self.api_ref.close()
            except Exception:
                pass
            return 1
@@ -2556,15 +2583,15 @@ class WindowHook:

 ####################################################################################################

-def get_free_port():
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(('127.0.0.1', 0))
-        return s.getsockname()[1]
-
-def start_api(port):
+def start_api(port_container, ready_event):
    TCPServer.allow_reuse_address = True
-    with TCPServer(("127.0.0.1", port), NoCacheRequestHandler) as httpd:
-        httpd.serve_forever()
+    try:
+        with TCPServer(("127.0.0.1", 0), NoCacheRequestHandler) as httpd:
+            port_container.append(httpd.server_address[1])
+            ready_event.set()
+            httpd.serve_forever()
+    except Exception:
+        ready_event.set()

 ####################################################################################################

@@ -2572,11 +2599,21 @@ if __name__ == "__main__":
    hide_on_start = "-h" in sys.argv or "-hide" in sys.argv
    init_width, init_height = 980, 670

-    port = get_free_port()
+    os.environ["WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS"] = "--proxy-bypass-list=127.0.0.1,localhost"

-    api_thread = threading.Thread(target=start_api, args=(port,), daemon=True)
+    port_container = []
+    server_ready = threading.Event()
+
+    api_thread = threading.Thread(target=start_api, args=(port_container, server_ready), daemon=True)
    api_thread.start()

+    server_ready.wait(timeout=5.0)
+
+    if not port_container:
+        os._exit(1)
+
+    port = port_container[0]
+
    js_api = WindowAPI()

    user32 = ctypes.windll.user32
@@ -742,7 +742,7 @@ class cloud_scanner:
        r = self._request("POST", f"/api/rescan/{sha256}")
        return r is not None and r.json().get('status') == 'success'

-    def upload_file(self, file_path, api_host, api_key, chunk_size=5242880):
+    def upload_file(self, file_path, api_host, api_key, chunk_size=5242880, need_rescan=False):
        try:
            self._init_session(api_host, api_key)
            sha256 = self.calc_hash(file_path)
@@ -750,9 +750,16 @@ class cloud_scanner:
                return False, None

            status_req = self._request("GET", f"/api/processing_status/{sha256}")
-            if status_req and status_req.json().get('status') != 'missing':
-                self.rescan(sha256, api_host, api_key)
-                return True, sha256
+            if status_req:
+                status_data = status_req.json()
+                current_status = status_data.get('status')
+                
+                if current_status == 'done':
+                    if need_rescan:
+                        self.rescan(sha256, api_host, api_key)
+                    return True, sha256
+                elif current_status in ('queued', 'processing'):
+                    return True, sha256

            file_size = os.path.getsize(file_path)
            if file_size > 104857600:
@@ -2,7 +2,7 @@ import pyinstaller_versionfile

 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.5.1.0',
+version='3.5.2.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",
@@ -114,8 +114,8 @@ typedef struct _DRIVER_DATA {
    PEPROCESS PyasProcess;
    ULONG PyasPid;
    LARGE_INTEGER Cookie;
-    FAST_MUTEX PortMutex;
-    FAST_MUTEX TrackerMutex;
+    KSPIN_LOCK PortMutex;
+    KSPIN_LOCK TrackerMutex;
    EX_RUNDOWN_REF PortRundown;
 } DRIVER_DATA, * PDRIVER_DATA;

@@ -90,7 +90,8 @@ static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID
    UNREFERENCED_PARAMETER(SizeOfContext);
    UNREFERENCED_PARAMETER(ConnectionPortCookie);

-    ExAcquireFastMutex(&GlobalData.PortMutex);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);

    GlobalData.ClientPort = ClientPort;
    GlobalData.PyasPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
@@ -98,7 +99,7 @@ static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID

    ExReInitializeRundownProtection(&GlobalData.PortRundown);

-    ExReleaseFastMutex(&GlobalData.PortMutex);
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);

    return STATUS_SUCCESS;
 }
@@ -106,9 +107,14 @@ static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID
 static VOID PortDisconnect(PVOID ConnectionCookie) {
    UNREFERENCED_PARAMETER(ConnectionCookie);

-    ExAcquireFastMutex(&GlobalData.PortMutex);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
    GlobalData.ClientPort = NULL;
-    ExReleaseFastMutex(&GlobalData.PortMutex);
+    GlobalData.PyasPid = 0;
+    GlobalData.PyasProcess = NULL;
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);

    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
 }
@@ -147,8 +153,8 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg

    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
    GlobalData.DriverObject = DriverObject;
-    ExInitializeFastMutex(&GlobalData.PortMutex);
-    ExInitializeFastMutex(&GlobalData.TrackerMutex);
+    KeInitializeSpinLock(&GlobalData.PortMutex);
+    KeInitializeSpinLock(&GlobalData.TrackerMutex);

    ExInitializeRundownProtection(&GlobalData.PortRundown);

@@ -199,6 +199,7 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
    UNREFERENCED_PARAMETER(FltObjects);

    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;

    if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) {
        return FLT_PREOP_SUCCESS_NO_CALLBACK;
@@ -235,12 +236,10 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE
                SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
            }

