Add files via upload

Fixed a bug where PYAS process protection was not working. (To be verified)

Engine/Properties/scanner.py

@@ -0,0 +1,731 @@
+import os, re, sys, math, json, zlib, pefile, datetime
+import ctypes, ctypes.wintypes
+import numpy as np
+import onnxruntime as ort
+
+####################################################################################################
+
+MODEL_FILE = "Pefile_General_S1.onnx"
+FEATURE_FILE = "features.json"
+MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024
+
+####################################################################################################
+
+class WINTRUST_FILE_INFO(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pcwszFilePath", ctypes.wintypes.LPCWSTR),
+        ("hFile", ctypes.wintypes.HANDLE),
+        ("pgKnownSubject", ctypes.wintypes.LPVOID)
+    ]
+
+class WINTRUST_DATA_UNION(ctypes.Union):
+    _fields_ = [
+        ("pFile", ctypes.POINTER(WINTRUST_FILE_INFO)),
+        ("pCatalog", ctypes.wintypes.LPVOID),
+        ("pBlob", ctypes.wintypes.LPVOID),
+        ("pSgnr", ctypes.wintypes.LPVOID),
+        ("pCert", ctypes.wintypes.LPVOID)
+    ]
+
+class WINTRUST_DATA(ctypes.Structure):
+    _fields_ = [
+        ("cbStruct", ctypes.wintypes.DWORD),
+        ("pPolicyCallbackData", ctypes.wintypes.LPVOID),
+        ("pSIPClientData", ctypes.wintypes.LPVOID),
+        ("dwUIChoice", ctypes.wintypes.DWORD),
+        ("fdwRevocationChecks", ctypes.wintypes.DWORD),
+        ("dwUnionChoice", ctypes.wintypes.DWORD),
+        ("u", WINTRUST_DATA_UNION),
+        ("dwStateAction", ctypes.wintypes.DWORD),
+        ("hWVTStateData", ctypes.wintypes.HANDLE),
+        ("pwszURLReference", ctypes.wintypes.LPCWSTR),
+        ("dwProvFlags", ctypes.wintypes.DWORD),
+        ("dwUIContext", ctypes.wintypes.DWORD),
+        ("pSignatureSettings", ctypes.wintypes.LPVOID)
+    ]
+
+class GUID(ctypes.Structure):
+    _fields_ = [
+        ("Data1", ctypes.wintypes.DWORD),
+        ("Data2", ctypes.wintypes.WORD),
+        ("Data3", ctypes.wintypes.WORD),
+        ("Data4", ctypes.c_ubyte * 8)
+    ]
+
+V2_GUID = GUID(0x00AAC56B, 0xCD44, 0x11D0, (ctypes.c_ubyte * 8)(0x8C, 0xC2, 0x00, 0xC0, 0x4F, 0xC2, 0x95, 0xEE))
+
+####################################################################################################
+
+class WinTrust:
+    @staticmethod
+    def verify(file_path):
+        if os.name != 'nt':
+            return 0
+        try:
+            wintrust = ctypes.windll.wintrust
+            wintrust.WinVerifyTrust.argtypes = [ctypes.wintypes.HWND, ctypes.POINTER(GUID), ctypes.wintypes.LPVOID]
+            wintrust.WinVerifyTrust.restype = ctypes.wintypes.LONG
+
+            fi = WINTRUST_FILE_INFO()
+            fi.cbStruct = ctypes.sizeof(WINTRUST_FILE_INFO)
+            fi.pcwszFilePath = os.path.abspath(file_path)
+            fi.hFile = None
+            fi.pgKnownSubject = None
+
+            wt_union = WINTRUST_DATA_UNION()
+            wt_union.pFile = ctypes.pointer(fi)
+
+            td = WINTRUST_DATA()
+            td.cbStruct = ctypes.sizeof(WINTRUST_DATA)
+            td.pPolicyCallbackData = None
+            td.pSIPClientData = None
+            td.dwUIChoice = 2
+            td.fdwRevocationChecks = 0
+            td.dwUnionChoice = 1
+            td.u = wt_union
+            td.dwStateAction = 0
+            td.hWVTStateData = None
+            td.pwszURLReference = None
+            td.dwProvFlags = 0
+            td.dwUIContext = 0
+            td.pSignatureSettings = None
+
+            return 1 if wintrust.WinVerifyTrust(None, ctypes.byref(V2_GUID), ctypes.byref(td)) == 0 else 0
+        except Exception:
+            return 0
+
+####################################################################################################
+
+class FeatureExtractor:
+    _STRING_PATTERN = re.compile(b'[\x20-\x7E]{5,}')
+    
+    _BYTE_HIST_KEYS = [f'ByteHist_{i:02X}' for i in range(256)]
+    _BYTE_ENT_KEYS = [f'ByteEnt_{i:02X}' for i in range(256)]
+    _STRING_KEYS = [f'StringHist_{i:02d}' for i in range(95)]
+    _SECTION_HASH_KEYS = [f'SectionHash_{i:02d}' for i in range(50)]
+    _CHAR_FLAGS = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
+    _CHAR_COUNT_KEYS = {flag: f'Char_{flag:08X}_Count' for flag in _CHAR_FLAGS}
+    _CHAR_ENT_KEYS = {flag: f'Char_{flag:08X}_MeanEntropy' for flag in _CHAR_FLAGS}
+    
+    _C_LOG_C_TABLE = np.zeros(2049, dtype=np.float64)
+    _C_LOG_C_TABLE[1:] = np.arange(1, 2049) * np.log2(np.arange(1, 2049))
+
+    @staticmethod
+    def _safe_float(val):
+        try:
+            f = float(val)
+            return f if not (math.isinf(f) or math.isnan(f)) else 0.0
+
+        except Exception: 
+            return 0.0
+
+    @staticmethod
+    def _calc_entropy(data):
+        if not data:
+            return 0.0
+
+        arr = np.frombuffer(data, dtype=np.uint8)
+        sz = len(arr)
+        counts = np.bincount(arr, minlength=256)
+        counts = counts[counts > 0]
+
+        return float(np.log2(sz) - np.sum(counts * np.log2(counts)) / sz)
+
+    @classmethod
+    def _extract_strings(cls, file_bytes):
+        res = {"StringCount": 0.0, "StringMeanLength": 0.0, "StringEntropy": 0.0}
+        res.update(dict.fromkeys(cls._STRING_KEYS, 0.0))
+
+        matches = cls._STRING_PATTERN.findall(file_bytes)
+        if not matches:
+            return res
+
+        combined_data = b''.join(matches)
+        count = len(matches)
+        total_len = len(combined_data)
+
+        res["StringCount"] = float(count)
+        res["StringMeanLength"] = float(total_len) / count
+        res["StringEntropy"] = cls._calc_entropy(combined_data)
+
+        arr = np.frombuffer(combined_data, dtype=np.uint8)
+        counts = np.bincount(arr, minlength=127)
+        char_counts = counts[0x20:0x7F]
+
+        res.update(dict(zip(cls._STRING_KEYS, char_counts.astype(np.float64) / total_len)))
+        return res
+
+    @classmethod
+    def _extract_histograms(cls, file_bytes):
+        arr = np.frombuffer(file_bytes, dtype=np.uint8)
+        sz = len(arr)
+        res = {}
+
+        if sz == 0:
+            res.update(dict.fromkeys(cls._BYTE_HIST_KEYS, 0.0))
+            res.update(dict.fromkeys(cls._BYTE_ENT_KEYS, 0.0))
+            return res
+
+        byte_counts = np.bincount(arr, minlength=256)
+        byte_hist = byte_counts.astype(np.float64) / sz
+        res.update(dict(zip(cls._BYTE_HIST_KEYS, byte_hist)))
+
+        ent_hist = np.zeros(256, dtype=np.float64)
+        window = 2048
+        step = 1024
+
+        if sz < window:
+            w_counts = byte_counts
+            p = w_counts[w_counts > 0] / float(sz)
+            entropy = float(-np.sum(p * np.log2(p)))
+            ent_bin = min(int(entropy * 2.0), 15)
+            byte_bins = w_counts.reshape(16, 16).sum(axis=1)
+            idx_start = ent_bin * 16
+            ent_hist[idx_start : idx_start+16] += byte_bins
+        else:
+            num_windows = (sz - window) // step + 1
+            batch_windows = 10000 
+            
+            for w_start in range(0, num_windows, batch_windows):
+                w_end = min(w_start + batch_windows, num_windows)
+                b_num = w_end - w_start
+                
+                start_byte = w_start * step
+                end_byte = start_byte + b_num * step + step
+                b_arr = arr[start_byte:end_byte]
+                
+                arr_2d = b_arr.reshape(b_num + 1, step)
+                offsets = (np.arange(b_num + 1, dtype=np.int32)[:, None] * 256)
+                flat_idx = (arr_2d.astype(np.int32) + offsets).ravel()
+                
+                chunk_counts = np.bincount(flat_idx, minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                window_counts = chunk_counts[:-1] + chunk_counts[1:]
+                
+                sum_c_log_c = np.sum(cls._C_LOG_C_TABLE[window_counts], axis=1)
+                entropies = 11.0 - sum_c_log_c / 2048.0
+                
+                ent_bins = (entropies * 2.0).astype(np.int32)
+                np.clip(ent_bins, 0, 15, out=ent_bins)
+                
+                byte_bins = window_counts.reshape(b_num, 16, 16).sum(axis=2)
+                flat_ent_bins = (ent_bins[:, None] * 16 + np.arange(16)).ravel()
+                np.add.at(ent_hist, flat_ent_bins, byte_bins.ravel())
+
+        ent_sum = np.sum(ent_hist)
+        if ent_sum > 0:
+            ent_hist /= ent_sum
+
+        res.update(dict(zip(cls._BYTE_ENT_KEYS, ent_hist)))
+        return res
+
+    @classmethod
+    def _extract_overlay_features(cls, pe, fsize):
+        overlay_offset = pe.get_overlay_data_start_offset()
+        if not overlay_offset or overlay_offset >= fsize:
+            return {"HasOverlay": 0.0, "OverlaySize": 0.0, "OverlayRatio": 0.0, "OverlayEntropy": 0.0}
+        
+        overlay_data = pe.get_overlay()
+        if not overlay_data:
+            return {"HasOverlay": 0.0, "OverlaySize": 0.0, "OverlayRatio": 0.0, "OverlayEntropy": 0.0}
+
+        sz = len(overlay_data)
+        return {
+            "HasOverlay": 1.0,
+            "OverlaySize": float(sz),
+            "OverlayRatio": float(sz) / float(fsize),
+            "OverlayEntropy": cls._calc_entropy(overlay_data)
+        }
+
+    @classmethod
+    def _extract_rich_header(cls, pe):
+        if not hasattr(pe, 'RICH_HEADER') or not pe.RICH_HEADER:
+            return {"HasRichHeader": 0.0, "RichHeaderCount": 0.0}
+        return {
+            "HasRichHeader": 1.0,
+            "RichHeaderCount": float(len(pe.RICH_HEADER.values) // 2) if hasattr(pe.RICH_HEADER, 'values') else 0.0
+        }
+
+    @classmethod
+    def _extract_ep_anomalies(cls, pe):
+        if not hasattr(pe, 'OPTIONAL_HEADER') or not hasattr(pe, 'sections') or not pe.sections:
+            return {"EntryPointSectionIndex": -1.0, "EntryPointInExecutable": 0.0, "EntryPointInLastSection": 0.0}
+
+        ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint
+        ep_section_idx = -1
+        ep_in_exec = 0.0
+        
+        for idx, sec in enumerate(pe.sections):
+            if sec.VirtualAddress <= ep < (sec.VirtualAddress + sec.Misc_VirtualSize):
+                ep_section_idx = idx
+                if sec.Characteristics & 0x20000000:
+                    ep_in_exec = 1.0
+                break
+                
+        return {
+            "EntryPointSectionIndex": float(ep_section_idx),
+            "EntryPointInExecutable": ep_in_exec,
+            "EntryPointInLastSection": 1.0 if ep_section_idx == len(pe.sections) - 1 else 0.0
+        }
+
+    @classmethod
+    def _extract_advanced_resources(cls, pe):
+        res_data = {
+            "ResourceMaxEntropy": 0.0,
+            "ResourceMinEntropy": 0.0,
+            "ResourceMeanEntropy": 0.0,
+            "ResourceLangCount": 0.0,
+            "ResourceRCDataCount": 0.0
+        }
+        
+        if not hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
+            return res_data
+            
+        entropies = []
+        langs = set()
+        rcdata_count = 0
+        
+        for entry_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:
+            if hasattr(entry_type, 'id') and entry_type.id == 10: 
+                rcdata_count += len(getattr(entry_type.directory, 'entries', []))
+                
+            if not hasattr(entry_type, 'directory'):
+                continue
+                
+            for entry_id in entry_type.directory.entries:
+                if not hasattr(entry_id, 'directory'):
+                    continue
+                    
+                for entry_lang in entry_id.directory.entries:
+                    if hasattr(entry_lang, 'id'):
+                        langs.add(entry_lang.id)
+
+                    if hasattr(entry_lang, 'data'):
+                        try:
+                            data = pe.get_data(entry_lang.data.struct.OffsetToData, entry_lang.data.struct.Size)
+                            entropies.append(cls._calc_entropy(data))
+                        except Exception:
+                            continue
+                            
+        res_data["ResourceLangCount"] = float(len(langs))
+        res_data["ResourceRCDataCount"] = float(rcdata_count)
+        
+        if entropies:
+            res_data["ResourceMaxEntropy"] = max(entropies)
+            res_data["ResourceMinEntropy"] = min(entropies)
+            res_data["ResourceMeanEntropy"] = sum(entropies) / len(entropies)
+            
+        return res_data
+
+    @classmethod
+    def _extract_load_config(cls, pe):
+        cfg = {"HasLoadConfig": 0.0, "HasCFG": 0.0, "HasSEHTable": 0.0}
+        if hasattr(pe, 'DIRECTORY_ENTRY_LOAD_CONFIG'):
+            cfg["HasLoadConfig"] = 1.0
+            struct = pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct
+
+            if getattr(struct, 'GuardCFFunctionTable', 0) != 0:
+                cfg["HasCFG"] = 1.0
+
+            if getattr(struct, 'SEHandlerTable', 0) != 0:
+                cfg["HasSEHTable"] = 1.0
+
+        return cfg
+
+    @classmethod
+    def _extract_security_directory(cls, pe, file_bytes, fsize):
+        res = {"HasSignature": 0.0, "SignatureCount": 0.0}
+        if not hasattr(pe, 'OPTIONAL_HEADER') or not hasattr(pe.OPTIONAL_HEADER, 'DATA_DIRECTORY'):
+            return res
+
+        sec_idx = 4
+        directories = pe.OPTIONAL_HEADER.DATA_DIRECTORY
+        if len(directories) <= sec_idx:
+            return res
+
+        sec_dir = directories[sec_idx]
+        if sec_dir.Size == 0 or sec_dir.VirtualAddress == 0:
+            return res
+
+        res["HasSignature"] = 1.0
+        offset = sec_dir.VirtualAddress
+        size = sec_dir.Size
+
+        if offset + size > fsize or offset < 0 or size < 0:
+            return res
+
+        count = 0
+        curr = offset
+        end = offset + size
+
+        while curr + 8 <= end:
+            dw_length = int.from_bytes(file_bytes[curr:curr+4], 'little')
+            if dw_length < 8:
+                break
+
+            count += 1
+            curr += (dw_length + 7) & ~7
+
+        res["SignatureCount"] = float(count)
+        return res
+
+    @classmethod
+    def extract(cls, file_path):
+        pe = None
+        try:
+            fsize = os.path.getsize(file_path)
+            if fsize == 0 or fsize > MAX_FILE_SIZE: 
+                return None
+
+            with open(file_path, "rb") as f:
+                file_bytes = f.read()
+
+            base, dlls, apis = {}, set(), set()
+            pe = pefile.PE(data=file_bytes, fast_load=True)
+
+            try:
+                pe.parse_rich_header()
+                pe.parse_data_directories(directories=[
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'], 
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'], 
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'], 
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_DEBUG'], 
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_TLS'],
+                    pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG']
+                ])
+            except Exception: 
+                pass
+            
+            base['TrustSigned'] = float(WinTrust.verify(file_path))
+            base['FileEntropy'] = cls._calc_entropy(file_bytes)
+            base['FileSize'] = float(fsize)
+            
+            fh = pe.FILE_HEADER
