Add files via upload

任务管理器通过匹配 Rule_Process_TrustedPaths 中的 *\\Windows\\* 规则被误判为可信进程，导致黑名单检查失效。

Engine/Properties/convert.py

@@ -9,12 +9,15 @@ try:
     JSON_DUMPS = lambda x: orjson.dumps(x).decode('utf-8')
     JSON_LOADS = orjson.loads
     HAS_ORJSON = True
+
 except ImportError:
     import json
     JSON_DUMPS = json.dumps
     JSON_LOADS = json.loads
     HAS_ORJSON = False
 
+####################################################################################################
+
 JSONL_PATH = "pe_features.jsonl"
 BATCH_SIZE = 1000
 MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024
@@ -69,7 +72,8 @@ V2_GUID = GUID(0x00AAC56B, 0xCD44, 0x11D0, (ctypes.c_ubyte * 8)(0x8C, 0xC2, 0x00
 ####################################################################################################
 
 def verify_signature(file_path):
-    if os.name != 'nt': return 0
+    if os.name != 'nt':
+        return 0
     try:
         wintrust = ctypes.windll.wintrust
         wintrust.WinVerifyTrust.argtypes = [ctypes.wintypes.HWND, ctypes.POINTER(GUID), ctypes.wintypes.LPVOID]
@@ -126,16 +130,20 @@ class FeatureExtractor:
         try:
             f = float(val)
             return f if not (math.isinf(f) or math.isnan(f)) else 0.0
+
         except Exception: 
             return 0.0
 
     @staticmethod
     def _calc_entropy(data):
-        if not data: return 0.0
+        if not data:
+            return 0.0
+
         arr = np.frombuffer(data, dtype=np.uint8)
         sz = len(arr)
         counts = np.bincount(arr, minlength=256)
         counts = counts[counts > 0]
+
         return float(np.log2(sz) - np.sum(counts * np.log2(counts)) / sz)
 
     @classmethod
@@ -189,6 +197,7 @@ class FeatureExtractor:
             byte_bins = w_counts.reshape(16, 16).sum(axis=1)
             idx_start = ent_bin * 16
             ent_hist[idx_start : idx_start+16] += byte_bins
+
         else:
             num_windows = (sz - window) // step + 1
             batch_windows = 10000 
@@ -247,6 +256,7 @@ class FeatureExtractor:
     def _extract_rich_header(cls, pe):
         if not hasattr(pe, 'RICH_HEADER') or not pe.RICH_HEADER:
             return {"HasRichHeader": 0.0, "RichHeaderCount": 0.0}
+
         return {
             "HasRichHeader": 1.0,
             "RichHeaderCount": float(len(pe.RICH_HEADER.values) // 2) if hasattr(pe.RICH_HEADER, 'values') else 0.0
@@ -305,6 +315,7 @@ class FeatureExtractor:
                 for entry_lang in entry_id.directory.entries:
                     if hasattr(entry_lang, 'id'):
                         langs.add(entry_lang.id)
+
                     if hasattr(entry_lang, 'data'):
                         try:
                             data = pe.get_data(entry_lang.data.struct.OffsetToData, entry_lang.data.struct.Size)
@@ -328,10 +339,13 @@ class FeatureExtractor:
         if hasattr(pe, 'DIRECTORY_ENTRY_LOAD_CONFIG'):
             cfg["HasLoadConfig"] = 1.0
             struct = pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct
+
             if getattr(struct, 'GuardCFFunctionTable', 0) != 0:
                 cfg["HasCFG"] = 1.0
+
             if getattr(struct, 'SEHandlerTable', 0) != 0:
                 cfg["HasSEHTable"] = 1.0
+
         return cfg
 
     @classmethod
@@ -364,6 +378,7 @@ class FeatureExtractor:
             dw_length = int.from_bytes(file_bytes[curr:curr+4], 'little')
             if dw_length < 8:
                 break
+
             count += 1
             curr += (dw_length + 7) & ~7
 
@@ -372,9 +387,10 @@ class FeatureExtractor:
 
     @classmethod
     def extract(cls, file_bytes, file_path, fsize):
-        if fsize == 0: return None
-        base, dlls, apis, pe = {}, set(), set(), None
+        if fsize == 0:
+            return None
 
+        base, dlls, apis, pe = {}, set(), set(), None
         try:
             pe = pefile.PE(data=file_bytes, fast_load=True)
             
@@ -410,7 +426,6 @@ class FeatureExtractor:
             base['Is64Bit'] = 1.0 if base['Machine'] in (0x8664, 0xAA64, 0x0200) else 0.0
             base['IsExe'] = 1.0 if pe.is_exe() else 0.0
             base['IsDll'] = 1.0 if pe.is_dll() else 0.0
-
             base['ExceptionCount'] = 0.0
 
             if hasattr(pe, 'OPTIONAL_HEADER'):
@@ -452,10 +467,14 @@ class FeatureExtractor:
                     raw_sizes.append(section.SizeOfRawData)
                     v_sizes.append(section.Misc_VirtualSize)
 
-                    if section.Characteristics & 0x20000000: exec_sec += 1
-                    if section.Characteristics & 0x80000000: write_sec += 1
-                    if section.Characteristics & 0x40000000: read_sec += 1
-                    if section.SizeOfRawData + section.PointerToRawData > fsize: sec_exc = 1
+                    if section.Characteristics & 0x20000000:
+                        exec_sec += 1
+                    if section.Characteristics & 0x80000000:
+                        write_sec += 1
+                    if section.Characteristics & 0x40000000:
+                        read_sec += 1
+                    if section.SizeOfRawData + section.PointerToRawData > fsize:
+                        sec_exc = 1
 
                     for flag in cls._CHAR_FLAGS:
                         if section.Characteristics & flag:
@@ -495,11 +514,13 @@ class FeatureExtractor:
                         if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
                             for st in getattr(fileinfo, 'StringTable', []):
                                 for key, val in st.entries.items():
+
                                     try:
                                         k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
                                         if k in string_keys:
                                             v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
                                             base[f'{k}Length'] = float(len(v))
+
                                     except Exception: 
                                         continue
 
@@ -519,13 +540,19 @@ class FeatureExtractor:
                 func_count = 0
                 for entry in pe.DIRECTORY_ENTRY_IMPORT:
                     if getattr(entry, 'dll', None):
-                        try: dlls.add(entry.dll.decode('ascii', 'ignore').lower())
-                        except Exception: pass
+                        try:
+                            dlls.add(entry.dll.decode('ascii', 'ignore').lower())
+                        except Exception:
+                            pass
+
                     for imp in getattr(entry, 'imports', []):
                         func_count += 1
                         if getattr(imp, 'name', None):
-                            try: apis.add(imp.name.decode('ascii', 'ignore'))
-                            except Exception: pass
+                            try:
+                                apis.add(imp.name.decode('ascii', 'ignore'))
+                            except Exception:
+                                pass
+
                 base['ImportFunctionCount'] = float(func_count)
 
             base['ExportCount'] = float(len(pe.DIRECTORY_ENTRY_EXPORT.symbols)) if (hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols')) else 0.0
@@ -550,10 +577,13 @@ class FeatureExtractor:
             base.update(cls._extract_load_config(pe))
             base.update(cls._extract_security_directory(pe, file_bytes, fsize))
 
-            for k in base: base[k] = cls._safe_float(base[k])
+            for k in base:
+                base[k] = cls._safe_float(base[k])
+
             return {"Base": base, "DLLs": list(dlls), "APIs": list(apis)}
 
-        except Exception: return None
+        except Exception:
+            return None
         finally:
             if pe: pe.close()
 
@@ -570,6 +600,7 @@ def load_existing_hashes():
             match = pattern.search(line)
             if match:
                 hashes.add(match.group(1).decode('ascii'))
+
     return hashes
 
 GLOBAL_HASHES = set()
@@ -636,6 +667,7 @@ def scan_and_save(path, label, existing_hashes):
                 skipped += 1
             elif status == 'success':
                 sha256, json_str = data
+
                 if sha256 not in existing_hashes:
                     existing_hashes.add(sha256)
                     batch_buffer.append(json_str)
@@ -660,10 +692,12 @@ def scan_and_save(path, label, existing_hashes):
         print("\n\n[-] User aborted. Force terminating all child processes...")
         pool.terminate()
         pool.join()
+
     except Exception as e:
         print(f"\n[-] Critical error: {e}")
         pool.terminate()
         pool.join()
+
     finally:
         if batch_buffer:
             try:
@@ -688,15 +722,20 @@ if __name__ == "__main__":
         while True:
             print("-" * 57)
             target_path = input("\n[*] Enter path (file or directory): ").strip().strip('"').strip("'")
-            if target_path.lower() in ['exit', 'q']: break
+            if target_path.lower() in ['exit', 'q']:
+                break
+
             if not target_path or not os.path.exists(target_path):
                 print("[-] Invalid path.")
                 continue
 
             while True:
                 label_input = input("[*] Enter label (0=Safe, 1=Malware): ").strip()
-                if label_input.lower() in ['exit', 'q']: sys.exit()
-                if label_input in ['0', '1']: break
+                if label_input.lower() in ['exit', 'q']:
+                    sys.exit()
+                if label_input in ['0', '1']:
+                    break
+
                 print("[-] Please enter 0 or 1.")
 
             scan_and_save(target_path, int(label_input), existing_hashes)

Engine/Properties/scanner.py

@@ -116,16 +116,20 @@ class FeatureExtractor:
         try:
             f = float(val)
             return f if not (math.isinf(f) or math.isnan(f)) else 0.0
+
         except Exception: 
             return 0.0
 
     @staticmethod
     def _calc_entropy(data):
-        if not data: return 0.0
+        if not data:
+            return 0.0
+
         arr = np.frombuffer(data, dtype=np.uint8)
         sz = len(arr)
         counts = np.bincount(arr, minlength=256)
         counts = counts[counts > 0]
+
         return float(np.log2(sz) - np.sum(counts * np.log2(counts)) / sz)
 
     @classmethod
@@ -295,6 +299,7 @@ class FeatureExtractor:
                 for entry_lang in entry_id.directory.entries:
                     if hasattr(entry_lang, 'id'):
                         langs.add(entry_lang.id)
+
                     if hasattr(entry_lang, 'data'):
                         try:
                             data = pe.get_data(entry_lang.data.struct.OffsetToData, entry_lang.data.struct.Size)
@@ -318,10 +323,13 @@ class FeatureExtractor:
         if hasattr(pe, 'DIRECTORY_ENTRY_LOAD_CONFIG'):
             cfg["HasLoadConfig"] = 1.0
             struct = pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct
+
             if getattr(struct, 'GuardCFFunctionTable', 0) != 0:
                 cfg["HasCFG"] = 1.0
+
             if getattr(struct, 'SEHandlerTable', 0) != 0:
                 cfg["HasSEHTable"] = 1.0
+
         return cfg
 
     @classmethod
@@ -354,6 +362,7 @@ class FeatureExtractor:
             dw_length = int.from_bytes(file_bytes[curr:curr+4], 'little')
             if dw_length < 8:
                 break
+
             count += 1
             curr += (dw_length + 7) & ~7
 
@@ -406,7 +415,6 @@ class FeatureExtractor:
             base['Is64Bit'] = 1.0 if base['Machine'] in (0x8664, 0xAA64, 0x0200) else 0.0
             base['IsExe'] = 1.0 if pe.is_exe() else 0.0
             base['IsDll'] = 1.0 if pe.is_dll() else 0.0
-
             base['ExceptionCount'] = 0.0
 
             if hasattr(pe, 'OPTIONAL_HEADER'):
@@ -448,10 +456,14 @@ class FeatureExtractor:
                     raw_sizes.append(section.SizeOfRawData)
                     v_sizes.append(section.Misc_VirtualSize)
 
-                    if section.Characteristics & 0x20000000: exec_sec += 1
-                    if section.Characteristics & 0x80000000: write_sec += 1
-                    if section.Characteristics & 0x40000000: read_sec += 1
-                    if section.SizeOfRawData + section.PointerToRawData > fsize: sec_exc = 1
+                    if section.Characteristics & 0x20000000:
+                        exec_sec += 1
+                    if section.Characteristics & 0x80000000:
+                        write_sec += 1
+                    if section.Characteristics & 0x40000000:
+                        read_sec += 1
+                    if section.SizeOfRawData + section.PointerToRawData > fsize:
+                        sec_exc = 1
 
                     for flag in cls._CHAR_FLAGS:
                         if section.Characteristics & flag:
@@ -491,11 +503,13 @@ class FeatureExtractor:
                         if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
                             for st in getattr(fileinfo, 'StringTable', []):
                                 for key, val in st.entries.items():
+
                                     try:
                                         k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
                                         if k in string_keys:
                                             v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
                                             base[f'{k}Length'] = float(len(v))
+
                                     except Exception: 
                                         continue
 
@@ -515,13 +529,19 @@ class FeatureExtractor:
                 func_count = 0
                 for entry in pe.DIRECTORY_ENTRY_IMPORT:
                     if getattr(entry, 'dll', None):
-                        try: dlls.add(entry.dll.decode('ascii', 'ignore').lower())
-                        except Exception: pass
+                        try:
+                            dlls.add(entry.dll.decode('ascii', 'ignore').lower())
+                        except Exception:
+                            pass
+
                     for imp in getattr(entry, 'imports', []):
                         func_count += 1
                         if getattr(imp, 'name', None):
-                            try: apis.add(imp.name.decode('ascii', 'ignore'))
-                            except Exception: pass
+                            try:
+                                apis.add(imp.name.decode('ascii', 'ignore'))
+                            except Exception:
+                                pass
+
                 base['ImportFunctionCount'] = float(func_count)
 
             base['ExportCount'] = float(len(pe.DIRECTORY_ENTRY_EXPORT.symbols)) if (hasattr(pe, 'DIRECTORY_ENTRY_EXPORT') and hasattr(pe.DIRECTORY_ENTRY_EXPORT, 'symbols')) else 0.0
@@ -546,12 +566,16 @@ class FeatureExtractor:
             base.update(cls._extract_load_config(pe))
             base.update(cls._extract_security_directory(pe, file_bytes, fsize))
 
-            for k in base: base[k] = cls._safe_float(base[k])
+            for k in base:
+                base[k] = cls._safe_float(base[k])
+
             return {"Base": base, "DLLs": list(dlls), "APIs": list(apis)}
 
-        except Exception: return None
+        except Exception:
+            return None
         finally:
-            if pe: pe.close()
+            if pe:
+                pe.close()
 
 ####################################################################################################
 
@@ -564,16 +588,48 @@ class ModelPredictor:
         expected_dim = self.sess.get_inputs()[0].shape[1]
         current_dim = len(self.model_features)
         if current_dim != expected_dim:
-            raise ValueError(f"Dimension mismatch! Model expects {expected_dim} features, but feature file lists {current_dim}.")
+            raise ValueError(f"Dimension error: Model expects {expected_dim}, but feature file has {current_dim}")
 
         self.feat_map = {feat: i for i, feat in enumerate(self.model_features)}
+        
+        self.dll_hash_dim = 512
+        self.api_hash_dim = 4096
+        self.dll_hash_pad = 3
+        self.api_hash_pad = 4
+        self._parse_hash_dims()
 
     def _load_features(self, path):
         if not os.path.exists(path):
             raise FileNotFoundError(f"Feature file not found: {path}")
+
         with open(path, 'r') as f:
             return json.load(f)
 
+    def _parse_hash_dims(self):
+        max_dll = -1
+        max_api = -1
+        
+        for feat in self.model_features:
+            if feat.startswith("DllHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_dll = max(max_dll, int(val_str))
+                    self.dll_hash_pad = len(val_str)
+                except Exception:
+                    pass
+            elif feat.startswith("ApiHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_api = max(max_api, int(val_str))
+                    self.api_hash_pad = len(val_str)
+                except Exception:
+                    pass
+                    
+        if max_dll >= 0:
+            self.dll_hash_dim = max_dll + 1
+        if max_api >= 0:
+            self.api_hash_dim = max_api + 1
+
     def predict(self, raw_data):
         vec = np.zeros((1, len(self.model_features)), dtype=np.float32)
         base = raw_data.get('Base', {})
@@ -585,14 +641,14 @@ class ModelPredictor:
                 vec[0, self.feat_map[k]] = v
 
         for d in dlls:
-            h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
-            feat_name = f"DllHash_{h:03d}"
+            h = zlib.crc32(d.encode('utf-8', 'ignore')) % self.dll_hash_dim
+            feat_name = f"DllHash_{h:0{self.dll_hash_pad}d}"
             if feat_name in self.feat_map:
                 vec[0, self.feat_map[feat_name]] += 1.0
 
         for a in apis:
-            h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
-            feat_name = f"ApiHash_{h:04d}"
+            h = zlib.crc32(a.encode('utf-8', 'ignore')) % self.api_hash_dim
+            feat_name = f"ApiHash_{h:0{self.api_hash_pad}d}"
             if feat_name in self.feat_map:
                 vec[0, self.feat_map[feat_name]] += 1.0
 
@@ -604,9 +660,11 @@ class ModelPredictor:
                 prob_dict = result[0]
                 if hasattr(prob_dict, 'get'):
                     return float(prob_dict.get(1, prob_dict.get('1', 0.0)))
+
             elif isinstance(result, np.ndarray):
                 if result.ndim == 2 and result.shape[1] > 1:
                     return float(result[0][1])
+                    
         return 0.0
 
 ####################################################################################################
@@ -615,6 +673,7 @@ def scan_target(target, predictor):
     files = []
     if os.path.isfile(target):
         files.append(target)
+
     elif os.path.isdir(target):
         for r, _, fs in os.walk(target):
             for f in fs:
@@ -679,6 +738,7 @@ if __name__ == "__main__":
                 print()
                 print("-" * 80)
                 scan_target(target, predictor)
+
             else:
                 print(f"[-] Path does not exist: {target}")
     else:
@@ -687,11 +747,15 @@ if __name__ == "__main__":
                 print()
                 print("-" * 80)
                 path = input("\n[?] Enter File or Folder Path (or 'q' to exit): ").strip().strip('"').strip("'")
-                if path.lower() in ['q', 'exit']: break
+                if path.lower() in ['q', 'exit']:
+                    break
+
                 if not os.path.exists(path):
                     print("[-] Path does not exist.")
                     continue
+
                 scan_target(path, predictor)
+
             except KeyboardInterrupt:
                 break
             except Exception as e:

Engine/Properties/train_server.py

@@ -12,6 +12,7 @@ from sklearn.metrics import accuracy_score, roc_auc_score
 try:
     import orjson
     JSON_LOADS = orjson.loads
+
 except ImportError:
     JSON_LOADS = json.loads
 
@@ -21,11 +22,11 @@ JSONL_PATH = "pe_features.jsonl"
 MODEL_FILE = "model.txt"
 ONNX_FILE = "Pefile_General_S1.onnx"
 FEATURE_FILE = "features.json"
+
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
-
-DLL_HASH_DIM = 256
-API_HASH_DIM = 1024
+DLL_HASH_DIM = 512
+API_HASH_DIM = 4096
 
 EXCLUDE_FEATURES = {
     'label', 'filehash',
@@ -56,12 +57,14 @@ def analyze_schema(jsonl_path):
     with open(jsonl_path, 'rb') as f:
         for line in f:
             num_lines += 1
+
             if not base_keys:
                 try:
                     data = JSON_LOADS(line)
                     base_data = data.get('Base')
                     if base_data:
                         base_keys.update(base_data.keys())
+
                 except Exception:
                     pass
 
@@ -76,6 +79,7 @@ def analyze_schema(jsonl_path):
 def load_data_efficiently(jsonl_path, base_schema, dll_schema, api_schema, num_lines):
     print(f"[*] Stage 2: Building sparse feature matrix dynamically via Multiprocessing...")
     final_features = base_schema + dll_schema + api_schema
+
     num_features = len(final_features)
     offset_dll = len(base_schema)
     offset_api = offset_dll + DLL_HASH_DIM
@@ -118,6 +122,7 @@ def _chunk_worker(args):
             if f.read(1) != b'\n':
                 f.seek(start_byte)
                 f.readline()
+
             else:
                 f.seek(start_byte)
         else:
@@ -181,9 +186,7 @@ def _calculate_dynamic_lr(current_iter: int) -> float:
 def train_process(X, y, feature_names):
     print(f"[*] Dataset shape: {X.shape}")
     
-    X_train, X_test, y_train, y_test = train_test_split(
-        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
-    )
+    X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y)
     
     n_pos = (y_train == 1).sum()
     n_neg = (y_train == 0).sum()
@@ -300,6 +303,7 @@ if __name__ == "__main__":
     try:
         model, X_test, y_test = train_process(X, y, final_features)
         evaluate_and_save(model, X_test, y_test)
+
     except KeyboardInterrupt:
         print("\n\n[-] Training aborted.")
     except Exception as e:

Engine/Properties/train_user.py

@@ -12,6 +12,7 @@ from sklearn.metrics import accuracy_score, roc_auc_score
 try:
     import orjson
     JSON_LOADS = orjson.loads
+
 except ImportError:
     JSON_LOADS = json.loads
 
@@ -21,11 +22,11 @@ JSONL_PATH = "pe_features.jsonl"
 MODEL_FILE = "model.txt"
 ONNX_FILE = "Pefile_General_T1.onnx"
 FEATURE_FILE = "features.json"
+
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
-
-DLL_HASH_DIM = 256
-API_HASH_DIM = 1024
+DLL_HASH_DIM = 512
+API_HASH_DIM = 4096
 
 EXCLUDE_FEATURES = {
     'label', 'filehash',
@@ -56,12 +57,14 @@ def analyze_schema(jsonl_path):
     with open(jsonl_path, 'rb') as f:
         for line in f:
             num_lines += 1
+
             if not base_keys:
                 try:
                     data = JSON_LOADS(line)
                     base_data = data.get('Base')
                     if base_data:
                         base_keys.update(base_data.keys())
+
                 except Exception:
                     pass
 
@@ -76,6 +79,7 @@ def analyze_schema(jsonl_path):
 def load_data_efficiently(jsonl_path, base_schema, dll_schema, api_schema, num_lines):
     print(f"[*] Stage 2: Building sparse feature matrix dynamically via Multiprocessing...")
     final_features = base_schema + dll_schema + api_schema
+
     num_features = len(final_features)
     offset_dll = len(base_schema)
     offset_api = offset_dll + DLL_HASH_DIM
@@ -118,6 +122,7 @@ def _chunk_worker(args):
             if f.read(1) != b'\n':
                 f.seek(start_byte)
                 f.readline()
+
             else:
                 f.seek(start_byte)
         else:
@@ -181,9 +186,7 @@ def _calculate_dynamic_lr(current_iter: int) -> float:
 def train_process(X, y, feature_names):
     print(f"[*] Dataset shape: {X.shape}")
     
-    X_train, X_test, y_train, y_test = train_test_split(
-        X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y
-    )
+    X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=TEST_SIZE, random_state=RANDOM_SEED, stratify=y)
     
     n_pos = (y_train == 1).sum()
     n_neg = (y_train == 0).sum()
@@ -208,7 +211,7 @@ def train_process(X, y, feature_names):
         params,
         train_data,
         valid_sets=[valid_data],
-        num_boost_round=500,
+        num_boost_round=300,
         callbacks=[
             lgb.log_evaluation(period=50),
             lgb.reset_parameter(learning_rate=_calculate_dynamic_lr)
@@ -300,6 +303,7 @@ if __name__ == "__main__":
     try:
         model, X_test, y_test = train_process(X, y, final_features)
         evaluate_and_save(model, X_test, y_test)
+
     except KeyboardInterrupt:
         print("\n\n[-] Training aborted.")
     except Exception as e:

Interface/static/js/i18n.js

@@ -68,18 +68,14 @@ window.AppI18n = {
             "update_check": "檢查更新",
             "update_check_desc": "此選項可以檢查可用更新",
             "search_proc": "搜尋進程...",
-            "btn_view": "查看",
-            "btn_end": "結束",
             "manage_white": "白名單管理",
             "search_file": "搜尋檔案...",
-            "btn_add": "加入",
-            "btn_remove": "移除",
             "manage_quarantine": "隔離區管理",
             "btn_scan": "掃描",
             "search_window": "搜尋窗口...",
             "search_rule": "搜尋規則...",
             "search_log": "搜尋日誌...",
-            "btn_export": "導出",
+            "btn_export": "導出項目",
             "msg_init": "正在初始化中",
             "msg_update_fail": "檢查更新失敗",
             "msg_new_version": "發現新版本",
@@ -98,7 +94,6 @@ window.AppI18n = {
             "msg_click_target": "請在5秒內點擊目標視窗...",
             "msg_confirm_block": "確認攔截",
             "msg_repaired": "已修復選取項目",
-            "btn_repair": "修復",
             "title_prompt": "提示",
             "title_error": "錯誤",
             "path_unknown": "未知路徑",
@@ -141,12 +136,56 @@ window.AppI18n = {
             "col_status": "狀態",
             "status_enabled": "已啟用",
             "status_disabled": "已禁用",
-            "btn_enable": "啟用",
-            "btn_disable": "禁用",
             "search_item": "搜尋項目...",
             "type_reg": "登錄檔",
             "type_srv": "服務",
             "type_tsk": "排程任務",
+            "btn_view_item": "查看項目",
+            "btn_end": "結束進程",
+            "btn_enable_item": "啟用項目",
+            "btn_disable_item": "禁用項目",
+            "btn_delete_item": "刪除項目",
+            "btn_repair_item": "修復項目",
+            "btn_add_item": "新增項目",
+            "btn_remove_item": "移除項目",
+            "btn_add_file": "新增檔案",
+            "btn_add_path": "新增路徑",
+            "manage_netmon": "流量監控",
+            "manage_netmon_desc": "此選項可以實時監控網路流量",
+            "col_down_speed": "下載速度",
+            "col_up_speed": "上傳速度",
+            "col_conn_count": "連接數",
+            "btn_extract_item": "提取項目",
+            "msg_extract_success": "成功提取選取項目",
+            "msg_key_activated": "產品金鑰已啟用",
+            "INFO": "資訊",
+            "WARN": "警告",
+            "BLOCK": "攔截",
+            "SCAN": "掃描",
+            "System": "系統",
+            "Config Update": "設定更新",
+            "File Extract": "檔案提取",
+            "Load Engine": "載入引擎",
+            "Scan Completed": "掃描完成",
+            "Scan Engine": "掃描引擎",
+            "Virus Detected": "發現病毒",
+            "Virus Delete": "刪除病毒",
+            "Cloud API": "雲端 API",
+            "MBR Repaired": "MBR 修復",
+            "System Repair": "系統修復",
+            "Process Block": "進程攔截",
+            "Process DLL Block": "進程 DLL 攔截",
+            "File Block": "檔案攔截",
+            "Network Block": "網路攔截",
+            "Driver Block": "驅動攔截",
+            "System Restart": "系統重啟",
+            "Clean Junk": "清理垃圾",
+            "protect_suspend": "進程暫停",
+            "protect_suspend_desc": "此選項可以暫停進程等待掃描",
+            "opt_autostart": "開機啟動",
+            "opt_autostart_desc": "此選項可以設定開機自動執行",
+            "opt_ext_filter": "副檔名過濾",
+            "opt_ext_filter_desc": "此選項僅掃描指定檔案副檔名",
         },
         "simplified_switch": {
             "app_name": "PYAS Security",
@@ -216,18 +255,14 @@ window.AppI18n = {
             "update_check": "检查更新",
             "update_check_desc": "此选项可以检查可用更新",
             "search_proc": "搜索进程...",
-            "btn_view": "查看",
-            "btn_end": "结束",
             "manage_white": "白名单管理",
             "search_file": "搜索文件...",
-            "btn_add": "加入",
-            "btn_remove": "移除",
             "manage_quarantine": "隔离区管理",
             "btn_scan": "扫描",
             "search_window": "搜索窗口...",
             "search_rule": "搜索规则...",
             "search_log": "搜索日志...",
-            "btn_export": "导出",
+            "btn_export": "导出项目",
             "msg_init": "正在初始化中",
             "msg_update_fail": "检查更新失败",
             "msg_new_version": "发现新版本",
@@ -246,7 +281,6 @@ window.AppI18n = {
             "msg_click_target": "请在5秒内点击目标窗口...",
             "msg_confirm_block": "确认拦截",
             "msg_repaired": "已修复选取项目",
-            "btn_repair": "修复",
             "title_prompt": "提示",
             "title_error": "错误",
             "path_unknown": "未知路径",
@@ -289,12 +323,56 @@ window.AppI18n = {
             "col_status": "状态",
             "status_enabled": "已启用",
             "status_disabled": "已禁用",
-            "btn_enable": "启用",
-            "btn_disable": "禁用",
             "search_item": "搜索项目...",
             "type_reg": "注册表",
             "type_srv": "服务",
             "type_tsk": "计划任务",
+            "btn_view_item": "查看项目",
+            "btn_end": "结束进程",
+            "btn_enable_item": "启用项目",
+            "btn_disable_item": "禁用项目",
+            "btn_delete_item": "删除项目",
+            "btn_repair_item": "修复项目",
+            "btn_add_item": "新增项目",
+            "btn_remove_item": "移除项目",
+            "btn_add_file": "新增文件",
+            "btn_add_path": "新增路径",
+            "manage_netmon": "流量监控",
+            "manage_netmon_desc": "此选项可以实时监控网络流量",
+            "col_down_speed": "下载速度",
+            "col_up_speed": "上传速度",
+            "col_conn_count": "连接数",
+            "btn_extract_item": "提取项目",
+            "msg_extract_success": "成功提取选取项目",
+            "msg_key_activated": "产品密钥已启用",
+            "INFO": "信息",
+            "WARN": "警告",
+            "BLOCK": "拦截",
+            "SCAN": "扫描",
+            "System": "系统",
+            "Config Update": "设置更新",
+            "File Extract": "文件提取",
+            "Load Engine": "加载引擎",
+            "Scan Completed": "扫描完成",
+            "Scan Engine": "扫描引擎",
+            "Virus Detected": "发现病毒",
+            "Virus Delete": "删除病毒",
+            "Cloud API": "云端 API",
+            "MBR Repaired": "MBR 修复",
+            "System Repair": "系统修复",
+            "Process Block": "进程拦截",
+            "Process DLL Block": "进程 DLL 拦截",
+            "File Block": "文件拦截",
+            "Network Block": "网络拦截",
+            "Driver Block": "驱动拦截",
+            "System Restart": "系统重启",
+            "Clean Junk": "清理垃圾",
+            "protect_suspend": "进程暂停",
+            "protect_suspend_desc": "此选项可以暂停进程等待扫描",
+            "opt_autostart": "开机启动",
+            "opt_autostart_desc": "此选项可以设定开机自动运行",
+            "opt_ext_filter": "后缀名过滤",
+            "opt_ext_filter_desc": "此选项仅扫描指定文件后缀名",
         },
         "english_switch": {
             "app_name": "PYAS Security",
@@ -364,18 +442,14 @@ window.AppI18n = {
             "update_check": "Check for Updates",
             "update_check_desc": "Check for the latest updates",
             "search_proc": "Search processes...",
-            "btn_view": "View",
-            "btn_end": "End Task",
             "manage_white": "Whitelist Manager",
             "search_file": "Search files...",
-            "btn_add": "Add",
-            "btn_remove": "Remove",
             "manage_quarantine": "Quarantine Manager",
             "btn_scan": "Scan",
             "search_window": "Search windows...",
             "search_rule": "Search rules...",
             "search_log": "Search logs...",
-            "btn_export": "Export",
+            "btn_export": "Export Items",
             "msg_init": "Initializing...",
             "msg_update_fail": "Update check failed",
             "msg_new_version": "New version found",
@@ -394,7 +468,6 @@ window.AppI18n = {
             "msg_click_target": "Click the target window within 5s...",
             "msg_confirm_block": "Confirm Block",
             "msg_repaired": "Selected items repaired",
-            "btn_repair": "Repair",
             "title_prompt": "Prompt",
             "title_error": "Error",
             "path_unknown": "Unknown Path",
@@ -437,12 +510,56 @@ window.AppI18n = {
             "col_status": "Status",
             "status_enabled": "Enabled",
             "status_disabled": "Disabled",
-            "btn_enable": "Enable",
-            "btn_disable": "Disable",
             "search_item": "Search items...",
             "type_reg": "Registry",
             "type_srv": "Service",
             "type_tsk": "Task",
+            "btn_view_item": "View Item",
+            "btn_end": "End Process",
+            "btn_enable_item": "Enable Item",
+            "btn_disable_item": "Disable Item",
+            "btn_delete_item": "Delete Item",
+            "btn_repair_item": "Repair Item",
+            "btn_add_item": "Add Item",
+            "btn_remove_item": "Remove Item",
+            "btn_add_file": "Add File",
+            "btn_add_path": "Add Path",
+            "manage_netmon": "Traffic Monitor",
+            "manage_netmon_desc": "Monitor network traffic in real-time",
+            "col_down_speed": "Download Speed",
+            "col_up_speed": "Upload Speed",
+            "col_conn_count": "Connections",
+            "btn_extract_item": "Extract Item",
+            "msg_extract_success": "Successfully extracted selected items",
+            "msg_key_activated": "Product key activated",
+            "INFO": "INFO",
+            "WARN": "WARN",
+            "BLOCK": "BLOCK",
+            "SCAN": "SCAN",
+            "System": "System",
+            "Config Update": "Config Update",
+            "File Extract": "File Extract",
+            "Load Engine": "Load Engine",
+            "Scan Completed": "Scan Completed",
+            "Scan Engine": "Scan Engine",
+            "Virus Detected": "Virus Detected",
+            "Virus Delete": "Virus Delete",
+            "Cloud API": "Cloud API",
+            "MBR Repaired": "MBR Repaired",
+            "System Repair": "System Repair",
+            "Process Block": "Process Block",
+            "Process DLL Block": "Process DLL Block",
+            "File Block": "File Block",
+            "Network Block": "Network Block",
+            "Driver Block": "Driver Block",
+            "System Restart": "System Restart",
+            "Clean Junk": "Clean Junk",
+            "protect_suspend": "Process Suspend",
+            "protect_suspend_desc": "Suspend processes while waiting for scanning",
+            "opt_autostart": "Auto Start",
+            "opt_autostart_desc": "Run automatically at system startup",
+            "opt_ext_filter": "Suffix Filter",
+            "opt_ext_filter_desc": "This option only scans specified file extensions",
         },
         "japanese_switch": {
             "app_name": "PYAS Security",
@@ -512,12 +629,8 @@ window.AppI18n = {
             "update_check": "アップデートの確認",
             "update_check_desc": "利用可能なアップデートを確認します",
             "search_proc": "プロセスを検索...",
-            "btn_view": "表示",
-            "btn_end": "タスクの終了",
             "manage_white": "ホワイトリスト管理",
             "search_file": "ファイルを検索...",
-            "btn_add": "追加",
-            "btn_remove": "削除",
             "manage_quarantine": "隔離管理",
             "btn_scan": "スキャン",
             "search_window": "ウィンドウを検索...",
@@ -542,7 +655,6 @@ window.AppI18n = {
             "msg_click_target": "5秒以内にターゲットウィンドウをクリックしてください...",
             "msg_confirm_block": "ブロックの確認",
             "msg_repaired": "選択された項目が修復されました",
-            "btn_repair": "修復",
             "title_prompt": "プロンプト",
             "title_error": "エラー",
             "path_unknown": "不明なパス",
@@ -585,12 +697,56 @@ window.AppI18n = {
             "col_status": "ステータス",
             "status_enabled": "有効",
             "status_disabled": "無効",
-            "btn_enable": "有効化",
-            "btn_disable": "無効化",
             "search_item": "項目を検索...",
             "type_reg": "レジストリ",
             "type_srv": "サービス",
             "type_tsk": "タスク",
+            "btn_view_item": "項目を表示",
+            "btn_end": "プロセスを終了",
+            "btn_enable_item": "項目を有効化",
+            "btn_disable_item": "項目を無効化",
+            "btn_delete_item": "項目を削除",
+            "btn_repair_item": "項目を修復",
+            "btn_add_item": "項目を追加",
+            "btn_remove_item": "項目を削除",
+            "btn_add_file": "ファイルを追加",
+            "btn_add_path": "パスを追加",
+            "manage_netmon": "トラフィック監視",
+            "manage_netmon_desc": "ネットワークトラフィックをリアルタイムで監視します",
+            "col_down_speed": "ダウンロード速度",
+            "col_up_speed": "アップロード速度",
+            "col_conn_count": "接続数",
+            "btn_extract_item": "アイテムを抽出",
+            "msg_extract_success": "選択したアイテムを正常に抽出しました",
+            "msg_key_activated": "プロダクトキーが有効化されました",
+            "INFO": "情報",
+            "WARN": "警告",
+            "BLOCK": "ブロック",
+            "SCAN": "スキャン",
+            "System": "システム",
+            "Config Update": "設定の更新",
+            "File Extract": "ファイルの抽出",
+            "Load Engine": "エンジンのロード",
+            "Scan Completed": "スキャン完了",
+            "Scan Engine": "スキャンエンジン",
+            "Virus Detected": "ウイルス検出",
+            "Virus Delete": "ウイルス削除",
+            "Cloud API": "クラウド API",
+            "MBR Repaired": "MBR 修復",
+            "System Repair": "システム修復",
+            "Process Block": "プロセスブロック",
+            "Process DLL Block": "プロセス DLL ブロック",
+            "File Block": "ファイルブロック",
+            "Network Block": "ネットワークブロック",
+            "Driver Block": "ドライバーブロック",
+            "System Restart": "システムの再起動",
+            "Clean Junk": "ジャンククリーンアップ",
+            "protect_suspend": "プロセスの一時停止",
+            "protect_suspend_desc": "スキャン待ちの間プロセスを一時停止します",
+            "opt_autostart": "自動起動",
+            "opt_autostart_desc": "システム起動時に自動的に実行します",
+            "opt_ext_filter": "拡張子フィルタ",
+            "opt_ext_filter_desc": "このオプションは指定された拡張子のファイルのみをスキャンします",
         },
         "korean_switch": {
             "app_name": "PYAS Security",
@@ -660,12 +816,8 @@ window.AppI18n = {
             "update_check": "업데이트 확인",
             "update_check_desc": "사용 가능한 최신 업데이트를 확인합니다",
             "search_proc": "프로세스 검색...",
-            "btn_view": "보기",
-            "btn_end": "작업 끝내기",
             "manage_white": "화이트리스트 관리",
             "search_file": "파일 검색...",
-            "btn_add": "추가",
-            "btn_remove": "제거",
             "manage_quarantine": "격리소 관리",
             "btn_scan": "스캔",
             "search_window": "창 검색...",
@@ -690,7 +842,6 @@ window.AppI18n = {
             "msg_click_target": "5초 이내에 대상 창을 클릭하십시오...",
             "msg_confirm_block": "차단 확인",
             "msg_repaired": "선택한 항목이 복구되었습니다",
-            "btn_repair": "복구",
             "title_prompt": "프롬프트",
             "title_error": "오류",
             "path_unknown": "알 수 없는 경로",
@@ -733,12 +884,56 @@ window.AppI18n = {
             "col_status": "상태",
             "status_enabled": "사용",
             "status_disabled": "사용 안 함",
-            "btn_enable": "사용",
-            "btn_disable": "사용 안 함",
             "search_item": "항목 검색...",
             "type_reg": "레지스트리",
             "type_srv": "서비스",
             "type_tsk": "작업",
+            "btn_view_item": "항목 보기",
+            "btn_end": "프로세스 종료",
+            "btn_enable_item": "항목 사용",
+            "btn_disable_item": "항목 사용 안 함",
+            "btn_delete_item": "항목 삭제",
+            "btn_repair_item": "항목 복구",
+            "btn_add_item": "항목 추가",
+            "btn_remove_item": "항목 제거",
+            "btn_add_file": "파일 추가",
+            "btn_add_path": "경로 추가",
+            "manage_netmon": "트래픽 모니터링",
+            "manage_netmon_desc": "실시간으로 네트워크 트래픽을 모니터링합니다",
+            "col_down_speed": "다운로드 속도",
+            "col_up_speed": "업로드 속도",
+            "col_conn_count": "연결 수",
+            "btn_extract_item": "항목 추출",
+            "msg_extract_success": "선택한 항목을 성공적으로 추출했습니다",
+            "msg_key_activated": "제품 키가 활성화되었습니다",
+            "INFO": "정보",
+            "WARN": "경고",
+            "BLOCK": "차단",
+            "SCAN": "스캔",
+            "System": "시스템",
+            "Config Update": "설정 업데이트",
+            "File Extract": "파일 추출",
+            "Load Engine": "엔진 로드",
+            "Scan Completed": "스캔 완료",
+            "Scan Engine": "스캔 엔진",
+            "Virus Detected": "바이러스 발견",
+            "Virus Delete": "바이러스 삭제",
+            "Cloud API": "클라우드 API",
+            "MBR Repaired": "MBR 복구",
+            "System Repair": "시스템 복구",
+            "Process Block": "프로세스 차단", 
+            "Process DLL Block": "프로세스 DLL 차단",
+            "File Block": "파일 차단",
+            "Network Block": "네트워크 차단",
+            "Driver Block": "드라이버 차단",
+            "System Restart": "시스템 재시작",
+            "Clean Junk": "정크 정리",
+            "protect_suspend": "프로세스 일시 중지",
+            "protect_suspend_desc": "스캔을 기다리는 동안 프로세스를 일시 중지합니다",
+            "opt_autostart": "자동 시작",
+            "opt_autostart_desc": "시스템 시작 시 자동으로 실행합니다",
+            "opt_ext_filter": "확장자 필터",
+            "opt_ext_filter_desc": "이 옵션은 지정된 파일 확장자만 스캔합니다",
         },
         "french_switch": {
             "app_name": "PYAS Security",
@@ -808,12 +1003,8 @@ window.AppI18n = {
             "update_check": "Vérifier les mises à jour",
             "update_check_desc": "Vérifier les dernières mises à jour",
             "search_proc": "Rechercher des processus...",
-            "btn_view": "Voir",
-            "btn_end": "Fin de tâche",
             "manage_white": "Gestionnaire de liste blanche",
             "search_file": "Rechercher des fichiers...",
-            "btn_add": "Ajouter",
-            "btn_remove": "Retirer",
             "manage_quarantine": "Gestionnaire de quarantaine",
             "btn_scan": "Analyser",
             "search_window": "Rechercher des fenêtres...",
@@ -838,7 +1029,6 @@ window.AppI18n = {
             "msg_click_target": "Cliquez sur la fenêtre cible dans les 5s...",
             "msg_confirm_block": "Confirmer le blocage",
             "msg_repaired": "Éléments sélectionnés réparés",
-            "btn_repair": "Réparer",
             "title_prompt": "Indication",
             "title_error": "Erreur",
             "path_unknown": "Chemin inconnu",
@@ -881,12 +1071,56 @@ window.AppI18n = {
             "col_status": "Statut",
             "status_enabled": "Activé",
             "status_disabled": "Désactivé",
-            "btn_enable": "Activer",
-            "btn_disable": "Désactiver",
             "search_item": "Rechercher des éléments...",
             "type_reg": "Registre",
             "type_srv": "Service",
             "type_tsk": "Tâche",
+            "btn_view_item": "Afficher l'élément",
+            "btn_end": "Terminer le processus",
+            "btn_enable_item": "Activer l'élément",
+            "btn_disable_item": "Désactiver l'élément",
+            "btn_delete_item": "Supprimer l'élément",
+            "btn_repair_item": "Réparer l'élément",
+            "btn_add_item": "Ajouter l'élément",
+            "btn_remove_item": "Retirer l'élément",
+            "btn_add_file": "Ajouter un fichier",
+            "btn_add_path": "Ajouter un chemin",
+            "manage_netmon": "Moniteur de trafic",
+            "manage_netmon_desc": "Surveille le trafic réseau en temps réel",
+            "col_down_speed": "Vitesse de téléchargement",
+            "col_up_speed": "Vitesse de téléversement",
+            "col_conn_count": "Connexions",
+            "btn_extract_item": "Extraire l'élément",
+            "msg_extract_success": "Éléments sélectionnés extraits avec succès",
+            "msg_key_activated": "Clé de produit activée",
+            "INFO": "INFO",
+            "WARN": "AVERT",
+            "BLOCK": "BLOCAGE",
+            "SCAN": "ANALYSE",
+            "System": "Système",
+            "Config Update": "Mise à jour config",
+            "File Extract": "Extraction de fichier",
+            "Load Engine": "Chargement moteur",
+            "Scan Completed": "Analyse terminée",
+            "Scan Engine": "Moteur d'analyse",
+            "Virus Detected": "Virus détecté",
+            "Virus Delete": "Suppression de virus",
+            "Cloud API": "API Cloud",
+            "MBR Repaired": "MBR réparé",
+            "System Repair": "Réparation système",
+            "Process Block": "Processus bloqué",
+            "Process DLL Block": "Blocage DLL Processus",
+            "File Block": "Fichier bloqué",
+            "Network Block": "Réseau bloqué",
+            "Driver Block": "Pilote bloqué",
+            "System Restart": "Redémarrage système",
+            "Clean Junk": "Nettoyage",
+            "protect_suspend": "Suspendre processus",
+            "protect_suspend_desc": "Suspend les processus en attente d'analyse",
+            "opt_autostart": "Démarrage auto",
+            "opt_autostart_desc": "Exécuter automatiquement au démarrage",
+            "opt_ext_filter": "Filtre d'extension",
+            "opt_ext_filter_desc": "Cette option analyse uniquement les extensions de fichiers spécifiées",
         },
         "spanish_switch": {
             "app_name": "PYAS Security",
@@ -894,7 +1128,7 @@ window.AppI18n = {
             "scan_smart": "Escaneo inteligente",
             "scan_smart_desc": "Escanear rápidamente la seguridad del dispositivo",
             "log_export": "Exportar registros",
-            "log_export_desc": "Filtrar registros y exportar a un archivo",
+            "log_export_desc": "Filtrer registros y exportar a un archivo",
             "scan_virus": "Escaneo de virus",
             "scan_virus_desc": "Seleccione un método de escaneo avanzado",
             "btn_delete": "Eliminar",
@@ -956,12 +1190,8 @@ window.AppI18n = {
             "update_check": "Buscar actualizaciones",
             "update_check_desc": "Comprobar las últimas actualizaciones",
             "search_proc": "Buscar procesos...",
-            "btn_view": "Ver",
-            "btn_end": "Finalizar tarea",
             "manage_white": "Gestor de lista blanca",
             "search_file": "Buscar archivos...",
-            "btn_add": "Añadir",
-            "btn_remove": "Eliminar",
             "manage_quarantine": "Gestor de cuarentena",
             "btn_scan": "Escanear",
             "search_window": "Buscar ventanas...",
@@ -986,7 +1216,6 @@ window.AppI18n = {
             "msg_click_target": "Haga clic en la ventana objetivo en 5s...",
             "msg_confirm_block": "Confirmar bloqueo",
             "msg_repaired": "Elementos seleccionados reparados",
-            "btn_repair": "Reparar",
             "title_prompt": "Aviso",
             "title_error": "Error",
             "path_unknown": "Ruta desconocida",
@@ -1029,12 +1258,56 @@ window.AppI18n = {
             "col_status": "Estado",
             "status_enabled": "Habilitado",
             "status_disabled": "Deshabilitado",
-            "btn_enable": "Habilitar",
-            "btn_disable": "Deshabilitar",
             "search_item": "Buscar elementos...",
             "type_reg": "Registro",
             "type_srv": "Servicio",
             "type_tsk": "Tarea",
+            "btn_view_item": "Ver elemento",
+            "btn_end": "Terminar proceso",
+            "btn_enable_item": "Habilitar elemento",
+            "btn_disable_item": "Deshabilitar elemento",
+            "btn_delete_item": "Eliminar elemento",
+            "btn_repair_item": "Reparar elemento",
+            "btn_add_item": "Añadir elemento",
+            "btn_remove_item": "Eliminar elemento",
+            "btn_add_file": "Añadir archivo",
+            "btn_add_path": "Añadir ruta",
+            "manage_netmon": "Monitor de tráfico",
+            "manage_netmon_desc": "Monitorea el tráfico de red en tiempo real",
+            "col_down_speed": "Velocidad de descarga",
+            "col_up_speed": "Velocidad de subida",
+            "col_conn_count": "Conexiones",
+            "btn_extract_item": "Extraer elemento",
+            "msg_extract_success": "Elementos seleccionados extraídos con éxito",
+            "msg_key_activated": "Clave de producto activada",
+            "INFO": "INFO",
+            "WARN": "ADVERT",
+            "BLOCK": "BLOQUEO",
+            "SCAN": "ESCANEO",
+            "System": "Sistema",
+            "Config Update": "Actualización config",
+            "File Extract": "Extracción de archivo",
+            "Load Engine": "Cargar motor",
+            "Scan Completed": "Escaneo completado",
+            "Scan Engine": "Motor de escaneo",
+            "Virus Detected": "Virus detectado",
+            "Virus Delete": "Eliminación de virus",
+            "Cloud API": "API en la nube",
+            "MBR Repaired": "MBR reparado",
+            "System Repair": "Reparación del sistema",
+            "Process Block": "Proceso bloqueado",
+            "Process DLL Block": "Bloqueo de DLL de proceso",
+            "File Block": "Archivo bloqueado",
+            "Network Block": "Red bloqueada",
+            "Driver Block": "Controlador bloqueado",
+            "System Restart": "Reinicio del sistema",
+            "Clean Junk": "Limpieza de basura",
+            "protect_suspend": "Suspender procesos",
+            "protect_suspend_desc": "Suspender procesos mientras espera el escaneo",
+            "opt_autostart": "Inicio automático",
+            "opt_autostart_desc": "Ejecutar automáticamente al inicio",
+            "opt_ext_filter": "Filtro de extensión",
+            "opt_ext_filter_desc": "Esta opción solo escanea extensiones de archivo especificadas",
         },
         "hindi_switch": {
             "app_name": "PYAS Security",
@@ -1104,12 +1377,8 @@ window.AppI18n = {
             "update_check": "अद्यतन जाँचे",
             "update_check_desc": "नवीनतम अपडेट के लिए जाँचें",
             "search_proc": "प्रक्रियाएँ खोजें...",
-            "btn_view": "देखें",
-            "btn_end": "कार्य समाप्त करें",
             "manage_white": "श्वेतसूची प्रबंधक",
             "search_file": "फ़ाइलें खोजें...",
-            "btn_add": "जोड़ें",
-            "btn_remove": "निकालें",
             "manage_quarantine": "संगरोध प्रबंधक",
             "btn_scan": "स्कैन",
             "search_window": "विंडोज़ खोजें...",
@@ -1134,7 +1403,6 @@ window.AppI18n = {
             "msg_click_target": "5 सेकंड के भीतर लक्ष्य विंडो पर क्लिक करें...",
             "msg_confirm_block": "ब्लॉक की पुष्टि करें",
             "msg_repaired": "चयनित आइटम मरम्मत किए गए",
-            "btn_repair": "मरम्मत",
             "title_prompt": "सुझाव",
             "title_error": "त्रुटि",
             "path_unknown": "अज्ञात पथ",
@@ -1177,12 +1445,56 @@ window.AppI18n = {
             "col_status": "स्थिति",
             "status_enabled": "सक्षम",
             "status_disabled": "अक्षम",
-            "btn_enable": "सक्षम करें",
-            "btn_disable": "अक्षम करें",
             "search_item": "आइटम खोजें...",
             "type_reg": "रजिस्ट्री",
             "type_srv": "सेवा",
             "type_tsk": "कार्य",
+            "btn_view_item": "आइटम देखें",
+            "btn_end": "प्रक्रिया समाप्त करें",
+            "btn_enable_item": "आइटम सक्षम करें",
+            "btn_disable_item": "आइटम अक्षम करें",
+            "btn_delete_item": "आइटम हटाएं",
+            "btn_repair_item": "आइटम की मरम्मत करें",
+            "btn_add_item": "आइटम जोड़ें",
+            "btn_remove_item": "आइटम निकालें",
+            "btn_add_file": "फ़ाइल जोड़ें",
+            "btn_add_path": "पथ जोड़ें",
+            "manage_netmon": "ट्रैफ़िक मॉनिटर",
+            "manage_netmon_desc": "रीयल-टाइम में नेटवर्क ट्रैफ़िक की निगरानी करें",
+            "col_down_speed": "डाउनलोड गति",
+            "col_up_speed": "अपलोड गति",
+            "col_conn_count": "कनेक्शन",
+            "btn_extract_item": "आइटम निकालें",
+            "msg_extract_success": "चयनित आइटम सफलतापूर्वक निकाले गए",
+            "msg_key_activated": "उत्पाद कुंजी सक्रिय हो गई",
+            "INFO": "जानकारी",
+            "WARN": "चेतावनी",
+            "BLOCK": "अवरोध",
+            "SCAN": "स्कैन",
+            "System": "सिस्टम",
+            "Config Update": "कॉन्फ़िगरेशन अपडेट",
+            "File Extract": "फ़ाइल निकालें",
+            "Load Engine": "इंजन लोड",
+            "Scan Completed": "स्कैन पूरा हुआ",
+            "Scan Engine": "स्कैन इंजन",
+            "Virus Detected": "वायरस का पता चला",
+            "Virus Delete": "वायरस हटाएँ",
+            "Cloud API": "क्लाउड API",
+            "MBR Repaired": "MBR मरम्मत",
+            "System Repair": "सिस्टम मरम्मत",
+            "Process Block": "प्रक्रिया अवरुद्ध",
+            "Process DLL Block": "प्रक्रिया DLL अवरोध",
+            "File Block": "फ़ाइल अवरुद्ध",
+            "Network Block": "नेटवर्क अवरुद्ध",
+            "Driver Block": "ड्राइवर अवरुद्ध",
+            "System Restart": "सिस्टम पुनरारंभ",
+            "Clean Junk": "कचरा साफ़ करें",
+            "protect_suspend": "प्रक्रिया रोकें",
+            "protect_suspend_desc": "स्कैन की प्रतीक्षा करते समय प्रक्रियाओं को रोकें",
+            "opt_autostart": "स्वतः प्रारंभ",
+            "opt_autostart_desc": "सिस्टम स्टार्टअप पर स्वचालित रूप से चलाएं",
+            "opt_ext_filter": "एक्सटेंशन फ़िल्टर",
+            "opt_ext_filter_desc": "यह विकल्प केवल निर्दिष्ट फ़ाइल एक्सटेंशन को स्कैन करता है",
         },
         "arabic_switch": {
             "app_name": "PYAS Security",
@@ -1252,12 +1564,8 @@ window.AppI18n = {
             "update_check": "التحقق من التحديثات",
             "update_check_desc": "التحقق من أحدث التحديثات",
             "search_proc": "البحث في العمليات...",
-            "btn_view": "عرض",
-            "btn_end": "إنهاء المهمة",
             "manage_white": "مدير القائمة البيضاء",
             "search_file": "البحث عن الملفات...",
-            "btn_add": "إضافة",
-            "btn_remove": "إزالة",
             "manage_quarantine": "مدير الحجر الصحي",
             "btn_scan": "فحص",
             "search_window": "البحث عن النوافذ...",
@@ -1282,7 +1590,6 @@ window.AppI18n = {
             "msg_click_target": "انقر على النافذة المستهدفة خلال 5 ثوانٍ...",
             "msg_confirm_block": "تأكيد الحظر",
             "msg_repaired": "تم إصلاح العناصر المحددة",
-            "btn_repair": "إصلاح",
             "title_prompt": "تلميح",
             "title_error": "خطأ",
             "path_unknown": "مسار غير معروف",
@@ -1325,12 +1632,56 @@ window.AppI18n = {
             "col_status": "الحالة",
             "status_enabled": "مُمكّن",
             "status_disabled": "مُعطّل",
-            "btn_enable": "تمكين",
-            "btn_disable": "تعطيل",
             "search_item": "البحث في العناصر...",
             "type_reg": "التسجيل",
             "type_srv": "خدمة",
             "type_tsk": "مهمة",
+            "btn_view_item": "عرض العنصر",
+            "btn_end": "إنهاء العملية",
+            "btn_enable_item": "تمكين العنصر",
+            "btn_disable_item": "تعطيل العنصر",
+            "btn_delete_item": "حذف العنصر",
+            "btn_repair_item": "إصلاح العنصر",
+            "btn_add_item": "إضافة عنصر",
+            "btn_remove_item": "إزالة العنصر",
+            "btn_add_file": "إضافة ملف",
+            "btn_add_path": "إضافة مسار",
+            "manage_netmon": "مراقبة حركة المرور",
+            "manage_netmon_desc": "مراقبة حركة مرور الشبكة في الوقت الفعلي",
+            "col_down_speed": "سرعة التنزيل",
+            "col_up_speed": "سرعة الرفع",
+            "col_conn_count": "الاتصالات",
+            "btn_extract_item": "استخراج العنصر",
+            "msg_extract_success": "تم استخراج العناصر المحددة بنجاح",
+            "msg_key_activated": "تم تنشيط مفتاح المنتج",
+            "INFO": "معلومات",
+            "WARN": "تحذير",
+            "BLOCK": "حظر",
+            "SCAN": "فحص",
+            "System": "النظام",
+            "Config Update": "تحديث التكوين",
+            "File Extract": "استخراج ملف",
+            "Load Engine": "تحميل المحرك",
+            "Scan Completed": "اكتمل الفحص",
+            "Scan Engine": "محرك الفحص",
+            "Virus Detected": "تم اكتشاف فيروس",
+            "Virus Delete": "حذف فيروس",
+            "Cloud API": "واجهة السحابة",
+            "MBR Repaired": "تم إصلاح MBR",
+            "System Repair": "إصلاح النظام",
+            "Process Block": "حظر عملية",
+            "Process DLL Block": "حظر DLL للعملية",
+            "File Block": "حظر ملف",
+            "Network Block": "حظر شبكة",
+            "Driver Block": "حظر محرك",
+            "System Restart": "إعادة تشغيل النظام",
+            "Clean Junk": "تنظيف المخلفات",
+            "protect_suspend": "تعليق العمليات",
+            "protect_suspend_desc": "تعليق العمليات أثناء انتظار الفحص",
+            "opt_autostart": "بدء تلقائي",
+            "opt_autostart_desc": "التشغيل تلقائيًا عند بدء التشغيل",
+            "opt_ext_filter": "تصفية الامتداد",
+            "opt_ext_filter_desc": "يقوم هذا الخيار بفحص امتدادات الملفات المحددة فقط",
         },
         "russian_switch": {
             "app_name": "PYAS Security",
@@ -1380,7 +1731,7 @@ window.AppI18n = {
             "scan_context": "Сканирование из контекстного меню",
             "scan_context_desc": "Включить функцию сканирования по правому клику",
             "theme_color": "Цветовая тема",
-            "theme_color_desc": "Выберите цветовую тему приложения",
+            "theme_color_desc": "Выберите цветовой тему приложения",
             "theme_system": "Системная тема",
             "theme_white": "Светлый режим",
             "theme_red": "Красная тема",
@@ -1400,12 +1751,8 @@ window.AppI18n = {
             "update_check": "Проверить обновления",
             "update_check_desc": "Проверить наличие последних обновлений",
             "search_proc": "Поиск процессов...",
-            "btn_view": "Просмотр",
-            "btn_end": "Завершить",
             "manage_white": "Управление белым списком",
             "search_file": "Поиск файлов...",
-            "btn_add": "Добавить",
-            "btn_remove": "Удалить",
             "manage_quarantine": "Управление карантином",
             "btn_scan": "Сканировать",
             "search_window": "Поиск окон...",
@@ -1430,7 +1777,6 @@ window.AppI18n = {
             "msg_click_target": "Нажмите на целевое окно в течение 5 сек...",
             "msg_confirm_block": "Подтвердить блокировку",
             "msg_repaired": "Выбранные элементы восстановлены",
-            "btn_repair": "Восстановить",
             "title_prompt": "Подсказка",
             "title_error": "Ошибка",
             "path_unknown": "Неизвестный путь",
@@ -1473,12 +1819,56 @@ window.AppI18n = {
             "col_status": "Статус",
             "status_enabled": "Включено",
             "status_disabled": "Отключено",
-            "btn_enable": "Включить",
-            "btn_disable": "Отключить",
             "search_item": "Поиск элементов...",
             "type_reg": "Реестр",
             "type_srv": "Служба",
             "type_tsk": "Задача",
+            "btn_view_item": "Просмотр элемента",
+            "btn_end": "Завершить процесс",
+            "btn_enable_item": "Включить элемент",
+            "btn_disable_item": "Отключить элемент",
+            "btn_delete_item": "Удалить элемент",
+            "btn_repair_item": "Восстановить элемент",
+            "btn_add_item": "Добавить элемент",
+            "btn_remove_item": "Удалить элемент",
+            "btn_add_file": "Добавить файл",
+            "btn_add_path": "Добавить путь",
+            "manage_netmon": "Монитор трафика",
+            "manage_netmon_desc": "Мониторинг сетевого трафика в реальном времени",
+            "col_down_speed": "Скорость скачивания",
+            "col_up_speed": "Скорость загрузки",
+            "col_conn_count": "Соединения",
+            "btn_extract_item": "Извлечь элемент",
+            "msg_extract_success": "Выбранные элементы успешно извлечены",
+            "msg_key_activated": "Ключ продукта активирован",
+            "INFO": "ИНФО",
+            "WARN": "ПРЕДУПРЕЖДЕНИЕ",
+            "BLOCK": "БЛОКИРОВКА",
+            "SCAN": "СКАНИРОВАНИЕ",
+            "System": "Система",
+            "Config Update": "Обновление конфигурации",
+            "File Extract": "Извлечение файла",
+            "Load Engine": "Загрузка движка",
+            "Scan Completed": "Сканирование завершено",
+            "Scan Engine": "Движок сканирования",
+            "Virus Detected": "Обнаружен вирус",
+            "Virus Delete": "Удаление вируса",
+            "Cloud API": "Облачный API",
+            "MBR Repaired": "MBR восстановлен",
+            "System Repair": "Восстановление системы",
+            "Process Block": "Блокировка процесса",
+            "Process DLL Block": "Блокировка DLL процесса",
+            "File Block": "Блокировка файла",
+            "Network Block": "Блокировка сети",
+            "Driver Block": "Блокировка драйвера",
+            "System Restart": "Перезапуск системы",
+            "Clean Junk": "Очистка мусора",
+            "protect_suspend": "Приостановка процессов",
+            "protect_suspend_desc": "Приостановка процессов в ожидании сканирования",
+            "opt_autostart": "Автозапуск",
+            "opt_autostart_desc": "Автоматический запуск при старте системы",
+            "opt_ext_filter": "Фильтр расширений",
+            "opt_ext_filter_desc": "Этот параметр сканирует только указанные расширения файлов",
         },
         "slovenian_switch": {
             "app_name": "PYAS Security",
@@ -1548,12 +1938,8 @@ window.AppI18n = {
             "update_check": "Preveri posodobitve",
             "update_check_desc": "Preveri zadnje posodobitve",
             "search_proc": "Išči procese...",
-            "btn_view": "Poglej",
-            "btn_end": "Končaj opravilo",
             "manage_white": "Upravitelj seznama dovoljenih",
             "search_file": "Išči datoteke...",
-            "btn_add": "Dodaj",
-            "btn_remove": "Odstrani",
             "manage_quarantine": "Upravitelj karantene",
             "btn_scan": "Skeniraj",
             "search_window": "Išči okna...",
@@ -1578,7 +1964,6 @@ window.AppI18n = {
             "msg_click_target": "Kliknite na ciljno okno v 5s...",
             "msg_confirm_block": "Potrdi blokado",
             "msg_repaired": "Izbrani predmeti popravljeni",
-            "btn_repair": "Popravi",
             "title_prompt": "Namig",
             "title_error": "Napaka",
             "path_unknown": "Neznana pot",
@@ -1621,12 +2006,56 @@ window.AppI18n = {
             "col_status": "Stanje",
             "status_enabled": "Omogočeno",
             "status_disabled": "Onemogočeno",
-            "btn_enable": "Omogoči",
-            "btn_disable": "Onemogoči",
             "search_item": "Išči elemente...",
             "type_reg": "Register",
             "type_srv": "Storitev",
             "type_tsk": "Opravilo",
+            "btn_view_item": "Ogled elementa",
+            "btn_end": "Končaj proces",
+            "btn_enable_item": "Omogoči element",
+            "btn_disable_item": "Onemogoči element",
+            "btn_delete_item": "Izbriši element",
+            "btn_repair_item": "Popravi element",
+            "btn_add_item": "Dodaj element",
+            "btn_remove_item": "Odstrani element",
+            "btn_add_file": "Dodaj datoteko",
+            "btn_add_path": "Dodaj pot",
+            "manage_netmon": "Nadzor prometa",
+            "manage_netmon_desc": "Spremlja omrežni promet v realnem času",
+            "col_down_speed": "Hitrost prenosa",
+            "col_up_speed": "Hitrost nalaganja",
+            "col_conn_count": "Povezave",
+            "btn_extract_item": "Izvleči element",
+            "msg_extract_success": "Izbrani elementi so bili uspešno izvlečeni",
+            "msg_key_activated": "Ključ izdelka je aktiviran",
+            "INFO": "INFO",
+            "WARN": "OPOZORILO",
+            "BLOCK": "BLOKADA",
+            "SCAN": "SKENIRANJE",
+            "System": "Sistem",
+            "Config Update": "Posodobitev konfiguracije",
+            "File Extract": "Izvleček datoteke",
+            "Load Engine": "Nalaganje mehanizma",
+            "Scan Completed": "Skeniranje končano",
+            "Scan Engine": "Mehanizem skeniranja",
+            "Virus Detected": "Zaznan virus",
+            "Virus Delete": "Izbris virusa",
+            "Cloud API": "Oblačni API",
+            "MBR Repaired": "MBR popravljen",
+            "System Repair": "Popravilo sistema",
+            "Process Block": "Proces blokiran",
+            "Process DLL Block": "Blokada procesne DLL",
+            "File Block": "Datoteka blokirana",
+            "Network Block": "Omrežje blokirano",
+            "Driver Block": "Gonilnik blokiran",
+            "System Restart": "Ponovni zagon sistema",
+            "Clean Junk": "Čiščenje nesnage",
+            "protect_suspend": "Začasna ustavitev",
+            "protect_suspend_desc": "Zaustavite procese med čakanjem na skeniranje",
+            "opt_autostart": "Samodejni zagon",
+            "opt_autostart_desc": "Samodejni zagon ob zagonu sistema",
+            "opt_ext_filter": "Filter končnic",
+            "opt_ext_filter_desc": "Ta možnost skenira samo določene končnice datotek",
         }
     },
     langMap: {