-            if (SystemBuffer) {
-                if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
-                    SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                    Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                    callbackStatus = FLT_PREOP_COMPLETE;
-                }
+            if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
+                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+                callbackStatus = FLT_PREOP_COMPLETE;
            }
        }
    }
@@ -34,6 +34,36 @@ VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INF
    }
 }

+static BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId) {
+    if (ProcessId == (HANDLE)4) return TRUE;
+
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    NTSTATUS status;
+    BOOLEAN isCritical = FALSE;
+    PEPROCESS Process = NULL;
+    PUNICODE_STRING imageFileName = NULL;
+
+    status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(status)) return FALSE;
+
+    status = SeLocateProcessImageName(Process, &imageFileName);
+
+    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
+        if (WildcardMatch(L"*\\Windows\\System32\\csrss.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\lsass.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\services.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\wininit.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*\\Windows\\System32\\smss.exe", imageFileName->Buffer, imageFileName->Length)) {
+            isCritical = TRUE;
+        }
+        ExFreePool(imageFileName);
+    }
+
+    ObDereferenceObject(Process);
+    return isCritical;
+}
+
 static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;

@@ -79,6 +109,8 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;

    if (IsTargetProtected(TargetPid)) {
+        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
+
        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);

        if (bIsTrusted) {
@@ -99,10 +131,10 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
            PROCESS_SET_INFORMATION |
            PROCESS_SET_QUOTA;

-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);

        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
        }
    }

@@ -128,6 +160,8 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;

    if (IsTargetProtected(TargetPid)) {
+        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
+
        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);

        if (bIsTrusted) {
@@ -144,10 +178,10 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
            THREAD_SET_INFORMATION |
            THREAD_SET_THREAD_TOKEN;

-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask;
+        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);

        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask;
+            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
        }
    }

@@ -149,30 +149,32 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
                            (Info->ValueName ? Info->ValueName->Length : 0) +
                            sizeof(WCHAR);

-                        PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                        if (Buffer) {
-                            UNICODE_STRING FullPath;
-                            FullPath.Buffer = Buffer;
-                            FullPath.Length = 0;
-                            FullPath.MaximumLength = (USHORT)FullSize;
+                        if (FullSize <= 0xFFFF) {
+                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                            if (Buffer) {
+                                UNICODE_STRING FullPath;
+                                FullPath.Buffer = Buffer;
+                                FullPath.Length = 0;
+                                FullPath.MaximumLength = (USHORT)FullSize;

-                            RtlCopyUnicodeString(&FullPath, KeyName);
+                                RtlCopyUnicodeString(&FullPath, KeyName);

-                            if (Info->ValueName && Info->ValueName->Length > 0) {
-                                if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                    RtlAppendUnicodeToString(&FullPath, L"\\");
+                                if (Info->ValueName && Info->ValueName->Length > 0) {
+                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                        RtlAppendUnicodeToString(&FullPath, L"\\");
+                                    }
+                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                                }
-                                RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                            }

-                            if (CheckRegistryRule(&FullPath)) {
-                                HANDLE Pid = PsGetCurrentProcessId();
-                                if (!IsProcessTrusted(Pid)) {
-                                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                    status = STATUS_ACCESS_DENIED;
+                                if (CheckRegistryRule(&FullPath)) {
+                                    HANDLE Pid = PsGetCurrentProcessId();
+                                    if (!IsProcessTrusted(Pid)) {
+                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                        status = STATUS_ACCESS_DENIED;
+                                    }
                                }
+                                PyasFree(Buffer);
                            }
-                            PyasFree(Buffer);
                        }
                    }
                }
@@ -194,30 +196,32 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
                            (Info->ValueName ? Info->ValueName->Length : 0) +
                            sizeof(WCHAR);

-                        PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                        if (Buffer) {
-                            UNICODE_STRING FullPath;
-                            FullPath.Buffer = Buffer;
-                            FullPath.Length = 0;
-                            FullPath.MaximumLength = (USHORT)FullSize;
+                        if (FullSize <= 0xFFFF) {
+                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                            if (Buffer) {
+                                UNICODE_STRING FullPath;
+                                FullPath.Buffer = Buffer;
+                                FullPath.Length = 0;
+                                FullPath.MaximumLength = (USHORT)FullSize;

-                            RtlCopyUnicodeString(&FullPath, KeyName);
+                                RtlCopyUnicodeString(&FullPath, KeyName);

-                            if (Info->ValueName && Info->ValueName->Length > 0) {
-                                if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                    RtlAppendUnicodeToString(&FullPath, L"\\");
+                                if (Info->ValueName && Info->ValueName->Length > 0) {
+                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                        RtlAppendUnicodeToString(&FullPath, L"\\");
+                                    }
+                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                                }
-                                RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                            }