+            base['Machine'] = getattr(fh, 'Machine', 0)
+            base['NumberOfSections'] = getattr(fh, 'NumberOfSections', 0)
+            base['TimeDateStamp'] = getattr(fh, 'TimeDateStamp', 0)
+            base['PointerToSymbolTable'] = getattr(fh, 'PointerToSymbolTable', 0)
+            base['NumberOfSymbols'] = getattr(fh, 'NumberOfSymbols', 0)
+            base['SizeOfOptionalHeader'] = getattr(fh, 'SizeOfOptionalHeader', 0)
+            base['Characteristics'] = getattr(fh, 'Characteristics', 0)
+
+            curr_ts = datetime.datetime.utcnow().timestamp()
+            base['HasInvalidTimestamp'] = 1.0 if (base['TimeDateStamp'] < 631152000 or base['TimeDateStamp'] > curr_ts + 2592000) else 0.0
+            base['FileTimeException'] = 1.0 if base['TimeDateStamp'] == 0 else 0.0
+            base['Is64Bit'] = 1.0 if base['Machine'] in (0x8664, 0xAA64, 0x0200) else 0.0
+            base['IsExe'] = 1.0 if pe.is_exe() else 0.0
+            base['IsDll'] = 1.0 if pe.is_dll() else 0.0
+            base['ExceptionCount'] = 0.0
+
+            if hasattr(pe, 'OPTIONAL_HEADER'):
+                op = pe.OPTIONAL_HEADER
+                fields = ['Magic', 'MajorLinkerVersion', 'MinorLinkerVersion', 'SizeOfCode', 'SizeOfInitializedData', 'SizeOfUninitializedData', 'AddressOfEntryPoint', 'BaseOfCode', 'ImageBase', 'SectionAlignment', 'FileAlignment', 'MajorOperatingSystemVersion', 'MinorOperatingSystemVersion', 'MajorImageVersion', 'MinorImageVersion', 'MajorSubsystemVersion', 'MinorSubsystemVersion', 'SizeOfImage', 'SizeOfHeaders', 'CheckSum', 'Subsystem', 'DllCharacteristics', 'SizeOfStackReserve', 'SizeOfStackCommit', 'SizeOfHeapReserve', 'SizeOfHeapCommit', 'LoaderFlags', 'NumberOfRvaAndSizes']
+                for f in fields: base[f] = getattr(op, f, 0)
+                base['IsDriver'] = 1.0 if base.get('Subsystem') == 1 else 0.0
+
+                if hasattr(op, 'DATA_DIRECTORY'):
+                    for i, directory in enumerate(op.DATA_DIRECTORY):
+                        base[f'DataDirectory_{i}_Size'] = directory.Size
+                        base[f'DataDirectory_{i}_VA'] = directory.VirtualAddress
+                    
+                    exc_idx = pefile.DIRECTORY_ENTRY.get('IMAGE_DIRECTORY_ENTRY_EXCEPTION', 3)
+                    if len(op.DATA_DIRECTORY) > exc_idx and op.DATA_DIRECTORY[exc_idx].Size > 0:
+                        base['ExceptionCount'] = op.DATA_DIRECTORY[exc_idx].Size // 12 if base['Machine'] in (0x8664, 0xAA64) else 0.0
+
+            res_flags_count = dict.fromkeys(cls._CHAR_COUNT_KEYS.values(), 0.0)
+            res_flags_ent = dict.fromkeys(cls._CHAR_ENT_KEYS.values(), 0.0)
+            res_sec_hash = dict.fromkeys(cls._SECTION_HASH_KEYS, 0.0)
+
+            if hasattr(pe, 'sections'):
+                base['SectionCount'] = len(pe.sections)
+                entropies, raw_sizes, v_sizes = [], [], []
+                exec_sec, write_sec, read_sec, sec_exc = 0, 0, 0, 0
+                
+                for section in pe.sections:
+                    sec_name = section.Name.rstrip(b'\x00')
+                    hash_val = zlib.crc32(sec_name) % 50
+                    res_sec_hash[cls._SECTION_HASH_KEYS[hash_val]] += 1.0
+
+                    try:
+                        s_data = section.get_data()
+                        s_entropy = cls._calc_entropy(s_data)
+                    except Exception: 
+                        s_entropy = 0.0
+
+                    entropies.append(s_entropy)
+                    raw_sizes.append(section.SizeOfRawData)
+                    v_sizes.append(section.Misc_VirtualSize)
+
+                    if section.Characteristics & 0x20000000:
+                        exec_sec += 1
+                    if section.Characteristics & 0x80000000:
+                        write_sec += 1
+                    if section.Characteristics & 0x40000000:
+                        read_sec += 1
+                    if section.SizeOfRawData + section.PointerToRawData > fsize:
+                        sec_exc = 1
+
+                    for flag in cls._CHAR_FLAGS:
+                        if section.Characteristics & flag:
+                            res_flags_count[cls._CHAR_COUNT_KEYS[flag]] += 1.0
+                            res_flags_ent[cls._CHAR_ENT_KEYS[flag]] += s_entropy
+
+                base['SectionMaxEntropy'] = max(entropies) if entropies else 0.0
+                base['SectionMinEntropy'] = min(entropies) if entropies else 0.0
+                base['SectionMeanEntropy'] = sum(entropies) / len(entropies) if entropies else 0.0
+                base['SectionMaxRawSize'] = max(raw_sizes) if raw_sizes else 0.0
+                base['SectionMinRawSize'] = min(raw_sizes) if raw_sizes else 0.0
+                base['SectionMeanRawSize'] = sum(raw_sizes) / len(raw_sizes) if raw_sizes else 0.0
+                base['SectionMaxVSize'] = max(v_sizes) if v_sizes else 0.0
+                base['SectionMinVSize'] = min(v_sizes) if v_sizes else 0.0
+                base['SectionMeanVSize'] = sum(v_sizes) / len(v_sizes) if v_sizes else 0.0
+                base['ExecutableSections'] = float(exec_sec)
+                base['WritableSections'] = float(write_sec)
+                base['ReadableSections'] = float(read_sec)
+                base['SectionException'] = float(sec_exc)
+
+                for flag in cls._CHAR_FLAGS:
+                    cnt_key = cls._CHAR_COUNT_KEYS[flag]
+                    if res_flags_count[cnt_key] > 0:
+                        res_flags_ent[cls._CHAR_ENT_KEYS[flag]] /= res_flags_count[cnt_key]
+
+            base.update(res_flags_count)
+            base.update(res_flags_ent)
+            base.update(res_sec_hash)
+
+            string_keys = ['FileDescription', 'FileVersion', 'ProductName', 'ProductVersion', 'CompanyName', 'LegalCopyright', 'Comments', 'InternalName', 'LegalTrademarks', 'SpecialBuild', 'PrivateBuild']
+            for key in string_keys: 
+                base[f'{key}Length'] = 0.0
+                
+            if hasattr(pe, 'FileInfo'):
+                for fileinfo_list in pe.FileInfo:
+                    for fileinfo in fileinfo_list:
+                        if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
+                            for st in getattr(fileinfo, 'StringTable', []):
+                                for key, val in st.entries.items():
+
+                                    try:
+                                        k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
+                                        if k in string_keys:
+                                            v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
+                                            base[f'{k}Length'] = float(len(v))
+
+                                    except Exception: 
+                                        continue
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_TLS') and hasattr(pe.DIRECTORY_ENTRY_TLS, 'struct'):
+                base['HasTlsCallbacks'] = 1.0 if getattr(pe.DIRECTORY_ENTRY_TLS.struct, 'AddressOfCallBacks', 0) != 0 else 0.0
+            
+            if hasattr(pe, 'VS_FIXEDFILEINFO') and len(pe.VS_FIXEDFILEINFO) > 0:
+                flags = getattr(pe.VS_FIXEDFILEINFO[0], 'FileFlags', 0)
+                base['IsDebug'] = 1.0 if flags & 0x1 else 0.0
+                base['IsPreRelease'] = 1.0 if flags & 0x2 else 0.0
+                base['IsPatched'] = 1.0 if flags & 0x4 else 0.0
+                base['IsPrivateBuild'] = 1.0 if flags & 0x8 else 0.0
+                base['IsSpecialBuild'] = 1.0 if flags & 0x20 else 0.0
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
+                base['ImportCount'] = float(len(pe.DIRECTORY_ENTRY_IMPORT))
+                func_count = 0
+                for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                    if getattr(entry, 'dll', None):
+                        try:
+                            dlls.add(entry.dll.decode('ascii', 'ignore').lower())
+                        except Exception:
+                            pass
+
+                    for imp in getattr(entry, 'imports', []):
+                        func_count += 1
+                        if getattr(imp, 'name', None):
+                            try:
+                                apis.add(imp.name.decode('ascii', 'ignore'))
+                            except Exception:
+                                pass
+
+                base['ImportFunctionCount'] = float(func_count)
+
+            base['ExportCount'] = float(len(pe.DIRECTORY_ENTRY_EXPORT.symbols)) if (hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols')) else 0.0
+
+            if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
+                icon_count = 0
+                for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
+                    if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
+                        icon_count += len(getattr(entry.directory, 'entries', []))
+                base['IconCount'] = float(icon_count)
+            else: 
+                base['IconCount'] = 0.0
+
+            base['DebugCount'] = float(len(pe.DIRECTORY_ENTRY_DEBUG)) if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG') else 0.0
+
+            base.update(cls._extract_strings(file_bytes))
+            base.update(cls._extract_histograms(file_bytes))
+            base.update(cls._extract_overlay_features(pe, fsize))
+            base.update(cls._extract_rich_header(pe))
+            base.update(cls._extract_ep_anomalies(pe))
+            base.update(cls._extract_advanced_resources(pe))
+            base.update(cls._extract_load_config(pe))
+            base.update(cls._extract_security_directory(pe, file_bytes, fsize))
+
+            for k in base:
+                base[k] = cls._safe_float(base[k])
+
+            return {"Base": base, "DLLs": list(dlls), "APIs": list(apis)}
+
+        except Exception:
+            return None
+        finally:
+            if pe:
+                pe.close()
+
+####################################################################################################
+
+class ModelPredictor:
+    def __init__(self, model_path, feature_path):
+        self.model_features = self._load_features(feature_path)
+        self.sess = ort.InferenceSession(model_path, providers=['CPUExecutionProvider'])
+        self.input_name = self.sess.get_inputs()[0].name
+        
+        expected_dim = self.sess.get_inputs()[0].shape[1]
+        current_dim = len(self.model_features)
+        if current_dim != expected_dim:
+            raise ValueError(f"Dimension mismatch! Model expects {expected_dim} features, but feature file lists {current_dim}.")
+
+        self.feat_map = {feat: i for i, feat in enumerate(self.model_features)}
+
+    def _load_features(self, path):
+        if not os.path.exists(path):
+            raise FileNotFoundError(f"Feature file not found: {path}")
+
+        with open(path, 'r') as f:
+            return json.load(f)
+
+    def predict(self, raw_data):
+        vec = np.zeros((1, len(self.model_features)), dtype=np.float32)
+        base = raw_data.get('Base', {})
+        dlls = raw_data.get('DLLs', [])
+        apis = raw_data.get('APIs', [])
+
+        for k, v in base.items():
+            if k in self.feat_map:
+                vec[0, self.feat_map[k]] = v
+
+        for d in dlls:
+            h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
+            feat_name = f"DllHash_{h:03d}"
+            if feat_name in self.feat_map:
+                vec[0, self.feat_map[feat_name]] += 1.0
+
+        for a in apis:
+            h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
+            feat_name = f"ApiHash_{h:04d}"
+            if feat_name in self.feat_map:
+                vec[0, self.feat_map[feat_name]] += 1.0
+
+        outputs = self.sess.run(None, {self.input_name: vec})
+        
+        if len(outputs) > 1:
+            result = outputs[1]
+            if isinstance(result, list) and len(result) > 0:
+                prob_dict = result[0]
+                if hasattr(prob_dict, 'get'):
+                    return float(prob_dict.get(1, prob_dict.get('1', 0.0)))
+
+            elif isinstance(result, np.ndarray):
+                if result.ndim == 2 and result.shape[1] > 1:
+                    return float(result[0][1])
+
+        return 0.0
+
+####################################################################################################
+
+def scan_target(target, predictor):
+    files = []
+    if os.path.isfile(target):
+        files.append(target)
+
+    elif os.path.isdir(target):
+        for r, _, fs in os.walk(target):
+            for f in fs:
+                files.append(os.path.join(r, f))
+    
+    if not files:
+        print("[-] No valid PE files found.")
+        return
+
+    print(f"\n[*] Scanning {len(files)} files...\n")
+    print(f"{'RESULT':<10} | {'PROB':<8} | {'FILE'}")
+    print("-" * 80)
+
+    safe_count = 0
+    mal_count = 0
+    
+    for fpath in files:
+        try:
+            data = FeatureExtractor.extract(fpath)
+            if not data:
+                print(f"{'ERROR':<10} | {'----':<8} | {fpath}")
+                continue
+            
+            prob = predictor.predict(data)
+            is_malware = prob > 0.5
+            
+            label = "MALWARE" if is_malware else "SAFE"
+            if is_malware:
+                mal_count += 1
+            else:
+                safe_count += 1
+
+            print(f"{label:<10} | {prob:.4f}   | {fpath}")
+            
+        except Exception as e:
+            print(f"{'FAIL':<10} | {'----':<8} | {fpath} ({str(e)})")
+
+    print("-" * 80)
+    print(f"[*] Summary: Safe={safe_count}, Malware={mal_count}, Total={len(files)}")
+
+####################################################################################################
+
+if __name__ == "__main__":
+    print("\n-------------------------- PE Malware Predictor v4.0 --------------------------\n")
+    print(f"[*] © 2020-2026 87owo (PYAS Security)")
+    print(f"[*] Loading model features and weights...")
+
+    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
+    model_path = os.path.join(base_dir, MODEL_FILE)
+    feature_path = os.path.join(base_dir, FEATURE_FILE)
+
+    try:
+        predictor = ModelPredictor(model_path, feature_path)
+    except Exception as e:
+        print(f"[-] Critical Error: {e}")
+        sys.exit(1)
+
+    if len(sys.argv) > 1:
+        for path in sys.argv[1:]:
+            target = path.strip('"').strip("'")
+            if os.path.exists(target):
+                print()
+                print("-" * 80)
+                scan_target(target, predictor)
+
+            else:
+                print(f"[-] Path does not exist: {target}")
+    else:
+        while True:
+            try:
+                print()
+                print("-" * 80)
+                path = input("\n[?] Enter File or Folder Path (or 'q' to exit): ").strip().strip('"').strip("'")
+                if path.lower() in ['q', 'exit']:
+                    break
+
+                if not os.path.exists(path):
+                    print("[-] Path does not exist.")
+                    continue
+
+                scan_target(path, predictor)
+
+            except KeyboardInterrupt:
+                break
+            except Exception as e:
+                print(f"[-] Error: {e}")

