Add files via upload

Updated the language in the Driver Signature section for clarity.

Engine/Heuristic/Rules_General_A1.yar

@@ -1437,3 +1437,22 @@ rule General_52 {
       uint16(0) == 0x5a4d and filesize < 2000KB and
       8 of them
 }
+
+rule General_53 {
+   meta:
+      description = "53"
+      author = "PYAS Security"
+      date = "2026-07-02"
+   strings:
+      $s1 = "VUZsQlUxO" wide
+      $s2 = "VRaV04xY21s" wide
+      $s3 = "MGVW" wide
+      $s4 = "OUJkWFJvYjNKc" wide
+      $s5 = "GVtRjBhVz" wide
+      $s6 = "l1WDFabGNtbG" ascii
+      $s7 = "1hV05o" fullword ascii
+      $s8 = "ZEdsdmJnPT0=" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize > 20MB and
+      7 of them
+}

Engine/Properties/convert.py

@@ -1,4 +1,4 @@
-import re, os, sys, math, time, zlib, datetime, hashlib
+import re, os, sys, math, time, zlib, mmap, datetime, hashlib
 import ctypes, ctypes.wintypes, pefile, multiprocessing
 import numpy as np
 
@@ -113,6 +113,9 @@ def verify_signature(file_path):
 
 class FeatureExtractor:
     _STRING_PATTERN = re.compile(b'[\x20-\x7E]{5,}')
+    _STRING_FAST_PATH_BYTES = 4194304
+    _STRING_BATCH_BYTES = 4194304
+    _HISTOGRAM_BATCH_WINDOWS = 1024
     
     _BYTE_HIST_KEYS = [f'ByteHist_{i:02X}' for i in range(256)]
     _BYTE_ENT_KEYS = [f'ByteEnt_{i:02X}' for i in range(256)]
@@ -125,6 +128,49 @@ class FeatureExtractor:
     _C_LOG_C_TABLE = np.zeros(2049, dtype=np.float64)
     _C_LOG_C_TABLE[1:] = np.arange(1, 2049) * np.log2(np.arange(1, 2049))
 
+    _OPTIONAL_HEADER_FIELDS = [
+        'Magic', 'MajorLinkerVersion', 'MinorLinkerVersion', 'SizeOfCode',
+        'SizeOfInitializedData', 'SizeOfUninitializedData', 'AddressOfEntryPoint',
+        'BaseOfCode', 'ImageBase', 'SectionAlignment', 'FileAlignment',
+        'MajorOperatingSystemVersion', 'MinorOperatingSystemVersion',
+        'MajorImageVersion', 'MinorImageVersion', 'MajorSubsystemVersion',
+        'MinorSubsystemVersion', 'SizeOfImage', 'SizeOfHeaders', 'CheckSum',
+        'Subsystem', 'DllCharacteristics', 'SizeOfStackReserve', 'SizeOfStackCommit',
+        'SizeOfHeapReserve', 'SizeOfHeapCommit', 'LoaderFlags', 'NumberOfRvaAndSizes'
+    ]
+
+    _SECTION_DEFAULTS = {
+        'SectionCount': 0.0,
+        'SectionMaxEntropy': 0.0,
+        'SectionMinEntropy': 0.0,
+        'SectionMeanEntropy': 0.0,
+        'SectionMaxRawSize': 0.0,
+        'SectionMinRawSize': 0.0,
+        'SectionMeanRawSize': 0.0,
+        'SectionMaxVSize': 0.0,
+        'SectionMinVSize': 0.0,
+        'SectionMeanVSize': 0.0,
+        'ExecutableSections': 0.0,
+        'WritableSections': 0.0,
+        'ReadableSections': 0.0,
+        'SectionException': 0.0
+    }
+
+    _CONDITIONAL_DEFAULTS = {
+        'IsDriver': 0.0,
+        'HasTlsCallbacks': 0.0,
+        'IsDebug': 0.0,
+        'IsPreRelease': 0.0,
+        'IsPatched': 0.0,
+        'IsPrivateBuild': 0.0,
+        'IsSpecialBuild': 0.0,
+        'ImportCount': 0.0,
+        'ImportFunctionCount': 0.0,
+        'ExportCount': 0.0,
+        'IconCount': 0.0,
+        'DebugCount': 0.0
+    }
+
     @staticmethod
     def _safe_float(val):
         try:
@@ -134,6 +180,18 @@ class FeatureExtractor:
         except Exception: 
             return 0.0
 
+    @classmethod
+    def _base_defaults(cls):
+        base = dict.fromkeys(cls._OPTIONAL_HEADER_FIELDS, 0.0)
+        base.update(cls._SECTION_DEFAULTS)
+        base.update(cls._CONDITIONAL_DEFAULTS)
+
+        for i in range(16):
+            base[f'DataDirectory_{i}_Size'] = 0.0
+            base[f'DataDirectory_{i}_VA'] = 0.0
+
+        return base
+
     @staticmethod
     def _calc_entropy(data):
         if not data:
@@ -151,25 +209,84 @@ class FeatureExtractor:
         res = {"StringCount": 0.0, "StringMeanLength": 0.0, "StringEntropy": 0.0}
         res.update(dict.fromkeys(cls._STRING_KEYS, 0.0))
 
-        matches = cls._STRING_PATTERN.findall(file_bytes)
-        if not matches:
-            return res
+        if len(file_bytes) <= cls._STRING_FAST_PATH_BYTES:
+            matches = cls._STRING_PATTERN.findall(file_bytes)
+            if not matches:
+                return res
 
-        combined_data = b''.join(matches)
-        count = len(matches)
-        total_len = len(combined_data)
+            combined_data = b''.join(matches)
+            count = len(matches)
+            total_len = len(combined_data)
+            global_counts = np.bincount(np.frombuffer(combined_data, dtype=np.uint8), minlength=256)
+        else:
+            count = 0
+            total_len = 0
+            global_counts = np.zeros(256, dtype=np.int64)
+            mv = memoryview(file_bytes)
+            pos = 0
+            size = len(file_bytes)
+
+            while pos < size:
+                chunk_end = min(pos + cls._STRING_BATCH_BYTES, size)
+                chunk_arr = np.frombuffer(mv[pos:chunk_end], dtype=np.uint8)
+                separators = (chunk_arr < 0x20) | (chunk_arr > 0x7E)
+
+                if separators.any():
+                    last_separator = len(separators) - 1 - int(np.argmax(separators[::-1]))
+                    segment_end = pos + last_separator + 1
+                    matches = cls._STRING_PATTERN.findall(mv[pos:segment_end])
+
+                    if matches:
+                        combined_data = b''.join(matches)
+                        count += len(matches)
+                        total_len += len(combined_data)
+                        global_counts += np.bincount(np.frombuffer(combined_data, dtype=np.uint8), minlength=256)
+
+                    pos = segment_end
+                    continue
+
+                pending_len = 0
+                pending_counts = np.zeros(256, dtype=np.int64)
+
+                while pos < size:
+                    chunk_end = min(pos + cls._STRING_BATCH_BYTES, size)
+                    chunk_arr = np.frombuffer(mv[pos:chunk_end], dtype=np.uint8)
+                    separators = (chunk_arr < 0x20) | (chunk_arr > 0x7E)
+
+                    if separators.any():
+                        first_separator = int(np.argmax(separators))
+                        if first_separator:
+                            pending_counts += np.bincount(chunk_arr[:first_separator], minlength=256)
+                            pending_len += first_separator
+                        pos += first_separator + 1
+                        break
+
+                    pending_counts += np.bincount(chunk_arr, minlength=256)
+                    pending_len += len(chunk_arr)
+                    pos = chunk_end
+
+                if pending_len >= 5:
+                    count += 1
+                    total_len += pending_len
+                    global_counts += pending_counts
+
+            if count == 0 or total_len == 0:
+                return res
 
         res["StringCount"] = float(count)
         res["StringMeanLength"] = float(total_len) / count
-        res["StringEntropy"] = cls._calc_entropy(combined_data)
 
-        arr = np.frombuffer(combined_data, dtype=np.uint8)
-        counts = np.bincount(arr, minlength=127)
-        char_counts = counts[0x20:0x7F]
+        counts_nonzero = global_counts[global_counts > 0]
+        if len(counts_nonzero) > 0:
+            res["StringEntropy"] = float(np.log2(total_len) - np.sum(counts_nonzero * np.log2(counts_nonzero)) / total_len)
+
+        valid_chars = global_counts[0x20:0x7F]
+        res.update(dict(zip(cls._STRING_KEYS, valid_chars.astype(np.float64) / total_len)))
 
-        res.update(dict(zip(cls._STRING_KEYS, char_counts.astype(np.float64) / total_len)))
         return res
 
+
+
     @classmethod
     def _extract_histograms(cls, file_bytes):
         arr = np.frombuffer(file_bytes, dtype=np.uint8)
@@ -177,56 +294,64 @@ class FeatureExtractor:
         res = {}
 
         if sz == 0:
+            res['FileEntropy'] = 0.0
             res.update(dict.fromkeys(cls._BYTE_HIST_KEYS, 0.0))
             res.update(dict.fromkeys(cls._BYTE_ENT_KEYS, 0.0))
             return res
 
-        byte_counts = np.bincount(arr, minlength=256)
-        byte_hist = byte_counts.astype(np.float64) / sz
-        res.update(dict(zip(cls._BYTE_HIST_KEYS, byte_hist)))
-
+        byte_counts = np.zeros(256, dtype=np.int64)
         ent_hist = np.zeros(256, dtype=np.float64)
         window = 2048
         step = 1024
 
         if sz < window:
-            w_counts = byte_counts
-            p = w_counts[w_counts > 0] / float(sz)
+            byte_counts += np.bincount(arr, minlength=256)
+            p = byte_counts[byte_counts > 0] / float(sz)
             entropy = float(-np.sum(p * np.log2(p)))
             ent_bin = min(int(entropy * 2.0), 15)
-            byte_bins = w_counts.reshape(16, 16).sum(axis=1)
+            byte_bins = byte_counts.reshape(16, 16).sum(axis=1)
             idx_start = ent_bin * 16
             ent_hist[idx_start : idx_start+16] += byte_bins
-
         else:
             num_windows = (sz - window) // step + 1
-            batch_windows = 10000 
-            
-            for w_start in range(0, num_windows, batch_windows):
-                w_end = min(w_start + batch_windows, num_windows)
+
+            for w_start in range(0, num_windows, cls._HISTOGRAM_BATCH_WINDOWS):
+                w_end = min(w_start + cls._HISTOGRAM_BATCH_WINDOWS, num_windows)
                 b_num = w_end - w_start
-                
+
                 start_byte = w_start * step
                 end_byte = start_byte + b_num * step + step
-                b_arr = arr[start_byte:end_byte]
-                
-                arr_2d = b_arr.reshape(b_num + 1, step)
-                offsets = (np.arange(b_num + 1, dtype=np.int32)[:, None] * 256)
-                flat_idx = (arr_2d.astype(np.int32) + offsets).ravel()
-                
-                chunk_counts = np.bincount(flat_idx, minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                encoded = arr[start_byte:end_byte].astype(np.int32).reshape(b_num + 1, step)
+                encoded += np.arange(b_num + 1, dtype=np.int32)[:, None] * 256
+
+                chunk_counts = np.bincount(encoded.ravel(), minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                del encoded
+
+                byte_counts += np.sum(chunk_counts[:-1], axis=0)
+                if w_end == num_windows:
+                    byte_counts += chunk_counts[-1]
+
                 window_counts = chunk_counts[:-1] + chunk_counts[1:]
-                
                 sum_c_log_c = np.sum(cls._C_LOG_C_TABLE[window_counts], axis=1)
                 entropies = 11.0 - sum_c_log_c / 2048.0
-                
+
                 ent_bins = (entropies * 2.0).astype(np.int32)
                 np.clip(ent_bins, 0, 15, out=ent_bins)
-                
+
                 byte_bins = window_counts.reshape(b_num, 16, 16).sum(axis=2)
                 flat_ent_bins = (ent_bins[:, None] * 16 + np.arange(16)).ravel()
                 np.add.at(ent_hist, flat_ent_bins, byte_bins.ravel())
 
+            covered_size = (num_windows + 1) * step
+            if covered_size < sz:
+                byte_counts += np.bincount(arr[covered_size:], minlength=256)
+
+        counts_nonzero = byte_counts[byte_counts > 0]
+        res['FileEntropy'] = float(np.log2(sz) - np.sum(counts_nonzero * np.log2(counts_nonzero)) / sz)
+
+        byte_hist = byte_counts.astype(np.float64) / sz
+        res.update(dict(zip(cls._BYTE_HIST_KEYS, byte_hist)))
+
         ent_sum = np.sum(ent_hist)
         if ent_sum > 0:
             ent_hist /= ent_sum
@@ -234,6 +359,7 @@ class FeatureExtractor:
         res.update(dict(zip(cls._BYTE_ENT_KEYS, ent_hist)))
         return res
 
+
     @classmethod
     def _extract_overlay_features(cls, pe, fsize):
         overlay_offset = pe.get_overlay_data_start_offset()
@@ -390,7 +516,7 @@ class FeatureExtractor:
         if fsize == 0:
             return None
 
-        base, dlls, apis, pe = {}, set(), set(), None
+        base, dlls, apis, pe = cls._base_defaults(), set(), set(), None
         try:
             pe = pefile.PE(data=file_bytes, fast_load=True)
             
@@ -408,7 +534,6 @@ class FeatureExtractor:
                 pass
             
             base['TrustSigned'] = float(verify_signature(file_path))
-            base['FileEntropy'] = cls._calc_entropy(file_bytes)
             base['FileSize'] = float(fsize)
             
             fh = pe.FILE_HEADER
@@ -613,20 +738,22 @@ def _extract_worker_wrapper(args):
     return _extract_worker(*args)
 
 def _extract_worker(file_path, label):
+    mm = None
+    f = None
+
     try:
         fsize = os.path.getsize(file_path)
         if fsize == 0 or fsize > MAX_FILE_SIZE:
             return 'error', None
 
-        with open(file_path, "rb") as f:
-            file_bytes = f.read()
-
-        sha256 = hashlib.sha256(file_bytes).hexdigest()
+        f = open(file_path, "rb")
+        mm = mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ)
+        sha256 = hashlib.sha256(mm).hexdigest()
         
         if sha256 in GLOBAL_HASHES:
             return 'skipped', None
 
-        res = FeatureExtractor.extract(file_bytes, file_path, fsize)
+        res = FeatureExtractor.extract(mm, file_path, fsize)
         if res:
             final_res = {"Label": label, "FileHash": sha256, **res}
             return 'success', (sha256, JSON_DUMPS(final_res) + "\n")
@@ -634,6 +761,11 @@ def _extract_worker(file_path, label):
         return 'error', None
     except Exception:
         return 'error', None
+    finally:
+        if mm:
+            mm.close()
+        if f:
+            f.close()
 
 ####################################################################################################
 

Engine/Properties/scanner.py

@@ -1,11 +1,11 @@
-import os, re, sys, math, json, zlib, pefile, datetime
+import os, re, sys, math, json, zlib, mmap, pefile, datetime
 import ctypes, ctypes.wintypes
 import numpy as np
 import onnxruntime as ort
 
 ####################################################################################################
 
-MODEL_FILE = "Pefile_General_S1.onnx"
+MODEL_FILE = "Pefile_General_T1.onnx"
 FEATURE_FILE = "features.json"
 MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024
 
@@ -99,6 +99,9 @@ class WinTrust:
 
 class FeatureExtractor:
     _STRING_PATTERN = re.compile(b'[\x20-\x7E]{5,}')
+    _STRING_FAST_PATH_BYTES = 4194304
+    _STRING_BATCH_BYTES = 4194304
+    _HISTOGRAM_BATCH_WINDOWS = 1024
     
     _BYTE_HIST_KEYS = [f'ByteHist_{i:02X}' for i in range(256)]
     _BYTE_ENT_KEYS = [f'ByteEnt_{i:02X}' for i in range(256)]
@@ -111,6 +114,49 @@ class FeatureExtractor:
     _C_LOG_C_TABLE = np.zeros(2049, dtype=np.float64)
     _C_LOG_C_TABLE[1:] = np.arange(1, 2049) * np.log2(np.arange(1, 2049))
 