-                            if (CheckRegistryRule(&FullPath)) {
-                                HANDLE Pid = PsGetCurrentProcessId();
-                                if (!IsProcessTrusted(Pid)) {
-                                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                    status = STATUS_ACCESS_DENIED;
+                                if (CheckRegistryRule(&FullPath)) {
+                                    HANDLE Pid = PsGetCurrentProcessId();
+                                    if (!IsProcessTrusted(Pid)) {
+                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                                        status = STATUS_ACCESS_DENIED;
+                                    }
                                }
+                                PyasFree(Buffer);
                            }
-                            PyasFree(Buffer);
                        }
                    }
                }
@@ -10,19 +10,21 @@ constexpr auto TRUST_CACHE_TTL_SEC = 300;

 typedef struct _RANSOM_TRACKER {
    PEPROCESS Process;
+    LARGE_INTEGER ProcessCreateTime;
    ULONG ActivityCount;
    LARGE_INTEGER LastActivityTime;
 } RANSOM_TRACKER, * PRANSOM_TRACKER;

 typedef struct _TRUST_CACHE_ENTRY {
    PEPROCESS Process;
+    LARGE_INTEGER ProcessCreateTime;
    BOOLEAN IsTrusted;
    LARGE_INTEGER CacheTime;
 } TRUST_CACHE_ENTRY, * PTRUST_CACHE_ENTRY;

 static RANSOM_TRACKER RansomTrackers[MAX_TRACKERS];
 static TRUST_CACHE_ENTRY TrustCache[TRUST_CACHE_SIZE];
-static FAST_MUTEX TrustCacheLock;
+static KSPIN_LOCK TrustCacheLock;
 static BOOLEAN g_CacheInitialized = FALSE;

 static ERESOURCE RuleLock;
@@ -107,7 +109,7 @@ static BOOLEAN HasSuffix(PCUNICODE_STRING String, PCWSTR Suffix) {
 }

 BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
-    if (!Pattern || !String) return FALSE;
+    if (Pattern == NULL || String == NULL) return FALSE;

    USHORT StringLenChars = StringLengthBytes / sizeof(WCHAR);
    PCWSTR mp = NULL;
@@ -123,7 +125,7 @@ BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
            Pattern++;
            String++;
        }
-        else if (mp) {
+        else if (mp != NULL) {
            Pattern = mp;
            String = cp++;
        }
@@ -134,7 +136,8 @@ BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) {
    while (*Pattern == L'*') {
        Pattern++;
    }
-    return !*Pattern;
+
+    return (*Pattern == L'\0') ? TRUE : FALSE;
 }

 static ULONG ProcessJsonUnescape(PWCHAR Buffer, ULONG LengthChars) {
@@ -202,17 +205,23 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN

                    while (Ptr < End) {
                        SkipWhitespace(&Ptr, End);
-                        if (Ptr >= End) break;
-
-                        if (*Ptr == ']') {
-                            Ptr++;
+                        if (Ptr >= End || *Ptr == ']') {
+                            if (Ptr < End) Ptr++;
                            return;
                        }

                        if (*Ptr == '"') {
                            PCHAR StartQuote = ++Ptr;
+                            BOOLEAN Escaped = FALSE;
+
                            while (Ptr < End) {
-                                if (*Ptr == '"' && *(Ptr - 1) != '\\') break;
+                                if (*Ptr == '"' && Escaped == FALSE) break;
+                                if (*Ptr == '\\') {
+                                    Escaped = (Escaped == FALSE) ? TRUE : FALSE;
+                                }
+                                else {
+                                    Escaped = FALSE;
+                                }
                                Ptr++;
                            }

@@ -242,9 +251,6 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN
                                Ptr++;
                            }
                        }
-                        else if (*Ptr == ',') {
-                            Ptr++;
-                        }
                        else {
                            Ptr++;
                        }
@@ -259,7 +265,7 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN

 VOID InitializeRulesEngine() {
    ExInitializeResourceLite(&RuleLock);
-    ExInitializeFastMutex(&TrustCacheLock);
+    KeInitializeSpinLock(&TrustCacheLock);
    RtlZeroMemory(TrustCache, sizeof(TrustCache));
    g_CacheInitialized = TRUE;
 }
@@ -298,25 +304,33 @@ static VOID RemoveRule(PRULE_NODE* Head, PUNICODE_STRING RuleStr) {
 }

 VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr) {
+    KeEnterCriticalRegion();
    ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
    AddRule(&g_ProcessTrustedPaths, RuleStr);
    AddRule(&g_FileExceptionPaths, RuleStr);

-    ExAcquireFastMutex(&TrustCacheLock);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
    RtlZeroMemory(TrustCache, sizeof(TrustCache));
-    ExReleaseFastMutex(&TrustCacheLock);
+    KeReleaseSpinLock(&TrustCacheLock, OldIrql);
+
    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
 }

 VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr) {
+    KeEnterCriticalRegion();
    ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
    RemoveRule(&g_ProcessTrustedPaths, RuleStr);
    RemoveRule(&g_FileExceptionPaths, RuleStr);

-    ExAcquireFastMutex(&TrustCacheLock);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
    RtlZeroMemory(TrustCache, sizeof(TrustCache));
-    ExReleaseFastMutex(&TrustCacheLock);
+    KeReleaseSpinLock(&TrustCacheLock, OldIrql);
+
    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
 }

 NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
@@ -359,58 +373,58 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
    }

    if (Info->Type == REG_EXPAND_SZ || Info->Type == REG_SZ) {
-        PathBufferSize = ResultLength + 1024;
+        PathBufferSize = Info->DataLength + 1024;
        PathBuffer = (PWCHAR)PyasAllocate(PathBufferSize);

        if (PathBuffer) {
            RtlZeroMemory(PathBuffer, PathBufferSize);
-            PWCHAR Src = (PWCHAR)Info->Data;
+            if (Info->DataLength > 0) {
+                RtlCopyMemory(PathBuffer, Info->Data, Info->DataLength);
+            }