Engine/Properties/train_server.py

@@ -1,114 +1,192 @@
-import os, sys, time, sqlite3, re, json
-import pandas as pd
+import os, sys, time, json, zlib, array, onnxmltools, multiprocessing
 import numpy as np
+import pandas as pd
 import lightgbm as lgb
-import onnxmltools
+import scipy.sparse as sp
 
+from collections import defaultdict
 from onnxmltools.convert.common.data_types import FloatTensorType
 from sklearn.model_selection import train_test_split
-from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
+from sklearn.metrics import accuracy_score, roc_auc_score
+
+try:
+    import orjson
+    JSON_LOADS = orjson.loads
+
+except ImportError:
+    JSON_LOADS = json.loads
 
 ####################################################################################################
 
-DB_PATH = "pe_features.db"
+JSONL_PATH = "pe_features.jsonl"
 MODEL_FILE = "model.txt"
 ONNX_FILE = "Pefile_General_S1.onnx"
 FEATURE_FILE = "features.json"
-TEST_SIZE = 0.1
+
+TEST_SIZE = 0.0001
 RANDOM_SEED = 42
+DLL_HASH_DIM = 256
+API_HASH_DIM = 1024
+
+EXCLUDE_FEATURES = {
+    'label', 'filehash',
+}
 
 LGBM_PARAMS = {
     'objective': 'binary',
     'metric': ['binary_logloss', 'auc'],
     'boosting_type': 'gbdt',
-    'num_leaves': 512,
-    'learning_rate': 0.05,
+    'num_leaves': 256,
     'feature_fraction': 0.8,
-    'bagging_fraction': 0.8,
+    'bagging_fraction': 1.0,
     'bagging_freq': 5,
     'verbose': -1,
     'seed': RANDOM_SEED,
     'n_jobs': -1,
     'max_depth': -1,
-    'min_data_in_leaf': 10,
-    'lambda_l1': 0.05,
-    'lambda_l2': 0.05,
+    'min_data_in_leaf': 50,
 }
 
 ####################################################################################################
 
-def clean_col_name(name):
-    return re.sub(r'[^A-Za-z0-9_]+', '', name)
+def analyze_schema(jsonl_path):
+    print("[*] Stage 1: Scanning global schema...")
+    base_keys = set()
+    num_lines = 0
 
-def get_raw_schema(db_path):
-    if not os.path.exists(db_path):
-        return None
-    conn = sqlite3.connect(db_path)
-    try:
-        cursor = conn.cursor()
-        cursor.execute("PRAGMA table_info(PeData)")
-        columns = [row[1] for row in cursor.fetchall()]
-        exclude = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score', 'filehash', 'timedatestamp'}
-        return [c for c in columns if c.lower().strip() not in exclude]
-    except Exception as e:
-        print(f"[-] Schema extraction error: {e}")
-        return None
-    finally:
-        conn.close()
+    with open(jsonl_path, 'rb') as f:
+        for line in f:
+            num_lines += 1
 
-####################################################################################################
+            if not base_keys:
+                try:
+                    data = JSON_LOADS(line)
+                    base_data = data.get('Base')
+                    if base_data:
+                        base_keys.update(base_data.keys())
 
-def load_data(db_path, raw_cols):
-    print(f"[*] Connecting to database: {db_path}")
-    conn = sqlite3.connect(db_path)
-    req_cols = list(set(raw_cols + ['Label']))
-    sql = f"SELECT {', '.join(req_cols)} FROM PeData"
+                except Exception:
+                    pass
+
+    base_schema = sorted([k for k in base_keys if k.lower().strip() not in EXCLUDE_FEATURES])
+    dll_schema = [f"DllHash_{i:03d}" for i in range(DLL_HASH_DIM)]
+    api_schema = [f"ApiHash_{i:04d}" for i in range(API_HASH_DIM)]
     
-    try:
-        chunks = []
-        for chunk in pd.read_sql_query(sql, conn, chunksize=20000):
-            label_col = next((c for c in chunk.columns if c.lower().strip() == 'label'), None)
-            if not label_col:
-                print("[-] Critical Error: Label column not found.")
-                return None, None, None
-
-            cols_to_cast = [c for c in chunk.columns if c != label_col]
-            chunk[cols_to_cast] = chunk[cols_to_cast].astype(np.float32)
-            chunk[label_col] = chunk[label_col].astype(np.int8)
-            chunks.append(chunk)
-
-        if not chunks:
-            return None, None, None
-
-        df = pd.concat(chunks, ignore_index=True)
-
-        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
-        y = df[label_col].astype(int)
-        X = df.drop(columns=[label_col], errors='ignore')
-        
-        valid_features = [c for c in raw_cols if c in X.columns]
-        X = X[valid_features].copy()
-        
-        rename_map = {old: clean_col_name(old) for old in X.columns}
-        X = X.rename(columns=rename_map)
-        
-        if X.columns.duplicated().any():
-            print("[-] Warning: Duplicate column names detected after cleaning. Deduplicating...")
-            X = X.loc[:, ~X.columns.duplicated()]
-
-        final_features = X.columns.tolist()
-        return X, y, final_features
-    finally:
-        conn.close()
+    return base_schema, dll_schema, api_schema, num_lines
 
 ####################################################################################################
 
-def train_process(X, y):
+def load_data_efficiently(jsonl_path, base_schema, dll_schema, api_schema, num_lines):
+    print(f"[*] Stage 2: Building sparse feature matrix dynamically via Multiprocessing...")
+    final_features = base_schema + dll_schema + api_schema
+
+    num_features = len(final_features)
+    offset_dll = len(base_schema)
+    offset_api = offset_dll + DLL_HASH_DIM
+
+    file_size = os.path.getsize(jsonl_path)
+    workers = min(os.cpu_count() or 4, 16)
+    chunk_size = file_size // workers
+    
+    tasks = []
+    for i in range(workers):
+        start = i * chunk_size
+        end = file_size if i == workers - 1 else (i + 1) * chunk_size
+        tasks.append((jsonl_path, start, end, base_schema, num_features, offset_dll, offset_api))
+        
+    with multiprocessing.Pool(workers) as pool:
+        results = pool.map(_chunk_worker, tasks)
+        
+    Xs = [r[0] for r in results if r[0].shape[0] > 0]
+    ys = [r[1] for r in results if r[1].shape[0] > 0]
+    
+    X_final = sp.vstack(Xs, format='csr') if Xs else sp.csr_matrix((0, num_features), dtype=np.float32)
+    y_final = np.concatenate(ys) if ys else np.array([], dtype=np.int8)
+    
+    return X_final, pd.Series(y_final), final_features
+
+def _chunk_worker(args):
+    filepath, start_byte, end_byte, base_schema, num_features, offset_dll, offset_api = args
+    
+    base_idx = {feat: i for i, feat in enumerate(base_schema)}
+    base_idx_get = base_idx.get
+    
+    rows = array.array('i')
+    cols = array.array('i')
+    vals = array.array('f')
+    y_list = array.array('b')
+    
+    with open(filepath, 'rb') as f:
+        if start_byte > 0:
+            f.seek(start_byte - 1)
+            if f.read(1) != b'\n':
+                f.seek(start_byte)
+                f.readline()
+
+            else:
+                f.seek(start_byte)
+        else:
+            f.seek(0)
+            
+        row_idx = 0
+        while f.tell() < end_byte:
+            line = f.readline()
+            if not line:
+                break
+                
+            try:
+                data = JSON_LOADS(line)
+                y_list.append(data.get('Label', 0))
+
+                base_data = data.get('Base')
+                if base_data:
+                    for k, v in base_data.items():
+                        idx = base_idx_get(k)
+                        if idx is not None:
+                            val = float(v)
+                            if val != 0.0:
+                                rows.append(row_idx)
+                                cols.append(idx)
+                                vals.append(val)
+
+                dll_data = data.get('DLLs')
+                if dll_data:
+                    for d in dll_data:
+                        idx = zlib.crc32(d.encode('utf-8', 'ignore')) % DLL_HASH_DIM
+                        rows.append(row_idx)
+                        cols.append(offset_dll + idx)
+                        vals.append(1.0)
+
+                api_data = data.get('APIs')
+                if api_data:
+                    for a in api_data:
+                        idx = zlib.crc32(a.encode('utf-8', 'ignore')) % API_HASH_DIM
+                        rows.append(row_idx)
+                        cols.append(offset_api + idx)
+                        vals.append(1.0)
+
+                row_idx += 1
+            except Exception:
+                continue
+                
+    y_arr = np.frombuffer(y_list, dtype=np.int8)
+    np_rows = np.frombuffer(rows, dtype=np.int32)
+    np_cols = np.frombuffer(cols, dtype=np.int32)
+    np_vals = np.frombuffer(vals, dtype=np.float32)
+    
+    X_local = sp.csr_matrix((np_vals, (np_rows, np_cols)), shape=(row_idx, num_features), dtype=np.float32)
+    
+    return X_local, y_arr
+
+####################################################################################################
+
+def _calculate_dynamic_lr(current_iter: int) -> float:
+    return max(0.01, 0.1 - (current_iter // 80) * 0.01)
+
+def train_process(X, y, feature_names):
     print(f"[*] Dataset shape: {X.shape}")
     
-    X_train, X_test, y_train, y_test = train_test_split(
-        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
-    )
+    X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y)
     
     n_pos = (y_train == 1).sum()
     n_neg = (y_train == 0).sum()
@@ -117,11 +195,11 @@ def train_process(X, y):
     weight_ratio_target = 0.005
     final_pos_weight = base_weight * weight_ratio_target
     
-    print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
-    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted={final_pos_weight:.4f}")
+    print(f"[*] Sample distribution: Safe={n_neg}, Malware={n_pos}")
+    print(f"[*] Weight correction: Base={base_weight:.4f}, Final={final_pos_weight:.4f}")
     
-    train_data = lgb.Dataset(X_train, label=y_train)
-    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data)
+    train_data = lgb.Dataset(X_train, label=y_train, feature_name=feature_names)
+    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data, feature_name=feature_names)
     
     params = LGBM_PARAMS.copy()
     params['scale_pos_weight'] = final_pos_weight
@@ -133,14 +211,15 @@ def train_process(X, y):
         params,
         train_data,
         valid_sets=[valid_data],
-        num_boost_round=1000,
+        num_boost_round=500,
         callbacks=[
-            lgb.log_evaluation(period=100)
+            lgb.log_evaluation(period=50),
+            lgb.reset_parameter(learning_rate=_calculate_dynamic_lr)
         ]
     )
     
     elapsed = time.time() - start_time
-    print(f"\n[+] Training finished in {elapsed:.2f}s")
+    print(f"\n[+] Training complete, time elapsed {elapsed:.2f} seconds")
     
     return model, X_test, y_test
 
@@ -156,12 +235,10 @@ def export_onnx_model(model, feature_names):
         with open(FEATURE_FILE, 'w') as f:
             json.dump(feature_names, f)
             
-        print(f"[+] ONNX export success. Features synced to {FEATURE_FILE}")
+        print(f"[+] ONNX export successful. Feature order saved to {FEATURE_FILE}")
     except Exception as e:
         print(f"[-] ONNX export failed: {e}")
 
-####################################################################################################
-
 def evaluate_and_save(model, X_test, y_test):
     print("\n------------------- Evaluation Report -------------------\n")
     y_prob = model.predict(X_test, num_iteration=model.best_iteration)
@@ -181,14 +258,14 @@ def evaluate_and_save(model, X_test, y_test):
     detection_rate = (tp / total_malware * 100) if total_malware > 0 else 0.0
     fpr = (fp / total_safe * 100) if total_safe > 0 else 0.0
     
-    print(f"Accuracy : {acc:.4f}")
-    print(f"ROC AUC  : {auc:.4f}\n")
+    print(f"Accuracy : {acc:.6f}")
+    print(f"ROC AUC  : {auc:.6f}\n")
     
     print(f"True Positive (Class 1) : {detection_rate:.3f}% ({tp}/{total_malware})")
     print(f"False Positive (Class 0) : {fpr:.3f}% ({fp}/{total_safe})")
 
     print("\n---------------------------------------------------------\n")
-    print("[*] Top 20 Features (Importance by Gain):")
+    print("[*] Top 20 Features:")
     
     feature_names = model.feature_name()
     importance = model.feature_importance(importance_type='gain')
@@ -205,25 +282,29 @@ def evaluate_and_save(model, X_test, y_test):
 ####################################################################################################
 
 if __name__ == "__main__":
-    print("\n---------------- PE Malware Trainer v3.1 ----------------\n")
+    multiprocessing.freeze_support()
+    print("\n---------------- PE Malware Trainer v4.0 ----------------\n")
 
-    if not os.path.exists(DB_PATH):
-        print(f"[-] Error: Database {DB_PATH} not found.")
+    if not os.path.exists(JSONL_PATH):
+        print(f"[-] Error: Feature file {JSONL_PATH} not found.")
         sys.exit(1)
 
-    raw_schema = get_raw_schema(DB_PATH)
-    if not raw_schema:
-        print("[-] Error: Could not read schema.")
+    base_schema, dll_schema, api_schema, num_lines = analyze_schema(JSONL_PATH)
+    if num_lines == 0:
+        print("[-] Error: Feature file is empty.")
         sys.exit(1)
 
-    X, y, _ = load_data(DB_PATH, raw_schema)
-    if X is None:
-        sys.exit(1)
+    print(f"[*] Detected Base features: {len(base_schema)}")
+    print(f"[*] Hashing DLL features: {len(dll_schema)}")
+    print(f"[*] Hashing API features: {len(api_schema)}")
 
+    X, y, final_features = load_data_efficiently(JSONL_PATH, base_schema, dll_schema, api_schema, num_lines)
+    
     try:
-        model, X_test, y_test = train_process(X, y)
+        model, X_test, y_test = train_process(X, y, final_features)
         evaluate_and_save(model, X_test, y_test)
+
     except KeyboardInterrupt:
-        print("\n\n[-] Training interrupted.")
+        print("\n\n[-] Training aborted.")
     except Exception as e:
-        print(f"\n[-] Critical Error: {e}")
+        print(f"\n[-] System exception: {e}")