Interface/static/js/main.js

@@ -14,6 +14,8 @@ document.addEventListener('DOMContentLoaded', () => {
         firstLaunch: false,
         taskmgrTimer: null,
         taskmgrActive: false,
+        netmonTimer: null,
+        netmonActive: false,
         virusMap: new Map(),
         virusResults: [],
         junkList: []
@@ -78,14 +80,16 @@ document.addEventListener('DOMContentLoaded', () => {
     };
 
     const cols = {
-        log: [{key: 'time_str', label: 'col_date', flex: 1.5}, {key: 'level', label: 'col_type', flex: 0.8}, {key: 'action', label: 'col_func', flex: 1.2, isI18n: true}, {key: 'source', label: 'col_path', flex: 3}],
+        log: [{key: 'time_str', label: 'col_date', flex: 1.5}, {key: 'level', label: 'col_type', flex: 0.8, isI18n: true}, {key: 'action', label: 'col_func', flex: 1.2, isI18n: true}, {key: 'source', label: 'col_path', flex: 3}],
         process: [{key: 'name', label: 'col_name', flex: 1.5}, {key: 'pid', label: 'col_pid', flex: 0.5}, {key: 'path', label: 'col_path', flex: 3}],
         startup: [{key: 'type', label: 'col_type', flex: 0.5, isI18n: true}, {key: 'name', label: 'col_name', flex: 1.5}, {key: 'status', label: 'col_status', flex: 0.5, isI18n: true}, {key: 'path', label: 'col_path', flex: 3}],
         virus: [{key: 'label', label: 'col_type', flex: 1, isI18n: true}, {key: 'path', label: 'col_path', flex: 3}],
         pathOnly: [{key: 'path', label: 'col_path', flex: 1}],
+        fileList: [{key: 'time_str', label: 'col_date', flex: 1.5}, {key: 'path', label: 'col_path', flex: 5}],
         junk: [{key: 'path', label: 'col_path', flex: 3}, {key: 'sizeStr', label: 'col_size', flex: 1}],
         popup: [{key: 'exe', label: 'col_prog', flex: 1}, {key: 'class', label: 'col_class', flex: 1}, {key: 'title', label: 'col_title', flex: 2}],
-        repair: [{key: 'display', label: 'col_repair', flex: 1, isI18n: true}, {key: 'path', label: 'col_path', flex: 3}]
+        repair: [{key: 'display', label: 'col_repair', flex: 1, isI18n: true}, {key: 'path', label: 'col_path', flex: 3}],
+        netmon: [{key: 'name', label: 'col_name', flex: 1.5}, {key: 'pid', label: 'col_pid', flex: 0.5}, {key: 'downStr', label: 'col_down_speed', flex: 1}, {key: 'upStr', label: 'col_up_speed', flex: 1}, {key: 'connCount', label: 'col_conn_count', flex: 0.8}]
     };
 
     const buildCustomSelectElement = (select) => {
@@ -338,11 +342,25 @@ document.addEventListener('DOMContentLoaded', () => {
             if (selectAllCb) selectAllCb.disabled = dataList.length === 0;
 
             const ft = filterText.toLowerCase();
-            let displayData = dataList.filter(item => !filterText || columns.some(col => String(item[col.key] || '').toLowerCase().includes(ft)));
+            let displayData = dataList.filter(item => !filterText || columns.some(col => {
+                const rawVal = String(item[col.key] || '');
+                if (rawVal.toLowerCase().includes(ft)) return true;
+                if (col.isI18n) {
+                    const transVal = getMsg(rawVal);
+                    if (transVal && transVal.toLowerCase().includes(ft)) return true;
+                }
+                return false;
+            }));
 
             displayData.sort((a, b) => {
                 const valA = a[state.sortKey] ?? '', valB = b[state.sortKey] ?? '';
-                if (state.sortKey === 'sizeStr' && 'size' in a && 'size' in b) return state.sortAsc ? a.size - b.size : b.size - a.size;
+                
+                const rawKeyMap = { 'sizeStr': 'size', 'downStr': 'down', 'upStr': 'up' };
+                if (rawKeyMap[state.sortKey] && rawKeyMap[state.sortKey] in a && rawKeyMap[state.sortKey] in b) {
+                    const rawKey = rawKeyMap[state.sortKey];
+                    return state.sortAsc ? a[rawKey] - b[rawKey] : b[rawKey] - a[rawKey];
+                }
+
                 const numA = parseFloat(valA), numB = parseFloat(valB);
                 if (!isNaN(numA) && !isNaN(numB) && String(valA).trim() !== '' && String(valB).trim() !== '') return state.sortAsc ? numA - numB : numB - numA;
                 return state.sortAsc ? String(valA).localeCompare(String(valB)) : String(valB).localeCompare(String(valA));
@@ -429,23 +447,23 @@ document.addEventListener('DOMContentLoaded', () => {
     };
 
     const checkVirusListEmpty = () => {
-    updateCustomSelectUI('scan_method_select', 'none');
-    if (appState.virusResults.length === 0) {
-        appState.virusMap.clear();
-        changeScanSelectMode('scan');
-        const title = document.querySelector('#scan_window .section-title');
-        const text = document.getElementById('progress_text');
-        if (title) { 
-            title.setAttribute('data-i18n', 'scan_virus'); 
-            title.textContent = getMsg('scan_virus'); 
+        updateCustomSelectUI('scan_method_select', 'none');
+        if (appState.virusResults.length === 0) {
+            appState.virusMap.clear();
+            changeScanSelectMode('scan');
+            const title = document.querySelector('#scan_window .section-title');
+            const text = document.getElementById('progress_text');
+            if (title) { 
+                title.setAttribute('data-i18n', 'scan_virus'); 
+                title.textContent = getMsg('scan_virus'); 
+            }
+            if (text) {
+                text.setAttribute('data-i18n', 'scan_virus_desc');
+                text.removeAttribute('data-dynamic-msg');
+                text.textContent = getMsg('scan_virus_desc');
+            }
         }
-        if (text) {
-            text.setAttribute('data-i18n', 'scan_virus_desc');
-            text.removeAttribute('data-dynamic-msg');
-            text.textContent = getMsg('scan_virus_desc');
-        }
-    }
-};
+    };
 
     const triggerScan = (method) => {
         if (!window.pywebview) return;
@@ -501,16 +519,41 @@ document.addEventListener('DOMContentLoaded', () => {
     const fetchProcs = () => {
         if (!appState.taskmgrActive || !window.pywebview) return;
         const widget = document.querySelector('#taskmgr_window .manage-widget');
-        const blockFetch = widget && (widget.gridState?.checkedSet.size > 0 || widget.matches(':hover')) || document.querySelector('.custom-context-menu.show') || document.body.classList.contains('resizing-active');
+        const blockFetch = (widget && widget.gridState?.checkedSet.size > 0) || document.querySelector('.custom-context-menu.show') || document.body.classList.contains('resizing-active');
         
         if (!blockFetch) {
             window.pywebview.api.get_process_list().then(procs => {
                 const mapped = procs.map(p => ({ name: p.name, pid: p.pid, path: (p.path && p.path !== "None" && p.path !== "Unknown") ? p.path : "path_unknown" }));
                 renderDataGrid('#taskmgr_window', mapped, cols.process, 'pid', false);
-                if (appState.taskmgrActive) appState.taskmgrTimer = setTimeout(fetchProcs, 2000);
-            }).catch(() => { if (appState.taskmgrActive) appState.taskmgrTimer = setTimeout(fetchProcs, 2000); });
+                if (appState.taskmgrActive) appState.taskmgrTimer = setTimeout(fetchProcs, 1000);
+            }).catch(() => { if (appState.taskmgrActive) appState.taskmgrTimer = setTimeout(fetchProcs, 1000); });
         } else {
-            if (appState.taskmgrActive) appState.taskmgrTimer = setTimeout(fetchProcs, 2000);
+            if (appState.taskmgrActive) appState.taskmgrTimer = setTimeout(fetchProcs, 1000);
+        }
+    };
+    
+    const fetchNetmon = () => {
+        if (!appState.netmonActive || !window.pywebview) return;
+        const widget = document.querySelector('#netmon_window .manage-widget');
+        const blockFetch = (widget && widget.gridState?.checkedSet.size > 0) || document.querySelector('.custom-context-menu.show') || document.body.classList.contains('resizing-active');
+        
+        if (!blockFetch) {
+            window.pywebview.api.get_traffic_list().then(list => {
+                const mapped = list.map(item => ({
+                    name: item.name,
+                    pid: item.pid,
+                    downStr: formatSize(item.down) + '/s',
+                    down: item.down,
+                    upStr: formatSize(item.up) + '/s',
+                    up: item.up,
+                    connCount: item.conn,
+                    path: (item.path && item.path !== "None" && item.path !== "Unknown") ? item.path : "path_unknown"
+                }));
+                renderDataGrid('#netmon_window', mapped, cols.netmon, 'pid', false);
+                if (appState.netmonActive) appState.netmonTimer = setTimeout(fetchNetmon, 1000);
+            }).catch(() => { if (appState.netmonActive) appState.netmonTimer = setTimeout(fetchNetmon, 1000); });
+        } else {
+            if (appState.netmonActive) appState.netmonTimer = setTimeout(fetchNetmon, 1000);
         }
     };
 