-            if (NT_SUCCESS(RtlStringCbCopyW(PathBuffer, PathBufferSize, Src))) {
-                PWCHAR LastSlash = NULL;
-                PWCHAR Current = PathBuffer;
-                while (*Current) {
-                    if (*Current == L'\\') LastSlash = Current;
-                    Current++;
-                }
+            PWCHAR LastSlash = NULL;
+            PWCHAR Current = PathBuffer;
+            while (*Current) {
+                if (*Current == L'\\') LastSlash = Current;
+                Current++;
+            }

-                if (LastSlash) {
-                    *LastSlash = L'\0';
+            if (LastSlash) {
+                *LastSlash = L'\0';

-                    SIZE_T CurrentPathLen = wcslen(PathBuffer);
-                    const WCHAR FilterSuffix[] = L"\\Filter";
-                    SIZE_T FilterLen = (sizeof(FilterSuffix) / sizeof(WCHAR)) - 1;
+                SIZE_T CurrentPathLen = wcslen(PathBuffer);
+                const WCHAR FilterSuffix[] = L"\\Filter";
+                SIZE_T FilterLen = (sizeof(FilterSuffix) / sizeof(WCHAR)) - 1;

-                    if (CurrentPathLen >= FilterLen) {
-                        PWCHAR SuffixStart = PathBuffer + CurrentPathLen - FilterLen;
-                        BOOLEAN Match = TRUE;
-                        for (SIZE_T i = 0; i < FilterLen; i++) {
-                            if (RtlDowncaseUnicodeChar(SuffixStart[i]) != RtlDowncaseUnicodeChar(FilterSuffix[i])) {
-                                Match = FALSE;
-                                break;
-                            }
-                        }
-                        if (Match) {
-                            *SuffixStart = L'\0';
+                if (CurrentPathLen >= FilterLen) {
+                    PWCHAR SuffixStart = PathBuffer + CurrentPathLen - FilterLen;
+                    BOOLEAN Match = TRUE;
+                    for (SIZE_T i = 0; i < FilterLen; i++) {
+                        if (RtlDowncaseUnicodeChar(SuffixStart[i]) != RtlDowncaseUnicodeChar(FilterSuffix[i])) {
+                            Match = FALSE;
+                            break;
                        }
                    }
-
-                    RtlStringCbCatW(PathBuffer, PathBufferSize, L"\\Rules\\Rules_Driver_P1.json");
-
-                    if (wcsncmp(PathBuffer, L"\\??\\", 4) != 0 &&
-                        wcsncmp(PathBuffer, L"\\SystemRoot", 11) != 0 &&
-                        wcsncmp(PathBuffer, L"\\DosDevices\\", 12) != 0) {
-
-                        PWCHAR TmpBuffer = (PWCHAR)PyasAllocate(PathBufferSize + 16);
-                        if (TmpBuffer) {
-                            RtlStringCbCopyW(TmpBuffer, PathBufferSize + 16, L"\\??\\");
-                            RtlStringCbCatW(TmpBuffer, PathBufferSize + 16, PathBuffer);
-                            PyasFree(PathBuffer);
-                            PathBuffer = TmpBuffer;
-                        }
+                    if (Match) {
+                        *SuffixStart = L'\0';
                    }
-                    RtlInitUnicodeString(&FinalPath, PathBuffer);
                }
+
+                RtlStringCbCatW(PathBuffer, PathBufferSize, L"\\Rules\\Rules_Driver_P1.json");
+
+                if (wcsncmp(PathBuffer, L"\\??\\", 4) != 0 &&
+                    wcsncmp(PathBuffer, L"\\SystemRoot", 11) != 0 &&
+                    wcsncmp(PathBuffer, L"\\DosDevices\\", 12) != 0) {
+
+                    PWCHAR TmpBuffer = (PWCHAR)PyasAllocate(PathBufferSize + 16);
+                    if (TmpBuffer) {
+                        RtlStringCbCopyW(TmpBuffer, PathBufferSize + 16, L"\\??\\");
+                        RtlStringCbCatW(TmpBuffer, PathBufferSize + 16, PathBuffer);
+                        PyasFree(PathBuffer);
+                        PathBuffer = TmpBuffer;
+                    }
+                }
+                RtlInitUnicodeString(&FinalPath, PathBuffer);
            }
        }
    }
@@ -435,6 +449,7 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
                if (NT_SUCCESS(status)) {
                    ((PCHAR)FileBuffer)[FileInfo.EndOfFile.LowPart] = '\0';

+                    KeEnterCriticalRegion();
                    ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
                    ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_Registry_BlockList", &g_RegistryBlockList);
                    ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_Registry_TrustedList", &g_RegistryTrustedList);
@@ -444,6 +459,7 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
                    ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_File_ExceptionPaths", &g_FileExceptionPaths);
                    ParseAndLoadRules((PCHAR)FileBuffer, FileInfo.EndOfFile.LowPart, "Rule_File_RansomwareExtensions", &g_FileRansomExts);
                    ExReleaseResourceLite(&RuleLock);
+                    KeLeaveCriticalRegion();
                }
                PyasFree(FileBuffer);
            }
@@ -456,6 +472,7 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) {
 }