Engine/Properties/train_server_lfp.py

@@ -1,216 +0,0 @@
-import os, sys, time, sqlite3, re, json
-import pandas as pd
-import numpy as np
-import lightgbm as lgb
-import onnxmltools
-
-from onnxmltools.convert.common.data_types import FloatTensorType
-from sklearn.model_selection import train_test_split
-from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
-
-####################################################################################################
-
-DB_PATH = "pe_features.db"
-MODEL_FILE = "model.txt"
-ONNX_FILE = "model.onnx"
-FEATURE_FILE = "features.json"
-TEST_SIZE = 0.0001
-RANDOM_SEED = 42
-
-LGBM_PARAMS = {
-    'objective': 'binary',
-    'metric': ['binary_logloss', 'auc'],
-    'boosting_type': 'gbdt',
-    'num_leaves': 512,
-    'learning_rate': 0.05,
-    'feature_fraction': 0.8,
-    'bagging_fraction': 0.8,
-    'bagging_freq': 5,
-    'verbose': -1,
-    'seed': RANDOM_SEED,
-    'n_jobs': -1,
-    'max_depth': -1,
-    'min_data_in_leaf': 10,
-    'lambda_l1': 0.1,
-    'lambda_l2': 0.1,
-}
-
-####################################################################################################
-
-def clean_col_name(name):
-    return re.sub(r'[^A-Za-z0-9_]+', '', name)
-
-def get_raw_schema(db_path):
-    if not os.path.exists(db_path):
-        return None
-    conn = sqlite3.connect(db_path)
-    try:
-        cursor = conn.cursor()
-        cursor.execute("PRAGMA table_info(PeData)")
-        columns = [row[1] for row in cursor.fetchall()]
-        exclude = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score', 'filehash', 'timedatestamp'}
-        return [c for c in columns if c.lower().strip() not in exclude]
-    except Exception as e:
-        print(f"[-] Schema extraction error: {e}")
-        return None
-    finally:
-        conn.close()
-
-####################################################################################################
-
-def load_data(db_path, raw_cols):
-    print(f"[*] Connecting to database: {db_path}")
-    conn = sqlite3.connect(db_path)
-    req_cols = list(set(raw_cols + ['Label']))
-    sql = f"SELECT {', '.join(req_cols)} FROM PeData"
-    
-    try:
-        chunks = []
-        for chunk in pd.read_sql_query(sql, conn, chunksize=20000):
-            label_col = next((c for c in chunk.columns if c.lower().strip() == 'label'), None)
-            if not label_col:
-                print("[-] Critical Error: Label column not found.")
-                return None, None, None
-
-            cols_to_cast = [c for c in chunk.columns if c != label_col]
-            chunk[cols_to_cast] = chunk[cols_to_cast].astype(np.float32)
-            chunk[label_col] = chunk[label_col].astype(np.int8)
-            chunks.append(chunk)
-
-        if not chunks:
-            return None, None, None
-
-        df = pd.concat(chunks, ignore_index=True)
-
-        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
-        y = df[label_col].astype(int)
-        X = df.drop(columns=[label_col], errors='ignore')
-        
-        valid_features = [c for c in raw_cols if c in X.columns]
-        X = X[valid_features].copy()
-        
-        rename_map = {old: clean_col_name(old) for old in X.columns}
-        X = X.rename(columns=rename_map)
-        
-        if X.columns.duplicated().any():
-            print("[-] Warning: Duplicate column names detected after cleaning. Deduplicating...")
-            X = X.loc[:, ~X.columns.duplicated()]
-
-        final_features = X.columns.tolist()
-        return X, y, final_features
-    finally:
-        conn.close()
-
-####################################################################################################
-
-def train_process(X, y):
-    print(f"[*] Dataset shape: {X.shape}")
-    
-    X_train, X_test, y_train, y_test = train_test_split(
-        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
-    )
-    
-    n_pos = (y_train == 1).sum()
-    n_neg = (y_train == 0).sum()
-    
-    base_weight = n_neg / n_pos if n_pos > 0 else 1.0
-    weight_ratio_target = 0.001
-    final_pos_weight = base_weight * weight_ratio_target
-    
-    print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
-    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted={final_pos_weight:.4f}")
-    
-    train_data = lgb.Dataset(X_train, label=y_train)
-    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data)
-    
-    params = LGBM_PARAMS.copy()
-    params['scale_pos_weight'] = final_pos_weight
-
-    print("\n[*] Starting LightGBM training...")
-    start_time = time.time()
-    
-    model = lgb.train(
-        params,
-        train_data,
-        valid_sets=[valid_data],
-        num_boost_round=1000,
-        callbacks=[
-            lgb.log_evaluation(period=100)
-        ]
-    )
-    
-    elapsed = time.time() - start_time
-    print(f"\n[+] Training finished in {elapsed:.2f}s")
-    
-    return model, X_test, y_test
-
-####################################################################################################
-
-def export_onnx_model(model, feature_names):
-    print(f"[*] Exporting ONNX model to {ONNX_FILE}...")
-    try:
-        initial_type = [('float_input', FloatTensorType([None, len(feature_names)]))]
-        onnx_model = onnxmltools.convert_lightgbm(model, initial_types=initial_type)
-        onnxmltools.utils.save_model(onnx_model, ONNX_FILE)
-        
-        with open(FEATURE_FILE, 'w') as f:
-            json.dump(feature_names, f)
-            
-        print(f"[+] ONNX export success. Features synced to {FEATURE_FILE}")
-    except Exception as e:
-        print(f"[-] ONNX export failed: {e}")
-
-####################################################################################################
-
-def evaluate_and_save(model, X_test, y_test):
-    print("\n------------------- Evaluation Report -------------------\n")
-    y_prob = model.predict(X_test, num_iteration=model.best_iteration)
-    y_pred = (y_prob > 0.5).astype(int)
-    
-    acc = accuracy_score(y_test, y_pred)
-    auc = roc_auc_score(y_test, y_prob)
-    
-    print(f"Accuracy : {acc:.4f}")
-    print(f"ROC AUC  : {auc:.4f}")
-    print("\n" + classification_report(y_test, y_pred, zero_division=0))
-
-    print("---------------------------------------------------------\n")
-    print("[*] Top 20 Features (Importance by Gain):")
-    
-    feature_names = model.feature_name()
-    importance = model.feature_importance(importance_type='gain')
-    feature_imp = pd.DataFrame(sorted(zip(importance, feature_names), reverse=True), columns=['Value', 'Feature'])
-    print(feature_imp.head(20).to_string(index=False))
-    
-    print("\n---------------------------------------------------------\n")
-    
-    model.save_model(MODEL_FILE)
-    print(f"[+] Native model saved to: {os.path.abspath(MODEL_FILE)}")
-    
-    export_onnx_model(model, feature_names)
-
-####################################################################################################
-
-if __name__ == "__main__":
-    print("\n---------------- PE Malware Trainer v3.1 ----------------\n")
-
-    if not os.path.exists(DB_PATH):
-        print(f"[-] Error: Database {DB_PATH} not found.")
-        sys.exit(1)
-
-    raw_schema = get_raw_schema(DB_PATH)
-    if not raw_schema:
-        print("[-] Error: Could not read schema.")
-        sys.exit(1)
-
-    X, y, _ = load_data(DB_PATH, raw_schema)
-    if X is None:
-        sys.exit(1)
-
-    try:
-        model, X_test, y_test = train_process(X, y)
-        evaluate_and_save(model, X_test, y_test)
-    except KeyboardInterrupt:
-        print("\n\n[-] Training interrupted.")
-    except Exception as e:
-        print(f"\n[-] Critical Error: {e}")

Engine/Properties/train_user.py

@@ -1,114 +1,192 @@
-import os, sys, time, sqlite3, re, json
-import pandas as pd
+import os, sys, time, json, zlib, array, onnxmltools, multiprocessing
 import numpy as np
+import pandas as pd
 import lightgbm as lgb
-import onnxmltools
+import scipy.sparse as sp
 
+from collections import defaultdict
 from onnxmltools.convert.common.data_types import FloatTensorType
 from sklearn.model_selection import train_test_split
-from sklearn.metrics import classification_report, accuracy_score, roc_auc_score
+from sklearn.metrics import accuracy_score, roc_auc_score
+
+try:
+    import orjson
+    JSON_LOADS = orjson.loads
+
+except ImportError:
+    JSON_LOADS = json.loads
 
 ####################################################################################################
 
-DB_PATH = "pe_features.db"
+JSONL_PATH = "pe_features.jsonl"
 MODEL_FILE = "model.txt"
 ONNX_FILE = "Pefile_General_T1.onnx"
 FEATURE_FILE = "features.json"
-TEST_SIZE = 0.1
+
+TEST_SIZE = 0.0001
 RANDOM_SEED = 42
+DLL_HASH_DIM = 256
+API_HASH_DIM = 1024
+
+EXCLUDE_FEATURES = {
+    'label', 'filehash',
+}
 
 LGBM_PARAMS = {
     'objective': 'binary',
     'metric': ['binary_logloss', 'auc'],
     'boosting_type': 'gbdt',
-    'num_leaves': 64,
-    'learning_rate': 0.05,
+    'num_leaves': 128,
     'feature_fraction': 0.8,
-    'bagging_fraction': 0.8,
+    'bagging_fraction': 1.0,
     'bagging_freq': 5,
     'verbose': -1,
     'seed': RANDOM_SEED,
     'n_jobs': -1,
     'max_depth': -1,
-    'min_data_in_leaf': 10,
-    'lambda_l1': 0.05,
-    'lambda_l2': 0.05,
+    'min_data_in_leaf': 50,
 }
 
 ####################################################################################################
 
-def clean_col_name(name):
-    return re.sub(r'[^A-Za-z0-9_]+', '', name)
+def analyze_schema(jsonl_path):
+    print("[*] Stage 1: Scanning global schema...")
+    base_keys = set()
+    num_lines = 0
 
-def get_raw_schema(db_path):
-    if not os.path.exists(db_path):
-        return None
-    conn = sqlite3.connect(db_path)
-    try:
-        cursor = conn.cursor()
-        cursor.execute("PRAGMA table_info(PeData)")
-        columns = [row[1] for row in cursor.fetchall()]
-        exclude = {'label', 'id', 'filename', 'filelength', 'rowid', 'probability', 'predictedlabel', 'score', 'filehash', 'timedatestamp'}
-        return [c for c in columns if c.lower().strip() not in exclude]
-    except Exception as e:
-        print(f"[-] Schema extraction error: {e}")
-        return None
-    finally:
-        conn.close()
+    with open(jsonl_path, 'rb') as f:
+        for line in f:
+            num_lines += 1
 
-####################################################################################################
+            if not base_keys:
+                try:
+                    data = JSON_LOADS(line)
+                    base_data = data.get('Base')
+                    if base_data:
+                        base_keys.update(base_data.keys())
 
-def load_data(db_path, raw_cols):
-    print(f"[*] Connecting to database: {db_path}")
-    conn = sqlite3.connect(db_path)
-    req_cols = list(set(raw_cols + ['Label']))
-    sql = f"SELECT {', '.join(req_cols)} FROM PeData"
+                except Exception:
+                    pass
+
+    base_schema = sorted([k for k in base_keys if k.lower().strip() not in EXCLUDE_FEATURES])
+    dll_schema = [f"DllHash_{i:03d}" for i in range(DLL_HASH_DIM)]
+    api_schema = [f"ApiHash_{i:04d}" for i in range(API_HASH_DIM)]
     
-    try:
-        chunks = []
-        for chunk in pd.read_sql_query(sql, conn, chunksize=20000):
-            label_col = next((c for c in chunk.columns if c.lower().strip() == 'label'), None)
-            if not label_col:
-                print("[-] Critical Error: Label column not found.")
-                return None, None, None
-
-            cols_to_cast = [c for c in chunk.columns if c != label_col]
-            chunk[cols_to_cast] = chunk[cols_to_cast].astype(np.float32)
-            chunk[label_col] = chunk[label_col].astype(np.int8)
-            chunks.append(chunk)
-
-        if not chunks:
-            return None, None, None
-
-        df = pd.concat(chunks, ignore_index=True)
-
-        label_col = next((c for c in df.columns if c.lower().strip() == 'label'), None)
-        y = df[label_col].astype(int)
-        X = df.drop(columns=[label_col], errors='ignore')
-        
-        valid_features = [c for c in raw_cols if c in X.columns]
-        X = X[valid_features].copy()
-        
-        rename_map = {old: clean_col_name(old) for old in X.columns}
-        X = X.rename(columns=rename_map)
-        
-        if X.columns.duplicated().any():
-            print("[-] Warning: Duplicate column names detected after cleaning. Deduplicating...")
-            X = X.loc[:, ~X.columns.duplicated()]
-
-        final_features = X.columns.tolist()
-        return X, y, final_features
-    finally:
-        conn.close()
+    return base_schema, dll_schema, api_schema, num_lines
 
 ####################################################################################################
 
-def train_process(X, y):
+def load_data_efficiently(jsonl_path, base_schema, dll_schema, api_schema, num_lines):
+    print(f"[*] Stage 2: Building sparse feature matrix dynamically via Multiprocessing...")
+    final_features = base_schema + dll_schema + api_schema
+
+    num_features = len(final_features)
+    offset_dll = len(base_schema)
+    offset_api = offset_dll + DLL_HASH_DIM
+
+    file_size = os.path.getsize(jsonl_path)
+    workers = min(os.cpu_count() or 4, 16)
+    chunk_size = file_size // workers
+    
+    tasks = []
+    for i in range(workers):
+        start = i * chunk_size
+        end = file_size if i == workers - 1 else (i + 1) * chunk_size
+        tasks.append((jsonl_path, start, end, base_schema, num_features, offset_dll, offset_api))
+        
+    with multiprocessing.Pool(workers) as pool:
+        results = pool.map(_chunk_worker, tasks)
+        
+    Xs = [r[0] for r in results if r[0].shape[0] > 0]
+    ys = [r[1] for r in results if r[1].shape[0] > 0]
+    
+    X_final = sp.vstack(Xs, format='csr') if Xs else sp.csr_matrix((0, num_features), dtype=np.float32)
+    y_final = np.concatenate(ys) if ys else np.array([], dtype=np.int8)
+    
+    return X_final, pd.Series(y_final), final_features
+
+def _chunk_worker(args):
+    filepath, start_byte, end_byte, base_schema, num_features, offset_dll, offset_api = args
+    
+    base_idx = {feat: i for i, feat in enumerate(base_schema)}
+    base_idx_get = base_idx.get
+    
+    rows = array.array('i')
+    cols = array.array('i')
+    vals = array.array('f')
+    y_list = array.array('b')
+    
+    with open(filepath, 'rb') as f:
+        if start_byte > 0:
+            f.seek(start_byte - 1)
+            if f.read(1) != b'\n':
+                f.seek(start_byte)
+                f.readline()
+
+            else:
+                f.seek(start_byte)
+        else:
+            f.seek(0)
+            
+        row_idx = 0
+        while f.tell() < end_byte:
+            line = f.readline()
+            if not line:
+                break
+                
+            try:
+                data = JSON_LOADS(line)
+                y_list.append(data.get('Label', 0))
+
+                base_data = data.get('Base')
+                if base_data:
+                    for k, v in base_data.items():
+                        idx = base_idx_get(k)
+                        if idx is not None:
+                            val = float(v)
+                            if val != 0.0:
+                                rows.append(row_idx)
+                                cols.append(idx)
+                                vals.append(val)
+
+                dll_data = data.get('DLLs')
+                if dll_data:
+                    for d in dll_data:
+                        idx = zlib.crc32(d.encode('utf-8', 'ignore')) % DLL_HASH_DIM
+                        rows.append(row_idx)
+                        cols.append(offset_dll + idx)
+                        vals.append(1.0)
+
+                api_data = data.get('APIs')
+                if api_data:
+                    for a in api_data:
+                        idx = zlib.crc32(a.encode('utf-8', 'ignore')) % API_HASH_DIM
+                        rows.append(row_idx)
+                        cols.append(offset_api + idx)
+                        vals.append(1.0)
+
+                row_idx += 1
+            except Exception:
+                continue
+                
+    y_arr = np.frombuffer(y_list, dtype=np.int8)
+    np_rows = np.frombuffer(rows, dtype=np.int32)
+    np_cols = np.frombuffer(cols, dtype=np.int32)
+    np_vals = np.frombuffer(vals, dtype=np.float32)
+    
+    X_local = sp.csr_matrix((np_vals, (np_rows, np_cols)), shape=(row_idx, num_features), dtype=np.float32)
+    
+    return X_local, y_arr
+
+####################################################################################################
+
+def _calculate_dynamic_lr(current_iter: int) -> float:
+    return max(0.01, 0.1 - (current_iter // 80) * 0.01)
+
+def train_process(X, y, feature_names):
     print(f"[*] Dataset shape: {X.shape}")
     