@@ -526,40 +569,45 @@ document.addEventListener('DOMContentLoaded', () => {
         });
     };
 
-    document.querySelector('#startup_window .primary-btn')?.addEventListener('click', () => {
-        const checked = getCheckedValues('#startup_window');
-        if (checked.length > 0 && window.pywebview) {
-            const widget = document.querySelector('#startup_window .manage-widget');
-            if (widget && widget.gridState && widget.gridState.lastDisplayData) {
-                widget.gridState.lastDisplayData.forEach(item => {
-                    if (checked.includes(item.id)) item.status = 'status_enabled';
-                });
-                widget.renderData();
-            }
-            window.pywebview.api.manage_startup(checked, 'enable').then(fetchStartup);
+    const fetchJunk = () => {
+        if (!window.pywebview) return;
+        const widget = document.querySelector('#junk_window .manage-widget');
+        if (widget?.gridState) widget.gridState.checkedSet.clear();
+        const listUl = document.querySelector('#junk_window .manage-list');
+        if (listUl && !listUl.children.length) {
+            listUl.innerHTML = `<li class="manage-list-item" style="pointer-events: none; justify-content: center; height: 100%; border: none;"><div style="color: var(--text-secondary); padding: 40px; font-size: 15px;">${getMsg('msg_init')}</div></li>`;
         }
-    });
+        window.pywebview.api.scan_system_junk().then(list => {
+            appState.junkList = list.map(item => ({ path: item.path, sizeStr: formatSize(item.size), size: item.size }));
+            renderDataGrid('#junk_window', appState.junkList, cols.junk, 'path', true);
+        });
+    };
 
-    document.querySelector('#startup_window .danger-btn')?.addEventListener('click', () => {
-        const checked = getCheckedValues('#startup_window');
-        if (checked.length > 0 && window.pywebview) {
-            const widget = document.querySelector('#startup_window .manage-widget');
-            if (widget && widget.gridState && widget.gridState.lastDisplayData) {
-                widget.gridState.lastDisplayData.forEach(item => {
-                    if (checked.includes(item.id)) item.status = 'status_disabled';
-                });
-                widget.renderData();
-            }
-            window.pywebview.api.manage_startup(checked, 'disable').then(fetchStartup);
+    const fetchRepair = () => {
+        if (!window.pywebview) return;
+        const listUl = document.querySelector('#repair_window .manage-list');
+        if (listUl && !listUl.children.length) {
+            listUl.innerHTML = `<li class="manage-list-item" style="pointer-events: none; justify-content: center; height: 100%; border: none;"><div style="color: var(--text-secondary); padding: 40px; font-size: 15px;">${getMsg('msg_init')}</div></li>`;
         }
-    });
+        window.pywebview.api.scan_system_repair().then(list => renderDataGrid('#repair_window', list, cols.repair, 'id', true));
+    };
 
     const refreshConfigLists = () => {
         if (!window.pywebview) return;
         window.pywebview.api.get_config().then(cfg => {
-            renderDataGrid('#whitelist_window', (cfg.white_list || []).map(i => ({path: i.file || i})), cols.pathOnly, 'path');
-            renderDataGrid('#quarantine_window', (cfg.quarantine || []).map(i => ({path: i.file || i})), cols.pathOnly, 'path');
-            renderDataGrid('#custom_protect_window', (cfg.custom_rule || []).map(i => ({path: i.file || i})), cols.pathOnly, 'path');
+            const formatTime = (ts) => {
+                if (!ts) return '-';
+                const d = new Date(ts * 1000);
+                const pad = n => n.toString().padStart(2, '0');
+                return `[${d.getFullYear()}-${pad(d.getMonth()+1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}]`;
+            };
+            const mapList = (arr) => (arr || []).map(i => ({
+                path: i.file || (typeof i === 'string' ? i : ''),
+                time_str: formatTime(i.time)
+            }));
+            renderDataGrid('#whitelist_window', mapList(cfg.white_list), cols.fileList, 'path');
+            renderDataGrid('#quarantine_window', mapList(cfg.quarantine), cols.fileList, 'path');
+            renderDataGrid('#custom_protect_window', mapList(cfg.custom_rule), cols.fileList, 'path');
             const popupRules = (cfg.block_list || []).map(item => ({ exe: item.exe || '*', class: item.class || '*', title: item.title || '*', value: item.exe || item.title }));
             renderDataGrid('#popup_window', popupRules, cols.popup, 'value');
         });
@@ -586,7 +634,13 @@ document.addEventListener('DOMContentLoaded', () => {
         if (appState.taskmgrActive) fetchProcs();
         else if (appState.taskmgrTimer) { clearTimeout(appState.taskmgrTimer); appState.taskmgrTimer = null; }
 
+        appState.netmonActive = targetId === 'netmon_window';
+        if (appState.netmonActive) fetchNetmon();
+        else if (appState.netmonTimer) { clearTimeout(appState.netmonTimer); appState.netmonTimer = null; }
+
         if (targetId === 'startup_window') fetchStartup();
+        if (targetId === 'junk_window') fetchJunk();
+        if (targetId === 'repair_window') fetchRepair();
 
         if (['whitelist_window', 'quarantine_window', 'popup_window', 'custom_protect_window'].includes(targetId)) refreshConfigLists();
 
@@ -649,13 +703,17 @@ document.addEventListener('DOMContentLoaded', () => {
     window.updateLogs = (entry) => {
         const logWidget = document.querySelector('.log-text');
         if (logWidget) {
-            let parts = [`[${entry.time_str}]`, entry.level, getMsg(entry.action || '')];
+            let parts = [`[${entry.time_str}]`, getMsg(entry.level || ''), getMsg(entry.action || '')];
             if (entry.source) parts.push(`Src: ${entry.source}`);
             if (entry.target) parts.push(`Tgt: ${entry.target}`);
             if (entry.code) parts.push(`Code: ${entry.code}`);
             if (entry.pid) parts.push(`PID: ${entry.pid}`);
             if (entry.hash) parts.push(`Hash: ${entry.hash}`);
-            if (entry.detail) parts.push(`Detail: ${entry.detail}`);
+            
+            if (entry.detail) {
+                const transDetail = getMsg(entry.detail);
+                parts.push(`Detail: ${transDetail !== entry.detail ? transDetail : entry.detail}`);
+            }
             if (entry.operate !== null) parts.push(`Op: ${entry.operate}`);
             parts.push(`Success: ${entry.success}`);
             let val = logWidget.value + parts.join(' | ') + '\n';
@@ -723,7 +781,7 @@ document.addEventListener('DOMContentLoaded', () => {
 
     document.querySelectorAll('.toggle-switch input').forEach((toggle, index) => {
         toggle.addEventListener('change', async (e) => {
-            const switchMap = ["process_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "context_switch"];
+            const switchMap = ["process_switch", "suspend_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "suffix_switch", "autostart_switch", "context_switch"];
             const key = switchMap[index];
             if (window.pywebview && key) {
                 toggle.disabled = true;
@@ -736,41 +794,97 @@ document.addEventListener('DOMContentLoaded', () => {
         });
     });
 
-    document.querySelector('#junk_window .primary-btn')?.addEventListener('click', (e) => {
-        if (!window.pywebview) return;
-        e.target.setAttribute('data-i18n', 'msg_init'); e.target.textContent = getMsg('msg_init');
-        const widget = document.querySelector('#junk_window .manage-widget');
-        if (widget?.gridState) widget.gridState.checkedSet.clear();
-        
-        window.pywebview.api.scan_system_junk().then(list => {
-            appState.junkList = list.map(item => ({ path: item.path, sizeStr: formatSize(item.size), size: item.size }));
-            renderDataGrid('#junk_window', appState.junkList, cols.junk, 'path', true);
-            e.target.setAttribute('data-i18n', 'btn_scan'); e.target.textContent = getMsg('btn_scan');
-        });
+    document.getElementById('taskmgr_select')?.addEventListener('change', (e) => {
+        const val = e.target.value;
+        const checkedCbs = document.querySelectorAll('#taskmgr_window .manage-list-item input[type="checkbox"]:checked');
+        if (checkedCbs.length === 0 || !window.pywebview) return updateCustomSelectUI('taskmgr_select', 'none');
+
+        if (val === 'view') {
+            checkedCbs.forEach(cb => {
+                if (cb.dataset.path && cb.dataset.path !== "path_unknown") window.pywebview.api.open_file_location(cb.dataset.path);
+            });
+        } else if (val === 'end') {
+            window.pywebview.api.show_confirm(getMsg("msg_end_proc_title"), getMsg("msg_end_proc_confirm")).then(res => {
+                if (res) Promise.all(Array.from(checkedCbs).map(cb => window.pywebview.api.kill_process(parseInt(cb.value)))).then(() => fetchProcs());
+            });
+        } else if (val === 'quarantine' || val === 'whitelist') {
+            const paths = Array.from(checkedCbs).map(cb => cb.dataset.path).filter(p => p && p !== "path_unknown");
+            if (paths.length > 0) {
+                const listKey = val === 'quarantine' ? 'quarantine' : 'white_list';
+                window.pywebview.api.manage_named_list(listKey, paths, 'add').then(() => {
+                    Promise.all(Array.from(checkedCbs).map(cb => window.pywebview.api.kill_process(parseInt(cb.value)))).then(() => fetchProcs());
+                });
+            }
+        }
+        updateCustomSelectUI('taskmgr_select', 'none');
+    });
+    
+    document.getElementById('netmon_select')?.addEventListener('change', (e) => {
+        const val = e.target.value;
+        const checkedCbs = document.querySelectorAll('#netmon_window .manage-list-item input[type="checkbox"]:checked');
+        if (checkedCbs.length === 0 || !window.pywebview) return updateCustomSelectUI('netmon_select', 'none');
+
+        if (val === 'view') {
+            checkedCbs.forEach(cb => {
+                if (cb.dataset.path && cb.dataset.path !== "path_unknown") window.pywebview.api.open_file_location(cb.dataset.path);
+            });
+        } else if (val === 'end') {
+            window.pywebview.api.show_confirm(getMsg("msg_end_proc_title"), getMsg("msg_end_proc_confirm")).then(res => {
+                if (res) Promise.all(Array.from(checkedCbs).map(cb => window.pywebview.api.kill_process(parseInt(cb.value)))).then(() => fetchNetmon());
+            });
+        }
+        updateCustomSelectUI('netmon_select', 'none');
     });
 
-    document.querySelector('#junk_window .danger-btn')?.addEventListener('click', () => {
+    document.getElementById('startup_select')?.addEventListener('change', (e) => {
+        const val = e.target.value;
+        const checked = getCheckedValues('#startup_window');
+        if (checked.length > 0 && window.pywebview) {
+            if (val === 'enable' || val === 'disable') {
+                const widget = document.querySelector('#startup_window .manage-widget');
+                if (widget && widget.gridState && widget.gridState.lastDisplayData) {
+                    widget.gridState.lastDisplayData.forEach(item => {
+                        if (checked.includes(item.id)) item.status = val === 'enable' ? 'status_enabled' : 'status_disabled';
+                    });
+                    widget.renderData();
+                }
+            }
+            window.pywebview.api.manage_startup(checked, val).then(fetchStartup);
+        }
+        updateCustomSelectUI('startup_select', 'none');
+    });
+
+    document.getElementById('junk_select')?.addEventListener('change', (e) => {
+        const val = e.target.value;
         const checked = getCheckedValues('#junk_window');
-        if (checked.length === 0 || !window.pywebview) return;
-        window.pywebview.api.clean_system_junk(checked).then(size => {
-            window.pywebview.api.show_alert(getMsg("title_prompt"), `${getMsg("msg_cleaned")}${formatSize(size)}`, "info");
-            appState.junkList = appState.junkList.filter(item => !checked.includes(item.path));
-            renderDataGrid('#junk_window', appState.junkList, cols.junk, 'path', true);
-        });
-    });
-
-    document.querySelector('#repair_window .primary-btn')?.addEventListener('click', () => {
         if (!window.pywebview) return;
-        window.pywebview.api.scan_system_repair().then(list => renderDataGrid('#repair_window', list, cols.repair, 'id', true));
+        
+        if (val === 'view') {
+            checked.forEach(path => window.pywebview.api.open_file_location(path));
+        } else if (val === 'delete') {
+            if (checked.length > 0) {
+                window.pywebview.api.clean_system_junk(checked).then(size => {
+                    window.pywebview.api.show_alert(getMsg("title_prompt"), `${getMsg("msg_cleaned")}${formatSize(size)}`, "info");
+                    appState.junkList = appState.junkList.filter(item => !checked.includes(item.path));
+                    renderDataGrid('#junk_window', appState.junkList, cols.junk, 'path', true);
+                });
+            }
+        }
+        updateCustomSelectUI('junk_select', 'none');
     });
 
-    document.querySelector('#repair_window .danger-btn')?.addEventListener('click', () => {
-        const checked = getCheckedValues('#repair_window');
-        if (checked.length === 0 || !window.pywebview) return;
-        window.pywebview.api.execute_system_repair(checked).then(() => {
-            window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_repaired"), "info");
-            renderDataGrid('#repair_window', [], cols.repair, 'id', true);
-        });
+    document.getElementById('repair_select')?.addEventListener('change', (e) => {
+        const val = e.target.value;
+        if (val === 'repair') {
+            const checked = getCheckedValues('#repair_window');
+            if (checked.length > 0 && window.pywebview) {
+                window.pywebview.api.execute_system_repair(checked).then(() => {
+                    window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_repaired"), "info");
+                    renderDataGrid('#repair_window', [], cols.repair, 'id', true);
+                });
+            }
+        }
+        updateCustomSelectUI('repair_select', 'none');
     });
 
     ['whitelist_window', 'quarantine_window', 'popup_window', 'custom_protect_window'].forEach(id => {
@@ -781,65 +895,87 @@ document.addEventListener('DOMContentLoaded', () => {
             'quarantine_window': 'quarantine'
         };
         const listKey = listKeyMap[id];
+        const selectId = id.replace('_window', '_select');
 
-        document.querySelector(`#${id} .modern-btn:not(.primary-btn)`)?.addEventListener('click', () => {
-            const checked = getCheckedValues(`#${id}`);
-            if (checked.length > 0 && window.pywebview) window.pywebview.api.remove_list_items(listKey, checked).then(refreshConfigLists);
-        });
-        
-        if (id !== 'popup_window') {
-            document.querySelector(`#${id} .primary-btn`)?.addEventListener('click', () => {
-                window.pywebview?.api.select_files().then(files => {
+        document.getElementById(selectId)?.addEventListener('change', (e) => {
+            const val = e.target.value;
+            if (!window.pywebview) return;
+
+            if (val === 'add') {
+                if (id === 'popup_window') {
+                    const wrapper = document.getElementById(selectId).nextElementSibling;
+                    const triggerText = wrapper.querySelector('.custom-select-text');
+                    const originalI18n = triggerText.getAttribute('data-i18n');
+                    const originalText = triggerText.textContent;
+                    
+                    triggerText.setAttribute('data-i18n', 'msg_click_target');
+                    triggerText.textContent = getMsg('msg_click_target');
+                    
+                    window.pywebview.api.capture_popup_window().then(rule => {
+                        triggerText.setAttribute('data-i18n', originalI18n || 'btn_select');
+                        triggerText.textContent = originalText;
+                        if (rule) window.pywebview.api.add_popup_rule(rule).then(ok => ok && refreshConfigLists());
+                    });
+                } else {
+                    window.pywebview.api.select_files().then(files => {
+                        if (files?.length > 0) window.pywebview.api.manage_named_list(listKey, files, 'add').then(refreshConfigLists);
+                    });
+                }
+            } else if (val === 'add_file') {
+                window.pywebview.api.select_files().then(files => {
                     if (files?.length > 0) window.pywebview.api.manage_named_list(listKey, files, 'add').then(refreshConfigLists);
                 });
-            });
-        }
-    });
-
-    document.querySelector('#popup_window .primary-btn')?.addEventListener('click', (e) => {
-        if (!window.pywebview) return;
-        e.target.setAttribute('data-i18n', 'msg_click_target'); e.target.textContent = getMsg('msg_click_target'); e.target.disabled = true;
-        window.pywebview.api.capture_popup_window().then(rule => {
-            e.target.setAttribute('data-i18n', 'btn_add'); e.target.textContent = getMsg('btn_add'); e.target.disabled = false;
-            if (rule) window.pywebview.api.add_popup_rule(rule).then(ok => ok && refreshConfigLists());
-        });
-    });
-
-    document.querySelector('#taskmgr_window .primary-btn')?.addEventListener('click', () => {
-        if (!window.pywebview) return;
-        document.querySelectorAll('#taskmgr_window .manage-list-item input[type="checkbox"]:checked').forEach(cb => {
-            if (cb.dataset.path && cb.dataset.path !== "path_unknown") window.pywebview.api.open_file_location(cb.dataset.path);
-        });
-    });
-
-    document.querySelector('#taskmgr_window .danger-btn')?.addEventListener('click', () => {
-        const cbs = document.querySelectorAll('#taskmgr_window .manage-list-item input[type="checkbox"]:checked');
-        if (cbs.length > 0 && window.pywebview) {
-            window.pywebview.api.show_confirm(getMsg("msg_end_proc_title"), getMsg("msg_end_proc_confirm")).then(res => {
-                if (res) Promise.all(Array.from(cbs).map(cb => window.pywebview.api.kill_process(parseInt(cb.value)))).then(() => {
-                    window.pywebview.api.get_process_list().then(procs => renderDataGrid('#taskmgr_window', procs.map(p => ({ name: p.name, pid: p.pid, path: (p.path && p.path !== "None" && p.path !== "Unknown") ? p.path : "path_unknown" })), cols.process, 'pid', false));
+            } else if (val === 'add_path') {
+                window.pywebview.api.select_folder().then(folder => {
+                    if (folder?.length > 0) window.pywebview.api.manage_named_list(listKey, folder, 'add').then(refreshConfigLists);
                 });
-            });
-        }
-    });
-
-    document.querySelector('#log_export_window .primary-btn')?.addEventListener('click', () => {
-        const checked = getCheckedValues('#log_export_window');
-        if (checked.length === 0) return window.pywebview?.api.show_alert(getMsg("title_prompt"), getMsg("msg_sel_log_export"), "warning");
-        window.pywebview?.api.export_logs(checked).then(res => res && window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_export_success"), "info"));
-    });
-
-    document.querySelector('#log_export_window .danger-btn')?.addEventListener('click', () => {
-        const checked = getCheckedValues('#log_export_window');
-        if (checked.length === 0 || !window.pywebview) return;
-        window.pywebview.api.show_confirm(getMsg("title_prompt"), getMsg("msg_del_log_confirm")).then(res => {
-            if (res) window.pywebview.api.clear_logs(checked).then(() => {
-                window.pywebview.api.get_logs().then(logs => renderDataGrid('#log_export_window', logs.reverse().map(log => ({ time_str: `[${log.time_str}]`, level: log.level, action: log.action, source: log.source || '-', id: log.id })), cols.log, 'id', true));
-                window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_log_deleted"), "info");
-            });
+            } else if (val === 'extract') {
+                const checked = getCheckedValues(`#${id}`);
+                if (checked.length > 0) {
+                    window.pywebview.api.select_folder().then(folder => {
+                        if (folder?.length > 0) {
+                            window.pywebview.api.extract_list_items(checked, folder[0]).then(success => {
+                                if (success) window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_extract_success"), "info");
+                            });
+                        }
+                    });
+                }
+            } else if (val === 'remove') {
+                const checked = getCheckedValues(`#${id}`);
+                if (checked.length > 0) window.pywebview.api.remove_list_items(listKey, checked).then(refreshConfigLists);
+            } else if (val === 'quarantine' || val === 'whitelist') {
+                const checked = getCheckedValues(`#${id}`);
+                if (checked.length > 0) {
+                    const targetKey = val === 'quarantine' ? 'quarantine' : 'white_list';
+                    window.pywebview.api.manage_named_list(targetKey, checked, 'add').then(() => refreshConfigLists());
+                }
+            }
+            updateCustomSelectUI(selectId, 'none');
         });
     });
 
+    document.getElementById('log_export_select')?.addEventListener('change', (e) => {
+        const val = e.target.value;
+        const checked = getCheckedValues('#log_export_window');
+        if (val === 'export') {
+            if (checked.length === 0) {
+                window.pywebview?.api.show_alert(getMsg("title_prompt"), getMsg("msg_sel_log_export"), "warning");
+            } else {
+                window.pywebview?.api.export_logs(checked).then(res => res && window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_export_success"), "info"));
+            }
+        } else if (val === 'delete') {
+            if (checked.length > 0 && window.pywebview) {
+                window.pywebview.api.show_confirm(getMsg("title_prompt"), getMsg("msg_del_log_confirm")).then(res => {
+                    if (res) window.pywebview.api.clear_logs(checked).then(() => {
+                        window.pywebview.api.get_logs().then(logs => renderDataGrid('#log_export_window', logs.reverse().map(log => ({ time_str: `[${log.time_str}]`, level: log.level, action: log.action, source: log.source || '-', id: log.id })), cols.log, 'id', true));
+                        window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_log_deleted"), "info");
+                    });
+                });
+            }
+        }
+        updateCustomSelectUI('log_export_select', 'none');
+    });
+
     document.getElementById('minimize_button')?.addEventListener('click', () => window.pywebview?.api.minimize());
     document.getElementById('close_button')?.addEventListener('click', () => window.pywebview?.api.hide_window());
 
@@ -897,7 +1033,18 @@ document.addEventListener('DOMContentLoaded', () => {
         }
     };
 
+    bindSettingAction('key_product', async () => {
+        if (!window.pywebview) return;
+        try {
+            const cfg = await window.pywebview.api.get_config();
+            if (cfg && cfg.api_key && cfg.api_key.trim() !== "") {
+                window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_key_activated"), "info");
+            }
+        } catch (e) {}
+    });
+
     bindSettingAction('web_official', () => window.pywebview?.api.open_website());
+    
     bindSettingAction('update_check', () => {
         window.pywebview?.api.check_update().then(res => {
             if (res.error) window.pywebview.api.show_alert(getMsg("title_error"), getMsg("msg_update_fail"), "error");
@@ -905,6 +1052,7 @@ document.addEventListener('DOMContentLoaded', () => {
             else window.pywebview.api.show_alert(getMsg("title_prompt"), `${getMsg("msg_latest_version")} ${res.current}`, "info");
         });
     });
+    
     bindSettingAction('opt_reset', () => {
         window.pywebview?.api.show_confirm(getMsg("title_prompt"), getMsg("opt_reset_desc")).then(res => {
             if (res) window.pywebview.api.reset_config().then(() => window.pywebview.api.show_alert(getMsg("title_prompt"), getMsg("msg_reset_success"), "info"));
@@ -917,11 +1065,12 @@ document.addEventListener('DOMContentLoaded', () => {
     renderDataGrid('#startup_window', [], cols.startup, 'id', false);
     renderDataGrid('#junk_window', [], cols.junk, 'path', true);
     renderDataGrid('#repair_window', [], cols.repair, 'id', true);
-    renderDataGrid('#whitelist_window', [], cols.pathOnly, 'path', false);
-    renderDataGrid('#quarantine_window', [], cols.pathOnly, 'path', false);
-    renderDataGrid('#custom_protect_window', [], cols.pathOnly, 'path', false);
+    renderDataGrid('#whitelist_window', [], cols.fileList, 'path', false);
+    renderDataGrid('#quarantine_window', [], cols.fileList, 'path', false);
+    renderDataGrid('#custom_protect_window', [], cols.fileList, 'path', false);
     renderDataGrid('#popup_window', [], cols.popup, 'value', false);
     renderDataGrid('#log_export_window', [], cols.log, 'id', true);
+    renderDataGrid('#netmon_window', [], cols.netmon, 'pid', false);
 
     window.addEventListener('pywebviewready', () => {
         window.pywebview.api.get_config().then(cfg => {
@@ -933,7 +1082,7 @@ document.addEventListener('DOMContentLoaded', () => {
             updateCustomSelectUI('theme_select', theme);
             updateCustomSelectUI('lang_select', lang);
 