 VOID UnloadRules() {
+    KeEnterCriticalRegion();
    ExAcquireResourceExclusiveLite(&RuleLock, TRUE);
    FreeList(&g_RegistryBlockList);
    FreeList(&g_RegistryTrustedList);
@@ -465,9 +482,14 @@ VOID UnloadRules() {
    FreeList(&g_FileExceptionPaths);
    FreeList(&g_FileRansomExts);
    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
 }

 NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName) {
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) {
+        return STATUS_UNSUCCESSFUL;
+    }
+
    NTSTATUS status;
    PEPROCESS Process = NULL;

@@ -492,33 +514,42 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
    if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
    if (ProcessId == (HANDLE)4) return TRUE;

-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
-
    PEPROCESS Process = NULL;
    if (!NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &Process))) {
        return FALSE;
    }

+    LARGE_INTEGER createTime;
+    createTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+
    if (g_CacheInitialized) {
-        ExAcquireFastMutex(&TrustCacheLock);
+        KIRQL OldIrql;
+        KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
        ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
-        if (TrustCache[Hash].Process == Process) {
+
+        if (TrustCache[Hash].Process == Process && TrustCache[Hash].ProcessCreateTime.QuadPart == createTime.QuadPart) {
            LARGE_INTEGER Now;
            KeQuerySystemTime(&Now);
            if ((Now.QuadPart - TrustCache[Hash].CacheTime.QuadPart) < (TRUST_CACHE_TTL_SEC * 10000000LL)) {
                BOOLEAN cachedResult = TrustCache[Hash].IsTrusted;
-                ExReleaseFastMutex(&TrustCacheLock);
+                KeReleaseSpinLock(&TrustCacheLock, OldIrql);
                ObDereferenceObject(Process);
                return cachedResult;
            }
        }
-        ExReleaseFastMutex(&TrustCacheLock);
+        KeReleaseSpinLock(&TrustCacheLock, OldIrql);
+    }
+
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) {
+        ObDereferenceObject(Process);
+        return FALSE;
    }

    PUNICODE_STRING imageFileName = NULL;
    NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);
    BOOLEAN isTrusted = FALSE;

+    KeEnterCriticalRegion();
    ExAcquireResourceSharedLite(&RuleLock, TRUE);

    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
@@ -547,15 +578,18 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {

 update_cache:
    if (g_CacheInitialized) {
-        ExAcquireFastMutex(&TrustCacheLock);
+        KIRQL OldIrql;
+        KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
        ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
        TrustCache[Hash].Process = Process;
+        TrustCache[Hash].ProcessCreateTime = createTime;
        TrustCache[Hash].IsTrusted = isTrusted;
        KeQuerySystemTime(&TrustCache[Hash].CacheTime);
-        ExReleaseFastMutex(&TrustCacheLock);
+        KeReleaseSpinLock(&TrustCacheLock, OldIrql);
    }

    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();

    if (imageFileName) ExFreePool(imageFileName);
    ObDereferenceObject(Process);
@@ -575,12 +609,14 @@ BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName) {
        return FALSE;
    }

+    KeEnterCriticalRegion();
    ExAcquireResourceSharedLite(&RuleLock, TRUE);

    PRULE_NODE AllowNode = g_RegistryTrustedList;
    while (AllowNode) {
        if (WildcardMatch(AllowNode->Pattern.Buffer, KeyName->Buffer, KeyName->Length)) {
            ExReleaseResourceLite(&RuleLock);
+            KeLeaveCriticalRegion();
            return FALSE;
        }
        AllowNode = AllowNode->Next;
@@ -596,18 +632,21 @@ BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName) {
        Node = Node->Next;
    }
    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
    return Match;
 }

 BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName) {
    if (!FileName || !FileName->Buffer) return FALSE;

+    KeEnterCriticalRegion();
    ExAcquireResourceSharedLite(&RuleLock, TRUE);

    PRULE_NODE ExNode = g_FileExceptionPaths;
    while (ExNode) {
        if (WildcardMatch(ExNode->Pattern.Buffer, FileName->Buffer, FileName->Length)) {
            ExReleaseResourceLite(&RuleLock);
+            KeLeaveCriticalRegion();
            return FALSE;
        }
        ExNode = ExNode->Next;
@@ -623,6 +662,7 @@ BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName) {
        Node = Node->Next;
    }
    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
    return Match;
 }

@@ -633,12 +673,14 @@ BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName) {
        return FALSE;
    }

+    KeEnterCriticalRegion();
    ExAcquireResourceSharedLite(&RuleLock, TRUE);

    PRULE_NODE ExNode = g_FileExceptionPaths;
    while (ExNode) {
        if (WildcardMatch(ExNode->Pattern.Buffer, FileName->Buffer, FileName->Length)) {
            ExReleaseResourceLite(&RuleLock);
+            KeLeaveCriticalRegion();
            return FALSE;
        }
        ExNode = ExNode->Next;
@@ -654,13 +696,16 @@ BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName) {
        Node = Node->Next;
    }
    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
    return Match;
 }

 static BOOLEAN IsHighEntropy(PVOID Buffer, ULONG Length) {
    if (!Buffer || Length < 256) return FALSE;