+    _OPTIONAL_HEADER_FIELDS = [
+        'Magic', 'MajorLinkerVersion', 'MinorLinkerVersion', 'SizeOfCode',
+        'SizeOfInitializedData', 'SizeOfUninitializedData', 'AddressOfEntryPoint',
+        'BaseOfCode', 'ImageBase', 'SectionAlignment', 'FileAlignment',
+        'MajorOperatingSystemVersion', 'MinorOperatingSystemVersion',
+        'MajorImageVersion', 'MinorImageVersion', 'MajorSubsystemVersion',
+        'MinorSubsystemVersion', 'SizeOfImage', 'SizeOfHeaders', 'CheckSum',
+        'Subsystem', 'DllCharacteristics', 'SizeOfStackReserve', 'SizeOfStackCommit',
+        'SizeOfHeapReserve', 'SizeOfHeapCommit', 'LoaderFlags', 'NumberOfRvaAndSizes'
+    ]
+
+    _SECTION_DEFAULTS = {
+        'SectionCount': 0.0,
+        'SectionMaxEntropy': 0.0,
+        'SectionMinEntropy': 0.0,
+        'SectionMeanEntropy': 0.0,
+        'SectionMaxRawSize': 0.0,
+        'SectionMinRawSize': 0.0,
+        'SectionMeanRawSize': 0.0,
+        'SectionMaxVSize': 0.0,
+        'SectionMinVSize': 0.0,
+        'SectionMeanVSize': 0.0,
+        'ExecutableSections': 0.0,
+        'WritableSections': 0.0,
+        'ReadableSections': 0.0,
+        'SectionException': 0.0
+    }
+
+    _CONDITIONAL_DEFAULTS = {
+        'IsDriver': 0.0,
+        'HasTlsCallbacks': 0.0,
+        'IsDebug': 0.0,
+        'IsPreRelease': 0.0,
+        'IsPatched': 0.0,
+        'IsPrivateBuild': 0.0,
+        'IsSpecialBuild': 0.0,
+        'ImportCount': 0.0,
+        'ImportFunctionCount': 0.0,
+        'ExportCount': 0.0,
+        'IconCount': 0.0,
+        'DebugCount': 0.0
+    }
+
     @staticmethod
     def _safe_float(val):
         try:
@@ -120,6 +166,18 @@ class FeatureExtractor:
         except Exception: 
             return 0.0
 
+    @classmethod
+    def _base_defaults(cls):
+        base = dict.fromkeys(cls._OPTIONAL_HEADER_FIELDS, 0.0)
+        base.update(cls._SECTION_DEFAULTS)
+        base.update(cls._CONDITIONAL_DEFAULTS)
+
+        for i in range(16):
+            base[f'DataDirectory_{i}_Size'] = 0.0
+            base[f'DataDirectory_{i}_VA'] = 0.0
+
+        return base
+
     @staticmethod
     def _calc_entropy(data):
         if not data:
@@ -137,25 +195,84 @@ class FeatureExtractor:
         res = {"StringCount": 0.0, "StringMeanLength": 0.0, "StringEntropy": 0.0}
         res.update(dict.fromkeys(cls._STRING_KEYS, 0.0))
 
-        matches = cls._STRING_PATTERN.findall(file_bytes)
-        if not matches:
-            return res
+        if len(file_bytes) <= cls._STRING_FAST_PATH_BYTES:
+            matches = cls._STRING_PATTERN.findall(file_bytes)
+            if not matches:
+                return res
 
-        combined_data = b''.join(matches)
-        count = len(matches)
-        total_len = len(combined_data)
+            combined_data = b''.join(matches)
+            count = len(matches)
+            total_len = len(combined_data)
+            global_counts = np.bincount(np.frombuffer(combined_data, dtype=np.uint8), minlength=256)
+        else:
+            count = 0
+            total_len = 0
+            global_counts = np.zeros(256, dtype=np.int64)
+            mv = memoryview(file_bytes)
+            pos = 0
+            size = len(file_bytes)
+
+            while pos < size:
+                chunk_end = min(pos + cls._STRING_BATCH_BYTES, size)
+                chunk_arr = np.frombuffer(mv[pos:chunk_end], dtype=np.uint8)
+                separators = (chunk_arr < 0x20) | (chunk_arr > 0x7E)
+
+                if separators.any():
+                    last_separator = len(separators) - 1 - int(np.argmax(separators[::-1]))
+                    segment_end = pos + last_separator + 1
+                    matches = cls._STRING_PATTERN.findall(mv[pos:segment_end])
+
+                    if matches:
+                        combined_data = b''.join(matches)
+                        count += len(matches)
+                        total_len += len(combined_data)
+                        global_counts += np.bincount(np.frombuffer(combined_data, dtype=np.uint8), minlength=256)
+
+                    pos = segment_end
+                    continue
+
+                pending_len = 0
+                pending_counts = np.zeros(256, dtype=np.int64)
+
+                while pos < size:
+                    chunk_end = min(pos + cls._STRING_BATCH_BYTES, size)
+                    chunk_arr = np.frombuffer(mv[pos:chunk_end], dtype=np.uint8)
+                    separators = (chunk_arr < 0x20) | (chunk_arr > 0x7E)
+
+                    if separators.any():
+                        first_separator = int(np.argmax(separators))
+                        if first_separator:
+                            pending_counts += np.bincount(chunk_arr[:first_separator], minlength=256)
+                            pending_len += first_separator
+                        pos += first_separator + 1
+                        break
+
+                    pending_counts += np.bincount(chunk_arr, minlength=256)
+                    pending_len += len(chunk_arr)
+                    pos = chunk_end
+
+                if pending_len >= 5:
+                    count += 1
+                    total_len += pending_len
+                    global_counts += pending_counts
+
+            if count == 0 or total_len == 0:
+                return res
 
         res["StringCount"] = float(count)
         res["StringMeanLength"] = float(total_len) / count
-        res["StringEntropy"] = cls._calc_entropy(combined_data)
 
-        arr = np.frombuffer(combined_data, dtype=np.uint8)
-        counts = np.bincount(arr, minlength=127)
-        char_counts = counts[0x20:0x7F]
+        counts_nonzero = global_counts[global_counts > 0]
+        if len(counts_nonzero) > 0:
+            res["StringEntropy"] = float(np.log2(total_len) - np.sum(counts_nonzero * np.log2(counts_nonzero)) / total_len)
+
+        valid_chars = global_counts[0x20:0x7F]
+        res.update(dict(zip(cls._STRING_KEYS, valid_chars.astype(np.float64) / total_len)))
 
-        res.update(dict(zip(cls._STRING_KEYS, char_counts.astype(np.float64) / total_len)))
         return res
 
+
+
     @classmethod
     def _extract_histograms(cls, file_bytes):
         arr = np.frombuffer(file_bytes, dtype=np.uint8)
@@ -163,55 +280,64 @@ class FeatureExtractor:
         res = {}
 
         if sz == 0:
+            res['FileEntropy'] = 0.0
             res.update(dict.fromkeys(cls._BYTE_HIST_KEYS, 0.0))
             res.update(dict.fromkeys(cls._BYTE_ENT_KEYS, 0.0))
             return res
 
-        byte_counts = np.bincount(arr, minlength=256)
-        byte_hist = byte_counts.astype(np.float64) / sz
-        res.update(dict(zip(cls._BYTE_HIST_KEYS, byte_hist)))
-
+        byte_counts = np.zeros(256, dtype=np.int64)
         ent_hist = np.zeros(256, dtype=np.float64)
         window = 2048
         step = 1024
 
         if sz < window:
-            w_counts = byte_counts
-            p = w_counts[w_counts > 0] / float(sz)
+            byte_counts += np.bincount(arr, minlength=256)
+            p = byte_counts[byte_counts > 0] / float(sz)
             entropy = float(-np.sum(p * np.log2(p)))
             ent_bin = min(int(entropy * 2.0), 15)
-            byte_bins = w_counts.reshape(16, 16).sum(axis=1)
+            byte_bins = byte_counts.reshape(16, 16).sum(axis=1)
             idx_start = ent_bin * 16
             ent_hist[idx_start : idx_start+16] += byte_bins
         else:
             num_windows = (sz - window) // step + 1
-            batch_windows = 10000 
-            
-            for w_start in range(0, num_windows, batch_windows):
-                w_end = min(w_start + batch_windows, num_windows)
+
+            for w_start in range(0, num_windows, cls._HISTOGRAM_BATCH_WINDOWS):
+                w_end = min(w_start + cls._HISTOGRAM_BATCH_WINDOWS, num_windows)
                 b_num = w_end - w_start
-                
+
                 start_byte = w_start * step
                 end_byte = start_byte + b_num * step + step
-                b_arr = arr[start_byte:end_byte]
-                
-                arr_2d = b_arr.reshape(b_num + 1, step)
-                offsets = (np.arange(b_num + 1, dtype=np.int32)[:, None] * 256)
-                flat_idx = (arr_2d.astype(np.int32) + offsets).ravel()
-                
-                chunk_counts = np.bincount(flat_idx, minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                encoded = arr[start_byte:end_byte].astype(np.int32).reshape(b_num + 1, step)
+                encoded += np.arange(b_num + 1, dtype=np.int32)[:, None] * 256
+
+                chunk_counts = np.bincount(encoded.ravel(), minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                del encoded
+
+                byte_counts += np.sum(chunk_counts[:-1], axis=0)
+                if w_end == num_windows:
+                    byte_counts += chunk_counts[-1]
+
                 window_counts = chunk_counts[:-1] + chunk_counts[1:]
-                
                 sum_c_log_c = np.sum(cls._C_LOG_C_TABLE[window_counts], axis=1)
                 entropies = 11.0 - sum_c_log_c / 2048.0
-                
+
                 ent_bins = (entropies * 2.0).astype(np.int32)
                 np.clip(ent_bins, 0, 15, out=ent_bins)
-                
+
                 byte_bins = window_counts.reshape(b_num, 16, 16).sum(axis=2)
                 flat_ent_bins = (ent_bins[:, None] * 16 + np.arange(16)).ravel()
                 np.add.at(ent_hist, flat_ent_bins, byte_bins.ravel())
 
+            covered_size = (num_windows + 1) * step
+            if covered_size < sz:
+                byte_counts += np.bincount(arr[covered_size:], minlength=256)
+
+        counts_nonzero = byte_counts[byte_counts > 0]
+        res['FileEntropy'] = float(np.log2(sz) - np.sum(counts_nonzero * np.log2(counts_nonzero)) / sz)
+
+        byte_hist = byte_counts.astype(np.float64) / sz
+        res.update(dict(zip(cls._BYTE_HIST_KEYS, byte_hist)))
+
         ent_sum = np.sum(ent_hist)
         if ent_sum > 0:
             ent_hist /= ent_sum
@@ -219,6 +345,7 @@ class FeatureExtractor:
         res.update(dict(zip(cls._BYTE_ENT_KEYS, ent_hist)))
         return res
 
+
     @classmethod
     def _extract_overlay_features(cls, pe, fsize):
         overlay_offset = pe.get_overlay_data_start_offset()
@@ -372,15 +499,19 @@ class FeatureExtractor:
     @classmethod
     def extract(cls, file_path):
         pe = None
+        mm = None
+        source_file = None
+
         try:
             fsize = os.path.getsize(file_path)
             if fsize == 0 or fsize > MAX_FILE_SIZE: 
                 return None
 
-            with open(file_path, "rb") as f:
-                file_bytes = f.read()
+            source_file = open(file_path, "rb")
+            mm = mmap.mmap(source_file.fileno(), 0, access=mmap.ACCESS_READ)
+            file_bytes = mm
 
-            base, dlls, apis = {}, set(), set()
+            base, dlls, apis = cls._base_defaults(), set(), set()
             pe = pefile.PE(data=file_bytes, fast_load=True)
 
             try:
@@ -397,7 +528,6 @@ class FeatureExtractor:
                 pass
             
             base['TrustSigned'] = float(WinTrust.verify(file_path))
-            base['FileEntropy'] = cls._calc_entropy(file_bytes)
             base['FileSize'] = float(fsize)
             
             fh = pe.FILE_HEADER
@@ -420,7 +550,8 @@ class FeatureExtractor:
             if hasattr(pe, 'OPTIONAL_HEADER'):
                 op = pe.OPTIONAL_HEADER
                 fields = ['Magic', 'MajorLinkerVersion', 'MinorLinkerVersion', 'SizeOfCode', 'SizeOfInitializedData', 'SizeOfUninitializedData', 'AddressOfEntryPoint', 'BaseOfCode', 'ImageBase', 'SectionAlignment', 'FileAlignment', 'MajorOperatingSystemVersion', 'MinorOperatingSystemVersion', 'MajorImageVersion', 'MinorImageVersion', 'MajorSubsystemVersion', 'MinorSubsystemVersion', 'SizeOfImage', 'SizeOfHeaders', 'CheckSum', 'Subsystem', 'DllCharacteristics', 'SizeOfStackReserve', 'SizeOfStackCommit', 'SizeOfHeapReserve', 'SizeOfHeapCommit', 'LoaderFlags', 'NumberOfRvaAndSizes']
-                for f in fields: base[f] = getattr(op, f, 0)
+                for field_name in fields:
+                    base[field_name] = getattr(op, field_name, 0)
                 base['IsDriver'] = 1.0 if base.get('Subsystem') == 1 else 0.0
 
                 if hasattr(op, 'DATA_DIRECTORY'):
@@ -571,11 +702,24 @@ class FeatureExtractor:
 
             return {"Base": base, "DLLs": list(dlls), "APIs": list(apis)}
 
-        except Exception:
+        except pefile.PEFormatError:
             return None
         finally:
-            if pe:
-                pe.close()
+            if pe is not None:
+                try:
+                    pe.close()
+                except Exception:
+                    pass
+            if mm is not None:
+                try:
+                    mm.close()
+                except Exception:
+                    pass
+            if source_file is not None:
+                try:
+                    source_file.close()
+                except Exception:
+                    pass
 
 ####################################################################################################
 
@@ -588,9 +732,15 @@ class ModelPredictor:
         expected_dim = self.sess.get_inputs()[0].shape[1]
         current_dim = len(self.model_features)
         if current_dim != expected_dim:
-            raise ValueError(f"Dimension mismatch! Model expects {expected_dim} features, but feature file lists {current_dim}.")
+            raise ValueError(f"Dimension error: Model expects {expected_dim}, but feature file has {current_dim}")
 
         self.feat_map = {feat: i for i, feat in enumerate(self.model_features)}
+        
+        self.dll_hash_dim = 512
+        self.api_hash_dim = 4096
+        self.dll_hash_pad = 3
+        self.api_hash_pad = 4
+        self._parse_hash_dims()
 
     def _load_features(self, path):
         if not os.path.exists(path):
@@ -599,6 +749,31 @@ class ModelPredictor:
         with open(path, 'r') as f:
             return json.load(f)
 
+    def _parse_hash_dims(self):
+        max_dll = -1
+        max_api = -1
+        
+        for feat in self.model_features:
+            if feat.startswith("DllHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_dll = max(max_dll, int(val_str))
+                    self.dll_hash_pad = len(val_str)
+                except Exception:
+                    pass
+            elif feat.startswith("ApiHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_api = max(max_api, int(val_str))
+                    self.api_hash_pad = len(val_str)
+                except Exception:
+                    pass
+                    
+        if max_dll >= 0:
+            self.dll_hash_dim = max_dll + 1
+        if max_api >= 0:
+            self.api_hash_dim = max_api + 1
+
     def predict(self, raw_data):
         vec = np.zeros((1, len(self.model_features)), dtype=np.float32)
         base = raw_data.get('Base', {})
@@ -610,14 +785,14 @@ class ModelPredictor:
                 vec[0, self.feat_map[k]] = v
 
         for d in dlls:
-            h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
-            feat_name = f"DllHash_{h:03d}"
+            h = zlib.crc32(d.encode('utf-8', 'ignore')) % self.dll_hash_dim
+            feat_name = f"DllHash_{h:0{self.dll_hash_pad}d}"
             if feat_name in self.feat_map:
                 vec[0, self.feat_map[feat_name]] += 1.0
 
         for a in apis:
-            h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
-            feat_name = f"ApiHash_{h:04d}"
+            h = zlib.crc32(a.encode('utf-8', 'ignore')) % self.api_hash_dim
+            feat_name = f"ApiHash_{h:0{self.api_hash_pad}d}"
             if feat_name in self.feat_map:
                 vec[0, self.feat_map[feat_name]] += 1.0
 