-            const switchMap = ["process_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "context_switch"];
+            const switchMap = ["process_switch", "suspend_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "suffix_switch", "autostart_switch", "context_switch"];
             document.querySelectorAll('.toggle-switch input').forEach((toggle, index) => {
                 if (appState.firstLaunch) { 
                     toggle.checked = false; 
@@ -953,8 +1102,8 @@ document.addEventListener('DOMContentLoaded', () => {
     window.onEngineReady = async () => {
         if (!appState.firstLaunch) return;
         await window.pywebview.api.update_config("first_launch", false);
-        const switchMap = ["process_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "context_switch"];
-        const seq = ["cloud_switch", "process_switch", "document_switch", "system_switch", "network_switch", "driver_switch"];
+        const switchMap = ["process_switch", "suspend_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "suffix_switch", "autostart_switch", "context_switch"];
+        const seq = ["cloud_switch", "autostart_switch", "suffix_switch", "process_switch", "suspend_switch", "document_switch", "system_switch", "network_switch", "driver_switch", "context_switch"];
         
         for (const key of seq) {
             const index = switchMap.indexOf(key);
@@ -967,7 +1116,7 @@ document.addEventListener('DOMContentLoaded', () => {
                         if (res !== undefined && res !== null) toggle.checked = res;
                     } catch { toggle.checked = false; } 
                     finally { toggle.disabled = false; }
-                    await new Promise(r => setTimeout(r, 200));
+                    await new Promise(r => setTimeout(r, 100));
                 }
             }
         }

Interface/templates/index.html

@@ -109,6 +109,12 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>進程暫停</h2><p data-i18n>此選項可以暫停進程等待掃描</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>檔案防護</h2><p data-i18n>此選項可以隔離惡意檔案建立</p>
@@ -174,6 +180,12 @@
                             </div>
                             <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
                         </div>
+                        <div class="list-item" style="cursor: pointer;" data-target="netmon_window">
+                            <div class="item-info">
+                                <h2 data-i18n>流量監控</h2><p data-i18n>此選項可以實時監控網路流量</p>
+                            </div>
+                            <button class="icon-action-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"></polyline></svg></button>
+                        </div>
                         <div class="list-item" style="cursor: pointer;" data-target="whitelist_window">
                             <div class="item-info">
                                 <h2 data-i18n>白名單</h2><p data-i18n>此選項可以查看並管理白名單</p>
@@ -209,6 +221,18 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>副檔名過濾</h2><p data-i18n>此選項僅掃描指定檔案副檔名</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>開機啟動</h2><p data-i18n>此選項可以設定開機自動執行</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>選單掃描</h2><p data-i18n>此選項可以啟用右鍵掃描功能</p>
@@ -278,34 +302,64 @@
                         </div>
                         <div class="license-widget">
                             <textarea class="license-text" readonly>87owo Publicly Available Source Code License Agreement
-Last updated: 2025-12-19
 
-1. License and Ownership
-   - This software and its source code are source available for public view.
-   - Access or execution of certain features may require an activation key.
-   - 87owo reserves all legal rights, no intellectual property is transferred.
-   - All project archives, source code, and binaries remain fully proprietary.
+Last Updated: 2026-06-09
+IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
-2. Use and Prohibitions
-   - You may view, download, and modify the code for local and personal use.
-   - Redistribution of any original or modified code requires prior consent.
-   - Commercial hosting or SaaS deployment is prohibited without permission.
-   - Reverse engineering, license removal, or illegal use is strictly barred.
+1. Definitions and Interpretation
 
-3. Data and Privacy
-   - This project may collect operational data for optimization and analysis.
-   - All collected data is strictly anonymized to ensure the user's privacy.
-   - Transmission of information is encrypted to prevent unauthorized access.
+   - 1.1. Author: Refers to 87owo (PYAS Security).
+   - 1.2. Software: Refers to the source code, binaries, project archives, assets, and documentation associated with this repository or distribution.
+   - 1.3. Personal Local Use: Means viewing, downloading, executing, and modifying the Software strictly on local hardware owned or directly controlled by an individual for private, non-commercial, non-production, and non-distribution purposes.
+   - 1.4. Enterprise Use: Includes enterprise internal deployment, multi-user institutional use, or utilization within any corporate environment, which is strictly excluded from Personal Local Use.
 
-4. Updates and Terms
-   - New releases may include critical patches, enhancements, or UI changes.
-   - Continued use of these services constitutes acceptance of updated terms.
-   - The author reserves the right to modify these license terms at any time.
+2. Intellectual Property and Ownership
 
-5. Warranty and Liability
-   - All services and assets are provided "as is" without any form of warranty.
-   - 87owo is not liable for any direct or indirect damages from software use.
-   - Users assume all risks regarding performance, data, and system integrity.
+   - 2.1. Retention of Rights: The Author reserves all legal rights, titles, and interests in and to the Software, including but not limited to all copyrights, trademarks, patents, and trade secrets.
+   - 2.2. No Transfer: No intellectual property rights or ownership stakes are transferred under this Agreement. All project components remain fully proprietary.
+   - 2.3. Activation Keys: Access to or execution of certain premium features, modules, or binary distributions within the Software may require a valid, authorized activation key issued solely by the Author.
+
+3. Grant of License and Permitted Use
+
+   Subject to your strict compliance with all terms of this Agreement, the Author hereby grants you a limited, non-exclusive, world-wide, royalty-free, revocable, and non-transferable license to:
+   - 3.1. Code Inspection: View and download the source code from official authorized repositories.
+   - 3.2. Local Modification: Modify the source code strictly for the purposes of Personal Local Use.
+   - 3.3. Local Execution: Execute the Software locally for personal evaluation and private deployment.
+
+4. Prohibitions and Restrictions
+
+   Except as explicitly granted in Section 3, you shall not, and shall not permit any third party to:
+   - 4.1. Unauthorized Redistribution: Copy, redistribute, sublicense, republish, mirror, or publicly disclose any original or modified versions of the source code, binaries, or assets.
+   - 4.2. Commercial and SaaS Deployment: Host, deploy, embed, or utilize the Software for commercial purposes, including but not limited to Software-as-a-Service (SaaS), commercial web hosting, paid remote execution, cloud infrastructure integration, or enterprise internal utility.
+   - 4.3. Reverse Engineering: Reverse engineer, decompile, decrypt, or disassemble any binary components of the Software, except and only to the extent that such restriction is explicitly prohibited by applicable mandatory laws.
+   - 4.4. Notice Preservation: Remove, obscure, deface, or alter any copyright notices, trademarks, hyperlinked terms, or license files included within the Software distribution.
+
+5. Prior Authorization and Application Channels
+
+   - 5.1. Authorization Requirement: Any activity exceeding the scope of Personal Local Use (including but not limited to public redistribution, independent forks not targeting upstream contributions, commercial deployment, or enterprise use) requires prior explicit written consent from the Author.
+   - 5.2. Official Application Channels: Users seeking such authorization must submit a formal request through one of the following official channels:
+      - Channel A (GitHub Fork): Initiating a standard Fork on the official GitHub repository for collaborative and upstream contributions.
+      - Channel B (GitHub Issues): Submitting a public issue utilizing the designated authorization request template.
+      - Channel C (Official Email): Sending a detailed inquiry to the official organizational email address associated with the PYAS Security project.
+   - 5.3. Request Content: Any application must explicitly state the specific use case, intended target audience, scope of deployment, and whether any commercial monetization is involved.
+
+6. Updates, Amendments, and Scope of Terms
+
+   - 6.1. New Releases: The Author may deliver updates, critical security patches, feature enhancements, or user interface modifications. Continued use of the Software constitutes acceptance of the latest distributed version.
+   - 6.2. Non-Retroactivity: The Author reserves the right to amend this License Agreement at any time. Amendments apply strictly to subsequent versions or new downloads. Copies lawfully acquired prior to such modification remain governed by the exact version of the License under which they were originally obtained.
+
+7. Telemetry, Data, and Privacy
+
+   - 7.1. Operational Data Collection: The Software may collect anonymized technical, operational, and usage data strictly for security analysis, performance optimization, and bug reporting.
+   - 7.2. Cloud Sample Submission: To enhance threat detection and malware analysis, the Software may automatically or manually transmit suspicious executable files and software samples to the Author's cloud infrastructure for deep analysis.
+   - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
+   - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
+   - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+
+8. Warranty Disclaimer and Limitation of Liability
+
+   - 8.1. Disclaimer of Warranty: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ALL RELATED ASSETS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+   - 8.2. Limitation of Liability: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. USERS ASSUME ALL RISKS REGARDING PERFORMANCE, DATA INTEGRITY, AND SYSTEM STABILITY.
 
 © 2020-2026 87owo (PYAS Security). All rights reserved.</textarea>
                         </div>
@@ -321,8 +375,15 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋進程..." placeholder="搜尋進程...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>查看</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>結束</button>
+                        <div class="action-group modern-action-group">
+                            <select id="taskmgr_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="view" data-i18n="btn_view_item">查看項目</option>
+                                <option value="end" data-i18n="btn_end">結束進程</option>
+                                <option value="quarantine" data-i18n="act_quarantine">加入隔離區</option>
+                                <option value="whitelist" data-i18n="act_white">加入白名單</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -336,8 +397,14 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋項目..." placeholder="搜尋項目...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>啟用</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>禁用</button>
+                        <div class="action-group modern-action-group">
+                            <select id="startup_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="enable" data-i18n="btn_enable_item">啟用項目</option>
+                                <option value="disable" data-i18n="btn_disable_item">禁用項目</option>
+                                <option value="delete" data-i18n="btn_delete_item">刪除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -351,8 +418,16 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="whitelist_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add_file" data-i18n="btn_add_file">新增檔案</option>
+                                <option value="add_path" data-i18n="btn_add_path">新增路徑</option>
+                                <option value="extract" data-i18n="btn_extract_item">提取項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                                <option value="quarantine" data-i18n="act_quarantine">加入隔離區</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -366,8 +441,16 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="quarantine_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add_file" data-i18n="btn_add_file">新增檔案</option>
+                                <option value="add_path" data-i18n="btn_add_path">新增路徑</option>
+                                <option value="extract" data-i18n="btn_extract_item">提取項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                                <option value="whitelist" data-i18n="act_white">加入白名單</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -381,8 +464,13 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋檔案..." placeholder="搜尋檔案...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>掃描</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>刪除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="junk_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="view" data-i18n="btn_view_item">查看項目</option>
+                                <option value="delete" data-i18n="btn_delete_item">刪除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -392,8 +480,12 @@ Last updated: 2025-12-19
                         <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
                         <h2 data-i18n>系統修復</h2>
                         <div class="spacer"></div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>掃描</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>修復</button>
+                        <div class="action-group modern-action-group">
+                            <select id="repair_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="repair" data-i18n="btn_repair_item">修復項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -407,8 +499,33 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋窗口..." placeholder="搜尋窗口...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="popup_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add" data-i18n="btn_add_item">新增項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                            </select>
+                        </div>
+                    </div>
+                    <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
+                </section>
+                
+                <section id="netmon_window" class="page sub-page">
+                    <div class="sub-header-toolbar">
+                        <button class="icon-btn" data-target="tool_window"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"></polyline></svg></button>
+                        <h2 data-i18n>流量監控</h2>
+                        <div class="spacer"></div>
+                        <div class="search-box">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
+                            <input type="text" data-i18n-placeholder="搜尋進程..." placeholder="搜尋進程...">
+                        </div>
+                        <div class="action-group modern-action-group">
+                            <select id="netmon_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="view" data-i18n="btn_view_item">查看項目</option>
+                                <option value="end" data-i18n="btn_end">結束進程</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -422,8 +539,13 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋規則..." placeholder="搜尋規則...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>加入</button>
-                        <button class="action-btn modern-btn" data-i18n>移除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="custom_protect_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="add" data-i18n="btn_add_item">新增項目</option>
+                                <option value="remove" data-i18n="btn_remove_item">移除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>
@@ -437,8 +559,13 @@ Last updated: 2025-12-19
                             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                             <input type="text" data-i18n-placeholder="搜尋日誌..." placeholder="搜尋日誌...">
                         </div>
-                        <button class="action-btn modern-btn primary-btn" data-i18n>導出</button>
-                        <button class="action-btn modern-btn danger-btn" data-i18n>刪除</button>
+                        <div class="action-group modern-action-group">
+                            <select id="log_export_select" class="modern-select">
+                                <option value="none" selected disabled data-i18n="btn_select">選擇</option>
+                                <option value="export" data-i18n="btn_export">導出項目</option>
+                                <option value="delete" data-i18n="btn_remove_item">移除項目</option>
+                            </select>
+                        </div>
                     </div>
                     <div class="manage-widget flex-grow"><ul class="manage-list"></ul></div>
                 </section>

LICENSE.txt

@@ -1,31 +1,61 @@
 87owo Publicly Available Source Code License Agreement
-Last updated: 2025-12-19
 
-1. License and Ownership
-   - This software and its source code are source available for public view.
-   - Access or execution of certain features may require an activation key.
-   - 87owo reserves all legal rights, no intellectual property is transferred.
-   - All project archives, source code, and binaries remain fully proprietary.
+Last Updated: 2026-06-09
+IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
-2. Use and Prohibitions
-   - You may view, download, and modify the code for local and personal use.
-   - Redistribution of any original or modified code requires prior consent.
-   - Commercial hosting or SaaS deployment is prohibited without permission.
-   - Reverse engineering, license removal, or illegal use is strictly barred.
+1. Definitions and Interpretation
 
-3. Data and Privacy
-   - This project may collect operational data for optimization and analysis.
-   - All collected data is strictly anonymized to ensure the user's privacy.
-   - Transmission of information is encrypted to prevent unauthorized access.
+   - 1.1. Author: Refers to 87owo (PYAS Security).
+   - 1.2. Software: Refers to the source code, binaries, project archives, assets, and documentation associated with this repository or distribution.
+   - 1.3. Personal Local Use: Means viewing, downloading, executing, and modifying the Software strictly on local hardware owned or directly controlled by an individual for private, non-commercial, non-production, and non-distribution purposes.
+   - 1.4. Enterprise Use: Includes enterprise internal deployment, multi-user institutional use, or utilization within any corporate environment, which is strictly excluded from Personal Local Use.
 
-4. Updates and Terms
-   - New releases may include critical patches, enhancements, or UI changes.
-   - Continued use of these services constitutes acceptance of updated terms.
-   - The author reserves the right to modify these license terms at any time.
+2. Intellectual Property and Ownership
 
-5. Warranty and Liability
-   - All services and assets are provided "as is" without any form of warranty.
-   - 87owo is not liable for any direct or indirect damages from software use.
-   - Users assume all risks regarding performance, data, and system integrity.
+   - 2.1. Retention of Rights: The Author reserves all legal rights, titles, and interests in and to the Software, including but not limited to all copyrights, trademarks, patents, and trade secrets.
+   - 2.2. No Transfer: No intellectual property rights or ownership stakes are transferred under this Agreement. All project components remain fully proprietary.
+   - 2.3. Activation Keys: Access to or execution of certain premium features, modules, or binary distributions within the Software may require a valid, authorized activation key issued solely by the Author.
+
+3. Grant of License and Permitted Use
+
+   Subject to your strict compliance with all terms of this Agreement, the Author hereby grants you a limited, non-exclusive, world-wide, royalty-free, revocable, and non-transferable license to:
+   - 3.1. Code Inspection: View and download the source code from official authorized repositories.
+   - 3.2. Local Modification: Modify the source code strictly for the purposes of Personal Local Use.
+   - 3.3. Local Execution: Execute the Software locally for personal evaluation and private deployment.
+
+4. Prohibitions and Restrictions
+
+   Except as explicitly granted in Section 3, you shall not, and shall not permit any third party to:
+   - 4.1. Unauthorized Redistribution: Copy, redistribute, sublicense, republish, mirror, or publicly disclose any original or modified versions of the source code, binaries, or assets.
+   - 4.2. Commercial and SaaS Deployment: Host, deploy, embed, or utilize the Software for commercial purposes, including but not limited to Software-as-a-Service (SaaS), commercial web hosting, paid remote execution, cloud infrastructure integration, or enterprise internal utility.
+   - 4.3. Reverse Engineering: Reverse engineer, decompile, decrypt, or disassemble any binary components of the Software, except and only to the extent that such restriction is explicitly prohibited by applicable mandatory laws.
+   - 4.4. Notice Preservation: Remove, obscure, deface, or alter any copyright notices, trademarks, hyperlinked terms, or license files included within the Software distribution.
+
+5. Prior Authorization and Application Channels
+
+   - 5.1. Authorization Requirement: Any activity exceeding the scope of Personal Local Use (including but not limited to public redistribution, independent forks not targeting upstream contributions, commercial deployment, or enterprise use) requires prior explicit written consent from the Author.
+   - 5.2. Official Application Channels: Users seeking such authorization must submit a formal request through one of the following official channels:
+      - Channel A (GitHub Fork): Initiating a standard Fork on the official GitHub repository for collaborative and upstream contributions.
+      - Channel B (GitHub Issues): Submitting a public issue utilizing the designated authorization request template.
+      - Channel C (Official Email): Sending a detailed inquiry to the official organizational email address associated with the PYAS Security project.
+   - 5.3. Request Content: Any application must explicitly state the specific use case, intended target audience, scope of deployment, and whether any commercial monetization is involved.
+
+6. Updates, Amendments, and Scope of Terms
+
+   - 6.1. New Releases: The Author may deliver updates, critical security patches, feature enhancements, or user interface modifications. Continued use of the Software constitutes acceptance of the latest distributed version.
+   - 6.2. Non-Retroactivity: The Author reserves the right to amend this License Agreement at any time. Amendments apply strictly to subsequent versions or new downloads. Copies lawfully acquired prior to such modification remain governed by the exact version of the License under which they were originally obtained.
+
+7. Telemetry, Data, and Privacy
+
+   - 7.1. Operational Data Collection: The Software may collect anonymized technical, operational, and usage data strictly for security analysis, performance optimization, and bug reporting.
+   - 7.2. Cloud Sample Submission: To enhance threat detection and malware analysis, the Software may automatically or manually transmit suspicious executable files and software samples to the Author's cloud infrastructure for deep analysis.
+   - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
+   - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
+   - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+
+8. Warranty Disclaimer and Limitation of Liability
+
+   - 8.1. Disclaimer of Warranty: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ALL RELATED ASSETS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+   - 8.2. Limitation of Liability: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. USERS ASSUME ALL RISKS REGARDING PERFORMANCE, DATA INTEGRITY, AND SYSTEM STABILITY.
 
 © 2020-2026 87owo (PYAS Security). All rights reserved.

PYAS_Engine.py

@@ -1,5 +1,5 @@
-import os, re, yara, time, math, json, numpy, base64, datetime, requests, zlib
-import ctypes, ctypes.wintypes, hashlib, pefile, threading, onnxruntime
+import os, re, yara, time, math, json, zlib, mmap, numpy, datetime, requests
+import ctypes, ctypes.wintypes, pefile, threading, onnxruntime
 
 ####################################################################################################
 
@@ -57,6 +57,7 @@ class sign_scanner:
                 setattr(self, name.lower(), ctypes.WinDLL(name, use_last_error=True))
             except Exception:
                 pass
+
         try:
             self.WinVerifyTrust = self.wintrust.WinVerifyTrust
             self.WinVerifyTrust.restype = ctypes.wintypes.LONG
@@ -75,8 +76,10 @@ class sign_scanner:
             fi.pcwszFilePath = os.path.abspath(file_path)
             fi.hFile = None
             fi.pgKnownSubject = None
+
             wt_union = WINTRUST_DATA_UNION()
             wt_union.pFile = ctypes.pointer(fi)
+
             td = WINTRUST_DATA()
             td.cbStruct = ctypes.sizeof(WINTRUST_DATA)
             td.pPolicyCallbackData = None
@@ -91,6 +94,7 @@ class sign_scanner:
             td.dwProvFlags = 0
             td.dwUIContext = 0
             td.pSignatureSettings = None
+
             return self.WinVerifyTrust(None, ctypes.byref(self.verify), ctypes.byref(td)) == 0
         except Exception:
             return False
@@ -106,15 +110,19 @@ class rule_scanner:
         yara_files = {}
         for root, _, files in os.walk(path):
             for file in files:
+
                 full_path = os.path.join(root, file)
                 if callback:
                     callback(full_path)
+
                 ext = os.path.splitext(file)[1].lower()
                 if ext in ('.yara', '.yar'):
                     namespace = os.path.relpath(full_path, path).replace(os.sep, '_')
                     yara_files[namespace] = full_path
+
                 elif ext in ('.yc', '.yrc'):
                     self.load_compiled_rule(full_path)
+
                 elif ext in ('.ip', '.txt'):
                     self.load_network_list(full_path)
 
@@ -155,6 +163,7 @@ class rule_scanner:
                 label = rule_name.split("_")[0]
                 level = rule_name.split("_")[-1]
                 return f"{label}:WinPE/Unknown.{level}!yr", level
+
             return False, False
         except Exception:
             return False, False
@@ -170,6 +179,7 @@ class rule_scanner:
                 label = rule_name.split("_")[0]
                 level = rule_name.split("_")[-1]
                 return f"{label}:WinPE/Unknown.{level}!ym", level
+
             return False, False
         except Exception:
             return False, False
@@ -183,6 +193,7 @@ class pe_scanner:
     _BYTE_ENT_KEYS = [f'ByteEnt_{i:02X}' for i in range(256)]
     _STRING_KEYS = [f'StringHist_{i:02d}' for i in range(95)]
     _SECTION_HASH_KEYS = [f'SectionHash_{i:02d}' for i in range(50)]
+
     _CHAR_FLAGS = [0x00000020, 0x00000040, 0x00000080, 0x02000000, 0x20000000, 0x40000000, 0x80000000]
     _CHAR_COUNT_KEYS = {flag: f'Char_{flag:08X}_Count' for flag in _CHAR_FLAGS}
     _CHAR_ENT_KEYS = {flag: f'Char_{flag:08X}_MeanEntropy' for flag in _CHAR_FLAGS}
@@ -194,6 +205,10 @@ class pe_scanner:
         self.model = None
         self.input_name = None
         self.feature_order = []
+        self.dll_hash_dim = 512
+        self.api_hash_dim = 4096
+        self.dll_hash_pad = 3
+        self.api_hash_pad = 4
         self.signer = sign_scanner()
         self.signer.init_windll(["wintrust"])
 
@@ -201,29 +216,62 @@ class pe_scanner:
         for root, _, files in os.walk(path):
             for file in files:
                 full_path = os.path.join(root, file)
+
                 if callback:
                     callback(full_path)
+
                 if full_path.endswith('.onnx'):
                     self.load_model(full_path)
 
     def load_model(self, model_path):
         if not os.path.exists(model_path):
             return
+
         try:
             self.model = onnxruntime.InferenceSession(model_path, providers=['CPUExecutionProvider'])
             self.input_name = self.model.get_inputs()[0].name
+
             feat_path = os.path.join(os.path.dirname(model_path), "features.json")
             if os.path.exists(feat_path):
                 with open(feat_path, 'r', encoding='utf-8') as f:
                     self.feature_order = json.load(f)
+
+            self._parse_hash_dims()
+
         except Exception:
             pass
 