-    X_train, X_test, y_train, y_test = train_test_split(
-        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
-    )
+    X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y)
     
     n_pos = (y_train == 1).sum()
     n_neg = (y_train == 0).sum()
@@ -117,11 +195,11 @@ def train_process(X, y):
     weight_ratio_target = 0.001
     final_pos_weight = base_weight * weight_ratio_target
     
-    print(f"[*] Balance Report: Safe={n_neg}, Malware={n_pos}")
-    print(f"[*] Weight Config: Base Balanced={base_weight:.4f}, Final Adjusted={final_pos_weight:.4f}")
+    print(f"[*] Sample distribution: Safe={n_neg}, Malware={n_pos}")
+    print(f"[*] Weight correction: Base={base_weight:.4f}, Final={final_pos_weight:.4f}")
     
-    train_data = lgb.Dataset(X_train, label=y_train)
-    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data)
+    train_data = lgb.Dataset(X_train, label=y_train, feature_name=feature_names)
+    valid_data = lgb.Dataset(X_test, label=y_test, reference=train_data, feature_name=feature_names)
     
     params = LGBM_PARAMS.copy()
     params['scale_pos_weight'] = final_pos_weight
@@ -133,14 +211,15 @@ def train_process(X, y):
         params,
         train_data,
         valid_sets=[valid_data],
-        num_boost_round=1000,
+        num_boost_round=300,
         callbacks=[
-            lgb.log_evaluation(period=100)
+            lgb.log_evaluation(period=50),
+            lgb.reset_parameter(learning_rate=_calculate_dynamic_lr)
         ]
     )
     
     elapsed = time.time() - start_time
-    print(f"\n[+] Training finished in {elapsed:.2f}s")
+    print(f"\n[+] Training complete, time elapsed {elapsed:.2f} seconds")
     
     return model, X_test, y_test
 
@@ -156,12 +235,10 @@ def export_onnx_model(model, feature_names):
         with open(FEATURE_FILE, 'w') as f:
             json.dump(feature_names, f)
             
-        print(f"[+] ONNX export success. Features synced to {FEATURE_FILE}")
+        print(f"[+] ONNX export successful. Feature order saved to {FEATURE_FILE}")
     except Exception as e:
         print(f"[-] ONNX export failed: {e}")
 
-####################################################################################################
-
 def evaluate_and_save(model, X_test, y_test):
     print("\n------------------- Evaluation Report -------------------\n")
     y_prob = model.predict(X_test, num_iteration=model.best_iteration)
@@ -181,14 +258,14 @@ def evaluate_and_save(model, X_test, y_test):
     detection_rate = (tp / total_malware * 100) if total_malware > 0 else 0.0
     fpr = (fp / total_safe * 100) if total_safe > 0 else 0.0
     
-    print(f"Accuracy : {acc:.4f}")
-    print(f"ROC AUC  : {auc:.4f}\n")
+    print(f"Accuracy : {acc:.6f}")
+    print(f"ROC AUC  : {auc:.6f}\n")
     
     print(f"True Positive (Class 1) : {detection_rate:.3f}% ({tp}/{total_malware})")
     print(f"False Positive (Class 0) : {fpr:.3f}% ({fp}/{total_safe})")
 
     print("\n---------------------------------------------------------\n")
-    print("[*] Top 20 Features (Importance by Gain):")
+    print("[*] Top 20 Features:")
     
     feature_names = model.feature_name()
     importance = model.feature_importance(importance_type='gain')
@@ -205,25 +282,29 @@ def evaluate_and_save(model, X_test, y_test):
 ####################################################################################################
 
 if __name__ == "__main__":
-    print("\n---------------- PE Malware Trainer v3.1 ----------------\n")
+    multiprocessing.freeze_support()
+    print("\n---------------- PE Malware Trainer v4.0 ----------------\n")
 
-    if not os.path.exists(DB_PATH):
-        print(f"[-] Error: Database {DB_PATH} not found.")
+    if not os.path.exists(JSONL_PATH):
+        print(f"[-] Error: Feature file {JSONL_PATH} not found.")
         sys.exit(1)
 
-    raw_schema = get_raw_schema(DB_PATH)
-    if not raw_schema:
-        print("[-] Error: Could not read schema.")
+    base_schema, dll_schema, api_schema, num_lines = analyze_schema(JSONL_PATH)
+    if num_lines == 0:
+        print("[-] Error: Feature file is empty.")
         sys.exit(1)
 
-    X, y, _ = load_data(DB_PATH, raw_schema)
-    if X is None:
-        sys.exit(1)
+    print(f"[*] Detected Base features: {len(base_schema)}")
+    print(f"[*] Hashing DLL features: {len(dll_schema)}")
+    print(f"[*] Hashing API features: {len(api_schema)}")
 
+    X, y, final_features = load_data_efficiently(JSONL_PATH, base_schema, dll_schema, api_schema, num_lines)
+    
     try:
-        model, X_test, y_test = train_process(X, y)
+        model, X_test, y_test = train_process(X, y, final_features)
         evaluate_and_save(model, X_test, y_test)
+
     except KeyboardInterrupt:
-        print("\n\n[-] Training interrupted.")
+        print("\n\n[-] Training aborted.")
     except Exception as e:
-        print(f"\n[-] Critical Error: {e}")
+        print(f"\n[-] System exception: {e}")

Interface/static/css/style.css

@@ -56,7 +56,7 @@ body {
 }
 
 .navigate-title {
-    font-size: 16px;
+    font-size: 17px;
     font-weight: 600;
     letter-spacing: -0.2px;
 }
@@ -797,6 +797,44 @@ body.resizing-active * {
     color: var(--text-primary);
 }
 
+.custom-context-menu {
+    position: absolute;
+    z-index: 10000;
+    background-color: var(--bg-panel);
+    border: 1px solid var(--border-color);
+    border-radius: 8px;
+    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);
+    padding: 4px;
+    display: none;
+    min-width: 160px;
+}
+
+.custom-context-menu.show {
+    display: block;
+}
+
+.custom-context-menu-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 8px 12px;
+    border-radius: 6px;
+    cursor: pointer;
+    font-size: 13px;
+    color: var(--text-primary);
+    transition: background-color 0.2s;
+}
+
+.custom-context-menu-item:hover {
+    background-color: var(--bg-hover);
+}
+
+.custom-context-menu-item svg {
+    width: 16px;
+    height: 16px;
+    color: var(--text-secondary);
+}
+
 ::-webkit-scrollbar { width: 6px; height: 6px; }
 ::-webkit-scrollbar-track { background: transparent; }
 ::-webkit-scrollbar-thumb { background: var(--border-color); border-radius: 10px; }

Interface/templates/index.html

@@ -109,6 +109,12 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>進程暫停</h2><p data-i18n>此選項可以暫停進程等待掃描</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>檔案防護</h2><p data-i18n>此選項可以隔離惡意檔案建立</p>
@@ -150,6 +156,12 @@
                             </div>
                             <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
                         </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="startup_window">
+                            <div class="item-info">
+                                <h2 data-i18n>啟動項管理</h2><p data-i18n>此選項可以管理各應用啟動項</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
                         <div class="list-item" style="cursor: pointer;" data-target="junk_window">
                             <div class="item-info">
                                 <h2 data-i18n>垃圾清理</h2><p data-i18n>此選項可以清理暫存垃圾檔案</p>
@@ -158,7 +170,7 @@
                         </div>
                         <div class="list-item" style="cursor: pointer;" data-target="repair_window">
                             <div class="item-info">
-                                <h2 data-i18n>系統修復</h2><p data-i18n>此選項可以修復系統註冊項目</p>
+                                <h2 data-i18n>系統修復</h2><p data-i18n>此選項可以修復系統登錄檔項目</p>
                             </div>
                             <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
                         </div>
@@ -168,6 +180,12 @@
                             </div>
                             <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
                         </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="netmon_window">
+                            <div class="item-info">
+                                <h2 data-i18n>流量監控</h2><p data-i18n>此選項可以實時監控網路流量</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
                         <div class="list-item" style="cursor: pointer;" data-target="whitelist_window">
                             <div class="item-info">
                                 <h2 data-i18n>白名單</h2><p data-i18n>此選項可以查看並管理白名單</p>
@@ -203,6 +221,12 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>開機啟動</h2><p data-i18n>此選項可以設定開機自動執行</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>選單掃描</h2><p data-i18n>此選項可以啟用右鍵掃描功能</p>
@@ -214,6 +238,7 @@
                                 <h2 data-i18n>顯色主題</h2><p data-i18n>此選項可以選擇主題顏色</p>
                             </div>
                             <select id="theme_select" class="modern-select">
+                                <option value="system_switch" selected data-i18n>跟隨系統</option>
                                 <option value="white_switch" data-i18n>白色主題</option>
                                 <option value="red_switch" data-i18n>紅色主題</option>
                                 <option value="yellow_switch" data-i18n>黃色主題</option>
@@ -271,34 +296,64 @@
                         </div>
                         <div class="license-widget">
                             <textarea class="license-text" readonly>87owo Publicly Available Source Code License Agreement
-Last updated: 2025-12-19
 
-1. License and Ownership
-   - This software and its source code are source available for public view.
-   - Access or execution of certain features may require an activation key.
-   - 87owo reserves all legal rights, no intellectual property is transferred.
-   - All project archives, source code, and binaries remain fully proprietary.
+Last Updated: 2026-06-09
+IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
-2. Use and Prohibitions
-   - You may view, download, and modify the code for local and personal use.
-   - Redistribution of any original or modified code requires prior consent.
-   - Commercial hosting or SaaS deployment is prohibited without permission.
-   - Reverse engineering, license removal, or illegal use is strictly barred.
+1. Definitions and Interpretation
 
-3. Data and Privacy
-   - This project may collect operational data for optimization and analysis.
-   - All collected data is strictly anonymized to ensure the user's privacy.
-   - Transmission of information is encrypted to prevent unauthorized access.
+   - 1.1. Author: Refers to 87owo (PYAS Security).
+   - 1.2. Software: Refers to the source code, binaries, project archives, assets, and documentation associated with this repository or distribution.
+   - 1.3. Personal Local Use: Means viewing, downloading, executing, and modifying the Software strictly on local hardware owned or directly controlled by an individual for private, non-commercial, non-production, and non-distribution purposes.
+   - 1.4. Enterprise Use: Includes enterprise internal deployment, multi-user institutional use, or utilization within any corporate environment, which is strictly excluded from Personal Local Use.
 
-4. Updates and Terms
-   - New releases may include critical patches, enhancements, or UI changes.
-   - Continued use of these services constitutes acceptance of updated terms.
-   - The author reserves the right to modify these license terms at any time.
+2. Intellectual Property and Ownership
 
-5. Warranty and Liability
-   - All services and assets are provided "as is" without any form of warranty.
-   - 87owo is not liable for any direct or indirect damages from software use.
-   - Users assume all risks regarding performance, data, and system integrity.
+   - 2.1. Retention of Rights: The Author reserves all legal rights, titles, and interests in and to the Software, including but not limited to all copyrights, trademarks, patents, and trade secrets.
+   - 2.2. No Transfer: No intellectual property rights or ownership stakes are transferred under this Agreement. All project components remain fully proprietary.
+   - 2.3. Activation Keys: Access to or execution of certain premium features, modules, or binary distributions within the Software may require a valid, authorized activation key issued solely by the Author.
+
+3. Grant of License and Permitted Use
+
+   Subject to your strict compliance with all terms of this Agreement, the Author hereby grants you a limited, non-exclusive, world-wide, royalty-free, revocable, and non-transferable license to:
+   - 3.1. Code Inspection: View and download the source code from official authorized repositories.
+   - 3.2. Local Modification: Modify the source code strictly for the purposes of Personal Local Use.
+   - 3.3. Local Execution: Execute the Software locally for personal evaluation and private deployment.
+
+4. Prohibitions and Restrictions
+
+   Except as explicitly granted in Section 3, you shall not, and shall not permit any third party to:
+   - 4.1. Unauthorized Redistribution: Copy, redistribute, sublicense, republish, mirror, or publicly disclose any original or modified versions of the source code, binaries, or assets.
+   - 4.2. Commercial and SaaS Deployment: Host, deploy, embed, or utilize the Software for commercial purposes, including but not limited to Software-as-a-Service (SaaS), commercial web hosting, paid remote execution, cloud infrastructure integration, or enterprise internal utility.
+   - 4.3. Reverse Engineering: Reverse engineer, decompile, decrypt, or disassemble any binary components of the Software, except and only to the extent that such restriction is explicitly prohibited by applicable mandatory laws.
+   - 4.4. Notice Preservation: Remove, obscure, deface, or alter any copyright notices, trademarks, hyperlinked terms, or license files included within the Software distribution.
+
+5. Prior Authorization and Application Channels
+
+   - 5.1. Authorization Requirement: Any activity exceeding the scope of Personal Local Use (including but not limited to public redistribution, independent forks not targeting upstream contributions, commercial deployment, or enterprise use) requires prior explicit written consent from the Author.
+   - 5.2. Official Application Channels: Users seeking such authorization must submit a formal request through one of the following official channels:
+      - Channel A (GitHub Fork): Initiating a standard Fork on the official GitHub repository for collaborative and upstream contributions.
+      - Channel B (GitHub Issues): Submitting a public issue utilizing the designated authorization request template.
+      - Channel C (Official Email): Sending a detailed inquiry to the official organizational email address associated with the PYAS Security project.
+   - 5.3. Request Content: Any application must explicitly state the specific use case, intended target audience, scope of deployment, and whether any commercial monetization is involved.
+
+6. Updates, Amendments, and Scope of Terms
+
+   - 6.1. New Releases: The Author may deliver updates, critical security patches, feature enhancements, or user interface modifications. Continued use of the Software constitutes acceptance of the latest distributed version.
+   - 6.2. Non-Retroactivity: The Author reserves the right to amend this License Agreement at any time. Amendments apply strictly to subsequent versions or new downloads. Copies lawfully acquired prior to such modification remain governed by the exact version of the License under which they were originally obtained.
+
+7. Telemetry, Data, and Privacy
+
+   - 7.1. Operational Data Collection: The Software may collect anonymized technical, operational, and usage data strictly for security analysis, performance optimization, and bug reporting.
+   - 7.2. Cloud Sample Submission: To enhance threat detection and malware analysis, the Software may automatically or manually transmit suspicious executable files and software samples to the Author's cloud infrastructure for deep analysis.
+   - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
+   - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
+   - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+
+8. Warranty Disclaimer and Limitation of Liability
+
+   - 8.1. Disclaimer of Warranty: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ALL RELATED ASSETS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+   - 8.2. Limitation of Liability: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. USERS ASSUME ALL RISKS REGARDING PERFORMANCE, DATA INTEGRITY, AND SYSTEM STABILITY.
 