@@ -633,7 +808,7 @@ class ModelPredictor:
             elif isinstance(result, np.ndarray):
                 if result.ndim == 2 and result.shape[1] > 1:
                     return float(result[0][1])
-
+                    
         return 0.0
 
 ####################################################################################################
@@ -652,46 +827,83 @@ def scan_target(target, predictor):
         print("[-] No valid PE files found.")
         return
 
-    print(f"\n[*] Scanning {len(files)} files...\n")
-    print(f"{'RESULT':<10} | {'PROB':<8} | {'FILE'}")
-    print("-" * 80)
+    log_buffer = []
+
+    def _log(message):
+        print(message)
+        log_buffer.append(message)
+
+    _log(f"[*] Scanning {len(files)} files...\n")
+    _log(f"{'RESULT':<10} | {'PROB':<8} | {'FILE'}")
+    _log("-" * 80)
 
     safe_count = 0
     mal_count = 0
+    unsupport_count = 0
+    error_count = 0
     
-    for fpath in files:
-        try:
-            data = FeatureExtractor.extract(fpath)
-            if not data:
-                print(f"{'ERROR':<10} | {'----':<8} | {fpath}")
-                continue
-            
-            prob = predictor.predict(data)
-            is_malware = prob > 0.5
-            
-            label = "MALWARE" if is_malware else "SAFE"
-            if is_malware:
-                mal_count += 1
-            else:
-                safe_count += 1
+    try:
+        for fpath in files:
+            try:
+                data = FeatureExtractor.extract(fpath)
+                if not data:
+                    _log(f"{'UNSUPPORT':<10} | {'-':<8} | {fpath}")
+                    unsupport_count += 1
+                    continue
+                
+                prob = predictor.predict(data)
+                is_malware = prob > 0.5
+                
+                label = "MALWARE" if is_malware else "SAFE"
+                if is_malware:
+                    mal_count += 1
+                else:
+                    safe_count += 1
 
-            print(f"{label:<10} | {prob:.4f}   | {fpath}")
-            
-        except Exception as e:
-            print(f"{'FAIL':<10} | {'----':<8} | {fpath} ({str(e)})")
+                _log(f"{label:<10} | {prob:.4f}   | {fpath}")
+                
+            except Exception as e:
+                _log(f"{'FAIL':<10} | {'-':<8} | {fpath} ({str(e)})")
+                error_count += 1
+                
+    except KeyboardInterrupt:
+        _log("\n[-] Scan aborted by user (Ctrl+C).\n")
 
-    print("-" * 80)
-    print(f"[*] Summary: Safe={safe_count}, Malware={mal_count}, Total={len(files)}")
+    _log("-" * 80)
+    _log(f"\n[*] Summary: Safe={safe_count}, Malware={mal_count}, Unsupport={unsupport_count}, Error={error_count}, Total={len(files)}")
+
+    log_filename = datetime.datetime.now().strftime("%Y%m%d_%H%M%S.log")
+    try:
+        with open(log_filename, "w", encoding="utf-8") as f:
+            f.write("\n".join(log_buffer) + "\n")
+        print(f"[*] Log saved successfully: {log_filename}")
+    except Exception as e:
+        print(f"[-] Failed to save log: {e}")
 
 ####################################################################################################
 
 if __name__ == "__main__":
+    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
+    
+    custom_model = MODEL_FILE
+    targets = []
+    
+    args = sys.argv[1:]
+    i = 0
+    while i < len(args):
+        if args[i] in ("-m", "-model", "--model") and i + 1 < len(args):
+            custom_model = args[i+1]
+            i += 2
+        else:
+            targets.append(args[i])
+            i += 1
+
     print("\n-------------------------- PE Malware Predictor v4.0 --------------------------\n")
     print(f"[*] © 2020-2026 87owo (PYAS Security)")
-    print(f"[*] Loading model features and weights...")
+    print(f"[*] Official Website: https://github.com/87owo/PYAS")
+    print(f"[*] Loading model: {custom_model}")
 
-    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
-    model_path = os.path.join(base_dir, MODEL_FILE)
+    model_path = os.path.join(base_dir, custom_model) if not os.path.isabs(custom_model) else custom_model
     feature_path = os.path.join(base_dir, FEATURE_FILE)
 
     try:
@@ -700,14 +912,13 @@ if __name__ == "__main__":
         print(f"[-] Critical Error: {e}")
         sys.exit(1)
 
-    if len(sys.argv) > 1:
-        for path in sys.argv[1:]:
+    if targets:
+        for path in targets:
             target = path.strip('"').strip("'")
             if os.path.exists(target):
                 print()
                 print("-" * 80)
                 scan_target(target, predictor)
-
             else:
                 print(f"[-] Path does not exist: {target}")
     else:

Engine/Properties/train_server.py

@@ -25,8 +25,8 @@ FEATURE_FILE = "features.json"
 
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
-DLL_HASH_DIM = 256
-API_HASH_DIM = 1024
+DLL_HASH_DIM = 512
+API_HASH_DIM = 4096
 
 EXCLUDE_FEATURES = {
     'label', 'filehash',
@@ -58,15 +58,14 @@ def analyze_schema(jsonl_path):
         for line in f:
             num_lines += 1
 
-            if not base_keys:
-                try:
-                    data = JSON_LOADS(line)
-                    base_data = data.get('Base')
-                    if base_data:
-                        base_keys.update(base_data.keys())
+            try:
+                data = JSON_LOADS(line)
+                base_data = data.get('Base')
+                if base_data:
+                    base_keys.update(base_data.keys())
 
-                except Exception:
-                    pass
+            except Exception:
+                pass
 
     base_schema = sorted([k for k in base_keys if k.lower().strip() not in EXCLUDE_FEATURES])
     dll_schema = [f"DllHash_{i:03d}" for i in range(DLL_HASH_DIM)]

Engine/Properties/train_user.py

@@ -25,8 +25,8 @@ FEATURE_FILE = "features.json"
 
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
-DLL_HASH_DIM = 256
-API_HASH_DIM = 1024
+DLL_HASH_DIM = 512
+API_HASH_DIM = 4096
 
 EXCLUDE_FEATURES = {
     'label', 'filehash',
@@ -58,15 +58,14 @@ def analyze_schema(jsonl_path):
         for line in f:
             num_lines += 1
 
-            if not base_keys:
-                try:
-                    data = JSON_LOADS(line)
-                    base_data = data.get('Base')
-                    if base_data:
-                        base_keys.update(base_data.keys())
+            try:
+                data = JSON_LOADS(line)
+                base_data = data.get('Base')
+                if base_data:
+                    base_keys.update(base_data.keys())
 
-                except Exception:
-                    pass
+            except Exception:
+                pass
 
     base_schema = sorted([k for k in base_keys if k.lower().strip() not in EXCLUDE_FEATURES])
     dll_schema = [f"DllHash_{i:03d}" for i in range(DLL_HASH_DIM)]
@@ -211,7 +210,7 @@ def train_process(X, y, feature_names):
         params,
         train_data,
         valid_sets=[valid_data],
-        num_boost_round=500,
+        num_boost_round=350,
         callbacks=[
             lgb.log_evaluation(period=50),
             lgb.reset_parameter(learning_rate=_calculate_dynamic_lr)

Interface/static/css/style.css

@@ -648,9 +648,38 @@ select.hidden + .custom-select-wrapper {
     transition: opacity 0.4s ease, visibility 0.4s ease;
 }
 
-#loading_overlay.fade-out {
-    opacity: 0;
-    visibility: hidden;
+#loading_overlay.fade-out {
+    opacity: 0;
+    visibility: hidden;
+}
+
+#loading_overlay.startup-error {
+    padding: 28px;
+    background-color: #f5f5f7;
+    color: #1d1d1f;
+}
+
+.startup-error-box {
+    max-width: 520px;
+    padding: 24px;
+    border: 1px solid rgba(0, 0, 0, 0.12);
+    border-radius: 8px;
+    background: #ffffff;
+    box-shadow: 0 16px 40px rgba(0, 0, 0, 0.12);
+}
+
+.startup-error-box h1 {
+    margin: 0 0 10px;
+    font-size: 18px;
+    font-weight: 700;
+}
+
+.startup-error-box p {
+    margin: 0;
+    font-size: 13px;
+    line-height: 1.6;
+    color: #515154;
+    word-break: break-word;
 }
 
 .spinner {

Interface/static/js/i18n.js

@@ -179,7 +179,15 @@ window.AppI18n = {
             "Network Block": "網路攔截",
             "Driver Block": "驅動攔截",
             "System Restart": "系統重啟",
-            "Clean Junk": "清理垃圾"
+            "Clean Junk": "清理垃圾",
+            "protect_suspend": "進程暫停",
+            "protect_suspend_desc": "此選項可以暫停進程等待掃描",
+            "protect_load": "加載防護",
+            "protect_load_desc": "此選項可以攔截惡意進程加載",
+            "opt_autostart": "開機啟動",
+            "opt_autostart_desc": "此選項可以設定開機自動執行",
+            "opt_ext_filter": "副檔名過濾",
+            "opt_ext_filter_desc": "此選項僅掃描指定檔案副檔名",
         },
         "simplified_switch": {
             "app_name": "PYAS Security",
@@ -360,7 +368,15 @@ window.AppI18n = {
             "Network Block": "网络拦截",
             "Driver Block": "驱动拦截",
             "System Restart": "系统重启",
-            "Clean Junk": "清理垃圾"
+            "Clean Junk": "清理垃圾",
+            "protect_suspend": "进程暂停",
+            "protect_suspend_desc": "此选项可以暂停进程等待扫描",
+            "protect_load": "加载防护",
+            "protect_load_desc": "此选项可以拦截恶意进程加载",
+            "opt_autostart": "开机启动",
+            "opt_autostart_desc": "此选项可以设定开机自动运行",
+            "opt_ext_filter": "后缀名过滤",
+            "opt_ext_filter_desc": "此选项仅扫描指定文件后缀名",
         },
         "english_switch": {
             "app_name": "PYAS Security",
@@ -541,7 +557,15 @@ window.AppI18n = {
             "Network Block": "Network Block",
             "Driver Block": "Driver Block",
             "System Restart": "System Restart",
-            "Clean Junk": "Clean Junk"
+            "Clean Junk": "Clean Junk",
+            "protect_suspend": "Process Suspend",
+            "protect_suspend_desc": "Suspend processes while waiting for scanning",
+            "protect_load": "Load Protection",
+            "protect_load_desc": "Intercept malicious process loading",
+            "opt_autostart": "Auto Start",
+            "opt_autostart_desc": "Run automatically at system startup",
+            "opt_ext_filter": "Suffix Filter",
+            "opt_ext_filter_desc": "This option only scans specified file extensions",
         },
         "japanese_switch": {
             "app_name": "PYAS Security",
@@ -722,7 +746,15 @@ window.AppI18n = {
             "Network Block": "ネットワークブロック",
             "Driver Block": "ドライバーブロック",
             "System Restart": "システムの再起動",
-            "Clean Junk": "ジャンククリーンアップ"
+            "Clean Junk": "ジャンククリーンアップ",
+            "protect_suspend": "プロセスの一時停止",
+            "protect_suspend_desc": "スキャン待ちの間プロセスを一時停止します",
+            "protect_load": "ロード保護",
+            "protect_load_desc": "悪意のあるプロセスの読み込みをインターセプトします",
+            "opt_autostart": "自動起動",
+            "opt_autostart_desc": "システム起動時に自動的に実行します",
+            "opt_ext_filter": "拡張子フィルタ",
+            "opt_ext_filter_desc": "このオプションは指定された拡張子のファイルのみをスキャンします",
         },
         "korean_switch": {
             "app_name": "PYAS Security",
@@ -903,7 +935,15 @@ window.AppI18n = {
             "Network Block": "네트워크 차단",
             "Driver Block": "드라이버 차단",
             "System Restart": "시스템 재시작",
-            "Clean Junk": "정크 정리"
+            "Clean Junk": "정크 정리",
+            "protect_suspend": "프로세스 일시 중지",
+            "protect_suspend_desc": "스캔을 기다리는 동안 프로세스를 일시 중지합니다",
+            "protect_load": "로드 보호",
+            "protect_load_desc": "악성 프로세스 로딩을 차단합니다",
+            "opt_autostart": "자동 시작",
+            "opt_autostart_desc": "시스템 시작 시 자동으로 실행합니다",
+            "opt_ext_filter": "확장자 필터",
+            "opt_ext_filter_desc": "이 옵션은 지정된 파일 확장자만 스캔합니다",
         },
         "french_switch": {
             "app_name": "PYAS Security",
@@ -1084,7 +1124,15 @@ window.AppI18n = {
             "Network Block": "Réseau bloqué",
             "Driver Block": "Pilote bloqué",
             "System Restart": "Redémarrage système",
-            "Clean Junk": "Nettoyage"
+            "Clean Junk": "Nettoyage",
+            "protect_suspend": "Suspendre processus",
+            "protect_suspend_desc": "Suspend les processus en attente d'analyse",
+            "protect_load": "Protection de chargement",
+            "protect_load_desc": "Intercepte le chargement de processus malveillants",
+            "opt_autostart": "Démarrage auto",
+            "opt_autostart_desc": "Exécuter automatiquement au démarrage",
+            "opt_ext_filter": "Filtre d'extension",
+            "opt_ext_filter_desc": "Cette option analyse uniquement les extensions de fichiers spécifiées",
         },
         "spanish_switch": {
             "app_name": "PYAS Security",
@@ -1265,7 +1313,15 @@ window.AppI18n = {
             "Network Block": "Red bloqueada",
             "Driver Block": "Controlador bloqueado",
             "System Restart": "Reinicio del sistema",
-            "Clean Junk": "Limpieza de basura"
+            "Clean Junk": "Limpieza de basura",
+            "protect_suspend": "Suspender procesos",
+            "protect_suspend_desc": "Suspender procesos mientras espera el escaneo",
+            "protect_load": "Protección de carga",
+            "protect_load_desc": "Interceptar la carga de procesos maliciosos",
+            "opt_autostart": "Inicio automático",
+            "opt_autostart_desc": "Ejecutar automáticamente al inicio",
+            "opt_ext_filter": "Filtro de extensión",
+            "opt_ext_filter_desc": "Esta opción solo escanea extensiones de archivo especificadas",
         },
         "hindi_switch": {
             "app_name": "PYAS Security",
@@ -1446,7 +1502,15 @@ window.AppI18n = {
             "Network Block": "नेटवर्क अवरुद्ध",
             "Driver Block": "ड्राइवर अवरुद्ध",
             "System Restart": "सिस्टम पुनरारंभ",
-            "Clean Junk": "कचरा साफ़ करें"
+            "Clean Junk": "कचरा साफ़ करें",
+            "protect_suspend": "प्रक्रिया रोकें",
+            "protect_suspend_desc": "स्कैन की प्रतीक्षा करते समय प्रक्रियाओं को रोकें",
+            "protect_load": "लोड सुरक्षा",
+            "protect_load_desc": "दुर्भावनापूर्ण प्रक्रिया लोडिंग को रोकें",
+            "opt_autostart": "स्वतः प्रारंभ",
+            "opt_autostart_desc": "सिस्टम स्टार्टअप पर स्वचालित रूप से चलाएं",
+            "opt_ext_filter": "एक्सटेंशन फ़िल्टर",
+            "opt_ext_filter_desc": "यह विकल्प केवल निर्दिष्ट फ़ाइल एक्सटेंशन को स्कैन करता है",
         },
         "arabic_switch": {
             "app_name": "PYAS Security",
@@ -1627,7 +1691,15 @@ window.AppI18n = {
             "Network Block": "حظر شبكة",
             "Driver Block": "حظر محرك",
             "System Restart": "إعادة تشغيل النظام",
-            "Clean Junk": "تنظيف المخلفات"
+            "Clean Junk": "تنظيف المخلفات",
+            "protect_suspend": "تعليق العمليات",
+            "protect_suspend_desc": "تعليق العمليات أثناء انتظار الفحص",
+            "protect_load": "حماية التحميل",
+            "protect_load_desc": "اعتراض تحميل العمليات الخبيثة",
+            "opt_autostart": "بدء تلقائي",
+            "opt_autostart_desc": "التشغيل تلقائيًا عند بدء التشغيل",
+            "opt_ext_filter": "تصفية الامتداد",
+            "opt_ext_filter_desc": "يقوم هذا الخيار بفحص امتدادات الملفات المحددة فقط",
         },
         "russian_switch": {
             "app_name": "PYAS Security",
@@ -1808,7 +1880,15 @@ window.AppI18n = {
             "Network Block": "Блокировка сети",
             "Driver Block": "Блокировка драйвера",
             "System Restart": "Перезапуск системы",
-            "Clean Junk": "Очистка мусора"
+            "Clean Junk": "Очистка мусора",
+            "protect_suspend": "Приостановка процессов",
+            "protect_suspend_desc": "Приостановка процессов в ожидании сканирования",
+            "protect_load": "Защита загрузки",
+            "protect_load_desc": "Перехват загрузки вредоносных процессов",
+            "opt_autostart": "Автозапуск",
+            "opt_autostart_desc": "Автоматический запуск при старте системы",
+            "opt_ext_filter": "Фильтр расширений",
+            "opt_ext_filter_desc": "Этот параметр сканирует только указанные расширения файлов",
         },
         "slovenian_switch": {
             "app_name": "PYAS Security",
@@ -1989,7 +2069,15 @@ window.AppI18n = {
             "Network Block": "Omrežje blokirano",
             "Driver Block": "Gonilnik blokiran",
             "System Restart": "Ponovni zagon sistema",
-            "Clean Junk": "Čiščenje nesnage"
+            "Clean Junk": "Čiščenje nesnage",
+            "protect_suspend": "Začasna ustavitev",
+            "protect_suspend_desc": "Zaustavite procese med čakanjem na skeniranje",
+            "protect_load": "Zaščita nalaganja",
+            "protect_load_desc": "Prestrezi nalaganje zlonamernih procesov",
+            "opt_autostart": "Samodejni zagon",
+            "opt_autostart_desc": "Samodejni zagon ob zagonu sistema",
+            "opt_ext_filter": "Filter končnic",
+            "opt_ext_filter_desc": "Ta možnost skenira samo določene končnice datotek",
         }
     },
     langMap: {