+    def _parse_hash_dims(self):
+        max_dll = -1
+        max_api = -1
+        
+        for feat in self.feature_order:
+            if feat.startswith("DllHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_dll = max(max_dll, int(val_str))
+                    self.dll_hash_pad = len(val_str)
+                except Exception:
+                    pass
+            elif feat.startswith("ApiHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_api = max(max_api, int(val_str))
+                    self.api_hash_pad = len(val_str)
+                except Exception:
+                    pass
+                    
+        if max_dll >= 0:
+            self.dll_hash_dim = max_dll + 1
+        if max_api >= 0:
+            self.api_hash_dim = max_api + 1
+
     def _safe_float(self, val):
         try:
             f = float(val)
             if math.isinf(f) or math.isnan(f): 
                 return 0.0
+
             return f
         except Exception:
             return 0.0
@@ -231,33 +279,43 @@ class pe_scanner:
     def _calc_entropy(self, data):
         if not data: 
             return 0.0
+
         arr = numpy.frombuffer(data, dtype=numpy.uint8)
         sz = len(arr)
         counts = numpy.bincount(arr, minlength=256)
         counts = counts[counts > 0]
+
         return float(numpy.log2(sz) - numpy.sum(counts * numpy.log2(counts)) / sz)
 
     def _extract_strings(self, file_bytes):
         res = {"StringCount": 0.0, "StringMeanLength": 0.0, "StringEntropy": 0.0}
         res.update(dict.fromkeys(self._STRING_KEYS, 0.0))
 
-        matches = self._STRING_PATTERN.findall(file_bytes)
-        if not matches:
-            return res
+        total_len = 0
+        count = 0
+        global_counts = numpy.zeros(256, dtype=numpy.int64)
+        mv = memoryview(file_bytes)
 
-        combined_data = b''.join(matches)
-        count = len(matches)
-        total_len = len(combined_data)
+        for m in self._STRING_PATTERN.finditer(file_bytes):
+            count += 1
+            start, end = m.span()
+            total_len += (end - start)
+            arr = numpy.frombuffer(mv[start:end], dtype=numpy.uint8)
+            global_counts += numpy.bincount(arr, minlength=256)
+
+        if count == 0 or total_len == 0:
+            return res
 
         res["StringCount"] = float(count)
         res["StringMeanLength"] = float(total_len) / count
-        res["StringEntropy"] = self._calc_entropy(combined_data)
 
-        arr = numpy.frombuffer(combined_data, dtype=numpy.uint8)
-        counts = numpy.bincount(arr, minlength=127)
-        char_counts = counts[0x20:0x7F]
+        counts_nonzero = global_counts[global_counts > 0]
+        if len(counts_nonzero) > 0:
+            res["StringEntropy"] = float(numpy.log2(total_len) - numpy.sum(counts_nonzero * numpy.log2(counts_nonzero)) / total_len)
+
+        valid_chars = global_counts[0x20:0x7F]
+        res.update(dict(zip(self._STRING_KEYS, valid_chars.astype(numpy.float64) / total_len)))
 
-        res.update(dict(zip(self._STRING_KEYS, char_counts.astype(numpy.float64) / total_len)))
         return res
 
     def _extract_histograms(self, file_bytes):
@@ -286,6 +344,7 @@ class pe_scanner:
             byte_bins = w_counts.reshape(16, 16).sum(axis=1)
             idx_start = ent_bin * 16
             ent_hist[idx_start : idx_start+16] += byte_bins
+
         else:
             num_windows = (sz - window) // step + 1
             batch_windows = 10000 
@@ -342,6 +401,7 @@ class pe_scanner:
     def _extract_rich_header(self, pe):
         if not hasattr(pe, 'RICH_HEADER') or not pe.RICH_HEADER:
             return {"HasRichHeader": 0.0, "RichHeaderCount": 0.0}
+
         return {
             "HasRichHeader": 1.0,
             "RichHeaderCount": float(len(pe.RICH_HEADER.values) // 2) if hasattr(pe.RICH_HEADER, 'values') else 0.0
@@ -398,6 +458,7 @@ class pe_scanner:
                 for entry_lang in entry_id.directory.entries:
                     if hasattr(entry_lang, 'id'):
                         langs.add(entry_lang.id)
+
                     if hasattr(entry_lang, 'data'):
                         try:
                             data = pe.get_data(entry_lang.data.struct.OffsetToData, entry_lang.data.struct.Size)
@@ -417,13 +478,17 @@ class pe_scanner:
 
     def _extract_load_config(self, pe):
         cfg = {"HasLoadConfig": 0.0, "HasCFG": 0.0, "HasSEHTable": 0.0}
+
         if hasattr(pe, 'DIRECTORY_ENTRY_LOAD_CONFIG'):
             cfg["HasLoadConfig"] = 1.0
             struct = pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct
+
             if getattr(struct, 'GuardCFFunctionTable', 0) != 0:
                 cfg["HasCFG"] = 1.0
+
             if getattr(struct, 'SEHandlerTable', 0) != 0:
                 cfg["HasSEHTable"] = 1.0
+
         return cfg
 
     def _extract_security_directory(self, pe, file_bytes, fsize):
@@ -463,18 +528,21 @@ class pe_scanner:
 
     def extract_features(self, file_path):
         pe = None
+        mm = None
+        f = None
+
         try:
             fsize = os.path.getsize(file_path)
             if fsize == 0 or fsize > 536870912:
                 return None
 
-            with open(file_path, "rb") as f:
-                file_bytes = f.read()
+            f = open(file_path, "rb")
+            mm = mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ)
 
             base = {}
             dlls = set()
             apis = set()
-            pe = pefile.PE(data=file_bytes, fast_load=True)
+            pe = pefile.PE(data=mm, fast_load=True)
             
             try:
                 pe.parse_rich_header()
@@ -490,7 +558,7 @@ class pe_scanner:
                 pass
             
             base['TrustSigned'] = 1.0 if self.signer.sign_verify(file_path) else 0.0
-            base['FileEntropy'] = self._calc_entropy(file_bytes)
+            base['FileEntropy'] = self._calc_entropy(mm)
             base['FileSize'] = float(fsize)
             
             fh = pe.FILE_HEADER
@@ -508,7 +576,6 @@ class pe_scanner:
             base['Is64Bit'] = 1.0 if base['Machine'] in (0x8664, 0xAA64, 0x0200) else 0.0
             base['IsExe'] = 1.0 if pe.is_exe() else 0.0
             base['IsDll'] = 1.0 if pe.is_dll() else 0.0
-
             base['ExceptionCount'] = 0.0
 
             if hasattr(pe, 'OPTIONAL_HEADER'):
@@ -556,6 +623,7 @@ class pe_scanner:
                     try:
                         s_data = section.get_data()
                         s_entropy = self._calc_entropy(s_data)
+
                     except Exception:
                         s_entropy = 0.0
 
@@ -563,10 +631,14 @@ class pe_scanner:
                     raw_sizes.append(section.SizeOfRawData)
                     v_sizes.append(section.Misc_VirtualSize)
 
-                    if section.Characteristics & 0x20000000: exec_sec += 1
-                    if section.Characteristics & 0x80000000: write_sec += 1
-                    if section.Characteristics & 0x40000000: read_sec += 1
-                    if section.SizeOfRawData + section.PointerToRawData > fsize: sec_exc = 1
+                    if section.Characteristics & 0x20000000:
+                        exec_sec += 1
+                    if section.Characteristics & 0x80000000:
+                        write_sec += 1
+                    if section.Characteristics & 0x40000000:
+                        read_sec += 1
+                    if section.SizeOfRawData + section.PointerToRawData > fsize:
+                        sec_exc = 1
 
                     for flag in self._CHAR_FLAGS:
                         if section.Characteristics & flag:
@@ -603,6 +675,7 @@ class pe_scanner:
             if hasattr(pe, 'FileInfo'):
                 for fileinfo_list in pe.FileInfo:
                     for fileinfo in fileinfo_list:
+
                         if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
                             for st in getattr(fileinfo, 'StringTable', []):
                                 for key, val in st.entries.items():
@@ -611,6 +684,7 @@ class pe_scanner:
                                         if k in string_keys:
                                             v = val.decode('utf-8', 'ignore') if isinstance(val, bytes) else str(val)
                                             base[f'{k}Length'] = float(len(v))
+
                                     except Exception: 
                                         continue
 
@@ -629,12 +703,14 @@ class pe_scanner:
             if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
                 base['ImportCount'] = float(len(pe.DIRECTORY_ENTRY_IMPORT))
                 func_count = 0
+
                 for entry in pe.DIRECTORY_ENTRY_IMPORT:
                     if getattr(entry, 'dll', None):
                         try:
                             dlls.add(entry.dll.decode('ascii', 'ignore').lower())
                         except Exception:
                             pass
+
                     for imp in getattr(entry, 'imports', []):
                         func_count += 1
                         if getattr(imp, 'name', None):
@@ -642,6 +718,7 @@ class pe_scanner:
                                 apis.add(imp.name.decode('ascii', 'ignore'))
                             except Exception:
                                 pass
+
                 base['ImportFunctionCount'] = float(func_count)
             else:
                 base['ImportCount'] = 0.0
@@ -657,6 +734,7 @@ class pe_scanner:
                 for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
                     if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
                         icon_count += len(getattr(entry.directory, 'entries', []))
+
                 base['IconCount'] = float(icon_count)
             else:
                 base['IconCount'] = 0.0
@@ -666,14 +744,14 @@ class pe_scanner:
             else:
                 base['DebugCount'] = 0.0
 
-            base.update(self._extract_strings(file_bytes))
-            base.update(self._extract_histograms(file_bytes))
+            base.update(self._extract_strings(mm))
+            base.update(self._extract_histograms(mm))
             base.update(self._extract_overlay_features(pe, fsize))
             base.update(self._extract_rich_header(pe))
             base.update(self._extract_ep_anomalies(pe))
             base.update(self._extract_advanced_resources(pe))
             base.update(self._extract_load_config(pe))
-            base.update(self._extract_security_directory(pe, file_bytes, fsize))
+            base.update(self._extract_security_directory(pe, mm, fsize))
 
             for k in base:
                 base[k] = self._safe_float(base[k])
@@ -685,10 +763,15 @@ class pe_scanner:
         finally:
             if pe:
                 pe.close()
+            if mm:
+                mm.close()
+            if f:
+                f.close()
 
     def pe_scan(self, file_path, enhanced_mode=False):
         if not self.model or not self.feature_order:
             return False, False
+
         try:
             raw_data = self.extract_features(file_path)
             if not raw_data:
@@ -708,8 +791,9 @@ class pe_scanner:
                 old_fn = f"Dll_{d}"
                 if old_fn in feat_map: 
                     vec[0, feat_map[old_fn]] = 1.0
-                h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
-                new_fn = f"DllHash_{h:03d}"
+
+                h = zlib.crc32(d.encode('utf-8', 'ignore')) % self.dll_hash_dim
+                new_fn = f"DllHash_{h:0{self.dll_hash_pad}d}"
                 if new_fn in feat_map: 
                     vec[0, feat_map[new_fn]] += 1.0
 
@@ -717,12 +801,15 @@ class pe_scanner:
                 old_fn = f"Api_{a}"
                 if old_fn in feat_map: 
                     vec[0, feat_map[old_fn]] = 1.0
-                h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
-                new_fn = f"ApiHash_{h:04d}"
+
+                h = zlib.crc32(a.encode('utf-8', 'ignore')) % self.api_hash_dim
+                new_fn = f"ApiHash_{h:0{self.api_hash_pad}d}"
                 if new_fn in feat_map: 
                     vec[0, feat_map[new_fn]] += 1.0
 
             outputs = self.model.run(None, {self.input_name: vec})
+            
+            del raw_data, vec
             result = outputs[1]
             prob = 0.0
 
@@ -730,12 +817,12 @@ class pe_scanner:
                 prob_dict = result[0]
                 if hasattr(prob_dict, 'get'):
                     prob = float(prob_dict.get(1, prob_dict.get('1', 0.0)))
+
             elif isinstance(result, numpy.ndarray):
                 if result.ndim == 2 and result.shape[1] > 1:
                     prob = float(result[0][1])
 
             score = int(prob * 100)
-            
             if score >= 80:
                 return f"General:WinPE/Malware.{score}!ml", score
             elif enhanced_mode and score >= 50:
@@ -749,67 +836,52 @@ class pe_scanner:
 
 class cloud_scanner:
     def __init__(self):
-        self.session = None
         self.api_host = None
         self.api_key = None
         self.timeout = 30
         self.lock = threading.RLock()
+        self.local = threading.local()
 
-    def _init_session(self, api_host, api_key):
-        with self.lock:
-            if self.session is None or self.api_host != api_host or self.api_key != api_key:
-                self.api_host = api_host.rstrip('/')
-                self.api_key = api_key
-                self.session = requests.Session()
-                self.session.headers.update({"X-API-Key": api_key, "User-Agent": "PYAS-Engine/1.1"})
+    def _get_session(self, api_host, api_key):
+        if not hasattr(self.local, 'session') or getattr(self.local, 'host', None) != api_host:
+            self.local.session = requests.Session()
+            self.local.session.headers.update({"X-API-Key": api_key, "User-Agent": "PYAS-Engine/1.1"})
+            self.local.host = api_host
 
-    def _request(self, method, endpoint, **kwargs):
-        with self.lock:
-            current_session = self.session
-            current_host = self.api_host
-            
-        if not current_session:
-            return None
-            
+        return self.local.session
+
+    def _request(self, method, endpoint, api_host, api_key, **kwargs):
+        session = self._get_session(api_host, api_key)
         try:
-            r = current_session.request(method, f"{current_host}{endpoint}", timeout=self.timeout, **kwargs)
+            r = session.request(method, f"{api_host}{endpoint}", timeout=self.timeout, **kwargs)
             if r.status_code == 200:
                 return r
+
         except Exception:
             pass
         return None
 
-    def calc_hash(self, file_path, block_size=65536):
-        try:
-            h = hashlib.sha256()
-            with open(file_path, "rb") as f:
-                for chunk in iter(lambda: f.read(block_size), b""):
-                    h.update(chunk)
-            return h.hexdigest()
-        except Exception:
-            return ""
-
 ####################################################################################################
 
     def rescan(self, sha256, api_host, api_key):
-        self._init_session(api_host, api_key)
-        r = self._request("POST", f"/api/rescan/{sha256}")
+        r = self._request("POST", f"/api/rescan/{sha256}", api_host, api_key)
         return r is not None and r.json().get('status') == 'success'
 
-    def upload_file(self, file_path, api_host, api_key, chunk_size=4194304, need_rescan=False, max_retries=3):
+    def upload_file(self, file_path, api_host, api_key, chunk_size=4194304, need_rescan=False, max_retries=3, file_hash=None):
         try:
-            self._init_session(api_host, api_key)
-            sha256 = self.calc_hash(file_path)
+            sha256 = file_hash
             if not sha256:
                 return False, None
 
-            status_req = self._request("GET", f"/api/processing_status/{sha256}")
+            status_req = self._request("GET", f"/api/processing_status/{sha256}", api_host, api_key)
             if status_req:
                 current_status = status_req.json().get('status')
+
                 if current_status == 'done':
                     if need_rescan:
                         self.rescan(sha256, api_host, api_key)
                     return True, sha256
+
                 elif current_status in ('queued', 'processing'):
                     return True, sha256
 
@@ -823,15 +895,11 @@ class cloud_scanner:
             with open(file_path, 'rb') as f:
                 for i in range(total_chunks):
                     chunk_data = f.read(chunk_size)
-                    headers = {
-                        "X-Chunk-Index": str(i),
-                        "X-Total-Chunks": str(total_chunks),
-                        "X-Upload-ID": upload_id
-                    }
+                    headers = {"X-Chunk-Index": str(i), "X-Total-Chunks": str(total_chunks), "X-Upload-ID": upload_id}
                     
                     chunk_success = False
                     for attempt in range(max_retries):
-                        r = self._request("POST", "/api/upload", files={'file': (os.path.basename(file_path), chunk_data)}, headers=headers)
+                        r = self._request("POST", "/api/upload", api_host, api_key, files={'file': (os.path.basename(file_path), chunk_data)}, headers=headers)
                         if r:
                             if i == total_chunks - 1:
                                 try:
@@ -840,6 +908,7 @@ class cloud_scanner:
                                         sha256 = resp.get('url', '').split('/')[-1]
                                 except Exception:
                                     pass
+
                             chunk_success = True
                             break
                         time.sleep(2 ** attempt)
@@ -857,24 +926,25 @@ class cloud_scanner:
         try:
             if not sha256:
                 return False
-            self._init_session(api_host, api_key)
 
             is_done = False
             for _ in range(max_retries):
-                r = self._request("GET", f"/api/processing_status/{sha256}")
+                r = self._request("GET", f"/api/processing_status/{sha256}", api_host, api_key)
                 if r:
                     st = r.json().get('status', 'error')
                     if st == 'done':
                         is_done = True
                         break
+
                     if st in ['error', 'failed']:
                         return False
+
                 time.sleep(interval)
 
             if not is_done:
                 return False
 
-            r = self._request("GET", f"/api/report/{sha256}")
+            r = self._request("GET", f"/api/report/{sha256}", api_host, api_key)
             if r:
                 data = r.json().get('data', {})
                 metadata = data.get('metadata', {})
@@ -885,6 +955,7 @@ class cloud_scanner:
                 is_malicious = 'General' in label
                 sim_malicious_count = 0
                 valid_sim_count = 0
+
                 for s in sims:
                     if s.get('similarity', 0) > 80:
                         valid_sim_count += 1
@@ -893,6 +964,7 @@ class cloud_scanner:
 
                 if is_malicious and (valid_sim_count == 0 or sim_malicious_count == valid_sim_count):
                     return f"General:WinPE/Malware.{score}!cl"
+
         except Exception:
             pass
         return False

PYAS_Inno.iss

@@ -0,0 +1,253 @@
+#define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
+#define AppName "PYAS"
+#define AppVersion "3.6.1.0"
+#define AppPublisher "PYAS Security"
+#define AppURL "https://github.com/87owo/PYAS"
+#define AppExeName "PYAS.exe"
+
+[Setup]
+AppId={#AppId}
+AppName={#AppName}
+AppVersion={#AppVersion}
+AppVerName={#AppName} {#AppVersion}
+AppPublisher={#AppPublisher}
+AppPublisherURL={#AppURL}
+AppSupportURL={#AppURL}
+AppUpdatesURL={#AppURL}
+VersionInfoVersion={#AppVersion}
+VersionInfoCompany={#AppPublisher}
+VersionInfoDescription={#AppName} Setup
+VersionInfoProductName={#AppName} Setup
+VersionInfoProductVersion={#AppVersion}
+DefaultDirName={autopf}\{#AppName}
+DefaultGroupName={#AppPublisher}\{#AppName}
+AllowNoIcons=yes
+LicenseFile=SetupResources\licence.rtf
+ShowLanguageDialog=yes
+WizardStyle=modern
+WizardImageFile=SetupResources\wizardImage.bmp
+WizardSmallImageFile=SetupResources\headerImage.png
+SetupIconFile=Payload\Interface\static\img\icon.ico
+UninstallDisplayIcon={app}\{#AppExeName}
+PrivilegesRequired=admin
+ArchitecturesAllowed=x64compatible
+ArchitecturesInstallIn64BitMode=x64compatible
+MinVersion=10.0
+Compression=lzma2/max
+SolidCompression=yes
+OutputDir=Output
+OutputBaseFilename=PYAS_Setup
+UsePreviousTasks=no
+
+[Languages]
+Name: "english"; MessagesFile: "compiler:Default.isl"
+Name: "chinesesimplified"; MessagesFile: "SetupResources\ChineseSimplified.isl"
+Name: "chinesetraditional"; MessagesFile: "SetupResources\ChineseTraditional.isl"
+Name: "japanese"; MessagesFile: "SetupResources\Japanese.isl"
+Name: "korean"; MessagesFile: "SetupResources\Korean.isl"
+Name: "french"; MessagesFile: "SetupResources\French.isl"
+Name: "spanish"; MessagesFile: "SetupResources\Spanish.isl"
+Name: "hindi"; MessagesFile: "SetupResources\Hindi.isl"
+Name: "arabic"; MessagesFile: "SetupResources\Arabic.isl"
+Name: "russian"; MessagesFile: "SetupResources\Russian.isl"
+Name: "slovenian"; MessagesFile: "SetupResources\Slovenian.isl"
+
+[Tasks]
+Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"
+Name: "autostart"; Description: "{cm:AutoStartTask}"; GroupDescription: "{cm:AdditionalIcons}"
+Name: "install_webview2"; Description: "{cm:InstallWebView2}"; GroupDescription: "{cm:Dependencies}"
+Name: "install_vcredist"; Description: "{cm:InstallVCRedist}"; GroupDescription: "{cm:Dependencies}"
+
+[Files]
+Source: "Payload\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Redist\VC_redist.x64.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
+Source: "Redist\MicrosoftEdgeWebview2Setup.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
+
+[Registry]
+Root: HKCU; Subkey: "Software\Classes\*\shell\PYAS_Scan"; Flags: uninsdeletekey dontcreatekey
+Root: HKCU; Subkey: "Software\Classes\Directory\shell\PYAS_Scan"; Flags: uninsdeletekey dontcreatekey
+
+[UninstallDelete]
+Type: filesandordirs; Name: "{commonappdata}\PYAS"
+
+[Icons]
+Name: "{autodesktop}\{#AppName}"; Filename: "{app}\{#AppExeName}"; Tasks: desktopicon
+Name: "{group}\{#AppName}"; Filename: "{app}\{#AppExeName}"
+Name: "{group}\Uninstall {#AppName}"; Filename: "{uninstallexe}"
+
+[Run]
+Filename: "{tmp}\PYAS_Redist\VC_redist.x64.exe"; Parameters: "/quiet /norestart"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingVCRuntime}"; Tasks: install_vcredist
+Filename: "{tmp}\PYAS_Redist\MicrosoftEdgeWebview2Setup.exe"; Parameters: "/silent /install"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingWebView2Runtime}"; Tasks: install_webview2
+Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#StringChange(AppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent runascurrentuser
+
+[CustomMessages]
+english.InstallingVCRuntime=Installing Microsoft Visual C++ Runtime...
+chinesesimplified.InstallingVCRuntime=正在安装 Microsoft Visual C++ 运行库...
+chinesetraditional.InstallingVCRuntime=正在安裝 Microsoft Visual C++ 執行庫...
+english.InstallingWebView2Runtime=Installing Microsoft Edge WebView2 Runtime...
+chinesesimplified.InstallingWebView2Runtime=正在安装 Microsoft Edge WebView2 Runtime...
+chinesetraditional.InstallingWebView2Runtime=正在安裝 Microsoft Edge WebView2 Runtime...
+english.AutoStartTask=Run PYAS automatically at system startup
+chinesesimplified.AutoStartTask=开机时自动运行 PYAS
+chinesetraditional.AutoStartTask=開機時自動執行 PYAS
+english.Dependencies=Dependencies:
+chinesesimplified.Dependencies=运行环境:
+chinesetraditional.Dependencies=執行環境:
+english.InstallWebView2=Install Microsoft Edge WebView2 Runtime
+chinesesimplified.InstallWebView2=安装 Microsoft Edge WebView2 运行环境
+chinesetraditional.InstallWebView2=安裝 Microsoft Edge WebView2 執行環境
+english.InstallVCRedist=Install Microsoft Visual C++ Runtime
+chinesesimplified.InstallVCRedist=安装 Microsoft Visual C++ 运行库
+chinesetraditional.InstallVCRedist=安裝 Microsoft Visual C++ 執行庫
+english.LegacyVersionDetected=An older version of PYAS was detected. Please uninstall it manually before installing.
+chinesesimplified.LegacyVersionDetected=检测到存在旧版 PYAS。请先手动卸载旧版后，再运行本安装程序。
+chinesetraditional.LegacyVersionDetected=檢測到存在舊版 PYAS。請先手動卸載舊版後，再執行本安裝程式。
+
+[Code]
+var
+  TasksInitialized: Boolean;
+
+function IsWebView2Installed: Boolean;
+var
+  RegKeyPath: string;
+  Version: string;
+begin
+  RegKeyPath := 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';
+  Result := False;
+  if RegQueryStringValue(HKLM, 'SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    if Length(Version) > 0 then Result := True;
+  if not Result and RegQueryStringValue(HKCU, RegKeyPath, 'pv', Version) then
+    if Length(Version) > 0 then Result := True;
+  if not Result and RegQueryStringValue(HKLM, RegKeyPath, 'pv', Version) then
+    if Length(Version) > 0 then Result := True;
+end;
+
+function IsVCRedistInstalled: Boolean;
+var
+  Bld: Cardinal;
+begin
+  Result := False;
+  if RegQueryDWordValue(HKLM, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Bld', Bld) then
+    if Bld > 0 then Result := True;
+end;
+
+procedure CurPageChanged(CurPageID: Integer);
+var
+  I: Integer;
+  ItemText: string;
+begin
+  if (CurPageID = wpSelectTasks) and not TasksInitialized then
+  begin
+    TasksInitialized := True;
+    for I := 0 to WizardForm.TasksList.Items.Count - 1 do
+    begin
+      ItemText := WizardForm.TasksList.Items[I];
+      if Pos('Visual C++', ItemText) > 0 then
+        WizardForm.TasksList.Checked[I] := not IsVCRedistInstalled
+      else if Pos('WebView2', ItemText) > 0 then
+        WizardForm.TasksList.Checked[I] := not IsWebView2Installed;
+    end;
+  end;
+end;
+
+procedure QuitOldInstance(InstallPath: string);
+var
+  ResultCode: Integer;
+  ExePath: string;
+begin
+  ExePath := InstallPath + '\{#AppExeName}';
+  if FileExists(ExePath) then
+  begin
+    Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+    Sleep(500);
+    Exec(ExpandConstant('{sys}\taskkill.exe'), '/F /IM {#AppExeName} /T', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  end;
+end;
+
+function InitializeSetup(): Boolean;
+var
+  OldInstallPath: string;
+  LegacyPath: string;
+begin
+  LegacyPath := ExpandConstant('{pf32}\{#AppName}');
+  if DirExists(LegacyPath) and FileExists(LegacyPath + '\{#AppExeName}') then
+  begin
+    MsgBox(CustomMessage('LegacyVersionDetected'), mbCriticalError, MB_OK);
+    Result := False;
+    Exit;
+  end;
+  if RegQueryStringValue(HKLM, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) or
+     RegQueryStringValue(HKCU, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) then
+  begin
+    QuitOldInstance(OldInstallPath);
+  end;
+  
+  Result := True;
+end;
+
+function InitializeUninstall(): Boolean;
+begin
+  QuitOldInstance(ExpandConstant('{app}'));
+  Result := True;
+end;
+
+procedure TryCreateStartupTask;
+var
+  ResultCode: Integer;
+  PSExe: string;
+  PSCommand: string;
+  AppPath: string;
+begin
+  AppPath := ExpandConstant('{app}\{#AppExeName}');
+  PSExe := ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe');
+  PSCommand := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command ' +
+               '$Action = New-ScheduledTaskAction -Execute ''' + AppPath + ''' -Argument ''-hide''; ' +
+               '$Trigger = New-ScheduledTaskTrigger -AtLogOn; ' +
+               '$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; ' +
+               'Register-ScheduledTask -TaskName ''PYAS_Security_ATS'' -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest -Force';
+  if not Exec(PSExe, PSCommand, '', SW_HIDE, ewWaitUntilTerminated, ResultCode) then
+  begin
+    Log(Format('Failed to create scheduled task, Exec error code: %d', [ResultCode]));
+  end
+  else if ResultCode <> 0 then
+  begin
+    Log(Format('powershell returned exit code %d while creating the scheduled task', [ResultCode]));
+  end;
+end;
+
+procedure TryDeleteStartupTask;
+var
+  ResultCode: Integer;
+begin
+  if not Exec(ExpandConstant('{sys}\schtasks.exe'), '/Delete /TN "PYAS_Security_ATS" /F', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) then
+  begin
+    Log(Format('Failed to delete scheduled task, Exec error code: %d', [ResultCode]));
+  end
+  else if ResultCode <> 0 then
+  begin
+    Log(Format('schtasks returned exit code %d while deleting the scheduled task', [ResultCode]));
+  end;
+end;
+
+procedure CurStepChanged(CurStep: TSetupStep);
+begin
+  if CurStep = ssPostInstall then
+  begin
+    if WizardIsTaskSelected('autostart') then
+    begin
+      TryCreateStartupTask;
+    end;
+  end;
+end;
+
+procedure CurUninstallStepChanged(CurUninstallStep: TUninstallStep);
+begin
+  if CurUninstallStep = usUninstall then
+  begin
+    TryDeleteStartupTask;
+  end
+  else if CurUninstallStep = usPostUninstall then
+  begin
+    DelTree(ExpandConstant('{app}'), True, True, True);
+  end;
+end;