-    ULONG Histogram[256] = { 0 };
+    PUSHORT Histogram = (PUSHORT)PyasAllocate(256 * sizeof(USHORT));
+    if (!Histogram) return FALSE;
+
    PUCHAR Ptr = (PUCHAR)Buffer;
    ULONG ScanLen = (Length > 1024) ? 1024 : Length;

@@ -670,16 +715,20 @@ static BOOLEAN IsHighEntropy(PVOID Buffer, ULONG Length) {
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
+        PyasFree(Histogram);
        return FALSE;
    }

-    ULONG MaxFreq = 0;
+    USHORT MaxFreq = 0;
    for (int i = 0; i < 256; i++) {
        if (Histogram[i] > MaxFreq) MaxFreq = Histogram[i];
    }

    ULONG ExpectedAvg = ScanLen / 256;
-    return (MaxFreq < (ExpectedAvg + HIGH_ENTROPY_THRESHOLD));
+    BOOLEAN Result = (MaxFreq < (ExpectedAvg + HIGH_ENTROPY_THRESHOLD));
+
+    PyasFree(Histogram);
+    return Result;
 }

 static BOOLEAN IsNaturallyCompressed(PCUNICODE_STRING FileName) {
@@ -713,14 +762,19 @@ static BOOLEAN IsUserDirectoryPath(PCUNICODE_STRING FileName) {
 }

 static BOOLEAN IsExplorerProcess(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+    if (KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
    PUNICODE_STRING imageFileName = NULL;
    NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);
    BOOLEAN isExplorer = FALSE;
-    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
-        if (HasSuffix(imageFileName, L"\\explorer.exe")) isExplorer = TRUE;
+
+    if (NT_SUCCESS(status) && imageFileName) {
+        if (imageFileName->Buffer && HasSuffix(imageFileName, L"\\explorer.exe")) {
+            isExplorer = TRUE;
+        }
        ExFreePool(imageFileName);
    }
+
    return isExplorer;
 }

@@ -755,9 +809,12 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr

    LARGE_INTEGER Now = { 0 };
    KeQuerySystemTime(&Now);
+    LARGE_INTEGER createTime;
+    createTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
    BOOLEAN Result = FALSE;

-    ExAcquireFastMutex(&GlobalData.TrackerMutex);
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.TrackerMutex, &OldIrql);

    PRANSOM_TRACKER Tracker = NULL;
    PRANSOM_TRACKER CandidateSlot = NULL;
@@ -770,7 +827,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
            LruSlot = Current;
        }

-        if (Current->Process == Process) {
+        if (Current->Process == Process && Current->ProcessCreateTime.QuadPart == createTime.QuadPart) {
            Tracker = Current;
            break;
        }
@@ -798,6 +855,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
        }

        Tracker->Process = Process;
+        Tracker->ProcessCreateTime = createTime;
        Tracker->ActivityCount = 0;
        Tracker->LastActivityTime = Now;
    }
@@ -817,7 +875,8 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
    if (Tracker->ActivityCount >= RANSOM_COUNT_THRESHOLD) {
        Result = TRUE;
    }
-    ExReleaseFastMutex(&GlobalData.TrackerMutex);
+
+    KeReleaseSpinLock(&GlobalData.TrackerMutex, OldIrql);
    ObDereferenceObject(Process);
    return Result;
 }
@@ -825,34 +884,48 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr
 NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize) {
    if (KeGetCurrentIrql() > APC_LEVEL) return STATUS_UNSUCCESSFUL;

-    PYAS_MESSAGE msg;
-    RtlZeroMemory(&msg, sizeof(msg));
-    msg.MessageCode = Code;
-    msg.ProcessId = Pid;
-
-    if (Path && PathSize > 0) {
-        size_t MaxSize = sizeof(msg.Path) - sizeof(WCHAR);
-        size_t BytesToCopy = PathSize;
-        if (BytesToCopy > MaxSize) BytesToCopy = MaxSize;
-
-        __try {
-            RtlCopyMemory(msg.Path, Path, BytesToCopy);
-            msg.Path[BytesToCopy / sizeof(WCHAR)] = L'\0';
-        }
-        __except (EXCEPTION_EXECUTE_HANDLER) {
-            return STATUS_ACCESS_VIOLATION;
-        }
-    }
-
    if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
        return STATUS_PORT_DISCONNECTED;
    }