Interface/templates/index.html

@@ -6,7 +6,18 @@
     <title>PYAS Security</title>
     <link rel="stylesheet" href="/static/css/style.css">
     <script defer src="/static/js/i18n.js"></script>
-    <script defer src="/static/js/main.js"></script>
+    <script defer src="/static/js/main.js"></script>
+    <script>
+        window.addEventListener('DOMContentLoaded', function () {
+            window.setTimeout(function () {
+                var overlay = document.getElementById('loading_overlay');
+                if (overlay && !overlay.classList.contains('fade-out') && !overlay.classList.contains('startup-error')) {
+                    overlay.classList.add('startup-error');
+                    overlay.innerHTML = '<div class="startup-error-box"><h1>PYAS failed to open</h1><p>WebView2 initialization timed out. PYAS will retry automatically.</p></div>';
+                }
+            }, 20000);
+        });
+    </script>
 </head>
 <body>
     <div id="loading_overlay">
@@ -109,6 +120,18 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>進程暫停</h2><p data-i18n>此選項可以暫停進程等待掃描</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>加載防護</h2><p data-i18n>此選項可以攔截惡意進程加載</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>檔案防護</h2><p data-i18n>此選項可以隔離惡意檔案建立</p>
@@ -123,13 +146,13 @@
                         </div>
                         <div class="list-item">
                             <div class="item-info">
-                                <h2 data-i18n>驅動防護</h2><p data-i18n>此選項可以實時攔截惡意行為</p>
+                                <h2 data-i18n>網路防護</h2><p data-i18n>此選項可以攔截惡意網路連接</p>
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
                         <div class="list-item">
                             <div class="item-info">
-                                <h2 data-i18n>網路防護</h2><p data-i18n>此選項可以攔截惡意網路連接</p>
+                                <h2 data-i18n>驅動防護</h2><p data-i18n>此選項可以實時攔截惡意行為</p>
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
@@ -215,6 +238,18 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>副檔名過濾</h2><p data-i18n>此選項僅掃描指定檔案副檔名</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>開機啟動</h2><p data-i18n>此選項可以設定開機自動執行</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>選單掃描</h2><p data-i18n>此選項可以啟用右鍵掃描功能</p>
@@ -284,34 +319,65 @@
                         </div>
                         <div class="license-widget">
                             <textarea class="license-text" readonly>87owo Publicly Available Source Code License Agreement
-Last updated: 2025-12-19
 
-1. License and Ownership
-   - This software and its source code are source available for public view.
-   - Access or execution of certain features may require an activation key.
-   - 87owo reserves all legal rights, no intellectual property is transferred.
-   - All project archives, source code, and binaries remain fully proprietary.
+Last Updated: 2026-07-18
+IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
-2. Use and Prohibitions
-   - You may view, download, and modify the code for local and personal use.
-   - Redistribution of any original or modified code requires prior consent.
-   - Commercial hosting or SaaS deployment is prohibited without permission.
-   - Reverse engineering, license removal, or illegal use is strictly barred.
+1. Definitions and Interpretation
 
-3. Data and Privacy
-   - This project may collect operational data for optimization and analysis.
-   - All collected data is strictly anonymized to ensure the user's privacy.
-   - Transmission of information is encrypted to prevent unauthorized access.
+   - 1.1. Author: Refers to 87owo (PYAS Security).
+   - 1.2. Software: Refers to the source code, binaries, project archives, assets, and documentation associated with this repository or distribution.
+   - 1.3. Personal Local Use: Means viewing, downloading, executing, and modifying the Software strictly on local hardware owned or directly controlled by an individual for private, non-commercial, non-production, and non-distribution purposes.
+   - 1.4. Enterprise Use: Includes enterprise internal deployment, multi-user institutional use, or utilization within any corporate environment, which is strictly excluded from Personal Local Use.
 
-4. Updates and Terms
-   - New releases may include critical patches, enhancements, or UI changes.
-   - Continued use of these services constitutes acceptance of updated terms.
-   - The author reserves the right to modify these license terms at any time.
+2. Intellectual Property and Ownership
 
-5. Warranty and Liability
-   - All services and assets are provided "as is" without any form of warranty.
-   - 87owo is not liable for any direct or indirect damages from software use.
-   - Users assume all risks regarding performance, data, and system integrity.
+   - 2.1. Retention of Rights: The Author reserves all legal rights, titles, and interests in and to the Software, including but not limited to all copyrights, trademarks, patents, and trade secrets.
+   - 2.2. No Transfer: No intellectual property rights or ownership stakes are transferred under this Agreement. All project components remain fully proprietary.
+   - 2.3. Activation Keys: Access to or execution of certain premium features, modules, or binary distributions within the Software may require a valid, authorized activation key issued solely by the Author.
+
+3. Grant of License and Permitted Use
+
+   Subject to your strict compliance with all terms of this Agreement, the Author hereby grants you a limited, non-exclusive, world-wide, royalty-free, revocable, and non-transferable license to:
+   - 3.1. Code Inspection: View and download the source code from official authorized repositories.
+   - 3.2. Local Modification: Modify the source code strictly for the purposes of Personal Local Use.
+   - 3.3. Local Execution: Execute the Software locally for personal evaluation and private deployment.
+
+4. Prohibitions and Restrictions
+
+   Except as explicitly granted in Section 3, you shall not, and shall not permit any third party to:
+   - 4.1. Unauthorized Redistribution: Copy, redistribute, sublicense, republish, mirror, or publicly disclose any original or modified versions of the source code, binaries, or assets.
+   - 4.2. Commercial and SaaS Deployment: Host, deploy, embed, or utilize the Software for commercial purposes, including but not limited to Software-as-a-Service (SaaS), commercial web hosting, paid remote execution, cloud infrastructure integration, or enterprise internal utility.
+   - 4.3. Reverse Engineering: Reverse engineer, decompile, decrypt, or disassemble any binary components of the Software, except and only to the extent that such restriction is explicitly prohibited by applicable mandatory laws.
+   - 4.4. Notice Preservation: Remove, obscure, deface, or alter any copyright notices, trademarks, hyperlinked terms, or license files included within the Software distribution.
+
+5. Prior Authorization and Application Channels
+
+   - 5.1. Authorization Requirement: Any activity exceeding the scope of Personal Local Use (including but not limited to public redistribution, independent forks not targeting upstream contributions, commercial deployment, or enterprise use) requires prior explicit written consent from the Author.
+   - 5.2. Official Application Channels: Users seeking such authorization must submit a formal request through one of the following official channels:
+      - Channel A (GitHub Fork): Initiating a standard Fork on the official GitHub repository for collaborative and upstream contributions.
+      - Channel B (GitHub Issues): Submitting a public issue utilizing the designated authorization request template.
+      - Channel C (Official Email): Sending a detailed inquiry to the official organizational email address associated with the PYAS Security project.
+   - 5.3. Request Content: Any application must explicitly state the specific use case, intended target audience, scope of deployment, and whether any commercial monetization is involved.
+
+6. Updates, Amendments, and Scope of Terms
+
+   - 6.1. New Releases: The Author may deliver updates, critical security patches, feature enhancements, or user interface modifications. Continued use of the Software constitutes acceptance of the latest distributed version.
+   - 6.2. Non-Retroactivity: The Author reserves the right to amend this License Agreement at any time. Amendments apply strictly to subsequent versions or new downloads. Copies lawfully acquired prior to such modification remain governed by the exact version of the License under which they were originally obtained.
+
+7. Telemetry, Data, and Privacy
+
+   - 7.1. Operational Data Collection: The Software may collect anonymized technical, operational, and usage data strictly for security analysis, performance optimization, and bug reporting.
+   - 7.2. Cloud Sample Submission: To enhance threat detection and malware analysis, the Software may automatically or manually transmit suspicious executable files and software samples to the Author's cloud infrastructure for deep analysis.
+   - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
+   - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
+   - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+   - 7.6. Driver Signature: Certain kernel-mode drivers distributed with this software may be digitally signed using code signing methods that are not certified by Microsoft Windows Hardware Quality Labs (WHQL). By installing or using this software, you acknowledge this and decide for yourself whether to install and trust such drivers on your system.
+
+8. Warranty Disclaimer and Limitation of Liability
+
+   - 8.1. Disclaimer of Warranty: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ALL RELATED ASSETS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+   - 8.2. Limitation of Liability: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. USERS ASSUME ALL RISKS REGARDING PERFORMANCE, DATA INTEGRITY, AND SYSTEM STABILITY.
 
 © 2020-2026 87owo (PYAS Security). All rights reserved.</textarea>
                         </div>

LICENSE.txt

@@ -1,31 +1,62 @@
 87owo Publicly Available Source Code License Agreement
-Last updated: 2025-12-19
 
-1. License and Ownership
-   - This software and its source code are source available for public view.
-   - Access or execution of certain features may require an activation key.
-   - 87owo reserves all legal rights, no intellectual property is transferred.
-   - All project archives, source code, and binaries remain fully proprietary.
+Last Updated: 2026-07-18
+IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
-2. Use and Prohibitions
-   - You may view, download, and modify the code for local and personal use.
-   - Redistribution of any original or modified code requires prior consent.
-   - Commercial hosting or SaaS deployment is prohibited without permission.
-   - Reverse engineering, license removal, or illegal use is strictly barred.
+1. Definitions and Interpretation
 
-3. Data and Privacy
-   - This project may collect operational data for optimization and analysis.
-   - All collected data is strictly anonymized to ensure the user's privacy.
-   - Transmission of information is encrypted to prevent unauthorized access.
+   - 1.1. Author: Refers to 87owo (PYAS Security).
+   - 1.2. Software: Refers to the source code, binaries, project archives, assets, and documentation associated with this repository or distribution.
+   - 1.3. Personal Local Use: Means viewing, downloading, executing, and modifying the Software strictly on local hardware owned or directly controlled by an individual for private, non-commercial, non-production, and non-distribution purposes.
+   - 1.4. Enterprise Use: Includes enterprise internal deployment, multi-user institutional use, or utilization within any corporate environment, which is strictly excluded from Personal Local Use.
 
-4. Updates and Terms
-   - New releases may include critical patches, enhancements, or UI changes.
-   - Continued use of these services constitutes acceptance of updated terms.
-   - The author reserves the right to modify these license terms at any time.
+2. Intellectual Property and Ownership
 
-5. Warranty and Liability
-   - All services and assets are provided "as is" without any form of warranty.
-   - 87owo is not liable for any direct or indirect damages from software use.
-   - Users assume all risks regarding performance, data, and system integrity.
+   - 2.1. Retention of Rights: The Author reserves all legal rights, titles, and interests in and to the Software, including but not limited to all copyrights, trademarks, patents, and trade secrets.
+   - 2.2. No Transfer: No intellectual property rights or ownership stakes are transferred under this Agreement. All project components remain fully proprietary.
+   - 2.3. Activation Keys: Access to or execution of certain premium features, modules, or binary distributions within the Software may require a valid, authorized activation key issued solely by the Author.
+
+3. Grant of License and Permitted Use
+
+   Subject to your strict compliance with all terms of this Agreement, the Author hereby grants you a limited, non-exclusive, world-wide, royalty-free, revocable, and non-transferable license to:
+   - 3.1. Code Inspection: View and download the source code from official authorized repositories.
+   - 3.2. Local Modification: Modify the source code strictly for the purposes of Personal Local Use.
+   - 3.3. Local Execution: Execute the Software locally for personal evaluation and private deployment.
+
+4. Prohibitions and Restrictions
+
+   Except as explicitly granted in Section 3, you shall not, and shall not permit any third party to:
+   - 4.1. Unauthorized Redistribution: Copy, redistribute, sublicense, republish, mirror, or publicly disclose any original or modified versions of the source code, binaries, or assets.
+   - 4.2. Commercial and SaaS Deployment: Host, deploy, embed, or utilize the Software for commercial purposes, including but not limited to Software-as-a-Service (SaaS), commercial web hosting, paid remote execution, cloud infrastructure integration, or enterprise internal utility.
+   - 4.3. Reverse Engineering: Reverse engineer, decompile, decrypt, or disassemble any binary components of the Software, except and only to the extent that such restriction is explicitly prohibited by applicable mandatory laws.
+   - 4.4. Notice Preservation: Remove, obscure, deface, or alter any copyright notices, trademarks, hyperlinked terms, or license files included within the Software distribution.
+
+5. Prior Authorization and Application Channels
+
+   - 5.1. Authorization Requirement: Any activity exceeding the scope of Personal Local Use (including but not limited to public redistribution, independent forks not targeting upstream contributions, commercial deployment, or enterprise use) requires prior explicit written consent from the Author.
+   - 5.2. Official Application Channels: Users seeking such authorization must submit a formal request through one of the following official channels:
+      - Channel A (GitHub Fork): Initiating a standard Fork on the official GitHub repository for collaborative and upstream contributions.
+      - Channel B (GitHub Issues): Submitting a public issue utilizing the designated authorization request template.
+      - Channel C (Official Email): Sending a detailed inquiry to the official organizational email address associated with the PYAS Security project.
+   - 5.3. Request Content: Any application must explicitly state the specific use case, intended target audience, scope of deployment, and whether any commercial monetization is involved.
+
+6. Updates, Amendments, and Scope of Terms
+
+   - 6.1. New Releases: The Author may deliver updates, critical security patches, feature enhancements, or user interface modifications. Continued use of the Software constitutes acceptance of the latest distributed version.
+   - 6.2. Non-Retroactivity: The Author reserves the right to amend this License Agreement at any time. Amendments apply strictly to subsequent versions or new downloads. Copies lawfully acquired prior to such modification remain governed by the exact version of the License under which they were originally obtained.
+
+7. Telemetry, Data, and Privacy
+
+   - 7.1. Operational Data Collection: The Software may collect anonymized technical, operational, and usage data strictly for security analysis, performance optimization, and bug reporting.
+   - 7.2. Cloud Sample Submission: To enhance threat detection and malware analysis, the Software may automatically or manually transmit suspicious executable files and software samples to the Author's cloud infrastructure for deep analysis.
+   - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
+   - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
+   - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+   - 7.6. Driver Signature: Certain kernel-mode drivers distributed with this software may be digitally signed using code signing methods that are not certified by Microsoft Windows Hardware Quality Labs (WHQL). By installing or using this software, you acknowledge this and decide for yourself whether to install and trust such drivers on your system.
+
+8. Warranty Disclaimer and Limitation of Liability
+
+   - 8.1. Disclaimer of Warranty: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ALL RELATED ASSETS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+   - 8.2. Limitation of Liability: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. USERS ASSUME ALL RISKS REGARDING PERFORMANCE, DATA INTEGRITY, AND SYSTEM STABILITY.
 