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.5.7.0',
+version='3.6.1.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -1,171 +1,176 @@
-#pragma once
-#include <fltKernel.h>
-#include <ntddk.h>      
-#include <ntdddisk.h>   
-#include <ntddscsi.h> 
-#include <ntstrsafe.h>
-
-constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
-constexpr auto MAX_PATH_LEN = 1024;
-constexpr auto PYAS_POOL_TAG = 'SAYP';
-
-#ifndef PROCESS_TERMINATE
-#define PROCESS_TERMINATE                  (0x0001)
-#endif
-#ifndef PROCESS_CREATE_THREAD
-#define PROCESS_CREATE_THREAD              (0x0002)
-#endif
-#ifndef PROCESS_VM_OPERATION
-#define PROCESS_VM_OPERATION               (0x0008)
-#endif
-#ifndef PROCESS_VM_READ
-#define PROCESS_VM_READ                    (0x0010)
-#endif
-#ifndef PROCESS_VM_WRITE
-#define PROCESS_VM_WRITE                   (0x0020)
-#endif
-#ifndef PROCESS_DUP_HANDLE
-#define PROCESS_DUP_HANDLE                 (0x0040)
-#endif
-#ifndef PROCESS_CREATE_PROCESS
-#define PROCESS_CREATE_PROCESS             (0x0080)
-#endif
-#ifndef PROCESS_SET_INFORMATION
-#define PROCESS_SET_INFORMATION            (0x0200)
-#endif
-#ifndef PROCESS_QUERY_INFORMATION
-#define PROCESS_QUERY_INFORMATION          (0x0400)
-#endif
-#ifndef PROCESS_SUSPEND_RESUME
-#define PROCESS_SUSPEND_RESUME             (0x0800)
-#endif
-#ifndef PROCESS_QUERY_LIMITED_INFORMATION
-#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
-#endif
-#ifndef PROCESS_SET_QUOTA
-#define PROCESS_SET_QUOTA                  (0x0100)
-#endif
-#ifndef THREAD_TERMINATE
-#define THREAD_TERMINATE                   (0x0001)
-#endif
-#ifndef THREAD_SUSPEND_RESUME
-#define THREAD_SUSPEND_RESUME              (0x0002)
-#endif
-#ifndef THREAD_SET_CONTEXT
-#define THREAD_SET_CONTEXT                 (0x0010)
-#endif
-#ifndef THREAD_SET_INFORMATION
-#define THREAD_SET_INFORMATION             (0x0020)
-#endif
-#ifndef THREAD_SET_THREAD_TOKEN
-#define THREAD_SET_THREAD_TOKEN            (0x0080)
-#endif
-#ifndef POOL_FLAG_NON_PAGED
-#define POOL_FLAG_NON_PAGED                0x0000000000000040UI64
-#endif
-
-#ifndef FSCTL_MANAGE_BYPASS_IO
-#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
-
-typedef enum _FS_BPIO_OPERATIONS {
-    FS_BPIO_OP_ENABLE = 1,
-    FS_BPIO_OP_DISABLE = 2,
-    FS_BPIO_OP_QUERY = 3,
-    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
-    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
-    FS_BPIO_OP_STREAM_PAUSE = 6,
-    FS_BPIO_OP_STREAM_RESUME = 7,
-    FS_BPIO_OP_GET_INFO = 8
-} FS_BPIO_OPERATIONS;
-
-typedef struct _FS_BPIO_INPUT {
-    FS_BPIO_OPERATIONS Operation;
-    ULONG InFlags;
-    ULONGLONG Reserved1;
-    ULONGLONG Reserved2;
-} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
-
-typedef struct _FS_BPIO_OUTPUT {
-    FS_BPIO_OPERATIONS Operation;
-    ULONG OutFlags;
-    ULONGLONG Reserved1;
-    ULONGLONG Reserved2;
-    NTSTATUS Status;
-} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
-
-#endif
-
-typedef struct _PYAS_MESSAGE {
-    ULONG MessageCode;
-    ULONG ProcessId;
-    WCHAR Path[MAX_PATH_LEN];
-} PYAS_MESSAGE, * PPYAS_MESSAGE;
-
-typedef struct _PYAS_USER_MESSAGE {
-    ULONG Command;
-    WCHAR Path[MAX_PATH_LEN];
-} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
-
-typedef struct _DRIVER_DATA {
-    PDRIVER_OBJECT DriverObject;
-    PFLT_FILTER FilterHandle;
-    PFLT_PORT ServerPort;
-    PFLT_PORT ClientPort;
-    PEPROCESS PyasProcess;
-    ULONG PyasPid;
-    LARGE_INTEGER Cookie;
-    KSPIN_LOCK PortMutex;
-    KSPIN_LOCK TrackerMutex;
-    EX_RUNDOWN_REF PortRundown;
-} DRIVER_DATA, * PDRIVER_DATA;
-
-typedef struct _RULE_NODE {
-    struct _RULE_NODE* Next;
-    UNICODE_STRING Pattern;
-} RULE_NODE, * PRULE_NODE;
-
-extern DRIVER_DATA GlobalData;
-
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-
-NTSTATUS InitializeProcessProtection();
-VOID UninitializeProcessProtection();
-NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
-VOID UninitializeRegistryProtection();
-
-NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
-VOID UnloadRules();
-
-VOID InitializeRulesEngine();
-VOID UninitializeRulesEngine();
-
-VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
-VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
-
-VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
-
-NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
-
-BOOLEAN IsProcessTrusted(HANDLE ProcessId);
-BOOLEAN IsTargetProtected(HANDLE ProcessId);
-BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
-
-BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);
-BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID WriteBuffer, ULONG WriteLength, BOOLEAN IsWrite);
-
-NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
-
-FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
-    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
-}
-
-FORCEINLINE VOID PyasFree(PVOID Ptr) {
-    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
+#pragma once
+#include <fltKernel.h>
+#include <ntddk.h>      
+#include <ntdddisk.h>   
+#include <ntddscsi.h> 
+#include <ntstrsafe.h>
+
+constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
+constexpr auto MAX_PATH_LEN = 1024;
+constexpr auto PYAS_POOL_TAG = 'SAYP';
+
+#ifndef PROCESS_TERMINATE
+#define PROCESS_TERMINATE                  (0x0001)
+#endif
+#ifndef PROCESS_CREATE_THREAD
+#define PROCESS_CREATE_THREAD              (0x0002)
+#endif
+#ifndef PROCESS_VM_OPERATION
+#define PROCESS_VM_OPERATION               (0x0008)
+#endif
+#ifndef PROCESS_VM_READ
+#define PROCESS_VM_READ                    (0x0010)
+#endif
+#ifndef PROCESS_VM_WRITE
+#define PROCESS_VM_WRITE                   (0x0020)
+#endif
+#ifndef PROCESS_DUP_HANDLE
+#define PROCESS_DUP_HANDLE                 (0x0040)
+#endif
+#ifndef PROCESS_CREATE_PROCESS
+#define PROCESS_CREATE_PROCESS             (0x0080)
+#endif
+#ifndef PROCESS_SET_INFORMATION
+#define PROCESS_SET_INFORMATION            (0x0200)
+#endif
+#ifndef PROCESS_QUERY_INFORMATION
+#define PROCESS_QUERY_INFORMATION          (0x0400)
+#endif
+#ifndef PROCESS_SUSPEND_RESUME
+#define PROCESS_SUSPEND_RESUME             (0x0800)
+#endif
+#ifndef PROCESS_QUERY_LIMITED_INFORMATION
+#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
+#endif
+#ifndef PROCESS_SET_QUOTA
+#define PROCESS_SET_QUOTA                  (0x0100)
+#endif
+#ifndef THREAD_TERMINATE
+#define THREAD_TERMINATE                   (0x0001)
+#endif
+#ifndef THREAD_SUSPEND_RESUME
+#define THREAD_SUSPEND_RESUME              (0x0002)
+#endif
+#ifndef THREAD_SET_CONTEXT
+#define THREAD_SET_CONTEXT                 (0x0010)
+#endif
+#ifndef THREAD_SET_INFORMATION
+#define THREAD_SET_INFORMATION             (0x0020)
+#endif
+#ifndef THREAD_SET_THREAD_TOKEN
+#define THREAD_SET_THREAD_TOKEN            (0x0080)
+#endif
+#ifndef POOL_FLAG_NON_PAGED
+#define POOL_FLAG_NON_PAGED                0x0000000000000040UI64
+#endif
+
+#ifndef FSCTL_MANAGE_BYPASS_IO
+#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+typedef enum _FS_BPIO_OPERATIONS {
+    FS_BPIO_OP_ENABLE = 1,
+    FS_BPIO_OP_DISABLE = 2,
+    FS_BPIO_OP_QUERY = 3,
+    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
+    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
+    FS_BPIO_OP_STREAM_PAUSE = 6,
+    FS_BPIO_OP_STREAM_RESUME = 7,
+    FS_BPIO_OP_GET_INFO = 8
+} FS_BPIO_OPERATIONS;
+
+typedef struct _FS_BPIO_INPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG InFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
+
+typedef struct _FS_BPIO_OUTPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG OutFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+    NTSTATUS Status;
+} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
+
+#endif
+
+typedef struct _PYAS_MESSAGE {
+    ULONG MessageCode;
+    ULONG ProcessId;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_MESSAGE, * PPYAS_MESSAGE;
+
+typedef struct _PYAS_USER_MESSAGE {
+    ULONG Command;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+
+typedef struct _DRIVER_DATA {
+    PDRIVER_OBJECT DriverObject;
+    PFLT_FILTER FilterHandle;
+    PFLT_PORT ServerPort;
+    PFLT_PORT ClientPort;
+    PEPROCESS PyasProcess;
+    ULONG PyasPid;
+    LARGE_INTEGER Cookie;
+    KSPIN_LOCK PortMutex;
+    KSPIN_LOCK TrackerMutex;
+    KSPIN_LOCK PidLock;
+    BOOLEAN Initialized;
+    EX_RUNDOWN_REF PortRundown;
+} DRIVER_DATA, * PDRIVER_DATA;
+
+typedef struct _RULE_NODE {
+    struct _RULE_NODE* Next;
+    UNICODE_STRING Pattern;
+} RULE_NODE, * PRULE_NODE;
+
+extern DRIVER_DATA GlobalData;
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+
+NTSTATUS InitializeProcessProtection();
+VOID UninitializeProcessProtection();
+NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
+VOID UninitializeRegistryProtection();
+
+NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
+VOID UnloadRules();
+
+VOID InitializeRulesEngine();
+VOID UninitializeRulesEngine();
+
+VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
+VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
+
+VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
+
+NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
+
+ULONG SafeGetPyasPid();
+VOID SafeSetPyasPid(ULONG Pid);
+
+BOOLEAN IsProcessTrusted(HANDLE ProcessId);
+BOOLEAN IsTargetProtected(HANDLE ProcessId);
+BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
+
+BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);
+BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName);
+BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName);
+BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID WriteBuffer, ULONG WriteLength, BOOLEAN IsWrite);
+
+NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
+
+FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
+    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
+}
+
+FORCEINLINE VOID PyasFree(PVOID Ptr) {
+    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
 }

Plugins/Filter/DriverEntry.cpp

@@ -1,220 +1,224 @@
-#include "DriverCommon.h"
-
-DRIVER_DATA GlobalData;
-static BOOLEAN g_ImageNotifyRegistered = FALSE;
-
-static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-    UNREFERENCED_PARAMETER(VolumeDeviceType);
-    UNREFERENCED_PARAMETER(VolumeFilesystemType);
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS InstanceQueryTeardown(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-    return STATUS_SUCCESS;
-}
-
-static VOID InstanceTeardownStart(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-}
-
-static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-}
-
-static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(Flags);
-
-    if (GlobalData.ServerPort) {
-        FltCloseCommunicationPort(GlobalData.ServerPort);
-        GlobalData.ServerPort = NULL;
-    }
-
-    if (GlobalData.FilterHandle) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-        GlobalData.FilterHandle = NULL;
-    }
-
-    if (g_ImageNotifyRegistered) {
-        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
-        g_ImageNotifyRegistered = FALSE;
-    }
-
-    UninitializeRegistryProtection();
-    UninitializeProcessProtection();
-
-    UnloadRules();
-    UninitializeRulesEngine();
-
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength) {
-    UNREFERENCED_PARAMETER(PortCookie);
-    UNREFERENCED_PARAMETER(OutputBuffer);
-    UNREFERENCED_PARAMETER(OutputBufferLength);
-
-    if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
-        PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
-        if (msg->Command == 1 || msg->Command == 2) {
-            msg->Path[MAX_PATH_LEN - 1] = L'\0';
-            UNICODE_STRING us;
-            RtlInitUnicodeString(&us, msg->Path);
-            if (us.Length > 0) {
-                if (msg->Command == 1) {
-                    AddDynamicWhitelist(&us);
-                }
-                else {
-                    RemoveDynamicWhitelist(&us);
-                }
-            }
-        }
-    }
-
-    if (ReturnOutputBufferLength) {
-        *ReturnOutputBufferLength = 0;
-    }
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID* ConnectionPortCookie) {
-    UNREFERENCED_PARAMETER(ServerPortCookie);
-    UNREFERENCED_PARAMETER(ConnectionContext);
-    UNREFERENCED_PARAMETER(SizeOfContext);
-    UNREFERENCED_PARAMETER(ConnectionPortCookie);
-
-    KIRQL OldIrql;
-    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
-
-    GlobalData.ClientPort = ClientPort;
-    GlobalData.PyasPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
-    GlobalData.PyasProcess = PsGetCurrentProcess();
-
-    ExReInitializeRundownProtection(&GlobalData.PortRundown);
-
-    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
-
-    return STATUS_SUCCESS;
-}
-
-static VOID PortDisconnect(PVOID ConnectionCookie) {
-    UNREFERENCED_PARAMETER(ConnectionCookie);
-
-    KIRQL OldIrql;
-    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
-
-    GlobalData.ClientPort = NULL;
-    GlobalData.PyasPid = 0;
-    GlobalData.PyasProcess = NULL;
-
-    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
-
-    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
-}
-
-CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
-    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
-    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
-    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
-    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
-    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
-    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
-    { IRP_MJ_OPERATION_END }
-};
-
-CONST FLT_REGISTRATION FilterRegistration = {
-    sizeof(FLT_REGISTRATION),
-    FLT_REGISTRATION_VERSION,
-    0,
-    NULL,
-    Callbacks,
-    DriverUnload,
-    InstanceSetup,
-    InstanceQueryTeardown,
-    InstanceTeardownStart,
-    InstanceTeardownComplete,
-    NULL,
-    NULL,
-    NULL
-};
-
-extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
-    NTSTATUS status = STATUS_SUCCESS;
-    PSECURITY_DESCRIPTOR sd = NULL;
-    OBJECT_ATTRIBUTES oa = { 0 };
-    UNICODE_STRING name = { 0 };
-
-    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
-    GlobalData.DriverObject = DriverObject;
-    KeInitializeSpinLock(&GlobalData.PortMutex);
-    KeInitializeSpinLock(&GlobalData.TrackerMutex);
-
-    ExInitializeRundownProtection(&GlobalData.PortRundown);
-
-    InitializeRulesEngine();
-
-    status = LoadRulesFromDisk(RegistryPath);
-
-    status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) {
-        UnloadRules();
-        UninitializeRulesEngine();
-        return status;
-    }
-
-    status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
-    if (NT_SUCCESS(status)) {
-        RtlInitUnicodeString(&name, PYAS_PORT_NAME);
-        InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, sd);
-        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, PortMessage, 1);
-        FltFreeSecurityDescriptor(sd);
-    }
-
-    if (!NT_SUCCESS(status)) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-        GlobalData.FilterHandle = NULL;
-        UnloadRules();
-        UninitializeRulesEngine();
-        return status;
-    }
-
-    InitializeProcessProtection();
-
-    InitializeRegistryProtection(DriverObject);
-
-    NTSTATUS imageNotifyStatus = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
-    if (NT_SUCCESS(imageNotifyStatus)) {
-        g_ImageNotifyRegistered = TRUE;
-    }
-
-    status = FltStartFiltering(GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) {
-        if (g_ImageNotifyRegistered) {
-            PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
-            g_ImageNotifyRegistered = FALSE;
-        }
-
-        UninitializeRegistryProtection();
-        UninitializeProcessProtection();
-
-        if (GlobalData.ServerPort) {
-            FltCloseCommunicationPort(GlobalData.ServerPort);
-            GlobalData.ServerPort = NULL;
-        }
-
-        if (GlobalData.FilterHandle) {
-            FltUnregisterFilter(GlobalData.FilterHandle);
-            GlobalData.FilterHandle = NULL;
-        }
-
-        UnloadRules();
-        UninitializeRulesEngine();
-    }
-
-    return status;
+#include "DriverCommon.h"
+
+DRIVER_DATA GlobalData;
+static BOOLEAN g_ImageNotifyRegistered = FALSE;
+
+static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    UNREFERENCED_PARAMETER(VolumeDeviceType);
+    UNREFERENCED_PARAMETER(VolumeFilesystemType);
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS InstanceQueryTeardown(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    return STATUS_SUCCESS;
+}
+
+static VOID InstanceTeardownStart(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
+    UNREFERENCED_PARAMETER(Flags);
+
+    if (GlobalData.ServerPort) {
+        FltCloseCommunicationPort(GlobalData.ServerPort);
+        GlobalData.ServerPort = NULL;
+    }
+
+    if (GlobalData.FilterHandle) {
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        GlobalData.FilterHandle = NULL;
+    }
+
+    if (g_ImageNotifyRegistered) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        g_ImageNotifyRegistered = FALSE;
+    }
+
+    UninitializeRegistryProtection();
+    UninitializeProcessProtection();
+
+    UnloadRules();
+    UninitializeRulesEngine();
+
+    GlobalData.Initialized = FALSE;
+
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength) {
+    UNREFERENCED_PARAMETER(PortCookie);
+    UNREFERENCED_PARAMETER(OutputBuffer);
+    UNREFERENCED_PARAMETER(OutputBufferLength);
+
+    if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
+        PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
+        if (msg->Command == 1 || msg->Command == 2) {
+            msg->Path[MAX_PATH_LEN - 1] = L'\0';
+            UNICODE_STRING us;
+            RtlInitUnicodeString(&us, msg->Path);
+            if (us.Length > 0) {
+                if (msg->Command == 1) {
+                    AddDynamicWhitelist(&us);
+                }
+                else {
+                    RemoveDynamicWhitelist(&us);
+                }
+            }
+        }
+    }
+
+    if (ReturnOutputBufferLength) {
+        *ReturnOutputBufferLength = 0;
+    }
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID* ConnectionPortCookie) {
+    UNREFERENCED_PARAMETER(ServerPortCookie);
+    UNREFERENCED_PARAMETER(ConnectionContext);
+    UNREFERENCED_PARAMETER(SizeOfContext);
+    UNREFERENCED_PARAMETER(ConnectionPortCookie);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
+    GlobalData.ClientPort = ClientPort;
+    SafeSetPyasPid((ULONG)(ULONG_PTR)PsGetCurrentProcessId());
+    GlobalData.PyasProcess = PsGetCurrentProcess();
+
+    ExReInitializeRundownProtection(&GlobalData.PortRundown);
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+
+    return STATUS_SUCCESS;
+}
+
+static VOID PortDisconnect(PVOID ConnectionCookie) {
+    UNREFERENCED_PARAMETER(ConnectionCookie);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
+    GlobalData.ClientPort = NULL;
+    SafeSetPyasPid(0);
+    GlobalData.PyasProcess = NULL;
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+
+    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
+}
+
+CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
+    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
+    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
+    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
+    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
+    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
+    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
+    { IRP_MJ_OPERATION_END }
+};
+
+CONST FLT_REGISTRATION FilterRegistration = {
+    sizeof(FLT_REGISTRATION),
+    FLT_REGISTRATION_VERSION,
+    0,
+    NULL,
+    Callbacks,
+    DriverUnload,
+    InstanceSetup,
+    InstanceQueryTeardown,
+    InstanceTeardownStart,
+    InstanceTeardownComplete,
+    NULL,
+    NULL,
+    NULL
+};
+
+extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
+    NTSTATUS status = STATUS_SUCCESS;
+    PSECURITY_DESCRIPTOR sd = NULL;
+    OBJECT_ATTRIBUTES oa = { 0 };
+    UNICODE_STRING name = { 0 };
+
+    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
+    GlobalData.DriverObject = DriverObject;
+    KeInitializeSpinLock(&GlobalData.PortMutex);
+    KeInitializeSpinLock(&GlobalData.TrackerMutex);
+    KeInitializeSpinLock(&GlobalData.PidLock);
+    GlobalData.Initialized = TRUE;
+
+    ExInitializeRundownProtection(&GlobalData.PortRundown);
+
+    InitializeRulesEngine();
+
+    status = LoadRulesFromDisk(RegistryPath);
+
+    status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
+    if (!NT_SUCCESS(status)) {
+        UnloadRules();
+        UninitializeRulesEngine();
+        return status;
+    }
+
+    status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
+    if (NT_SUCCESS(status)) {
+        RtlInitUnicodeString(&name, PYAS_PORT_NAME);
+        InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, sd);
+        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, PortMessage, 1);
+        FltFreeSecurityDescriptor(sd);
+    }
+
+    if (!NT_SUCCESS(status)) {
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        GlobalData.FilterHandle = NULL;
+        UnloadRules();
+        UninitializeRulesEngine();
+        return status;
+    }
+
+    InitializeProcessProtection();
+
+    InitializeRegistryProtection(DriverObject);
+
+    NTSTATUS imageNotifyStatus = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+    if (NT_SUCCESS(imageNotifyStatus)) {
+        g_ImageNotifyRegistered = TRUE;
+    }
+
+    status = FltStartFiltering(GlobalData.FilterHandle);
+    if (!NT_SUCCESS(status)) {
+        if (g_ImageNotifyRegistered) {
+            PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+            g_ImageNotifyRegistered = FALSE;
+        }
+
+        UninitializeRegistryProtection();
+        UninitializeProcessProtection();
+
+        if (GlobalData.ServerPort) {
+            FltCloseCommunicationPort(GlobalData.ServerPort);
+            GlobalData.ServerPort = NULL;
+        }
+
+        if (GlobalData.FilterHandle) {
+            FltUnregisterFilter(GlobalData.FilterHandle);
+            GlobalData.FilterHandle = NULL;
+        }
+
+        UnloadRules();
+        UninitializeRulesEngine();
+    }
+
+    return status;
 }