    NTSTATUS status = STATUS_PORT_DISCONNECTED;
+
    if (GlobalData.ClientPort) {
-        LARGE_INTEGER timeout;
-        timeout.QuadPart = -(5 * 10000);
-        status = FltSendMessage(GlobalData.FilterHandle, &GlobalData.ClientPort, &msg, sizeof(msg), NULL, NULL, &timeout);
+        PPYAS_MESSAGE msg = (PPYAS_MESSAGE)PyasAllocate(sizeof(PYAS_MESSAGE));
+        if (msg) {
+            msg->MessageCode = Code;
+            msg->ProcessId = Pid;
+
+            if (Path && PathSize > 0) {
+                size_t MaxSize = sizeof(msg->Path) - sizeof(WCHAR);
+                size_t BytesToCopy = PathSize > MaxSize ? MaxSize : PathSize;
+
+                __try {
+                    RtlCopyMemory(msg->Path, Path, BytesToCopy);
+                    msg->Path[BytesToCopy / sizeof(WCHAR)] = L'\0';
+                }
+                __except (EXCEPTION_EXECUTE_HANDLER) {
+                    PyasFree(msg);
+                    ExReleaseRundownProtection(&GlobalData.PortRundown);
+                    return STATUS_ACCESS_VIOLATION;
+                }
+            }
+
+            LARGE_INTEGER timeout;
+            if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+                timeout.QuadPart = -(5 * 10000);
+            }
+            else {
+                timeout.QuadPart = 0;
+            }
+
+            status = FltSendMessage(GlobalData.FilterHandle, &GlobalData.ClientPort, msg, sizeof(PYAS_MESSAGE), NULL, NULL, &timeout);
+
+            PyasFree(msg);
+        }
+        else {
+            status = STATUS_INSUFFICIENT_RESOURCES;
+        }
    }