 © 2020-2026 87owo (PYAS Security). All rights reserved.

PYAS_Engine.py

@@ -1,5 +1,6 @@
-import os, re, yara, time, math, json, zlib, numpy, base64, requests, datetime
-import ctypes, ctypes.wintypes, hashlib, pefile, threading, onnxruntime
+import os, re, yara, time, math, json, zlib, mmap, numpy
+import pefile, threading, onnxruntime, datetime, requests
+import ctypes, ctypes.wintypes
 
 ####################################################################################################
 
@@ -188,6 +189,9 @@ class rule_scanner:
 
 class pe_scanner:
     _STRING_PATTERN = re.compile(b'[\x20-\x7E]{5,}')
+    _STRING_FAST_PATH_BYTES = 4194304
+    _STRING_BATCH_BYTES = 4194304
+    _HISTOGRAM_BATCH_WINDOWS = 1024
 
     _BYTE_HIST_KEYS = [f'ByteHist_{i:02X}' for i in range(256)]
     _BYTE_ENT_KEYS = [f'ByteEnt_{i:02X}' for i in range(256)]
@@ -201,10 +205,57 @@ class pe_scanner:
     _C_LOG_C_TABLE = numpy.zeros(2049, dtype=numpy.float64)
     _C_LOG_C_TABLE[1:] = numpy.arange(1, 2049) * numpy.log2(numpy.arange(1, 2049))
 
+    _OPTIONAL_HEADER_FIELDS = [
+        'Magic', 'MajorLinkerVersion', 'MinorLinkerVersion', 'SizeOfCode',
+        'SizeOfInitializedData', 'SizeOfUninitializedData', 'AddressOfEntryPoint',
+        'BaseOfCode', 'ImageBase', 'SectionAlignment', 'FileAlignment',
+        'MajorOperatingSystemVersion', 'MinorOperatingSystemVersion',
+        'MajorImageVersion', 'MinorImageVersion', 'MajorSubsystemVersion',
+        'MinorSubsystemVersion', 'SizeOfImage', 'SizeOfHeaders', 'CheckSum',
+        'Subsystem', 'DllCharacteristics', 'SizeOfStackReserve', 'SizeOfStackCommit',
+        'SizeOfHeapReserve', 'SizeOfHeapCommit', 'LoaderFlags', 'NumberOfRvaAndSizes'
+    ]
+
+    _SECTION_DEFAULTS = {
+        'SectionCount': 0.0,
+        'SectionMaxEntropy': 0.0,
+        'SectionMinEntropy': 0.0,
+        'SectionMeanEntropy': 0.0,
+        'SectionMaxRawSize': 0.0,
+        'SectionMinRawSize': 0.0,
+        'SectionMeanRawSize': 0.0,
+        'SectionMaxVSize': 0.0,
+        'SectionMinVSize': 0.0,
+        'SectionMeanVSize': 0.0,
+        'ExecutableSections': 0.0,
+        'WritableSections': 0.0,
+        'ReadableSections': 0.0,
+        'SectionException': 0.0
+    }
+
+    _CONDITIONAL_DEFAULTS = {
+        'IsDriver': 0.0,
+        'HasTlsCallbacks': 0.0,
+        'IsDebug': 0.0,
+        'IsPreRelease': 0.0,
+        'IsPatched': 0.0,
+        'IsPrivateBuild': 0.0,
+        'IsSpecialBuild': 0.0,
+        'ImportCount': 0.0,
+        'ImportFunctionCount': 0.0,
+        'ExportCount': 0.0,
+        'IconCount': 0.0,
+        'DebugCount': 0.0
+    }
+
     def __init__(self):
         self.model = None
         self.input_name = None
         self.feature_order = []
+        self.dll_hash_dim = 512
+        self.api_hash_dim = 4096
+        self.dll_hash_pad = 3
+        self.api_hash_pad = 4
         self.signer = sign_scanner()
         self.signer.init_windll(["wintrust"])
 
@@ -232,19 +283,56 @@ class pe_scanner:
                 with open(feat_path, 'r', encoding='utf-8') as f:
                     self.feature_order = json.load(f)
 
+            self._parse_hash_dims()
         except Exception:
             pass
 
+    def _parse_hash_dims(self):
+        max_dll = -1
+        max_api = -1
+        
+        for feat in self.feature_order:
+            if feat.startswith("DllHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_dll = max(max_dll, int(val_str))
+                    self.dll_hash_pad = len(val_str)
+                except Exception:
+                    pass
+            elif feat.startswith("ApiHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_api = max(max_api, int(val_str))
+                    self.api_hash_pad = len(val_str)
+                except Exception:
+                    pass
+                    
+        if max_dll >= 0:
+            self.dll_hash_dim = max_dll + 1
+        if max_api >= 0:
+            self.api_hash_dim = max_api + 1
+
     def _safe_float(self, val):
         try:
             f = float(val)
             if math.isinf(f) or math.isnan(f): 
                 return 0.0
-            return f
 
+            return f
         except Exception:
             return 0.0
 
+    def _base_defaults(self):
+        base = dict.fromkeys(self._OPTIONAL_HEADER_FIELDS, 0.0)
+        base.update(self._SECTION_DEFAULTS)
+        base.update(self._CONDITIONAL_DEFAULTS)
+
+        for i in range(16):
+            base[f'DataDirectory_{i}_Size'] = 0.0
+            base[f'DataDirectory_{i}_VA'] = 0.0
+
+        return base
+
     def _calc_entropy(self, data):
         if not data: 
             return 0.0
@@ -260,80 +348,148 @@ class pe_scanner:
         res = {"StringCount": 0.0, "StringMeanLength": 0.0, "StringEntropy": 0.0}
         res.update(dict.fromkeys(self._STRING_KEYS, 0.0))
 
-        matches = self._STRING_PATTERN.findall(file_bytes)
-        if not matches:
-            return res
+        if len(file_bytes) <= self._STRING_FAST_PATH_BYTES:
+            matches = self._STRING_PATTERN.findall(file_bytes)
+            if not matches:
+                return res
 
-        combined_data = b''.join(matches)
-        count = len(matches)
-        total_len = len(combined_data)
+            combined_data = b''.join(matches)
+            count = len(matches)
+            total_len = len(combined_data)
+            global_counts = numpy.bincount(numpy.frombuffer(combined_data, dtype=numpy.uint8), minlength=256)
+        else:
+            count = 0
+            total_len = 0
+            global_counts = numpy.zeros(256, dtype=numpy.int64)
+            mv = memoryview(file_bytes)
+            pos = 0
+            size = len(file_bytes)
+
+            while pos < size:
+                chunk_end = min(pos + self._STRING_BATCH_BYTES, size)
+                chunk_arr = numpy.frombuffer(mv[pos:chunk_end], dtype=numpy.uint8)
+                separators = (chunk_arr < 0x20) | (chunk_arr > 0x7E)
+
+                if separators.any():
+                    last_separator = len(separators) - 1 - int(numpy.argmax(separators[::-1]))
+                    segment_end = pos + last_separator + 1
+                    matches = self._STRING_PATTERN.findall(mv[pos:segment_end])
+
+                    if matches:
+                        combined_data = b''.join(matches)
+                        count += len(matches)
+                        total_len += len(combined_data)
+                        global_counts += numpy.bincount(numpy.frombuffer(combined_data, dtype=numpy.uint8), minlength=256)
+
+                    pos = segment_end
+                    continue
+
+                pending_len = 0
+                pending_counts = numpy.zeros(256, dtype=numpy.int64)
+
+                while pos < size:
+                    chunk_end = min(pos + self._STRING_BATCH_BYTES, size)
+                    chunk_arr = numpy.frombuffer(mv[pos:chunk_end], dtype=numpy.uint8)
+                    separators = (chunk_arr < 0x20) | (chunk_arr > 0x7E)
+
+                    if separators.any():
+                        first_separator = int(numpy.argmax(separators))
+                        if first_separator:
+                            pending_counts += numpy.bincount(chunk_arr[:first_separator], minlength=256)
+                            pending_len += first_separator
+                        pos += first_separator + 1
+                        break
+
+                    pending_counts += numpy.bincount(chunk_arr, minlength=256)
+                    pending_len += len(chunk_arr)
+                    pos = chunk_end
+
+                if pending_len >= 5:
+                    count += 1
+                    total_len += pending_len
+                    global_counts += pending_counts
+
+            if count == 0 or total_len == 0:
+                return res
 
         res["StringCount"] = float(count)
         res["StringMeanLength"] = float(total_len) / count
-        res["StringEntropy"] = self._calc_entropy(combined_data)
 
-        arr = numpy.frombuffer(combined_data, dtype=numpy.uint8)
-        counts = numpy.bincount(arr, minlength=127)
-        char_counts = counts[0x20:0x7F]
+        counts_nonzero = global_counts[global_counts > 0]
+        if len(counts_nonzero) > 0:
+            res["StringEntropy"] = float(numpy.log2(total_len) - numpy.sum(counts_nonzero * numpy.log2(counts_nonzero)) / total_len)
+
+        valid_chars = global_counts[0x20:0x7F]
+        res.update(dict(zip(self._STRING_KEYS, valid_chars.astype(numpy.float64) / total_len)))
 
-        res.update(dict(zip(self._STRING_KEYS, char_counts.astype(numpy.float64) / total_len)))
         return res
 
+
+
     def _extract_histograms(self, file_bytes):
         arr = numpy.frombuffer(file_bytes, dtype=numpy.uint8)
         sz = len(arr)
         res = {}
 
         if sz == 0:
+            res['FileEntropy'] = 0.0
             res.update(dict.fromkeys(self._BYTE_HIST_KEYS, 0.0))
             res.update(dict.fromkeys(self._BYTE_ENT_KEYS, 0.0))
             return res
 
-        byte_counts = numpy.bincount(arr, minlength=256)
-        byte_hist = byte_counts.astype(numpy.float64) / sz
-        res.update(dict(zip(self._BYTE_HIST_KEYS, byte_hist)))
-
+        byte_counts = numpy.zeros(256, dtype=numpy.int64)
         ent_hist = numpy.zeros(256, dtype=numpy.float64)
         window = 2048
         step = 1024
 
         if sz < window:
-            w_counts = byte_counts
-            p = w_counts[w_counts > 0] / float(sz)
+            byte_counts += numpy.bincount(arr, minlength=256)
+            p = byte_counts[byte_counts > 0] / float(sz)
             entropy = float(-numpy.sum(p * numpy.log2(p)))
             ent_bin = min(int(entropy * 2.0), 15)
-            byte_bins = w_counts.reshape(16, 16).sum(axis=1)
+            byte_bins = byte_counts.reshape(16, 16).sum(axis=1)
             idx_start = ent_bin * 16
             ent_hist[idx_start : idx_start+16] += byte_bins
         else:
             num_windows = (sz - window) // step + 1
-            batch_windows = 10000 
-            
-            for w_start in range(0, num_windows, batch_windows):
-                w_end = min(w_start + batch_windows, num_windows)
+
+            for w_start in range(0, num_windows, self._HISTOGRAM_BATCH_WINDOWS):
+                w_end = min(w_start + self._HISTOGRAM_BATCH_WINDOWS, num_windows)
                 b_num = w_end - w_start
-                
+
                 start_byte = w_start * step
                 end_byte = start_byte + b_num * step + step
-                b_arr = arr[start_byte:end_byte]
-                
-                arr_2d = b_arr.reshape(b_num + 1, step)
-                offsets = (numpy.arange(b_num + 1, dtype=numpy.int32)[:, None] * 256)
-                flat_idx = (arr_2d.astype(numpy.int32) + offsets).ravel()
-                
-                chunk_counts = numpy.bincount(flat_idx, minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                encoded = arr[start_byte:end_byte].astype(numpy.int32).reshape(b_num + 1, step)
+                encoded += numpy.arange(b_num + 1, dtype=numpy.int32)[:, None] * 256
+
+                chunk_counts = numpy.bincount(encoded.ravel(), minlength=(b_num + 1) * 256).reshape(b_num + 1, 256)
+                del encoded
+
+                byte_counts += numpy.sum(chunk_counts[:-1], axis=0)
+                if w_end == num_windows:
+                    byte_counts += chunk_counts[-1]
+
                 window_counts = chunk_counts[:-1] + chunk_counts[1:]
-                
                 sum_c_log_c = numpy.sum(self._C_LOG_C_TABLE[window_counts], axis=1)
                 entropies = 11.0 - sum_c_log_c / 2048.0
-                
+
                 ent_bins = (entropies * 2.0).astype(numpy.int32)
                 numpy.clip(ent_bins, 0, 15, out=ent_bins)
-                
+
                 byte_bins = window_counts.reshape(b_num, 16, 16).sum(axis=2)
                 flat_ent_bins = (ent_bins[:, None] * 16 + numpy.arange(16)).ravel()
                 numpy.add.at(ent_hist, flat_ent_bins, byte_bins.ravel())
 
+            covered_size = (num_windows + 1) * step
+            if covered_size < sz:
+                byte_counts += numpy.bincount(arr[covered_size:], minlength=256)
+
+        counts_nonzero = byte_counts[byte_counts > 0]
+        res['FileEntropy'] = float(numpy.log2(sz) - numpy.sum(counts_nonzero * numpy.log2(counts_nonzero)) / sz)
+
+        byte_hist = byte_counts.astype(numpy.float64) / sz
+        res.update(dict(zip(self._BYTE_HIST_KEYS, byte_hist)))
+
         ent_sum = numpy.sum(ent_hist)
         if ent_sum > 0:
             ent_hist /= ent_sum
@@ -341,6 +497,7 @@ class pe_scanner:
         res.update(dict(zip(self._BYTE_ENT_KEYS, ent_hist)))
         return res
 
+
     def _extract_overlay_features(self, pe, fsize):
         overlay_offset = pe.get_overlay_data_start_offset()
         if not overlay_offset or overlay_offset >= fsize:
@@ -445,6 +602,7 @@ class pe_scanner:
 
             if getattr(struct, 'GuardCFFunctionTable', 0) != 0:
                 cfg["HasCFG"] = 1.0
+
             if getattr(struct, 'SEHandlerTable', 0) != 0:
                 cfg["HasSEHTable"] = 1.0
 
@@ -479,7 +637,6 @@ class pe_scanner:
             dw_length = int.from_bytes(file_bytes[curr:curr+4], 'little')
             if dw_length < 8:
                 break
-
             count += 1
             curr += (dw_length + 7) & ~7
 
@@ -488,18 +645,21 @@ class pe_scanner:
 
     def extract_features(self, file_path):
         pe = None
+        mm = None
+        f = None
+
         try:
             fsize = os.path.getsize(file_path)
             if fsize == 0 or fsize > 536870912:
                 return None
 
-            with open(file_path, "rb") as f:
-                file_bytes = f.read()
+            f = open(file_path, "rb")
+            mm = mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ)
 
-            base = {}
+            base = self._base_defaults()
             dlls = set()
             apis = set()
-            pe = pefile.PE(data=file_bytes, fast_load=True)
+            pe = pefile.PE(data=mm, fast_load=True)
             
             try:
                 pe.parse_rich_header()
@@ -515,7 +675,6 @@ class pe_scanner:
                 pass
             
             base['TrustSigned'] = 1.0 if self.signer.sign_verify(file_path) else 0.0
-            base['FileEntropy'] = self._calc_entropy(file_bytes)
             base['FileSize'] = float(fsize)
             
             fh = pe.FILE_HEADER
@@ -580,6 +739,7 @@ class pe_scanner:
                     try:
                         s_data = section.get_data()
                         s_entropy = self._calc_entropy(s_data)
+
                     except Exception:
                         s_entropy = 0.0
 
@@ -631,9 +791,9 @@ class pe_scanner:
             if hasattr(pe, 'FileInfo'):
                 for fileinfo_list in pe.FileInfo:
                     for fileinfo in fileinfo_list:
+
                         if getattr(fileinfo, 'name', '') in ('StringFileInfo', b'StringFileInfo'):
                             for st in getattr(fileinfo, 'StringTable', []):
-
                                 for key, val in st.entries.items():
                                     try:
                                         k = key.decode('utf-8', 'ignore') if isinstance(key, bytes) else str(key)
@@ -690,6 +850,7 @@ class pe_scanner:
                 for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
                     if getattr(entry, 'id', None) == 3 and hasattr(entry, 'directory'):
                         icon_count += len(getattr(entry.directory, 'entries', []))
+
                 base['IconCount'] = float(icon_count)
             else:
                 base['IconCount'] = 0.0
@@ -699,14 +860,14 @@ class pe_scanner:
             else:
                 base['DebugCount'] = 0.0
 