Plugins/Filter/ProtectProcess.cpp

@@ -1,8 +1,10 @@
 #include "DriverCommon.h"
 
 static PVOID ObRegistrationHandle = NULL;
-static OB_CALLBACK_REGISTRATION ObRegistration;
-static OB_OPERATION_REGISTRATION ObCallbacks[2];
+static OB_CALLBACK_REGISTRATION ObRegistration = {0};
+static OB_OPERATION_REGISTRATION ObCallbacks[2] = {0};
+static KSPIN_LOCK ObDataLock = {0};
+static BOOLEAN ObDataInitialized = FALSE;
 
 static BOOLEAN IsSystemImage(PUNICODE_STRING FullImageName) {
     if (!FullImageName || !FullImageName->Buffer) return FALSE;
@@ -57,6 +59,10 @@ static BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId) {
             WildcardMatch(L"*\\Windows\\System32\\smss.exe", imageFileName->Buffer, imageFileName->Length)) {
             isCritical = TRUE;
         }
+    }
+
+    if (imageFileName) {
+        if (imageFileName->Buffer) ExFreePool(imageFileName->Buffer);
         ExFreePool(imageFileName);
     }
 
@@ -77,15 +83,17 @@ static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
 
     status = SeLocateProcessImageName(Process, &imageFileName);
 
-    if (NT_SUCCESS(status) && imageFileName) {
-        if (imageFileName->Buffer) {
-            if (WildcardMatch(L"*Taskmgr.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*taskkill.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*ProcessHacker.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*procmon.exe", imageFileName->Buffer, imageFileName->Length)) {
-                isBlacklisted = TRUE;
-            }
+    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
+        if (WildcardMatch(L"*Taskmgr.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*taskkill.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*ProcessHacker.exe", imageFileName->Buffer, imageFileName->Length) ||
+            WildcardMatch(L"*procmon.exe", imageFileName->Buffer, imageFileName->Length)) {
+            isBlacklisted = TRUE;
         }
+    }
+
+    if (imageFileName) {
+        if (imageFileName->Buffer) ExFreePool(imageFileName->Buffer);
         ExFreePool(imageFileName);
     }
 
@@ -105,20 +113,37 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR
     HANDLE SourcePid = PsGetCurrentProcessId();
 
     if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
+    if ((ULONG)(ULONG_PTR)SourcePid == SafeGetPyasPid()) return OB_PREOP_SUCCESS;
     if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
 
     if (IsTargetProtected(TargetPid)) {
         if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
 
-        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
-
-        if (bIsTrusted) {
-            if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsTrusted = FALSE;
-            }
+        BOOLEAN isBlacklisted = FALSE;
+        if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+            isBlacklisted = IsBlacklistedAdminTool(SourcePid);
         }
 
+        if (isBlacklisted) {
+            ACCESS_MASK DenyMask = PROCESS_TERMINATE |
+                PROCESS_VM_OPERATION |
+                PROCESS_VM_WRITE |
+                PROCESS_CREATE_THREAD |
+                PROCESS_VM_READ |
+                PROCESS_DUP_HANDLE |
+                PROCESS_SUSPEND_RESUME |
+                PROCESS_SET_INFORMATION |
+                PROCESS_SET_QUOTA;
+
+            OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
+
+            if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+                OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
+            }
+            return OB_PREOP_SUCCESS;
+        }
+
+        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
         if (bIsTrusted) return OB_PREOP_SUCCESS;
 
         ACCESS_MASK DenyMask = PROCESS_TERMINATE |
@@ -156,20 +181,33 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
     HANDLE SourcePid = PsGetCurrentProcessId();
 
     if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
+    if ((ULONG)(ULONG_PTR)SourcePid == SafeGetPyasPid()) return OB_PREOP_SUCCESS;
     if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
 
     if (IsTargetProtected(TargetPid)) {
         if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
 
-        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
-
-        if (bIsTrusted) {
-            if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsTrusted = FALSE;
-            }
+        BOOLEAN isBlacklisted = FALSE;
+        if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+            isBlacklisted = IsBlacklistedAdminTool(SourcePid);
         }
 
+        if (isBlacklisted) {
+            ACCESS_MASK DenyMask = THREAD_TERMINATE |
+                THREAD_SUSPEND_RESUME |
+                THREAD_SET_CONTEXT |
+                THREAD_SET_INFORMATION |
+                THREAD_SET_THREAD_TOKEN;
+
+            OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
+
+            if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+                OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
+            }
+            return OB_PREOP_SUCCESS;
+        }
+
+        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
         if (bIsTrusted) return OB_PREOP_SUCCESS;
 
         ACCESS_MASK DenyMask = THREAD_TERMINATE |
@@ -191,6 +229,9 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
 NTSTATUS InitializeProcessProtection() {
     static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob");
 
+    KeInitializeSpinLock(&ObDataLock);
+    ObDataInitialized = TRUE;
+
     ObCallbacks[0].ObjectType = PsProcessType;
     ObCallbacks[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
     ObCallbacks[0].PreOperation = PreOpenProcess;
@@ -219,6 +260,8 @@ NTSTATUS InitializeProcessProtection() {
 }
 
 VOID UninitializeProcessProtection() {
+    ObDataInitialized = FALSE;
+
     if (ObRegistrationHandle) {
         ObUnRegisterCallbacks(ObRegistrationHandle);
         ObRegistrationHandle = NULL;

Plugins/Rules/Rules_Driver_P1.json

@@ -1,228 +1,233 @@
 {
-  "Rule_Registry_BlockList": [
-    "\\REGISTRY\\MACHINE\\BCD00000000",
-    "\\REGISTRY\\MACHINE\\BCD00000000\\*",
-    
-    "*\\Classes\\.exe",
-    "*\\Classes\\.bat",
-    "*\\Classes\\.cmd",
-    "*\\Classes\\.com",
-    "*\\Classes\\exefile\\*",
-    "*\\Classes\\batfile\\*",
-    "*\\Classes\\cmdfile\\*",
-    "*\\Classes\\comfile\\*",
-    
-    "*\\mouclass",
-    "*\\kbdclass",
-    "*\\DisableAntiSpyware",
-    "*\\DisableWindowsUpdateAccess",
-    "*\\EnableLUA",
-    "*\\ConsentPromptBehaviorAdmin",
-    "*\\NoControlPanel",
-    "*\\NoDrives",
-    "*\\NoFileMenu",
-    "*\\NoFind",
-    "*\\NoStartMenuPinnedList",
-    "*\\NoSetFolders",
-    "*\\NoSetFolderOptions",
-    "*\\NoViewOnDrive",
-    "*\\NoClose",
-    "*\\NoDesktop",
-    "*\\NoLogoff",
-    "*\\NoFolderOptions",
-    "*\\RestrictRun",
-    "*\\NoViewContextMenu",
-    "*\\HideClock",
-    "*\\NoStartMenuMyGames",
-    "*\\NoStartMenuMyMusic",
-    "*\\DisableCMD",
-    "*\\NoAddingComponents",
-    "*\\NoWinKeys",
-    "*\\NoStartMenuLogOff",
-    "*\\NoSimpleNetIDList",
-    "*\\NoLowDiskSpaceChecks",
-    "*\\DisableLockWorkstation",
-    "*\\Restrict_Run",
-    "*\\DisableTaskMgr",
-    "*\\DisableRegistryTools",
-    "*\\DisableChangePassword",
-    "*\\NoComponents",
-    "*\\NoStartMenuMorePrograms",
-    "*\\NoActiveDesktop",
-    "*\\NoSetActiveDesktop",
-    "*\\NoRecentDocsMenu",
-    "*\\NoWindowsUpdate",
-    "*\\NoChangeStartMenu",
-    "*\\NoFavoritesMenu",
-    "*\\NoRecentDocsHistory",
-    "*\\NoSetTaskbar",
-    "*\\NoSMHelp",
-    "*\\NoTrayContextMenu",
-    "*\\NoManageMyComputerVerb",
-    "*\\NoRealMode",
-    "*\\NoRun",
-    "*\\ClearRecentDocsOnExit",
-    "*\\NoActiveDesktopChanges",
-    "*\\NoStartMenuNetworkPlaces",
-    "*\\NoLockScreen",
-    "*\\HideFastUserSwitching",
-    "*\\ConsentPromptBehaviorUser",
-    "*\\EnableSecureUIAPaths",
-    "*\\NoSRM",
-    "*\\NoInteractiveServices",
-    "*\\ShutdownWithoutLogon",
-    "*\\AutoAdminLogon",
-    "*\\BootExecute",
-    "*\\SubSystems",
-    "*\\FirmwareBootDevice",
-    "*\\BootDriverFlags",
-    "*\\SystemStartOptions",
-    "*\\DisableAutomaticRestartOnFailure",
-    "*\\SystemBiosVersion",
-    "*\\NoTheme",
-    "*\\SystemSetupInProgress",
-    "*\\SetupType",
-    "*\\AutoReboot",
-    "*\\Userinit",
-    "*\\UIHost",
-    "*\\Debugger",
-    "*\\DefaultUserName",
-    "*\\DefaultPassword",
-    "*\\AltDefaultUserName",
-    "*\\AltDefaultPassword",
-    "*\\DisableCAD",
-    "*\\LegalNoticeCaption",
-    "*\\LegalNoticeText",
-  ],
-  "Rule_Registry_TrustedList": [
-  ],
-  "Rule_Process_TrustedPaths": [
-    "\\Device\\HarddiskVolume*\\Windows\\*",
-    "\\Device\\HarddiskVolume*\\Program Files\\*",
-    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-    
-    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-    "*\\Sources\\SetupHost.exe",
-    "*\\Work\\*\\DismHost.exe",
-    
-    "*\\Google\\Chrome\\Application\\chrome.exe",
-    "*\\Microsoft\\Edge\\Application\\msedge.exe",
-    "*\\Mozilla Firefox\\firefox.exe",
-    "*\\Thorium\\Application\\thorium.exe",
-    
-    "*\\Steam\\steam.exe",
-    "*\\steam\\*\\steam.exe",
-    "*\\Battle.net\\*\\Battle.net.exe",
-    "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
-    
-    "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
-    "*\\ThunderEv.exe",
-    "*\\ThunderStart.exe",
-    "*\\KuGou.exe",
-    "*\\XLGame.exe",
-    "*\\XLLiveUD.exe",
-    
-    "*\\hrkill-*.exe",
-    "*\\bin\\HipsDaemon.exe",
-    "*\\360Safe.exe",
-    "*\\bilibili\\bilibili.exe",
-    
-    "*\\Kingsoft\\WPS Office\\ksolaunch.exe",
-    "*\\Kingsoft\\WPS Office\\*\\wps.exe",
-    
-    "*\\PC4399_WPFLauncher.exe",
-    "*\\bin\\APlayer.exe",
-    "*\\Neverness To Everness\\NTELauncher.exe",
-    "*\\Application\\AndrowsLauncher.exe",
-    "*\\bin\\*\\codex.exe",
-    "*\\bin\\codex.exe",
-  ],
-  "Rule_Process_ExploitableBlacklist": [
-    "*\\cmd.exe",
-    "*\\powershell.exe",
-    "*\\pwsh.exe",
-    "*\\wscript.exe",
-    "*\\cscript.exe",
-    "*\\mshta.exe",
-    "*\\regsvr32.exe",
-    "*\\certutil.exe",
-    "*\\bitsadmin.exe",
-    "*\\wmic.exe",
-    "*\\hh.exe",
-    "*\\cmstp.exe",
-    "*\\installutil.exe",
-    "*\\regasm.exe",
-    "*\\regsvcs.exe",
-    "*\\msbuild.exe",
-    "*\\csc.exe",
-    "*\\vbc.exe",
-    "*\\jsc.exe",
-    "*\\bash.exe",
-    "*\\scrcons.exe",
-    "*\\schtasks.exe",
-    "*\\at.exe",
-    "*\\reg.exe",
-    "*\\sc.exe",
-    "*\\net.exe",
-    "*\\net1.exe",
-    "*\\whoami.exe",
-    "*\\ipconfig.exe",
-    "*\\taskkill.exe",
-    "*\\ProcessHacker.exe",
-    "*\\procmon.exe",
-    "*\\procexp.exe",
-  ],
-  "Rule_File_ProtectedPaths": [
-    "*\\PYAS.exe",
-    "*\\Plugins\\Filter\\PYAS_Driver.sys",
-    "*\\Plugins\\Rules\\Rules_Driver_P1.json",
-    "*\\ProgramData\\PYAS\\*.json",
-    "*\\Engine\\Pattern\\*.onnx",
-    "*\\Engine\\Properties\\*.onnx",
-    
-    "\\Device\\HarddiskVolume*\\bootmgr",
-    "\\Device\\HarddiskVolume*\\boot.ini",
-    "\\Device\\HarddiskVolume*\\BOOTNXT",
-    "\\Device\\HarddiskVolume*\\EFI\\*",
-    "\\Device\\HarddiskVolume*\\Boot\\*",
-    "\\Device\\HarddiskVolume*\\Recovery\\*",
-    "\\Device\\HarddiskVolume*\\System Volume Information\\*",
-    "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
-    
-    "*\\CON",
-    "*\\CON\\*",
-    "*\\PRN",
-    "*\\PRN\\*",
-    "*\\AUX",
-    "*\\AUX\\*",
-    "*\\NUL",
-    "*\\NUL\\*",
-    "*\\COM?",
-    "*\\COM?\\*",
-    "*\\LPT?",
-    "*\\LPT?\\*",
-    "*\\OSDATA",
-    "*\\OSDATA\\*",
-    "*\\*<*",
-    "*\\*>*",
-  ],
-  "Rule_File_ExceptionPaths": [
-    "*\\Users\\*\\steam\\*",
-    "*\\AppData\\*",
-    "*\\Temp\\*",
-    "*\\Local\\Temp\\*",
-    "*\\ventoy\\Boot\\*",
-    "*\\AdminRegionConfig.*",
-    "*\\nt_qq\\nt_*\\*",
-    "*\\cache\\*",
-  ],
-  "Rule_File_RansomwareExtensions": [
-    ".zip", ".7z", ".rar", ".tar", ".gz",
-    ".ppt", ".pptx", ".wps", ".txt", ".rtf",
-    ".pdf", ".xls", ".xlsx", ".doc", ".docx",
-    ".jpg", ".jpeg", ".png", ".webp", ".gif",
-    ".mp3", ".wav", ".aac", ".ogg", ".flac",
-    ".mp4", ".avi", ".mov", ".wmv", ".mkv",
-  ]
+    "Rule_Registry_BlockList": [
+        "\\REGISTRY\\MACHINE\\BCD00000000",
+        "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+
+        "*\\Classes\\.exe",
+        "*\\Classes\\.bat",
+        "*\\Classes\\.cmd",
+        "*\\Classes\\.com",
+        "*\\Classes\\exefile\\*",
+        "*\\Classes\\batfile\\*",
+        "*\\Classes\\cmdfile\\*",
+        "*\\Classes\\comfile\\*",
+
+        "*\\mouclass",
+        "*\\kbdclass",
+        "*\\DisableAntiSpyware",
+        "*\\DisableWindowsUpdateAccess",
+        "*\\EnableLUA",
+        "*\\ConsentPromptBehaviorAdmin",
+        "*\\NoControlPanel",
+        "*\\NoDrives",
+        "*\\NoFileMenu",
+        "*\\NoFind",
+        "*\\NoStartMenuPinnedList",
+        "*\\NoSetFolders",
+        "*\\NoSetFolderOptions",
+        "*\\NoViewOnDrive",
+        "*\\NoClose",
+        "*\\NoDesktop",
+        "*\\NoLogoff",
+        "*\\NoFolderOptions",
+        "*\\RestrictRun",
+        "*\\NoViewContextMenu",
+        "*\\HideClock",
+        "*\\NoStartMenuMyGames",
+        "*\\NoStartMenuMyMusic",
+        "*\\DisableCMD",
+        "*\\NoAddingComponents",
+        "*\\NoWinKeys",
+        "*\\NoStartMenuLogOff",
+        "*\\NoSimpleNetIDList",
+        "*\\NoLowDiskSpaceChecks",
+        "*\\DisableLockWorkstation",
+        "*\\Restrict_Run",
+        "*\\DisableTaskMgr",
+        "*\\DisableRegistryTools",
+        "*\\DisableChangePassword",
+        "*\\NoComponents",
+        "*\\NoStartMenuMorePrograms",
+        "*\\NoActiveDesktop",
+        "*\\NoSetActiveDesktop",
+        "*\\NoRecentDocsMenu",
+        "*\\NoWindowsUpdate",
+        "*\\NoChangeStartMenu",
+        "*\\NoFavoritesMenu",
+        "*\\NoRecentDocsHistory",
+        "*\\NoSetTaskbar",
+        "*\\NoSMHelp",
+        "*\\NoTrayContextMenu",
+        "*\\NoManageMyComputerVerb",
+        "*\\NoRealMode",
+        "*\\NoRun",
+        "*\\ClearRecentDocsOnExit",
+        "*\\NoActiveDesktopChanges",
+        "*\\NoStartMenuNetworkPlaces",
+        "*\\NoLockScreen",
+        "*\\HideFastUserSwitching",
+        "*\\ConsentPromptBehaviorUser",
+        "*\\EnableSecureUIAPaths",
+        "*\\NoSRM",
+        "*\\NoInteractiveServices",
+        "*\\ShutdownWithoutLogon",
+        "*\\AutoAdminLogon",
+        "*\\BootExecute",
+        "*\\SubSystems",
+        "*\\FirmwareBootDevice",
+        "*\\BootDriverFlags",
+        "*\\SystemStartOptions",
+        "*\\DisableAutomaticRestartOnFailure",
+        "*\\SystemBiosVersion",
+        "*\\NoTheme",
+        "*\\SystemSetupInProgress",
+        "*\\SetupType",
+        "*\\AutoReboot",
+        "*\\Userinit",
+        "*\\UIHost",
+        "*\\Debugger",
+        "*\\DefaultUserName",
+        "*\\DefaultPassword",
+        "*\\AltDefaultUserName",
+        "*\\AltDefaultPassword",
+        "*\\DisableCAD",
+        "*\\LegalNoticeCaption",
+        "*\\LegalNoticeText",
+    ],
+    "Rule_Registry_TrustedList": [
+    ],
+    "Rule_Process_TrustedPaths": [
+        "\\Device\\HarddiskVolume*\\Windows\\*",
+        "\\Device\\HarddiskVolume*\\Program Files\\*",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+
+        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+        "*\\Sources\\SetupHost.exe",
+        "*\\Work\\*\\DismHost.exe",
+
+        "*\\Google\\Chrome\\Application\\chrome.exe",
+        "*\\Microsoft\\Edge\\Application\\msedge.exe",
+        "*\\Mozilla Firefox\\firefox.exe",
+        "*\\Thorium\\Application\\thorium.exe",
+
+        "*\\Steam\\steam.exe",
+        "*\\steam\\*\\steam.exe",
+        "*\\Battle.net\\*\\Battle.net.exe",
+        "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+
+        "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+        "*\\ThunderEv.exe",
+        "*\\ThunderStart.exe",
+        "*\\KuGou.exe",
+        "*\\XLGame.exe",
+        "*\\XLLiveUD.exe",
+
+        "*\\hrkill-*.exe",
+        "*\\bin\\HipsDaemon.exe",
+        "*\\360Safe.exe",
+        "*\\bilibili\\bilibili.exe",
+
+        "*\\WPS Office\\ksolaunch.exe",
+        "*\\WPS Office\\*\\wps.exe",
+        "*\\WPS Office\\*\\*.exe",
+
+        "*\\PC4399_WPFLauncher.exe",
+        "*\\bin\\APlayer.exe",
+        "*\\Neverness To Everness\\NTELauncher.exe",
+        "*\\Application\\AndrowsLauncher.exe",
+        "*\\bin\\*\\codex.exe",
+        "*\\bin\\codex.exe",
+    ],
+    "Rule_Process_ExploitableBlacklist": [
+        "*\\cmd.exe",
+        "*\\powershell.exe",
+        "*\\pwsh.exe",
+        "*\\wscript.exe",
+        "*\\cscript.exe",
+        "*\\mshta.exe",
+        "*\\regsvr32.exe",
+        "*\\certutil.exe",
+        "*\\bitsadmin.exe",
+        "*\\wmic.exe",
+        "*\\hh.exe",
+        "*\\cmstp.exe",
+        "*\\installutil.exe",
+        "*\\regasm.exe",
+        "*\\regsvcs.exe",
+        "*\\msbuild.exe",
+        "*\\csc.exe",
+        "*\\vbc.exe",
+        "*\\jsc.exe",
+        "*\\bash.exe",
+        "*\\scrcons.exe",
+        "*\\schtasks.exe",
+        "*\\at.exe",
+        "*\\reg.exe",
+        "*\\sc.exe",
+        "*\\net.exe",
+        "*\\net1.exe",
+        "*\\whoami.exe",
+        "*\\ipconfig.exe",
+        "*\\taskkill.exe",
+        "*\\ProcessHacker.exe",
+        "*\\procmon.exe",
+        "*\\procexp.exe",
+    ],
+    "Rule_File_ProtectedPaths": [
+        "*\\PYAS.exe",
+        "*\\Plugins\\Filter\\PYAS_Driver.sys",
+        "*\\Plugins\\Rules\\Rules_Driver_P1.json",
+        "*\\ProgramData\\PYAS\\*.json",
+        "*\\Engine\\Pattern\\*.onnx",
+        "*\\Engine\\Properties\\*.onnx",
+
+        "\\Device\\HarddiskVolume*\\bootmgr",
+        "\\Device\\HarddiskVolume*\\boot.ini",
+        "\\Device\\HarddiskVolume*\\BOOTNXT",
+        "\\Device\\HarddiskVolume*\\EFI\\*",
+        "\\Device\\HarddiskVolume*\\Boot\\*",
+        "\\Device\\HarddiskVolume*\\Recovery\\*",
+        "\\Device\\HarddiskVolume*\\System Volume Information\\*",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
+
+        "*\\CON",
+        "*\\CON\\*",
+        "*\\PRN",
+        "*\\PRN\\*",
+        "*\\AUX",
+        "*\\AUX\\*",
+        "*\\NUL",
+        "*\\NUL\\*",
+        "*\\COM?",
+        "*\\COM?\\*",
+        "*\\LPT?",
+        "*\\LPT?\\*",
+        "*\\OSDATA",
+        "*\\OSDATA\\*",
+        "*\\*<*",
+        "*\\*>*",
+    ],
+    "Rule_File_ExceptionPaths": [
+        "*\\Users\\*\\steam\\*",
+        "*\\AppData\\*",
+        "*\\Temp\\*",
+        "*\\Local\\Temp\\*",
+        "*\\ventoy\\Boot\\*",
+        "*\\AdminRegionConfig.*",
+        "*\\nt_qq\\nt_*\\*",
+        "*\\cache\\*",
+        "*\\Documents\\My Games\\*",
+        "*\\Documents\\Tencent Files\\*",
+        "*\\Documents\\WeChat Files\\*",
+        "*\\Documents\\WPS Cloud Files\\*"
+    ],
+    "Rule_File_RansomwareExtensions": [
+        ".zip", ".7z", ".rar", ".tar", ".gz",
+        ".ppt", ".pptx", ".wps", ".txt", ".rtf",
+        ".pdf", ".xls", ".xlsx", ".doc", ".docx",
+        ".jpg", ".jpeg", ".png", ".webp", ".gif",
+        ".mp3", ".wav", ".aac", ".ogg", ".flac",
+        ".mp4", ".avi", ".mov", ".wmv", ".mkv",
+    ]
 }