    ExReleaseRundownProtection(&GlobalData.PortRundown);
@@ -34,10 +34,6 @@ The following lists the storage locations of all relevant code and other related

 ```
 PYAS/
-├── Embed/                           # Deploy an embedded command line antivirus engine
-│   ├── Dockerfile
-│   └── ...
-│
 ├── Engine/                          # Complete code for Yara signatures and AI model training
 │   ├── Heuristic/
 │   │   └── ...                      # Yara Rules
Author	SHA1	Message	Date
87owo	ad85f11875	Add files via upload	2026-05-02 01:49:17 +08:00
87owo	9ae31834cc	Add files via upload	2026-05-02 01:16:32 +08:00
87owo	49a4dc6942	Add files via upload	2026-05-02 01:16:05 +08:00
87owo	a9f58cc30f	Add files via upload	2026-05-02 01:15:51 +08:00
87owo	bdb2198582	Add files via upload	2026-05-02 01:15:28 +08:00
87owo	f32a77ca8b	Add files via upload	2026-05-01 23:16:30 +08:00
87owo	121d3fb0ae	Add files via upload	2026-05-01 23:15:59 +08:00
87owo	1dd72f7600	Add files via upload	2026-05-01 23:15:22 +08:00
87owo	c7c168b007	Add files via upload	2026-05-01 23:14:45 +08:00
87owo	441b41c6af	Add files via upload	2026-05-01 23:13:56 +08:00
87owo	49a907283a	Add files via upload	2026-05-01 15:41:33 +08:00
87owo	0ffc52f9ba	Add files via upload	2026-05-01 13:10:33 +08:00
87owo	4e96ec49e7	Update README.md	2026-04-29 21:04:53 +08:00
87owo	dfb4646f51	Delete Embed directory	2026-04-29 21:04:30 +08:00
87owo	a8e82c38c9	Add files via upload	2026-04-29 18:09:24 +08:00
87owo	dba23289fd	Add files via upload	2026-04-29 17:41:00 +08:00
87owo	c2c1eb98d9	Add files via upload	2026-04-29 16:19:44 +08:00
87owo	364176912d	Add files via upload	2026-04-28 14:38:35 +08:00
87owo	202245baad	Add files via upload	2026-04-28 14:10:07 +08:00
				`@@ -1 +0,0 @@`
				["FileEntropy", "SectionMeanEntropy", "IsExe", "IsDll", "IsDriver", "Is64Bit", "Machine", "Magic", "CheckSum", "ImageBase", "SizeOfImage", "SizeOfHeaders", "Characteristics", "DllCharacteristics", "Subsystem", "LoaderFlags", "MajorLinkerVersion", "MinorLinkerVersion", "SizeOfCode", "SizeOfInitializedData", "SizeOfUninitializedData", "AddressOfEntryPoint", "BaseOfCode", "SectionAlignment", "FileAlignment", "MajorOperatingSystemVersion", "MinorOperatingSystemVersion", "MajorImageVersion", "MinorImageVersion", "MajorSubsystemVersion", "MinorSubsystemVersion", "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit", "NumberOfSections", "NumberOfRvaAndSizes", "PointerToSymbolTable", "NumberOfSymbols", "SizeOfOptionalHeader", "TextSectionMaxEntropy", "TextSectionMeanEntropy", "TextSizeRatio", "DataSectionMaxEntropy", "DataSectionMeanEntropy", "DataSizeRatio", "RsrcSectionMaxEntropy", "RsrcSectionMeanEntropy", "RsrcSizeRatio", "SectionCount", "ExecutableSections", "WritableSections", "ReadableSections", "SectionException", "Char_00000020_Count", "Char_00000020_MeanEntropy", "Char_00000040_Count", "Char_00000040_MeanEntropy", "Char_00000080_Count", "Char_00000080_MeanEntropy", "Char_02000000_Count", "Char_02000000_MeanEntropy", "Char_20000000_Count", "Char_20000000_MeanEntropy", "Char_40000000_Count", "Char_40000000_MeanEntropy", "Char_80000000_Count", "Char_80000000_MeanEntropy", "IconCount", "ApiCount", "ExportCount", "DebugCount", "ExceptionCount", "ImportCount", "ImportFunctionCount", "FileDescriptionLength", "FileVersionLength", "ProductNameLength", "ProductVersionLength", "CompanyNameLength", "LegalCopyrightLength", "CommentsLength", "InternalNameLength", "LegalTrademarksLength", "SpecialBuildLength", "PrivateBuildLength", "TrustSigned", "IsDebug", "IsPatched", "IsPrivateBuild", "IsPreRelease", "IsSpecialBuild", "IsAdmin", "IsInstall", "HasTlsCallbacks", "HasInvalidTimestamp", "HasRelocationDirectory", "HasPacked", "FileTimeException", "Cat_AntiDebug", "Cat_Audio", "Cat_COM", "Cat_Camera", "Cat_Clipboard", "Cat_DataObfuscation", "Cat_DotNet", "Cat_Encryption", "Cat_FileIO", "Cat_Graphics", "Cat_Injection", "Cat_Input", "Cat_Keylogging", "Cat_Memory", "Cat_MultiThreading", "Cat_Native", "Cat_Network", "Cat_Privileges", "Cat_ProcessControl", "Cat_Registry", "Cat_Resource", "Cat_ScreenCapture", "Cat_Services", "Cat_Synchronization", "Cat_WindowControl", "Dll_advapi32_dll", "Dll_bcrypt_dll", "Dll_comctl32_dll", "Dll_crypt32_dll", "Dll_dbghelp_dll", "Dll_gdi32_dll", "Dll_hal_dll", "Dll_imagehlp_dll", "Dll_iphlpapi_dll", "Dll_kernel32_dll", "Dll_mscoree_dll", "Dll_netapi32_dll", "Dll_ntdll_dll", "Dll_ole32_dll", "Dll_oleaut32_dll", "Dll_psapi_dll", "Dll_shell32_dll", "Dll_shlwapi_dll", "Dll_urlmon_dll", "Dll_user32_dll", "Dll_vbscript_dll", "Dll_version_dll", "Dll_winhttp_dll", "Dll_wininet_dll", "Dll_winmm_dll", "Dll_ws2_32_dll", "Dll_wsock32_dll", "Dll_wtsapi32_dll", "Api_AdjustTokenPrivileges", "Api_Base64Decode", "Api_BitBlt", "Api_CallNextHookEx", "Api_CallWindowProcA", "Api_CapCreateCaptureWindowA", "Api_CapCreateCaptureWindowW", "Api_CharLowerA", "Api_CharUpperA", "Api_CheckRemoteDebuggerPresent", "Api_CloseClipboard", "Api_CloseHandle", "Api_CoCreateInstance", "Api_CoInitialize", "Api_CoUninitialize", "Api_CompareStringA", "Api_ConnectNamedPipe", "Api_ControlService", "Api_CopyFileA", "Api_CopyFileW", "Api_CreateCompatibleBitmap", "Api_CreateCompatibleDC", "Api_CreateDCA", "Api_CreateDCW", "Api_CreateEventA", "Api_CreateEventW", "Api_CreateFileA", "Api_CreateFileMappingA", "Api_CreateFileMappingW", "Api_CreateFileW", "Api_CreateMutexA", "Api_CreateMutexW", "Api_CreateProcessA", "Api_CreateProcessW", "Api_CreateRemoteThread", "Api_CreateServiceA", "Api_CreateServiceW", "Api_CreateThread", "Api_CreateThreadpoolWork", "Api_CreateWindowExA", "Api_CryptAcquireContextA", "Api_CryptAcquireContextW", "Api_CryptCreateHash", "Api_CryptDecodeObject", "Api_CryptDecrypt", "Api_CryptDeriveKey", "Api_CryptDestroyHash", "Api_CryptDestroyKey", "Api_CryptEncrypt", "Api_CryptExportKey", "Api_CryptGenKey", "Api_CryptHashData", "Api_CryptImportKey", "Api_CryptReleaseContext", "Api_D3D11CreateDevice", "Api_DecodePointer", "Api_DefWindowProcA", "Api_DeleteCriticalSection", "Api_DeleteDC", "Api_DeleteFileA", "Api_DeleteFileW", "Api_DeleteObject", "Api_DeleteService", "Api_DestroyWindow", "Api_DeviceIoControl", "Api_Direct3DCreate9", "Api_DispatchMessageA", "Api_DnsQuery_A", "Api_DnsQuery_W", "Api_EncodePointer", "Api_EnterCriticalSection", "Api_EnumChildWindows", "Api_EnumWindows", "Api_ExitProcess", "Api_ExitThread", "Api_FindClose", "Api_FindFirstFileA", "Api_FindNextFileA", "Api_FindResourceA", "Api_FindWindowA", "Api_FindWindowW", "Api_FlushFileBuffers", "Api_FreeEnvironmentStringsW", "Api_FreeLibrary", "Api_FreeResource", "Api_GdipSaveImageToFile", "Api_GetACP", "Api_GetActiveWindow", "Api_GetAsyncKeyState", "Api_GetCapture", "Api_GetClientRect", "Api_GetClipboardData", "Api_GetCommandLineA", "Api_Line truncated