-            base.update(self._extract_strings(file_bytes))
-            base.update(self._extract_histograms(file_bytes))
+            base.update(self._extract_strings(mm))
+            base.update(self._extract_histograms(mm))
             base.update(self._extract_overlay_features(pe, fsize))
             base.update(self._extract_rich_header(pe))
             base.update(self._extract_ep_anomalies(pe))
             base.update(self._extract_advanced_resources(pe))
             base.update(self._extract_load_config(pe))
-            base.update(self._extract_security_directory(pe, file_bytes, fsize))
+            base.update(self._extract_security_directory(pe, mm, fsize))
 
             for k in base:
                 base[k] = self._safe_float(base[k])
@@ -718,10 +879,15 @@ class pe_scanner:
         finally:
             if pe:
                 pe.close()
+            if mm:
+                mm.close()
+            if f:
+                f.close()
 
     def pe_scan(self, file_path, enhanced_mode=False):
         if not self.model or not self.feature_order:
             return False, False
+
         try:
             raw_data = self.extract_features(file_path)
             if not raw_data:
@@ -742,8 +908,8 @@ class pe_scanner:
                 if old_fn in feat_map: 
                     vec[0, feat_map[old_fn]] = 1.0
 
-                h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
-                new_fn = f"DllHash_{h:03d}"
+                h = zlib.crc32(d.encode('utf-8', 'ignore')) % self.dll_hash_dim
+                new_fn = f"DllHash_{h:0{self.dll_hash_pad}d}"
                 if new_fn in feat_map: 
                     vec[0, feat_map[new_fn]] += 1.0
 
@@ -752,12 +918,14 @@ class pe_scanner:
                 if old_fn in feat_map: 
                     vec[0, feat_map[old_fn]] = 1.0
 
-                h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
-                new_fn = f"ApiHash_{h:04d}"
+                h = zlib.crc32(a.encode('utf-8', 'ignore')) % self.api_hash_dim
+                new_fn = f"ApiHash_{h:0{self.api_hash_pad}d}"
                 if new_fn in feat_map: 
                     vec[0, feat_map[new_fn]] += 1.0
 
             outputs = self.model.run(None, {self.input_name: vec})
+            
+            del raw_data, vec
             result = outputs[1]
             prob = 0.0
 
@@ -771,7 +939,6 @@ class pe_scanner:
                     prob = float(result[0][1])
 
             score = int(prob * 100)
-            
             if score >= 80:
                 return f"General:WinPE/Malware.{score}!ml", score
             elif enhanced_mode and score >= 50:

PYAS_Inno.iss

@@ -1,6 +1,6 @@
 #define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
 #define AppName "PYAS"
-#define AppVersion "3.5.9.0"
+#define AppVersion "3.6.5.0"
 #define AppPublisher "PYAS Security"
 #define AppURL "https://github.com/87owo/PYAS"
 #define AppExeName "PYAS.exe"
@@ -55,13 +55,15 @@ Name: "slovenian"; MessagesFile: "SetupResources\Slovenian.isl"
 [Tasks]
 Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"
 Name: "autostart"; Description: "{cm:AutoStartTask}"; GroupDescription: "{cm:AdditionalIcons}"
-Name: "install_webview2"; Description: "{cm:InstallWebView2}"; GroupDescription: "{cm:Dependencies}"
-Name: "install_vcredist"; Description: "{cm:InstallVCRedist}"; GroupDescription: "{cm:Dependencies}"
 
 [Files]
-Source: "Payload\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "Redist\VC_redist.x64.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
-Source: "Redist\MicrosoftEdgeWebview2Setup.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
+Source: "Redist\VC_redist.x64.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion; AfterInstall: EnsureVCRedist
+Source: "Redist\MicrosoftEdgeWebview2Setup.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion; AfterInstall: EnsureWebView2
+Source: "Payload\Engine\*"; DestDir: "{app}\Engine"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Payload\Interface\*"; DestDir: "{app}\Interface"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Payload\License\*"; DestDir: "{app}\License"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Payload\PYAS.exe"; DestDir: "{app}"; Flags: ignoreversion; AfterInstall: FinalizeDriverRemoval
+Source: "Payload\Plugins\*"; DestDir: "{app}\Plugins"; Flags: ignoreversion recursesubdirs createallsubdirs
 
 [Registry]
 Root: HKCU; Subkey: "Software\Classes\*\shell\PYAS_Scan"; Flags: uninsdeletekey dontcreatekey
@@ -76,9 +78,7 @@ Name: "{group}\{#AppName}"; Filename: "{app}\{#AppExeName}"
 Name: "{group}\Uninstall {#AppName}"; Filename: "{uninstallexe}"
 
 [Run]
-Filename: "{tmp}\PYAS_Redist\VC_redist.x64.exe"; Parameters: "/quiet /norestart"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingVCRuntime}"; Tasks: install_vcredist
-Filename: "{tmp}\PYAS_Redist\MicrosoftEdgeWebview2Setup.exe"; Parameters: "/silent /install"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingWebView2Runtime}"; Tasks: install_webview2
-Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#StringChange(AppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent runascurrentuser
+Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#StringChange(AppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent runascurrentuser; Check: CanLaunchApp
 
 [CustomMessages]
 english.InstallingVCRuntime=Installing Microsoft Visual C++ Runtime...
@@ -100,97 +100,183 @@ english.InstallVCRedist=Install Microsoft Visual C++ Runtime
 chinesesimplified.InstallVCRedist=安装 Microsoft Visual C++ 运行库
 chinesetraditional.InstallVCRedist=安裝 Microsoft Visual C++ 執行庫
 english.LegacyVersionDetected=An older version of PYAS was detected. Please uninstall it manually before installing.
+english.QuitFailed=PYAS or its driver could not be stopped safely. Restart Windows and run Setup again.
+english.DependencyInstallFailed=Required Microsoft runtime installation failed. Setup cannot continue.
 chinesesimplified.LegacyVersionDetected=检测到存在旧版 PYAS。请先手动卸载旧版后，再运行本安装程序。
 chinesetraditional.LegacyVersionDetected=檢測到存在舊版 PYAS。請先手動卸載舊版後，再執行本安裝程式。
 
-[Code]
-var
-  TasksInitialized: Boolean;
-
-function IsWebView2Installed: Boolean;
-var
-  RegKeyPath: string;
-  Version: string;
-begin
-  RegKeyPath := 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';
-  Result := False;
-  if RegQueryStringValue(HKLM, 'SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
-    if Length(Version) > 0 then Result := True;
-  if not Result and RegQueryStringValue(HKCU, RegKeyPath, 'pv', Version) then
-    if Length(Version) > 0 then Result := True;
-  if not Result and RegQueryStringValue(HKLM, RegKeyPath, 'pv', Version) then
-    if Length(Version) > 0 then Result := True;
-end;
-
-function IsVCRedistInstalled: Boolean;
-var
-  Bld: Cardinal;
-begin
-  Result := False;
-  if RegQueryDWordValue(HKLM, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Bld', Bld) then
-    if Bld > 0 then Result := True;
-end;
-
-procedure CurPageChanged(CurPageID: Integer);
-var
-  I: Integer;
-  ItemText: string;
-begin
-  if (CurPageID = wpSelectTasks) and not TasksInitialized then
-  begin
-    TasksInitialized := True;
-    for I := 0 to WizardForm.TasksList.Items.Count - 1 do
-    begin
-      ItemText := WizardForm.TasksList.Items[I];
-      if Pos('Visual C++', ItemText) > 0 then
-        WizardForm.TasksList.Checked[I] := not IsVCRedistInstalled
-      else if Pos('WebView2', ItemText) > 0 then
-        WizardForm.TasksList.Checked[I] := not IsWebView2Installed;
-    end;
-  end;
-end;
-
-procedure QuitOldInstance(InstallPath: string);
-var
-  ResultCode: Integer;
-  ExePath: string;
-begin
-  ExePath := InstallPath + '\{#AppExeName}';
-  if FileExists(ExePath) then
-  begin
-    Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-    Sleep(500);
-    Exec(ExpandConstant('{sys}\taskkill.exe'), '/F /IM {#AppExeName} /T', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-  end;
-end;
-
-function InitializeSetup(): Boolean;
-var
-  OldInstallPath: string;
-  LegacyPath: string;
-begin
-  LegacyPath := ExpandConstant('{pf32}\{#AppName}');
-  if DirExists(LegacyPath) and FileExists(LegacyPath + '\{#AppExeName}') then
-  begin
-    MsgBox(CustomMessage('LegacyVersionDetected'), mbCriticalError, MB_OK);
-    Result := False;
-    Exit;
-  end;
-  if RegQueryStringValue(HKLM, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) or
-     RegQueryStringValue(HKCU, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) then
-  begin
-    QuitOldInstance(OldInstallPath);
-  end;
-  
-  Result := True;
-end;
-
-function InitializeUninstall(): Boolean;
-begin
-  QuitOldInstance(ExpandConstant('{app}'));
-  Result := True;
-end;
-
+[Code]
+var
+  DependencyRestartRequired: Boolean;
+  DependenciesReady: Boolean;
+
+function FindWindow(lpClassName: LongWord; lpWindowName: string): HWND;
+  external '[email protected] stdcall';
+
+function GetTickCount: Cardinal;
+  external '[email protected] stdcall';
+
+function IsValidRuntimeVersion(Version: string): Boolean;
+begin
+  Result := (Length(Trim(Version)) > 0) and (Trim(Version) <> '0.0.0.0');
+end;
+
+function IsWebView2Installed: Boolean;
+var
+  Version: string;
+begin
+  Result := False;
+  if RegQueryStringValue(HKLM, 'SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    Result := IsValidRuntimeVersion(Version);
+  if not Result and RegQueryStringValue(HKLM, 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    Result := IsValidRuntimeVersion(Version);
+  if not Result and RegQueryStringValue(HKCU, 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    Result := IsValidRuntimeVersion(Version);
+end;
+
+function IsVCRedistInstalled: Boolean;
+var
+  Installed: Cardinal;
+  Version: string;
+begin
+  Result := False;
+  if RegQueryDWordValue(HKLM64, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Installed', Installed) and (Installed = 1) then
+  begin
+    if RegQueryStringValue(HKLM64, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Version', Version) then
+      Result := IsValidRuntimeVersion(Version)
+    else
+      Result := True;
+  end;
+end;
+
+function DependencyExitCodeSucceeded(ResultCode: Integer): Boolean;
+begin
+  Result := (ResultCode = 0) or (ResultCode = 1641) or (ResultCode = 3010);
+  if (ResultCode = 1641) or (ResultCode = 3010) then
+    DependencyRestartRequired := True;
+end;
+
+procedure EnsureVCRedist;
+var
+  ResultCode: Integer;
+  InstallerPath: string;
+begin
+  if IsVCRedistInstalled then Exit;
+  InstallerPath := ExpandConstant('{tmp}\PYAS_Redist\VC_redist.x64.exe');
+  WizardForm.StatusLabel.Caption := CustomMessage('InstallingVCRuntime');
+  if not Exec(InstallerPath, '/quiet /norestart', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) or
+     not DependencyExitCodeSucceeded(ResultCode) or not IsVCRedistInstalled then
+  begin
+    DependenciesReady := False;
+    RaiseException(CustomMessage('DependencyInstallFailed'));
+  end;
+end;
+
+procedure EnsureWebView2;
+var
+  ResultCode: Integer;
+  InstallerPath: string;
+begin
+  if IsWebView2Installed then Exit;
+  InstallerPath := ExpandConstant('{tmp}\PYAS_Redist\MicrosoftEdgeWebview2Setup.exe');
+  WizardForm.StatusLabel.Caption := CustomMessage('InstallingWebView2Runtime');
+  if not Exec(InstallerPath, '/silent /install', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) or
+     not DependencyExitCodeSucceeded(ResultCode) or not IsWebView2Installed then
+  begin
+    DependenciesReady := False;
+    RaiseException(CustomMessage('DependencyInstallFailed'));
+  end;
+end;
+
+function WaitForMainWindowToClose(TimeoutMs: Cardinal): Boolean;
+var
+  Deadline: Cardinal;
+begin
+  Deadline := GetTickCount + TimeoutMs;
+  repeat
+    if FindWindow(0, 'PYAS Security') = 0 then
+    begin
+      Result := True;
+      Exit;
+    end;
+    Sleep(100);
+  until GetTickCount >= Deadline;
+  Result := False;
+end;
+
+function QuitOldInstance(InstallPath: string): Boolean;
+var
+  ResultCode: Integer;
+  ExePath: string;
+begin
+  Result := True;
+  ExePath := InstallPath + '\{#AppExeName}';
+  if not FileExists(ExePath) then Exit;
+
+  if not Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) then
+  begin
+    Result := False;
+    Exit;
+  end;
+
+  Result := (ResultCode = 0) and WaitForMainWindowToClose(30000);
+end;
+
+procedure FinalizeDriverRemoval;
+var
+  ResultCode: Integer;
+  ExePath: string;
+begin
+  ExePath := ExpandConstant('{app}\{#AppExeName}');
+  if not Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) or (ResultCode <> 0) then
+    RaiseException(CustomMessage('QuitFailed'));
+end;
+
+function InitializeSetup(): Boolean;
+var
+  OldInstallPath: string;
+  LegacyPath: string;
+begin
+  DependencyRestartRequired := False;
+  DependenciesReady := True;
+  LegacyPath := ExpandConstant('{pf32}\{#AppName}');
+  if DirExists(LegacyPath) and FileExists(LegacyPath + '\{#AppExeName}') then
+  begin
+    MsgBox(CustomMessage('LegacyVersionDetected'), mbCriticalError, MB_OK);
+    Result := False;
+    Exit;
+  end;
+
+  if RegQueryStringValue(HKLM, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) or
+     RegQueryStringValue(HKCU, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) then
+  begin
+    if not QuitOldInstance(OldInstallPath) then
+    begin
+      MsgBox(CustomMessage('QuitFailed'), mbCriticalError, MB_OK);
+      Result := False;
+      Exit;
+    end;
+  end;
+
+  Result := True;
+end;
+
+function InitializeUninstall(): Boolean;
+begin
+  Result := QuitOldInstance(ExpandConstant('{app}'));
+  if not Result then
+    MsgBox(CustomMessage('QuitFailed'), mbCriticalError, MB_OK);
+end;
+
+function CanLaunchApp: Boolean;
+begin
+  Result := DependenciesReady and not DependencyRestartRequired;
+end;
+
+function NeedRestart: Boolean;
+begin
+  Result := DependencyRestartRequired;
+end;
 procedure TryCreateStartupTask;
 var
   ResultCode: Integer;