 © 2020-2026 87owo (PYAS Security). All rights reserved.</textarea>
                         </div>
@@ -314,8 +369,36 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋進程..." placeholder="搜尋進程...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>查看</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>結束</button>
+                        <div class="action-group modern-action-group">
+                            <select id="taskmgr_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="view" data-i18n="btn_view_item">查看項目</option>
+                                <option value="end" data-i18n="btn_end">結束進程</option>
+                                <option value="quarantine" data-i18n="act_quarantine">加入隔離區</option>
+                                <option value="whitelist" data-i18n="act_white">加入白名單</option>
+                            </select>
+                        </div>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+
+                <section id="startup_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>啟動項管理</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋項目..." placeholder="搜尋項目...">
+                        </div>
+                        <div class="action-group modern-action-group">
+                            <select id="startup_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="enable" data-i18n="btn_enable_item">啟用項目</option>
+                                <option value="disable" data-i18n="btn_disable_item">禁用項目</option>
+                                <option value="delete" data-i18n="btn_delete_item">刪除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -329,8 +412,16 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="whitelist_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add_file" data-i18n="btn_add_file">新增檔案</option>
+                                <option value="add_path" data-i18n="btn_add_path">新增路徑</option>
+                                <option value="extract" data-i18n="btn_extract_item">提取項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                                <option value="quarantine" data-i18n="act_quarantine">加入隔離區</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -344,8 +435,16 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="quarantine_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add_file" data-i18n="btn_add_file">新增檔案</option>
+                                <option value="add_path" data-i18n="btn_add_path">新增路徑</option>
+                                <option value="extract" data-i18n="btn_extract_item">提取項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                                <option value="whitelist" data-i18n="act_white">加入白名單</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -359,8 +458,13 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>掃描</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>刪除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="junk_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="view" data-i18n="btn_view_item">查看項目</option>
+                                <option value="delete" data-i18n="btn_delete_item">刪除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -370,8 +474,12 @@ Last updated: 2025-12-19
                         <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
                         <h2 data-i18n>系統修復</h2>
                         <div class="spacer"></div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>掃描</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>修復</button>
+                        <div class="action-group modern-action-group">
+                            <select id="repair_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="repair" data-i18n="btn_repair_item">修復項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -385,8 +493,33 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋窗口..." placeholder="搜尋窗口...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="popup_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add" data-i18n="btn_add_item">新增項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                            </select>
+                        </div>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+                
+                <section id="netmon_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>流量監控</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋進程..." placeholder="搜尋進程...">
+                        </div>
+                        <div class="action-group modern-action-group">
+                            <select id="netmon_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="view" data-i18n="btn_view_item">查看項目</option>
+                                <option value="end" data-i18n="btn_end">結束進程</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -400,8 +533,13 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋規則..." placeholder="搜尋規則...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="custom_protect_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add" data-i18n="btn_add_item">新增項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -415,8 +553,13 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋日誌..." placeholder="搜尋日誌...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>導出</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>刪除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="log_export_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="export" data-i18n="btn_export">導出項目</option>
+                                <option value="delete" data-i18n="btn_remove_item">移除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>

LICENSE.txt

@@ -1,31 +1,61 @@
 87owo Publicly Available Source Code License Agreement
-Last updated: 2025-12-19
 
-1. License and Ownership
-   - This software and its source code are source available for public view.
-   - Access or execution of certain features may require an activation key.
-   - 87owo reserves all legal rights, no intellectual property is transferred.
-   - All project archives, source code, and binaries remain fully proprietary.
+Last Updated: 2026-06-09
+IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
-2. Use and Prohibitions
-   - You may view, download, and modify the code for local and personal use.
-   - Redistribution of any original or modified code requires prior consent.
-   - Commercial hosting or SaaS deployment is prohibited without permission.
-   - Reverse engineering, license removal, or illegal use is strictly barred.
+1. Definitions and Interpretation
 
-3. Data and Privacy
-   - This project may collect operational data for optimization and analysis.
-   - All collected data is strictly anonymized to ensure the user's privacy.
-   - Transmission of information is encrypted to prevent unauthorized access.
+   - 1.1. Author: Refers to 87owo (PYAS Security).
+   - 1.2. Software: Refers to the source code, binaries, project archives, assets, and documentation associated with this repository or distribution.
+   - 1.3. Personal Local Use: Means viewing, downloading, executing, and modifying the Software strictly on local hardware owned or directly controlled by an individual for private, non-commercial, non-production, and non-distribution purposes.
+   - 1.4. Enterprise Use: Includes enterprise internal deployment, multi-user institutional use, or utilization within any corporate environment, which is strictly excluded from Personal Local Use.
 
-4. Updates and Terms
-   - New releases may include critical patches, enhancements, or UI changes.
-   - Continued use of these services constitutes acceptance of updated terms.
-   - The author reserves the right to modify these license terms at any time.
+2. Intellectual Property and Ownership
 
-5. Warranty and Liability
-   - All services and assets are provided "as is" without any form of warranty.
-   - 87owo is not liable for any direct or indirect damages from software use.
-   - Users assume all risks regarding performance, data, and system integrity.
+   - 2.1. Retention of Rights: The Author reserves all legal rights, titles, and interests in and to the Software, including but not limited to all copyrights, trademarks, patents, and trade secrets.
+   - 2.2. No Transfer: No intellectual property rights or ownership stakes are transferred under this Agreement. All project components remain fully proprietary.
+   - 2.3. Activation Keys: Access to or execution of certain premium features, modules, or binary distributions within the Software may require a valid, authorized activation key issued solely by the Author.
+
+3. Grant of License and Permitted Use
+
+   Subject to your strict compliance with all terms of this Agreement, the Author hereby grants you a limited, non-exclusive, world-wide, royalty-free, revocable, and non-transferable license to:
+   - 3.1. Code Inspection: View and download the source code from official authorized repositories.
+   - 3.2. Local Modification: Modify the source code strictly for the purposes of Personal Local Use.
+   - 3.3. Local Execution: Execute the Software locally for personal evaluation and private deployment.
+
+4. Prohibitions and Restrictions
+
+   Except as explicitly granted in Section 3, you shall not, and shall not permit any third party to:
+   - 4.1. Unauthorized Redistribution: Copy, redistribute, sublicense, republish, mirror, or publicly disclose any original or modified versions of the source code, binaries, or assets.
+   - 4.2. Commercial and SaaS Deployment: Host, deploy, embed, or utilize the Software for commercial purposes, including but not limited to Software-as-a-Service (SaaS), commercial web hosting, paid remote execution, cloud infrastructure integration, or enterprise internal utility.
+   - 4.3. Reverse Engineering: Reverse engineer, decompile, decrypt, or disassemble any binary components of the Software, except and only to the extent that such restriction is explicitly prohibited by applicable mandatory laws.
+   - 4.4. Notice Preservation: Remove, obscure, deface, or alter any copyright notices, trademarks, hyperlinked terms, or license files included within the Software distribution.
+
+5. Prior Authorization and Application Channels
+
+   - 5.1. Authorization Requirement: Any activity exceeding the scope of Personal Local Use (including but not limited to public redistribution, independent forks not targeting upstream contributions, commercial deployment, or enterprise use) requires prior explicit written consent from the Author.
+   - 5.2. Official Application Channels: Users seeking such authorization must submit a formal request through one of the following official channels:
+      - Channel A (GitHub Fork): Initiating a standard Fork on the official GitHub repository for collaborative and upstream contributions.
+      - Channel B (GitHub Issues): Submitting a public issue utilizing the designated authorization request template.
+      - Channel C (Official Email): Sending a detailed inquiry to the official organizational email address associated with the PYAS Security project.
+   - 5.3. Request Content: Any application must explicitly state the specific use case, intended target audience, scope of deployment, and whether any commercial monetization is involved.
+
+6. Updates, Amendments, and Scope of Terms
+
+   - 6.1. New Releases: The Author may deliver updates, critical security patches, feature enhancements, or user interface modifications. Continued use of the Software constitutes acceptance of the latest distributed version.
+   - 6.2. Non-Retroactivity: The Author reserves the right to amend this License Agreement at any time. Amendments apply strictly to subsequent versions or new downloads. Copies lawfully acquired prior to such modification remain governed by the exact version of the License under which they were originally obtained.
+
+7. Telemetry, Data, and Privacy
+
+   - 7.1. Operational Data Collection: The Software may collect anonymized technical, operational, and usage data strictly for security analysis, performance optimization, and bug reporting.
+   - 7.2. Cloud Sample Submission: To enhance threat detection and malware analysis, the Software may automatically or manually transmit suspicious executable files and software samples to the Author's cloud infrastructure for deep analysis.
+   - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
+   - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
+   - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+
+8. Warranty Disclaimer and Limitation of Liability
+
+   - 8.1. Disclaimer of Warranty: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ALL RELATED ASSETS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+   - 8.2. Limitation of Liability: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. USERS ASSUME ALL RISKS REGARDING PERFORMANCE, DATA INTEGRITY, AND SYSTEM STABILITY.
 
 © 2020-2026 87owo (PYAS Security). All rights reserved.

PYAS_Inno.iss

@@ -0,0 +1,253 @@
+#define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
+#define AppName "PYAS"
+#define AppVersion "3.6.0.0"
+#define AppPublisher "PYAS Security"
+#define AppURL "https://github.com/87owo/PYAS"
+#define AppExeName "PYAS.exe"
+
+[Setup]
+AppId={#AppId}
+AppName={#AppName}
+AppVersion={#AppVersion}
+AppVerName={#AppName} {#AppVersion}
+AppPublisher={#AppPublisher}
+AppPublisherURL={#AppURL}
+AppSupportURL={#AppURL}
+AppUpdatesURL={#AppURL}
+VersionInfoVersion={#AppVersion}
+VersionInfoCompany={#AppPublisher}
+VersionInfoDescription={#AppName} Setup
+VersionInfoProductName={#AppName} Setup
+VersionInfoProductVersion={#AppVersion}
+DefaultDirName={autopf}\{#AppName}
+DefaultGroupName={#AppPublisher}\{#AppName}
+AllowNoIcons=yes
+LicenseFile=SetupResources\licence.rtf
+ShowLanguageDialog=yes
+WizardStyle=modern
+WizardImageFile=SetupResources\wizardImage.bmp
+WizardSmallImageFile=SetupResources\headerImage.png
+SetupIconFile=Payload\Interface\static\img\icon.ico
+UninstallDisplayIcon={app}\{#AppExeName}
+PrivilegesRequired=admin
+ArchitecturesAllowed=x64compatible
+ArchitecturesInstallIn64BitMode=x64compatible
+MinVersion=10.0
+Compression=lzma2/max
+SolidCompression=yes
+OutputDir=Output
+OutputBaseFilename=PYAS_Setup
+UsePreviousTasks=no
+
+[Languages]
+Name: "english"; MessagesFile: "compiler:Default.isl"
+Name: "chinesesimplified"; MessagesFile: "SetupResources\ChineseSimplified.isl"
+Name: "chinesetraditional"; MessagesFile: "SetupResources\ChineseTraditional.isl"
+Name: "japanese"; MessagesFile: "SetupResources\Japanese.isl"
+Name: "korean"; MessagesFile: "SetupResources\Korean.isl"
+Name: "french"; MessagesFile: "SetupResources\French.isl"
+Name: "spanish"; MessagesFile: "SetupResources\Spanish.isl"
+Name: "hindi"; MessagesFile: "SetupResources\Hindi.isl"
+Name: "arabic"; MessagesFile: "SetupResources\Arabic.isl"
+Name: "russian"; MessagesFile: "SetupResources\Russian.isl"
+Name: "slovenian"; MessagesFile: "SetupResources\Slovenian.isl"
+
+[Tasks]
+Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"
+Name: "autostart"; Description: "{cm:AutoStartTask}"; GroupDescription: "{cm:AdditionalIcons}"
+Name: "install_webview2"; Description: "{cm:InstallWebView2}"; GroupDescription: "{cm:Dependencies}"
+Name: "install_vcredist"; Description: "{cm:InstallVCRedist}"; GroupDescription: "{cm:Dependencies}"
+
+[Files]
+Source: "Payload\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Redist\VC_redist.x64.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
+Source: "Redist\MicrosoftEdgeWebview2Setup.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
+
+[Registry]
+Root: HKCU; Subkey: "Software\Classes\*\shell\PYAS_Scan"; Flags: uninsdeletekey dontcreatekey
+Root: HKCU; Subkey: "Software\Classes\Directory\shell\PYAS_Scan"; Flags: uninsdeletekey dontcreatekey
+
+[UninstallDelete]
+Type: filesandordirs; Name: "{commonappdata}\PYAS"
+
+[Icons]
+Name: "{autodesktop}\{#AppName}"; Filename: "{app}\{#AppExeName}"; Tasks: desktopicon
+Name: "{group}\{#AppName}"; Filename: "{app}\{#AppExeName}"
+Name: "{group}\Uninstall {#AppName}"; Filename: "{uninstallexe}"
+
+[Run]
+Filename: "{tmp}\PYAS_Redist\VC_redist.x64.exe"; Parameters: "/quiet /norestart"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingVCRuntime}"; Tasks: install_vcredist
+Filename: "{tmp}\PYAS_Redist\MicrosoftEdgeWebview2Setup.exe"; Parameters: "/silent /install"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingWebView2Runtime}"; Tasks: install_webview2
+Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#StringChange(AppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent runascurrentuser
+
+[CustomMessages]
+english.InstallingVCRuntime=Installing Microsoft Visual C++ Runtime...
+chinesesimplified.InstallingVCRuntime=正在安装 Microsoft Visual C++ 运行库...
+chinesetraditional.InstallingVCRuntime=正在安裝 Microsoft Visual C++ 執行庫...
+english.InstallingWebView2Runtime=Installing Microsoft Edge WebView2 Runtime...
+chinesesimplified.InstallingWebView2Runtime=正在安装 Microsoft Edge WebView2 Runtime...
+chinesetraditional.InstallingWebView2Runtime=正在安裝 Microsoft Edge WebView2 Runtime...
+english.AutoStartTask=Run PYAS automatically at system startup
+chinesesimplified.AutoStartTask=开机时自动运行 PYAS
+chinesetraditional.AutoStartTask=開機時自動執行 PYAS
+english.Dependencies=Dependencies:
+chinesesimplified.Dependencies=运行环境:
+chinesetraditional.Dependencies=執行環境:
+english.InstallWebView2=Install Microsoft Edge WebView2 Runtime
+chinesesimplified.InstallWebView2=安装 Microsoft Edge WebView2 运行环境
+chinesetraditional.InstallWebView2=安裝 Microsoft Edge WebView2 執行環境
+english.InstallVCRedist=Install Microsoft Visual C++ Runtime
+chinesesimplified.InstallVCRedist=安装 Microsoft Visual C++ 运行库
+chinesetraditional.InstallVCRedist=安裝 Microsoft Visual C++ 執行庫
+english.LegacyVersionDetected=An older version of PYAS was detected. Please uninstall it manually before installing.
+chinesesimplified.LegacyVersionDetected=检测到存在旧版 PYAS。请先手动卸载旧版后，再运行本安装程序。
+chinesetraditional.LegacyVersionDetected=檢測到存在舊版 PYAS。請先手動卸載舊版後，再執行本安裝程式。
+
+[Code]
+var
+  TasksInitialized: Boolean;
+
+function IsWebView2Installed: Boolean;
+var
+  RegKeyPath: string;
+  Version: string;
+begin
+  RegKeyPath := 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';
+  Result := False;
+  if RegQueryStringValue(HKLM, 'SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    if Length(Version) > 0 then Result := True;
+  if not Result and RegQueryStringValue(HKCU, RegKeyPath, 'pv', Version) then
+    if Length(Version) > 0 then Result := True;
+  if not Result and RegQueryStringValue(HKLM, RegKeyPath, 'pv', Version) then
+    if Length(Version) > 0 then Result := True;
+end;
+
+function IsVCRedistInstalled: Boolean;
+var
+  Bld: Cardinal;
+begin
+  Result := False;
+  if RegQueryDWordValue(HKLM, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Bld', Bld) then
+    if Bld > 0 then Result := True;
+end;
+
+procedure CurPageChanged(CurPageID: Integer);
+var
+  I: Integer;
+  ItemText: string;
+begin
+  if (CurPageID = wpSelectTasks) and not TasksInitialized then
+  begin
+    TasksInitialized := True;
+    for I := 0 to WizardForm.TasksList.Items.Count - 1 do
+    begin
+      ItemText := WizardForm.TasksList.Items[I];
+      if Pos('Visual C++', ItemText) > 0 then
+        WizardForm.TasksList.Checked[I] := not IsVCRedistInstalled
+      else if Pos('WebView2', ItemText) > 0 then
+        WizardForm.TasksList.Checked[I] := not IsWebView2Installed;
+    end;
+  end;
+end;
+
+procedure QuitOldInstance(InstallPath: string);
+var
+  ResultCode: Integer;
+  ExePath: string;
+begin
+  ExePath := InstallPath + '\{#AppExeName}';
+  if FileExists(ExePath) then
+  begin
+    Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+    Sleep(500);
+    Exec(ExpandConstant('{sys}\taskkill.exe'), '/F /IM {#AppExeName} /T', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  end;
+end;
+
+function InitializeSetup(): Boolean;
+var
+  OldInstallPath: string;
+  LegacyPath: string;
+begin
+  LegacyPath := ExpandConstant('{pf32}\{#AppName}');
+  if DirExists(LegacyPath) and FileExists(LegacyPath + '\{#AppExeName}') then
+  begin
+    MsgBox(CustomMessage('LegacyVersionDetected'), mbCriticalError, MB_OK);
+    Result := False;
+    Exit;
+  end;
+  if RegQueryStringValue(HKLM, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) or
+     RegQueryStringValue(HKCU, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) then
+  begin
+    QuitOldInstance(OldInstallPath);
+  end;
+  
+  Result := True;
+end;
+
+function InitializeUninstall(): Boolean;
+begin
+  QuitOldInstance(ExpandConstant('{app}'));
+  Result := True;
+end;
+
+procedure TryCreateStartupTask;
+var
+  ResultCode: Integer;
+  PSExe: string;
+  PSCommand: string;
+  AppPath: string;
+begin
+  AppPath := ExpandConstant('{app}\{#AppExeName}');
+  PSExe := ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe');
+  PSCommand := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command ' +
+               '$Action = New-ScheduledTaskAction -Execute ''' + AppPath + ''' -Argument ''-hide''; ' +
+               '$Trigger = New-ScheduledTaskTrigger -AtLogOn; ' +
+               '$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; ' +
+               'Register-ScheduledTask -TaskName ''PYAS_Security_ATS'' -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest -Force';
+  if not Exec(PSExe, PSCommand, '', SW_HIDE, ewWaitUntilTerminated, ResultCode) then
+  begin
+    Log(Format('Failed to create scheduled task, Exec error code: %d', [ResultCode]));
+  end
+  else if ResultCode <> 0 then
+  begin
+    Log(Format('powershell returned exit code %d while creating the scheduled task', [ResultCode]));
+  end;
+end;
+
+procedure TryDeleteStartupTask;
+var
+  ResultCode: Integer;
+begin
+  if not Exec(ExpandConstant('{sys}\schtasks.exe'), '/Delete /TN "PYAS_Security_ATS" /F', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) then
+  begin
+    Log(Format('Failed to delete scheduled task, Exec error code: %d', [ResultCode]));
+  end
+  else if ResultCode <> 0 then
+  begin
+    Log(Format('schtasks returned exit code %d while deleting the scheduled task', [ResultCode]));
+  end;
+end;
+
+procedure CurStepChanged(CurStep: TSetupStep);
+begin
+  if CurStep = ssPostInstall then
+  begin
+    if WizardIsTaskSelected('autostart') then
+    begin
+      TryCreateStartupTask;
+    end;
+  end;
+end;
+
+procedure CurUninstallStepChanged(CurUninstallStep: TUninstallStep);
+begin
+  if CurUninstallStep = usUninstall then
+  begin
+    TryDeleteStartupTask;
+  end
+  else if CurUninstallStep = usPostUninstall then
+  begin
+    DelTree(ExpandConstant('{app}'), True, True, True);
+  end;
+end;

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.5.3.0',
+version='3.6.0.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Filter/DriverEntry.cpp

@@ -1,6 +1,7 @@
 #include "DriverCommon.h"
 
 DRIVER_DATA GlobalData;
+static BOOLEAN g_ImageNotifyRegistered = FALSE;
 
 static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
     UNREFERENCED_PARAMETER(FltObjects);
@@ -27,9 +28,7 @@ static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTA
 }
 
 static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
-    if (!(Flags & FLTFL_FILTER_UNLOAD_MANDATORY)) {
-        return STATUS_FLT_DO_NOT_DETACH;
-    }
+    UNREFERENCED_PARAMETER(Flags);
 
     if (GlobalData.ServerPort) {
         FltCloseCommunicationPort(GlobalData.ServerPort);
@@ -41,12 +40,14 @@ static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
         GlobalData.FilterHandle = NULL;
     }
 
-    PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+    if (g_ImageNotifyRegistered) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        g_ImageNotifyRegistered = FALSE;
+    }
+
     UninitializeRegistryProtection();
     UninitializeProcessProtection();
 
-    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
-
     UnloadRules();
     UninitializeRulesEngine();
 
@@ -61,12 +62,9 @@ static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBuff
     if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
         PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
         if (msg->Command == 1 || msg->Command == 2) {
-
             msg->Path[MAX_PATH_LEN - 1] = L'\0';
-
             UNICODE_STRING us;
             RtlInitUnicodeString(&us, msg->Path);
-
             if (us.Length > 0) {
                 if (msg->Command == 1) {
                     AddDynamicWhitelist(&us);
@@ -178,22 +176,29 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     }
 
     if (!NT_SUCCESS(status)) {
-        if (GlobalData.FilterHandle) {
-            FltUnregisterFilter(GlobalData.FilterHandle);
-            GlobalData.FilterHandle = NULL;
-        }
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        GlobalData.FilterHandle = NULL;
         UnloadRules();
         UninitializeRulesEngine();
         return status;
     }
 
     InitializeProcessProtection();
+
     InitializeRegistryProtection(DriverObject);
-    PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+
+    NTSTATUS imageNotifyStatus = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+    if (NT_SUCCESS(imageNotifyStatus)) {
+        g_ImageNotifyRegistered = TRUE;
+    }
 
     status = FltStartFiltering(GlobalData.FilterHandle);
     if (!NT_SUCCESS(status)) {
-        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        if (g_ImageNotifyRegistered) {
+            PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+            g_ImageNotifyRegistered = FALSE;
+        }
+
         UninitializeRegistryProtection();
         UninitializeProcessProtection();
 

Plugins/Filter/ProtectProcess.cpp

@@ -189,8 +189,7 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
 }
 
 NTSTATUS InitializeProcessProtection() {
-    static UNICODE_STRING Altitude = { 0 };
-    RtlInitUnicodeString(&Altitude, L"320000");
+    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob");
 
     ObCallbacks[0].ObjectType = PsProcessType;
     ObCallbacks[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
@@ -208,7 +207,15 @@ NTSTATUS InitializeProcessProtection() {
     ObRegistration.RegistrationContext = NULL;
     ObRegistration.OperationRegistration = ObCallbacks;
 
-    return ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+    NTSTATUS status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+
+    if (!NT_SUCCESS(status) && (status == STATUS_FLT_INSTANCE_ALTITUDE_COLLISION || status == STATUS_OBJECT_NAME_COLLISION)) {
+        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob.Fallback");
+        ObRegistration.Altitude = FallbackAltitude;
+        status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+    }
+
+    return status;
 }
 
 VOID UninitializeProcessProtection() {

Plugins/Filter/ProtectRegistry.cpp

@@ -235,9 +235,15 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 }
 
 NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject) {
-    UNICODE_STRING Altitude;
-    RtlInitUnicodeString(&Altitude, L"320000");
-    return CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm");
+    NTSTATUS status = CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+
+    if (!NT_SUCCESS(status)) {
+        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm.Fallback");
+        status = CmRegisterCallbackEx(RegistryCallback, &FallbackAltitude, DriverObject, NULL, &Cookie, NULL);
+    }
+
+    return status;
 }
 
 VOID UninitializeRegistryProtection() {

Plugins/Filter/ProtectRules.cpp

@@ -1,4 +1,4 @@
-#include "DriverCommon.h"
+#include "DriverCommon.h"
 
 constexpr auto MAX_TRACKERS = 64;
 constexpr auto RANSOM_TIME_WINDOW_MS = 3000;
@@ -525,7 +525,7 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
     if (g_CacheInitialized) {
         KIRQL OldIrql;
         KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
-        ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
+        ULONG Hash = (((ULONG)(ULONG_PTR)ProcessId) >> 2) & (TRUST_CACHE_SIZE - 1);
 
         if (TrustCache[Hash].Process == Process && TrustCache[Hash].ProcessCreateTime.QuadPart == createTime.QuadPart) {
             LARGE_INTEGER Now;
@@ -580,7 +580,7 @@ update_cache:
     if (g_CacheInitialized) {
         KIRQL OldIrql;
         KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
-        ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
+        ULONG Hash = (((ULONG)(ULONG_PTR)ProcessId) >> 2) & (TRUST_CACHE_SIZE - 1);
         TrustCache[Hash].Process = Process;
         TrustCache[Hash].ProcessCreateTime = createTime;
         TrustCache[Hash].IsTrusted = isTrusted;
@@ -597,8 +597,38 @@ update_cache:
 }
 
 BOOLEAN IsTargetProtected(HANDLE ProcessId) {
+    // 检查是否为已连接的 PYAS 进程
     if ((ULONG)(ULONG_PTR)ProcessId == GlobalData.PyasPid) return TRUE;
-    return FALSE;
+
+    // 额外检查：通过进程路径匹配保护规则（后备保护机制）
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    PUNICODE_STRING imageFileName = NULL;
+    NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);
+    if (!NT_SUCCESS(status) || !imageFileName || !imageFileName->Buffer) {
+        return FALSE;
+    }
+
+    BOOLEAN isProtected = FALSE;
+
+    KeEnterCriticalRegion();
+    ExAcquireResourceSharedLite(&RuleLock, TRUE);
+
+    // 检查进程路径是否匹配保护路径规则
+    PRULE_NODE Node = g_FileProtectedPaths;
+    while (Node) {
+        if (WildcardMatch(Node->Pattern.Buffer, imageFileName->Buffer, imageFileName->Length)) {
+            isProtected = TRUE;
+            break;
+        }
+        Node = Node->Next;
+    }
+
+    ExReleaseResourceLite(&RuleLock);
+    KeLeaveCriticalRegion();
+
+    if (imageFileName) ExFreePool(imageFileName);
+    return isProtected;
 }
 
 BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName) {

Plugins/Rules/Rules_Driver_P1.json

@@ -1,218 +1,233 @@
 {
-  "Rule_Registry_BlockList": [
-    "\\REGISTRY\\MACHINE\\BCD00000000",
-    "\\REGISTRY\\MACHINE\\BCD00000000\\*",
-    "*\\Image File Execution Options\\*",
-    
-    "*\\Classes\\.exe",
-    "*\\Classes\\.bat",
-    "*\\Classes\\.cmd",
-    "*\\Classes\\.com",
-    "*\\Classes\\exefile\\*",
-    "*\\Classes\\batfile\\*",
-    "*\\Classes\\cmdfile\\*",
-    "*\\Classes\\comfile\\*",
-    
-    "*\\mouclass",
-    "*\\kbdclass",
-    "*\\DisableAntiSpyware",
-    "*\\DisableWindowsUpdateAccess",
-    "*\\EnableLUA",
-    "*\\ConsentPromptBehaviorAdmin",
-    "*\\NoControlPanel",
-    "*\\NoDrives",
-    "*\\NoFileMenu",
-    "*\\NoFind",
-    "*\\NoStartMenuPinnedList",
-    "*\\NoSetFolders",
-    "*\\NoSetFolderOptions",
-    "*\\NoViewOnDrive",
-    "*\\NoClose",
-    "*\\NoDesktop",
-    "*\\NoLogoff",
-    "*\\NoFolderOptions",
-    "*\\RestrictRun",
-    "*\\NoViewContextMenu",
-    "*\\HideClock",
-    "*\\NoStartMenuMyGames",
-    "*\\NoStartMenuMyMusic",
-    "*\\DisableCMD",
-    "*\\NoAddingComponents",
-    "*\\NoWinKeys",
-    "*\\NoStartMenuLogOff",
-    "*\\NoSimpleNetIDList",
-    "*\\NoLowDiskSpaceChecks",
-    "*\\DisableLockWorkstation",
-    "*\\Restrict_Run",
-    "*\\DisableTaskMgr",
-    "*\\DisableRegistryTools",
-    "*\\DisableChangePassword",
-    "*\\NoComponents",
-    "*\\NoStartMenuMorePrograms",
-    "*\\NoActiveDesktop",
-    "*\\NoSetActiveDesktop",
-    "*\\NoRecentDocsMenu",
-    "*\\NoWindowsUpdate",
-    "*\\NoChangeStartMenu",
-    "*\\NoFavoritesMenu",
-    "*\\NoRecentDocsHistory",
-    "*\\NoSetTaskbar",
-    "*\\NoSMHelp",
-    "*\\NoTrayContextMenu",
-    "*\\NoManageMyComputerVerb",
-    "*\\NoRealMode",
-    "*\\NoRun",
-    "*\\ClearRecentDocsOnExit",
-    "*\\NoActiveDesktopChanges",
-    "*\\NoStartMenuNetworkPlaces",
-    "*\\NoLockScreen",
-    "*\\HideFastUserSwitching",
-    "*\\ConsentPromptBehaviorUser",
-    "*\\EnableSecureUIAPaths",
-    "*\\NoSRM",
-    "*\\NoInteractiveServices",
-    "*\\ShutdownWithoutLogon",
-    "*\\AutoAdminLogon",
-    "*\\BootExecute",
-    "*\\SubSystems",
-    "*\\FirmwareBootDevice",
-    "*\\BootDriverFlags",
-    "*\\SystemStartOptions",
-    "*\\CrashDumpEnabled",
-    "*\\DisableAutomaticRestartOnFailure",
-    "*\\SystemBiosVersion",
-    "*\\NoTheme",
-    "*\\SystemSetupInProgress",
-    "*\\CmdLine",
-    "*\\SetupType",
-    "*\\AutoReboot",
-    "*\\Userinit",
-    "*\\UIHost",
-    "*\\Debugger",
-    "*\\DefaultUserName",
-    "*\\DefaultPassword",
-    "*\\AltDefaultUserName",
-    "*\\AltDefaultPassword",
-    "*\\DisableCAD",
-    "*\\LegalNoticeCaption",
-    "*\\LegalNoticeText",
-  ],
-  "Rule_Registry_TrustedList": [
-  ],
-  "Rule_Process_TrustedPaths": [
-    "\\Device\\HarddiskVolume*\\Windows\\*",
-    "\\Device\\HarddiskVolume*\\Program Files\\*",
-    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-    
-    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-    
-    "*\\Google\\Chrome\\Application\\chrome.exe",
-    "*\\Microsoft\\Edge\\Application\\msedge.exe",
-    "*\\Mozilla Firefox\\firefox.exe",
-    
-    "*\\Steam\\steam.exe",
-    "*\\steam\\*\\steam.exe",
-    "*\\Battle.net\\*\\Battle.net.exe",
-    "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
-    
-    "*\\ThunderEv.exe",
-    "*\\ThunderStart.exe",
-    "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
-    "*\\KuGou.exe",
-    "*\\XLGame.exe",
-    "*\\XLLiveUD.exe",
-    "*\\PC4399_WPFLauncher.exe",
-    "*\\bin\\APlayer.exe",
-    "*\\hrkill-*.exe",
-    "*\\bin\\HipsDaemon.exe",
-    "*\\360Safe.exe",
-  ],
-  "Rule_Process_ExploitableBlacklist": [
-    "*\\cmd.exe",
-    "*\\powershell.exe",
-    "*\\pwsh.exe",
-    "*\\wscript.exe",
-    "*\\cscript.exe",
-    "*\\mshta.exe",
-    "*\\regsvr32.exe",
-    "*\\certutil.exe",
-    "*\\bitsadmin.exe",
-    "*\\wmic.exe",
-    "*\\hh.exe",
-    "*\\cmstp.exe",
-    "*\\installutil.exe",
-    "*\\regasm.exe",
-    "*\\regsvcs.exe",
-    "*\\msbuild.exe",
-    "*\\csc.exe",
-    "*\\vbc.exe",
-    "*\\jsc.exe",
-    "*\\bash.exe",
-    "*\\scrcons.exe",
-    "*\\schtasks.exe",
-    "*\\at.exe",
-    "*\\reg.exe",
-    "*\\sc.exe",
-    "*\\net.exe",
-    "*\\net1.exe",
-    "*\\whoami.exe",
-    "*\\ipconfig.exe",
-    "*\\taskkill.exe",
-    "*\\ProcessHacker.exe",
-    "*\\procmon.exe",
-    "*\\procexp.exe",
-  ],
-  "Rule_File_ProtectedPaths": [
-    "*\\PYAS.exe",
-    "*\\Plugins\\Filter\\PYAS_Driver.sys",
-    "*\\Plugins\\Rules\\Rules_Driver_P1.json",
-    "*\\ProgramData\\PYAS\\*.json",
-    "*\\Engine\\Pattern\\*.onnx",
-    "*\\Engine\\Properties\\*.onnx",
-    
-    "\\Device\\HarddiskVolume*\\bootmgr",
-    "\\Device\\HarddiskVolume*\\boot.ini",
-    "\\Device\\HarddiskVolume*\\BOOTNXT",
-    "\\Device\\HarddiskVolume*\\EFI\\*",
-    "\\Device\\HarddiskVolume*\\Boot\\*",
-    "\\Device\\HarddiskVolume*\\Recovery\\*",
-    "\\Device\\HarddiskVolume*\\System Volume Information\\*",
-    "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
-    
-    "*\\CON",
-    "*\\CON\\*",
-    "*\\PRN",
-    "*\\PRN\\*",
-    "*\\AUX",
-    "*\\AUX\\*",
-    "*\\NUL",
-    "*\\NUL\\*",
-    "*\\COM?",
-    "*\\COM?\\*",
-    "*\\LPT?",
-    "*\\LPT?\\*",
-    "*\\OSDATA",
-    "*\\OSDATA\\*",
-    "*\\*<*",
-    "*\\*>*",
-  ],
-  "Rule_File_ExceptionPaths": [
-    "*\\Users\\*\\steam\\*",
-    "*\\AppData\\*",
-    "*\\Temp\\*",
-    "*\\Local\\Temp\\*",
-    "*\\ventoy\\Boot\\*",
-    "*\\AdminRegionConfig.*",
-    "*\\nt_qq\\nt_*\\*",
-    "*\\cache\\*",
-  ],
-  "Rule_File_RansomwareExtensions": [
-    ".zip", ".7z", ".rar", ".tar", ".gz",
-    ".ppt", ".pptx", ".wps", ".txt", ".rtf",
-    ".pdf", ".xls", ".xlsx", ".doc", ".docx",
-    ".jpg", ".jpeg", ".png", ".webp", ".gif",
-    ".mp3", ".wav", ".aac", ".ogg", ".flac",
-    ".mp4", ".avi", ".mov", ".wmv", ".mkv",
-  ]
+    "Rule_Registry_BlockList": [
+        "\\REGISTRY\\MACHINE\\BCD00000000",
+        "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+
+        "*\\Classes\\.exe",
+        "*\\Classes\\.bat",
+        "*\\Classes\\.cmd",
+        "*\\Classes\\.com",
+        "*\\Classes\\exefile\\*",
+        "*\\Classes\\batfile\\*",
+        "*\\Classes\\cmdfile\\*",
+        "*\\Classes\\comfile\\*",
+
+        "*\\mouclass",
+        "*\\kbdclass",
+        "*\\DisableAntiSpyware",
+        "*\\DisableWindowsUpdateAccess",
+        "*\\EnableLUA",
+        "*\\ConsentPromptBehaviorAdmin",
+        "*\\NoControlPanel",
+        "*\\NoDrives",
+        "*\\NoFileMenu",
+        "*\\NoFind",
+        "*\\NoStartMenuPinnedList",
+        "*\\NoSetFolders",
+        "*\\NoSetFolderOptions",
+        "*\\NoViewOnDrive",
+        "*\\NoClose",
+        "*\\NoDesktop",
+        "*\\NoLogoff",
+        "*\\NoFolderOptions",
+        "*\\RestrictRun",
+        "*\\NoViewContextMenu",
+        "*\\HideClock",
+        "*\\NoStartMenuMyGames",
+        "*\\NoStartMenuMyMusic",
+        "*\\DisableCMD",
+        "*\\NoAddingComponents",
+        "*\\NoWinKeys",
+        "*\\NoStartMenuLogOff",
+        "*\\NoSimpleNetIDList",
+        "*\\NoLowDiskSpaceChecks",
+        "*\\DisableLockWorkstation",
+        "*\\Restrict_Run",
+        "*\\DisableTaskMgr",
+        "*\\DisableRegistryTools",
+        "*\\DisableChangePassword",
+        "*\\NoComponents",
+        "*\\NoStartMenuMorePrograms",
+        "*\\NoActiveDesktop",
+        "*\\NoSetActiveDesktop",
+        "*\\NoRecentDocsMenu",
+        "*\\NoWindowsUpdate",
+        "*\\NoChangeStartMenu",
+        "*\\NoFavoritesMenu",
+        "*\\NoRecentDocsHistory",
+        "*\\NoSetTaskbar",
+        "*\\NoSMHelp",
+        "*\\NoTrayContextMenu",
+        "*\\NoManageMyComputerVerb",
+        "*\\NoRealMode",
+        "*\\NoRun",
+        "*\\ClearRecentDocsOnExit",
+        "*\\NoActiveDesktopChanges",
+        "*\\NoStartMenuNetworkPlaces",
+        "*\\NoLockScreen",
+        "*\\HideFastUserSwitching",
+        "*\\ConsentPromptBehaviorUser",
+        "*\\EnableSecureUIAPaths",
+        "*\\NoSRM",
+        "*\\NoInteractiveServices",
+        "*\\ShutdownWithoutLogon",
+        "*\\AutoAdminLogon",
+        "*\\BootExecute",
+        "*\\SubSystems",
+        "*\\FirmwareBootDevice",
+        "*\\BootDriverFlags",
+        "*\\SystemStartOptions",
+        "*\\DisableAutomaticRestartOnFailure",
+        "*\\SystemBiosVersion",
+        "*\\NoTheme",
+        "*\\SystemSetupInProgress",
+        "*\\SetupType",
+        "*\\AutoReboot",
+        "*\\Userinit",
+        "*\\UIHost",
+        "*\\Debugger",
+        "*\\DefaultUserName",
+        "*\\DefaultPassword",
+        "*\\AltDefaultUserName",
+        "*\\AltDefaultPassword",
+        "*\\DisableCAD",
+        "*\\LegalNoticeCaption",
+        "*\\LegalNoticeText",
+    ],
+    "Rule_Registry_TrustedList": [
+    ],
+    "Rule_Process_TrustedPaths": [
+        "\\Device\\HarddiskVolume*\\Windows\\*",
+        "\\Device\\HarddiskVolume*\\Program Files\\*",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+
+        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+        "*\\Sources\\SetupHost.exe",
+        "*\\Work\\*\\DismHost.exe",
+
+        "*\\Google\\Chrome\\Application\\chrome.exe",
+        "*\\Microsoft\\Edge\\Application\\msedge.exe",
+        "*\\Mozilla Firefox\\firefox.exe",
+        "*\\Thorium\\Application\\thorium.exe",
+
+        "*\\Steam\\steam.exe",
+        "*\\steam\\*\\steam.exe",
+        "*\\Battle.net\\*\\Battle.net.exe",
+        "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+
+        "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+        "*\\ThunderEv.exe",
+        "*\\ThunderStart.exe",
+        "*\\KuGou.exe",
+        "*\\XLGame.exe",
+        "*\\XLLiveUD.exe",
+
+        "*\\hrkill-*.exe",
+        "*\\bin\\HipsDaemon.exe",
+        "*\\360Safe.exe",
+        "*\\bilibili\\bilibili.exe",
+
+        "*\\Kingsoft\\WPS Office\\ksolaunch.exe",
+        "*\\Kingsoft\\WPS Office\\*\\wps.exe",
+        "*\\Kingsoft\\WPS Office\\*\\*.exe",
+
+        "*\\PC4399_WPFLauncher.exe",
+        "*\\bin\\APlayer.exe",
+        "*\\Neverness To Everness\\NTELauncher.exe",
+        "*\\Application\\AndrowsLauncher.exe",
+        "*\\bin\\*\\codex.exe",
+        "*\\bin\\codex.exe",
+    ],
+    "Rule_Process_ExploitableBlacklist": [
+        "*\\cmd.exe",
+        "*\\powershell.exe",
+        "*\\pwsh.exe",
+        "*\\wscript.exe",
+        "*\\cscript.exe",
+        "*\\mshta.exe",
+        "*\\regsvr32.exe",
+        "*\\certutil.exe",
+        "*\\bitsadmin.exe",
+        "*\\wmic.exe",
+        "*\\hh.exe",
+        "*\\cmstp.exe",
+        "*\\installutil.exe",
+        "*\\regasm.exe",
+        "*\\regsvcs.exe",
+        "*\\msbuild.exe",
+        "*\\csc.exe",
+        "*\\vbc.exe",
+        "*\\jsc.exe",
+        "*\\bash.exe",
+        "*\\scrcons.exe",
+        "*\\schtasks.exe",
+        "*\\at.exe",
+        "*\\reg.exe",
+        "*\\sc.exe",
+        "*\\net.exe",
+        "*\\net1.exe",
+        "*\\whoami.exe",
+        "*\\ipconfig.exe",
+        "*\\taskkill.exe",
+        "*\\ProcessHacker.exe",
+        "*\\procmon.exe",
+        "*\\procexp.exe",
+    ],
+    "Rule_File_ProtectedPaths": [
+        "*\\PYAS.exe",
+        "*\\Plugins\\Filter\\PYAS_Driver.sys",
+        "*\\Plugins\\Rules\\Rules_Driver_P1.json",
+        "*\\ProgramData\\PYAS\\*.json",
+        "*\\Engine\\Pattern\\*.onnx",
+        "*\\Engine\\Properties\\*.onnx",
+
+        "\\Device\\HarddiskVolume*\\bootmgr",
+        "\\Device\\HarddiskVolume*\\boot.ini",
+        "\\Device\\HarddiskVolume*\\BOOTNXT",
+        "\\Device\\HarddiskVolume*\\EFI\\*",
+        "\\Device\\HarddiskVolume*\\Boot\\*",
+        "\\Device\\HarddiskVolume*\\Recovery\\*",
+        "\\Device\\HarddiskVolume*\\System Volume Information\\*",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
+
+        "*\\CON",
+        "*\\CON\\*",
+        "*\\PRN",
+        "*\\PRN\\*",
+        "*\\AUX",
+        "*\\AUX\\*",
+        "*\\NUL",
+        "*\\NUL\\*",
+        "*\\COM?",
+        "*\\COM?\\*",
+        "*\\LPT?",
+        "*\\LPT?\\*",
+        "*\\OSDATA",
+        "*\\OSDATA\\*",
+        "*\\*<*",
+        "*\\*>*",
+    ],
+    "Rule_File_ExceptionPaths": [
+        "*\\Users\\*\\steam\\*",
+        "*\\AppData\\*",
+        "*\\Temp\\*",
+        "*\\Local\\Temp\\*",
+        "*\\ventoy\\Boot\\*",
+        "*\\AdminRegionConfig.*",
+        "*\\nt_qq\\nt_*\\*",
+        "*\\cache\\*",
+        "*\\Documents\\My Games\\*",
+        "*\\Documents\\Tencent Files\\*",
+        "*\\Documents\\WeChat Files\\*",
+        "*\\Documents\\WPS Cloud Files\\*"
+    ],
+    "Rule_File_RansomwareExtensions": [
+        ".zip", ".7z", ".rar", ".tar", ".gz",
+        ".ppt", ".pptx", ".wps", ".txt", ".rtf",
+        ".pdf", ".xls", ".xlsx", ".doc", ".docx",
+        ".jpg", ".jpeg", ".png", ".webp", ".gif",
+        ".mp3", ".wav", ".aac", ".ogg", ".flac",
+        ".mp4", ".avi", ".mov", ".wmv", ".mkv",
+    ]
 }

README.md

@@ -26,6 +26,7 @@ pip install pandas
 pip install scikit-learn
 pip install lightgbm
 pip install onnxmltools
+pip install orjson
 ```
 
 ## File Information
@@ -131,7 +132,7 @@ graph TD
 
 The machine learning-based virus scanning engine training achieved extremely high accuracy.
 
-<img width="1191" height="1323" alt="train" src="https://github.com/user-attachments/assets/2eea8426-1f82-44e3-9a38-f96f9257cf50" />
+<img width="895" height="1097" alt="train" src="https://github.com/user-attachments/assets/fa7cf0e2-01a1-4234-9358-718c2b8a2c9a" />
 
 ## Support System