PYAS_Scanner.py

@@ -0,0 +1,640 @@
+import os, gc, json, time, stat, threading
+import ctypes, ctypes.wintypes
+
+from PYAS_Tools import MEMORY_BASIC_INFORMATION
+
+####################################################################################################
+
+class ScannerMixin:
+    def init_engine_thread(self):
+        try:
+            self.start_daemon_thread(self.backup_mbr)
+            self.start_daemon_thread(self.relock_file)
+            self.start_daemon_thread(self.init_whitelist)
+            self.start_daemon_thread(self.popup_intercept_thread)
+
+            def log_callback(x):
+                self.write_log("INFO", "Load Engine", source=os.path.basename(x))
+
+            self.heuristic.load_path(self.path_heuristic, callback=log_callback)
+            self.properties.load_path(self.path_properties, callback=log_callback)
+            self.write_log("INFO", "System", detail="Engine Initialization Complete")
+
+            if "-scan" in self.args_pyas:
+                try:
+                    idx = self.args_pyas.index("-scan")
+                    self.trigger_context_scan(self.args_pyas[idx+1])
+                except Exception:
+                    pass
+
+            with self.lock_config:
+                first_launch = self.pyas_config.get("first_launch", True)
+                driver_enabled = self.pyas_config.get("driver_switch", False)
+                context_enabled = self.pyas_config.get("context_switch", True)
+                autostart_enabled = self.pyas_config.get("autostart_switch", True)
+
+            self.register_context_menu(context_enabled)
+            self.manage_autostart(autostart_enabled)
+
+            if not first_launch:
+                with self.lock_config:
+                    if self.pyas_config.get("process_switch"):
+                        self.start_daemon_thread(self.protect_proc_thread)
+                    if self.pyas_config.get("document_switch"):
+                        self.start_daemon_thread(self.protect_file_thread)
+                    if self.pyas_config.get("system_switch"):
+                        self.start_daemon_thread(self.protect_system_thread)
+                    if self.pyas_config.get("network_switch"):
+                        self.start_daemon_thread(self.protect_net_thread)
+
+                if driver_enabled:
+                    if self.install_system_driver() and self.start_driver_listener(wait_ready=True):
+                        pass
+                    else:
+                        self.stop_system_driver()
+                        with self.lock_config:
+                            self.pyas_config["driver_switch"] = False
+                            self.save_config()
+
+                        self.write_log("WARN", "System", detail="Driver Protection Failed to Start", success=False)
+
+        except Exception as e:
+            self.write_log("WARN", "init_engine_thread", detail=str(e), success=False)
+
+####################################################################################################
+
+    def yield_files(self, targets):
+        if isinstance(targets, str):
+            if os.path.isdir(targets):
+                for root, dirs, files in os.walk(targets):
+                    dirs[:] = [d for d in dirs if not self._is_reparse_point(os.path.join(root, d))]
+                    for f in files:
+                        yield self.norm_path(os.path.join(root, f)), False
+
+            elif os.path.isfile(targets):
+                yield self.norm_path(targets), True
+
+        elif isinstance(targets, (list, tuple, set)):
+            for t in targets:
+                yield from self.yield_files(t)
+
+    def _is_reparse_point(self, path):
+        try:
+            if os.path.islink(path):
+                return True
+            if hasattr(os.path, 'isjunction') and os.path.isjunction(path):
+                return True
+
+            st = os.lstat(path)
+            return bool(getattr(st, 'st_file_attributes', 0) & 0x400)
+        except OSError:
+            return False
+
+####################################################################################################
+
+    def scan_engine(self, file_path):
+        with self.lock_config:
+            ext_switch = self.pyas_config.get("extension_switch", False)
+            sen_switch = self.pyas_config.get("sensitive_switch", False)
+
+        try:
+            pe_label, _ = self.properties.pe_scan(file_path, enhanced_mode=sen_switch)
+            if pe_label:
+                return pe_label
+        except Exception:
+            pass
+
+        try:
+            if ext_switch:
+                yara_label, _ = self.heuristic.yara_scan(file_path)
+                if yara_label:
+                    return yara_label
+        except Exception:
+            pass
+
+        return False
+
+    def safe_scan_engine(self, file_path):
+        norm_path = self.norm_path(file_path)
+        if not norm_path:
+            return False
+
+        file_hash = self.calc_file_hash(norm_path)
+        cache_key = file_hash if file_hash else os.path.normcase(norm_path)
+
+        with self.lock_file_ops:
+            if cache_key in self.hash_cache:
+                return self.hash_cache[cache_key]
+
+            if cache_key in self.scan_events:
+                event = self.scan_events[cache_key]
+                needs_scan = False
+            else:
+                event = threading.Event()
+                self.scan_events[cache_key] = event
+                needs_scan = True
+
+        if not needs_scan:
+            event.wait(timeout=60)
+            with self.lock_file_ops:
+                return self.hash_cache.get(cache_key, False)
+
+        try:
+            result = self.scan_engine(norm_path)
+            with self.lock_file_ops:
+                if len(self.hash_cache) > 10000:
+                    for k in list(self.hash_cache.keys())[:1000]:
+                        del self.hash_cache[k]
+
+                self.hash_cache[cache_key] = result
+            return result
+
+        finally:
+            with self.lock_file_ops:
+                if cache_key in self.scan_events:
+                    self.scan_events[cache_key].set()
+                    del self.scan_events[cache_key]
+
+            gc.collect()
+
+####################################################################################################
+
+    def _scan_result_messages(self, count=None, scanned=None, elapsed=None):
+        if count is None or scanned is None or elapsed is None:
+            with self.lock_virus:
+                count = len(getattr(self, 'virus_results', [])) if count is None else count
+                scanned = getattr(self, 'scan_count', 0) if scanned is None else scanned
+                scan_start = getattr(self, 'scan_start', time.time())
+                elapsed = int(time.time() - scan_start) if elapsed is None else elapsed
+
+        return {
+            "traditional_switch": f"發現 {count} 個病毒，掃描 {scanned} 個檔案，耗時 {elapsed} 秒",
+            "simplified_switch": f"发现 {count} 个病毒，扫描 {scanned} 个文件，耗时 {elapsed} 秒",
+            "english_switch": f"Found {count} viruses, scanned {scanned} files, time {elapsed}s",
+            "japanese_switch": f"{count} 個のウイルスを発見し、{scanned} 個のファイルをスキャンしました（所要時間 {elapsed} 秒）",
+            "korean_switch": f"바이러스 {count}개 발견, 파일 {scanned}개 검사, 소요 시간 {elapsed}초",
+            "french_switch": f"{count} virus trouvés, {scanned} fichiers analysés, temps {elapsed}s",
+            "spanish_switch": f"Se encontraron {count} virus, {scanned} archivos escaneados, tiempo {elapsed}s",
+            "hindi_switch": f"{count} वायरस मिले, {scanned} फ़ाइलें स्कैन की गईं, समय {elapsed}s",
+            "arabic_switch": f"تم العثور على {count} فيروسات، تم فحص {scanned} ملفات، الوقت {elapsed} ثانية",
+            "russian_switch": f"Найдено {count} вирусов, проверено {scanned} файлов, время {elapsed}с",
+            "slovenian_switch": f"Najdenih {count} virusov, skeniranih {scanned} datotek, čas {elapsed}s"
+        }
+
+    def _is_scan_cancel_requested(self):
+        with self.lock_virus:
+            return getattr(self, 'scan_stop_requested', False)
+
+    def _finish_scan_cancelled(self, messages=None):
+        with self.lock_virus:
+            count = len(getattr(self, 'virus_results', []))
+            scanned = getattr(self, 'scan_count', 0)
+            scan_start = getattr(self, 'scan_start', time.time())
+            elapsed = int(time.time() - scan_start)
+            self.scan_running = False
+            self.scan_preparing = False
+            self.scan_finished = True
+            self.scan_stop_requested = False
+
+        messages = messages or self._scan_result_messages(count, scanned, elapsed)
+
+        if self._window:
+            js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
+            self.ui_queue.put(js_cmd)
+
+        return False
+
+    def _begin_scan_preparation(self):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False) or getattr(self, 'scan_preparing', False):
+                return False
+
+            self.scan_preparing = True
+            self.scan_stop_requested = False
+            self.scan_finished = False
+            self.virus_results = []
+            self.scan_count = 0
+            self.scan_start = time.time()
+            return True
+
+    def start_scan(self, targets, from_preparing=False):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False) or (getattr(self, 'scan_preparing', False) and not from_preparing):
+                return False
+
+            if getattr(self, 'scan_stop_requested', False):
+                self.scan_running = False
+                self.scan_preparing = False
+                self.scan_finished = True
+                return False
+
+            self.scan_preparing = False
+            self.scan_running = True
+            self.scan_finished = False
+            self.scan_stop_requested = False
+            self.virus_results = []
+            self.scan_count = 0
+            self.scan_start = time.time()
+
+        self.scan_pool.submit(self.scan_worker, targets)
+        return True
+
+    def scan_worker(self, targets):
+        last_update = 0.0
+        try:
+            for file_path, is_explicit in self.yield_files(targets):
+                with self.lock_virus:
+                    if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                        break
+
+                norm_path = self.norm_path(file_path)
+                if not norm_path:
+                    continue
+
+                current_time = time.time()
+                if current_time - last_update >= 0.05:
+                    if self._window:
+                        js_cmd = f"if(window.updateScanProgress) window.updateScanProgress({json.dumps(norm_path.replace(os.sep, '/'))});"
+                        self.ui_queue.put(js_cmd)
+
+                    last_update = current_time
+
+                was_locked = False
+                try:
+                    with self.lock_file_ops:
+                        if norm_path in self.virus_lock:
+                            self.lock_file(norm_path, False)
+                            was_locked = True
+
+                    if self.is_in_whitelist(norm_path):
+                        continue
+
+                    with self.lock_virus:
+                        if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                            break
+                        self.scan_count += 1
+
+                    with self.lock_config:
+                        ext_filter = self.pyas_config.get("suffix_switch", True)
+                        suffix = self.pyas_config.get("suffix", [])
+
+                    if not is_explicit and ext_filter and os.path.splitext(norm_path)[-1].lower() not in suffix:
+                        continue
+
+                    result = self.safe_scan_engine(norm_path)
+                    with self.lock_virus:
+                        if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                            break
+
+                    if result:
+                        with self.lock_virus:
+                            self.virus_results.append(norm_path)
+
+                        if self._window: 
+                            js_cmd = f"if(window.addVirusResult) window.addVirusResult({json.dumps(result)}, {json.dumps(norm_path.replace(os.sep, '/'))});"
+                            self.ui_queue.put(js_cmd)
+
+                        self.write_log("SCAN", "Virus Detected", source=norm_path, file_hash=self.calc_file_hash(norm_path))
+
+                    self.cloud_check(norm_path)
+                except Exception as e:
+                    self.write_log("WARN", "Scan Engine", source=norm_path, detail=str(e), success=False)
+
+                finally:
+                    if was_locked:
+                        self.lock_file(norm_path, True)
+
+        finally:
+            with self.lock_virus:
+                cancelled = getattr(self, 'scan_stop_requested', False)
+                self.scan_running = False
+                self.scan_preparing = False
+                self.scan_finished = True
+                self.scan_stop_requested = False
+                count, scanned, elapsed = len(self.virus_results), self.scan_count, int(time.time() - self.scan_start)
+
+            messages = self._scan_result_messages(count, scanned, elapsed)
+            log_detail = f"Found {count} viruses, scanned {scanned} files, time {elapsed}s"
+
+            if self._window:
+                js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
+                self.ui_queue.put(js_cmd)
+
+            self.write_log("INFO", "Scan Completed", detail=log_detail)
+
+####################################################################################################
+
+    def stop_scan(self):
+        with self.lock_virus:
+            active = getattr(self, 'scan_running', False) or getattr(self, 'scan_preparing', False)
+            if active:
+                self.scan_stop_requested = True
+                self.scan_running = False
+            return active
+
+    def trigger_scan(self, method):
+        targets = []
+
+        if not self._begin_scan_preparation():
+            return False
+
+        try:
+            if method == "smart":
+                for folder in ["Desktop", "Downloads", "AppData"]:
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
+
+                    fp = os.path.join(self.path_user, folder)
+                    if os.path.exists(fp):
+                        targets.append(fp)
+
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if os.path.exists(self.path_config):
+                    targets.append(self.path_config)
+
+                buf = ctypes.create_unicode_buffer(1024)
+                max_address = 0x7FFFFFFFFFFF if ctypes.sizeof(ctypes.c_void_p) == 8 else 0x7FFFFFFF
+                system_dir = self.path_system.lower()
+
+                for proc in self.get_process_list():
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
+
+                    if proc["path"] and proc["path"] != "None": 
+                        targets.append(proc["path"])
+
+                    pid = proc["pid"]
+                    if pid <= 4:
+                        continue
+
+                    h_process = self.kernel32.OpenProcess(0x1000, False, pid)
+                    if h_process:
+                        try:
+                            address = 0
+                            mbi = MEMORY_BASIC_INFORMATION()
+                            while address < max_address and not self._is_scan_cancel_requested() and self.kernel32.VirtualQueryEx(h_process, ctypes.c_void_p(address), ctypes.byref(mbi), ctypes.sizeof(mbi)):
+                                if mbi.State == 0x1000 and mbi.Type == 0x1000000:
+                                    if self.psapi.GetMappedFileNameW(h_process, ctypes.c_void_p(address), buf, 1024):
+                                        raw_path = buf.value
+                                        if raw_path.startswith("\\"):
+                                            raw_path = self.device_path_to_drive(raw_path)
+
+                                        file_path = self.norm_path(raw_path)
+                                        if file_path and not file_path.lower().startswith(system_dir):
+                                            targets.append(file_path)
+
+                                if mbi.RegionSize == 0:
+                                    break
+                                address += mbi.RegionSize
+                        finally:
+                            self.kernel32.CloseHandle(h_process)
+
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
+
+                if not self.start_scan(list(set(targets)), from_preparing=True):
+                    return self._finish_scan_cancelled()
+
+                return True
+
+            elif method == "file":
+                targets = self.select_files()
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if targets:
+                    if not self.start_scan(targets, from_preparing=True):
+                        return self._finish_scan_cancelled()
+                    return True
+
+                return self._finish_scan_cancelled()
+
+            elif method == "path":
+                targets = self.select_folder()
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if targets:
+                    if not self.start_scan(targets, from_preparing=True):
+                        return self._finish_scan_cancelled()
+                    return True
+
+                return self._finish_scan_cancelled()
+
+            elif method == "full":
+                targets = [f"{chr(d)}:/" for d in range(65, 91) if os.path.exists(f"{chr(d)}:/")]
+                if self._is_scan_cancel_requested() or not self.start_scan(targets, from_preparing=True):
+                    return self._finish_scan_cancelled()
+                return True
+
+            return self._finish_scan_cancelled()
+
+        except Exception as e:
+            self.write_log("WARN", "trigger_scan", detail=str(e), success=False)
+            return self._finish_scan_cancelled()
+
+####################################################################################################
+
+    def _queue_virus_delete(self, file_path):
+        self._schedule_file_task("delete", file_path, self._retry_virus_delete, 0.5)
+
+    def _retry_virus_delete(self, file_path):
+        file_hash = self.calc_file_hash(file_path)
+        try:
+            with self.lock_file_ops:
+                if file_path in self.virus_lock:
+                    self.lock_file(file_path, False)
+
+            target_key = os.path.normcase(self.norm_path(file_path, must_exist=False) or file_path)
+            for proc in self.get_process_list():
+                proc_path = proc.get("path")
+                if not proc_path or proc_path == "None":
+                    continue
+                proc_key = os.path.normcase(self.norm_path(proc_path, must_exist=False) or proc_path)
+                if proc_key == target_key:
+                    self.kill_process(proc["pid"])
+
+            try:
+                os.chmod(file_path, stat.S_IWRITE)
+            except Exception:
+                pass
+            os.remove(file_path)
+        except FileNotFoundError:
+            pass
+        except Exception as e:
+            self.lock_file(file_path, True, quiet=True)
+            self._queue_virus_delete(file_path)
+            self.write_log("INFO", "Virus Delete Deferred", source=file_path, detail=str(e))
+            return
+
+        self.remove_list_items("quarantine", [file_path])
+        with self.lock_virus:
+            target_key = os.path.normcase(self.norm_path(file_path, must_exist=False) or file_path)
+            self.virus_results = [
+                result for result in self.virus_results
+                if os.path.normcase(self.norm_path(result, must_exist=False) or result) != target_key
+            ]
+        self.write_log("INFO", "Virus Delete", source=file_path, file_hash=file_hash, operate=True, success=True)
+
+    def solve_scan(self, file_paths):
+        deleted_paths = []
+        proc_map = {}
+        for proc in self.get_process_list():
+            if proc["path"] and proc["path"] != "None":
+
+                norm_p = self.norm_path(proc["path"], must_exist=False)
+                if norm_p:
+                    proc_map.setdefault(os.path.normcase(norm_p), []).append(proc["pid"])
+
+        last_update = 0.0
+        with self.lock_virus:
+            deleted_set = set()
+            for raw_path in file_paths:
+
+                path = self.norm_path(raw_path, must_exist=False)
+                if not path:
+                    continue
+
+                current_time = time.time()
+                if current_time - last_update >= 0.05:
+                    if self._window:
+                        self._window.evaluate_js(f"if(window.updateDeleteProgress) window.updateDeleteProgress({json.dumps(path.replace(os.sep, '/'))});")
+
+                    last_update = current_time
+
+                try:
+                    if path in self.virus_lock:
+                        self.lock_file(path, False)
+
+                    path_key = os.path.normcase(path)
+                    if path_key in proc_map:
+                        for pid in proc_map[path_key]:
+                            self.kill_process(pid)
+
+                    try:
+                        os.chmod(path, stat.S_IWRITE)
+                    except Exception:
+                        pass
+
+                    file_hash = self.calc_file_hash(path)
+                    try:
+                        os.remove(path)
+                    except Exception as e:
+                        self.lock_file(path, True, quiet=True)
+                        self._queue_virus_delete(path)
+                        self.write_log("INFO", "Virus Delete Deferred", source=path, detail=str(e))
+                        continue
+
+                    self.remove_list_items("quarantine", [path])
+                    deleted_paths.append(raw_path)
+                    deleted_set.add(path)
+                    self.write_log("INFO", "Virus Delete", source=path, file_hash=file_hash, operate=True, success=True)
+
+                except Exception as e:
+                    self.lock_file(path, True)
+                    self.write_log("SCAN", "Virus Delete", source=path, file_hash=self.calc_file_hash(path), detail=str(e), operate=True, success=False)
+
+            if deleted_set:
+                self.virus_results = [p for p in self.virus_results if p not in deleted_set]
+
+            remaining = len(self.virus_results)
+
+        messages = {
+            "traditional_switch": f"剩餘 {remaining} 個病毒，已刪除 {len(deleted_paths)} 個檔案。",
+            "simplified_switch": f"剩余 {remaining} 个病毒，已删除 {len(deleted_paths)} 个文件。",
+            "english_switch": f"Remaining {remaining} viruses, deleted {len(deleted_paths)} files.",
+            "japanese_switch": f"残りのウイルス {remaining} 個、削除されたファイル {len(deleted_paths)} 個。",
+            "korean_switch": f"남은 바이러스 {remaining}개, 삭제된 파일 {len(deleted_paths)}개.",
+            "french_switch": f"Virus restants : {remaining}, fichiers supprimés : {len(deleted_paths)}.",
+            "spanish_switch": f"Virus restantes: {remaining}, archivos eliminados: {len(deleted_paths)}.",
+            "hindi_switch": f"शेष वायरस {remaining}, हटाए गए फ़ाइलें {len(deleted_paths)}.",
+            "arabic_switch": f"الفيروسات المتبقية {remaining}، تم حذف {len(deleted_paths)} ملفات.",
+            "russian_switch": f"Осталось вирусов: {remaining}, удалено файлов: {len(deleted_paths)}.",
+            "slovenian_switch": f"Preostalih virusov: {remaining}, izbrisanih datotek: {len(deleted_paths)}."
+        }
+        if self._window:
+            self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {remaining});")
+
+        return deleted_paths
+
+    def remove_virus_result(self, paths):
+        with self.lock_virus:
+            norm_paths = set(self.norm_path(p, must_exist=False) for p in paths)
+            self.virus_results = [p for p in self.virus_results if p not in norm_paths]
+            return len(self.virus_results)
+
+####################################################################################################
+
+    def cloud_check(self, file_path):
+        norm_path = self.norm_path(file_path)
+        if not norm_path:
+            return
+
+        cache_key = os.path.normcase(norm_path)
+        with self.lock_file_ops:
+            if cache_key in self.cloud_pending:
+                return
+
+            self.cloud_pending.add(cache_key)
+
+        self.cloud_queue.put(norm_path)
+
+    def cloud_worker(self):
+        while True:
+            try:
+                file_path = self.cloud_queue.get()
+                cache_key = os.path.normcase(file_path)
+
+                try:
+                    self.perform_cloud_scan(file_path)
+                finally:
+                    with self.lock_file_ops:
+                        self.cloud_pending.discard(cache_key)
+
+                    self.cloud_queue.task_done()
+            except Exception:
+                pass
+
+    def perform_cloud_scan(self, file_path):
+        was_locked = False
+        try:
+            with self.lock_config:
+                if not self.pyas_config.get("cloud_switch", True):
+                    return False
+
+                api_host, api_key, max_size = self.pyas_config.get("api_host"), self.pyas_config.get("api_key"), self.pyas_config.get("size", 256 * 1024 * 1024)
+
+            if not os.path.exists(file_path) or not os.path.isfile(file_path):
+                return False
+
+            with self.lock_file_ops:
+                if file_path in self.virus_lock:
+                    self.lock_file(file_path, False)
+                    was_locked = True
+
+            if os.path.getsize(file_path) > max_size:
+                if was_locked:
+                    self.lock_file(file_path, True)
+                return False
+
+            file_hash = self.calc_file_hash(file_path)
+            success, sha256 = self.cloud.upload_file(file_path, api_host, api_key, file_hash=file_hash)
+            if was_locked:
+                self.lock_file(file_path, True)
+                was_locked = False
+
+            if not success:
+                self.write_log("WARN", "Cloud API", source=file_path, detail="Failed", success=False)
+
+        except Exception as e:
+            self.write_log("WARN", "perform_cloud_scan", detail=str(e), success=False)
+
+        finally:
+            if was_locked:
+                try:
+                    self.lock_file(file_path, True)
+                except Exception:
+                    pass
+        return False

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.5.9.0',
+version='3.6.5.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -1,171 +1,360 @@
-#pragma once
-#include <fltKernel.h>
-#include <ntddk.h>      
-#include <ntdddisk.h>   
-#include <ntddscsi.h> 
-#include <ntstrsafe.h>
-
-constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
-constexpr auto MAX_PATH_LEN = 1024;
-constexpr auto PYAS_POOL_TAG = 'SAYP';
-
-#ifndef PROCESS_TERMINATE
-#define PROCESS_TERMINATE                  (0x0001)
-#endif
-#ifndef PROCESS_CREATE_THREAD
-#define PROCESS_CREATE_THREAD              (0x0002)
-#endif
-#ifndef PROCESS_VM_OPERATION
-#define PROCESS_VM_OPERATION               (0x0008)
-#endif
-#ifndef PROCESS_VM_READ
-#define PROCESS_VM_READ                    (0x0010)
-#endif
-#ifndef PROCESS_VM_WRITE
-#define PROCESS_VM_WRITE                   (0x0020)
-#endif
-#ifndef PROCESS_DUP_HANDLE
-#define PROCESS_DUP_HANDLE                 (0x0040)
-#endif
-#ifndef PROCESS_CREATE_PROCESS
-#define PROCESS_CREATE_PROCESS             (0x0080)
-#endif
-#ifndef PROCESS_SET_INFORMATION
-#define PROCESS_SET_INFORMATION            (0x0200)
-#endif
-#ifndef PROCESS_QUERY_INFORMATION
-#define PROCESS_QUERY_INFORMATION          (0x0400)
-#endif
-#ifndef PROCESS_SUSPEND_RESUME
-#define PROCESS_SUSPEND_RESUME             (0x0800)
-#endif
-#ifndef PROCESS_QUERY_LIMITED_INFORMATION
-#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
-#endif
-#ifndef PROCESS_SET_QUOTA
-#define PROCESS_SET_QUOTA                  (0x0100)
-#endif
-#ifndef THREAD_TERMINATE
-#define THREAD_TERMINATE                   (0x0001)
-#endif
-#ifndef THREAD_SUSPEND_RESUME
-#define THREAD_SUSPEND_RESUME              (0x0002)
-#endif
-#ifndef THREAD_SET_CONTEXT
-#define THREAD_SET_CONTEXT                 (0x0010)
-#endif
-#ifndef THREAD_SET_INFORMATION
-#define THREAD_SET_INFORMATION             (0x0020)
-#endif
-#ifndef THREAD_SET_THREAD_TOKEN
-#define THREAD_SET_THREAD_TOKEN            (0x0080)
-#endif
-#ifndef POOL_FLAG_NON_PAGED
-#define POOL_FLAG_NON_PAGED                0x0000000000000040UI64
-#endif
-
-#ifndef FSCTL_MANAGE_BYPASS_IO
-#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
-
-typedef enum _FS_BPIO_OPERATIONS {
-    FS_BPIO_OP_ENABLE = 1,
-    FS_BPIO_OP_DISABLE = 2,
-    FS_BPIO_OP_QUERY = 3,
-    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
-    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
-    FS_BPIO_OP_STREAM_PAUSE = 6,
-    FS_BPIO_OP_STREAM_RESUME = 7,
-    FS_BPIO_OP_GET_INFO = 8
-} FS_BPIO_OPERATIONS;
-
-typedef struct _FS_BPIO_INPUT {
-    FS_BPIO_OPERATIONS Operation;
-    ULONG InFlags;
-    ULONGLONG Reserved1;
-    ULONGLONG Reserved2;
-} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
-
-typedef struct _FS_BPIO_OUTPUT {
-    FS_BPIO_OPERATIONS Operation;
-    ULONG OutFlags;
-    ULONGLONG Reserved1;
-    ULONGLONG Reserved2;
-    NTSTATUS Status;
-} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
-
-#endif
-
-typedef struct _PYAS_MESSAGE {
-    ULONG MessageCode;
-    ULONG ProcessId;
-    WCHAR Path[MAX_PATH_LEN];
-} PYAS_MESSAGE, * PPYAS_MESSAGE;
-
-typedef struct _PYAS_USER_MESSAGE {
-    ULONG Command;
-    WCHAR Path[MAX_PATH_LEN];
+#pragma once
+#include <fltKernel.h>
+#include <ntddk.h>      
+#include <ntdddisk.h>   
+#include <ntddscsi.h> 
+#include <ntstrsafe.h>
+
+constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
+constexpr auto MAX_PATH_LEN = 1024;
+constexpr auto PYAS_POOL_TAG = 'SAYP';
+constexpr auto PYAS_OB_ALTITUDE = L"320000.4101";
+constexpr auto PYAS_CONNECTION_MAGIC = 0x53415950;
+constexpr auto PYAS_CONNECTION_VERSION = 1;
+
+#ifndef PROCESS_TERMINATE
+#define PROCESS_TERMINATE                  (0x0001)
+#endif
+#ifndef PROCESS_CREATE_THREAD
+#define PROCESS_CREATE_THREAD              (0x0002)
+#endif
+#ifndef PROCESS_VM_OPERATION
+#define PROCESS_VM_OPERATION               (0x0008)
+#endif
+#ifndef PROCESS_VM_READ
+#define PROCESS_VM_READ                    (0x0010)
+#endif
+#ifndef PROCESS_VM_WRITE
+#define PROCESS_VM_WRITE                   (0x0020)
+#endif
+#ifndef PROCESS_DUP_HANDLE
+#define PROCESS_DUP_HANDLE                 (0x0040)
+#endif
+#ifndef PROCESS_CREATE_PROCESS
+#define PROCESS_CREATE_PROCESS             (0x0080)
+#endif
+#ifndef PROCESS_SET_INFORMATION
+#define PROCESS_SET_INFORMATION            (0x0200)
+#endif
+#ifndef PROCESS_QUERY_INFORMATION
+#define PROCESS_QUERY_INFORMATION          (0x0400)
+#endif
+#ifndef PROCESS_SUSPEND_RESUME
+#define PROCESS_SUSPEND_RESUME             (0x0800)
+#endif
+#ifndef PROCESS_QUERY_LIMITED_INFORMATION
+#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
+#endif
+#ifndef PROCESS_SET_QUOTA
+#define PROCESS_SET_QUOTA                  (0x0100)
+#endif
+#ifndef THREAD_TERMINATE
+#define THREAD_TERMINATE                   (0x0001)
+#endif
+#ifndef THREAD_SUSPEND_RESUME
+#define THREAD_SUSPEND_RESUME              (0x0002)
+#endif
+#ifndef THREAD_SET_CONTEXT
+#define THREAD_SET_CONTEXT                 (0x0010)
+#endif
+#ifndef THREAD_SET_INFORMATION
+#define THREAD_SET_INFORMATION             (0x0020)
+#endif
+#ifndef THREAD_SET_THREAD_TOKEN
+#define THREAD_SET_THREAD_TOKEN            (0x0080)
+#endif
+#ifndef THREAD_IMPERSONATE
+#define THREAD_IMPERSONATE                 (0x0100)
+#endif
+#ifndef THREAD_DIRECT_IMPERSONATION
+#define THREAD_DIRECT_IMPERSONATION        (0x0200)
+#endif
+#ifndef POOL_FLAG_NON_PAGED
+#define POOL_FLAG_NON_PAGED                0x0000000000000040UI64
+#endif
+
+#ifndef FSCTL_MANAGE_BYPASS_IO
+#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+typedef enum _FS_BPIO_OPERATIONS {
+    FS_BPIO_OP_ENABLE = 1,
+    FS_BPIO_OP_DISABLE = 2,
+    FS_BPIO_OP_QUERY = 3,
+    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
+    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
+    FS_BPIO_OP_STREAM_PAUSE = 6,
+    FS_BPIO_OP_STREAM_RESUME = 7,
+    FS_BPIO_OP_GET_INFO = 8
+} FS_BPIO_OPERATIONS;
+
+typedef struct _FS_BPIO_INPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG InFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
+
+typedef struct _FS_BPIO_OUTPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG OutFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+    NTSTATUS Status;
+} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
+#endif
+
+
+typedef enum _PYAS_DRIVER_STATE {
+    PyasDriverStateCold = 0,
+    PyasDriverStateStarting = 1,
+    PyasDriverStateRunning = 2,
+    PyasDriverStateStopping = 3,
+    PyasDriverStateStopRetry = 4,
+    PyasDriverStateStopped = 5
+} PYAS_DRIVER_STATE;
+
+typedef struct _PYAS_MESSAGE {
+    ULONG MessageCode;
+    ULONG ProcessId;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_MESSAGE, * PPYAS_MESSAGE;
+
+typedef enum _PYAS_COMMAND {
+    PyasCommandAddWhitelist = 1,
+    PyasCommandRemoveWhitelist = 2,
+    PyasCommandLoadRuleFile = 3,
+    PyasCommandClearRules = 4,
+    PyasCommandAuthorizeUnload = 5,
+    PyasCommandRevokeUnload = 6,
+    PyasCommandQueryState = 7
+} PYAS_COMMAND;
+
+typedef struct _PYAS_USER_MESSAGE {
+    ULONG Command;
+    WCHAR Path[MAX_PATH_LEN];
 } PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
 
-typedef struct _DRIVER_DATA {
-    PDRIVER_OBJECT DriverObject;
-    PFLT_FILTER FilterHandle;
-    PFLT_PORT ServerPort;
-    PFLT_PORT ClientPort;
-    PEPROCESS PyasProcess;
-    ULONG PyasPid;
-    LARGE_INTEGER Cookie;
-    KSPIN_LOCK PortMutex;
-    KSPIN_LOCK TrackerMutex;
-    EX_RUNDOWN_REF PortRundown;
-} DRIVER_DATA, * PDRIVER_DATA;
-
-typedef struct _RULE_NODE {
-    struct _RULE_NODE* Next;
-    UNICODE_STRING Pattern;
-} RULE_NODE, * PRULE_NODE;
-
-extern DRIVER_DATA GlobalData;
-
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-
-NTSTATUS InitializeProcessProtection();
-VOID UninitializeProcessProtection();
-NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
-VOID UninitializeRegistryProtection();
-
-NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
-VOID UnloadRules();
-
-VOID InitializeRulesEngine();
-VOID UninitializeRulesEngine();
-
-VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
-VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
-
-VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
-
-NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
-
-BOOLEAN IsProcessTrusted(HANDLE ProcessId);
-BOOLEAN IsTargetProtected(HANDLE ProcessId);
-BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
-
-BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);
-BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID WriteBuffer, ULONG WriteLength, BOOLEAN IsWrite);
-
-NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
-
-FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
-    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
-}
-
-FORCEINLINE VOID PyasFree(PVOID Ptr) {
-    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
+typedef struct _PYAS_CONNECTION_CONTEXT {
+    ULONG Size;
+    ULONG Version;
+    ULONG Magic;
+    ULONG ProcessId;
+} PYAS_CONNECTION_CONTEXT, * PPYAS_CONNECTION_CONTEXT;
+
+typedef struct _DRIVER_DATA {
+    PDRIVER_OBJECT DriverObject;
+    PFLT_FILTER FilterHandle;
+    PFLT_PORT ServerPort;
+    PFLT_PORT ClientPort;
+    PEPROCESS PyasProcess;
+    ULONG PyasPid;
+    LARGE_INTEGER Cookie;
+    KSPIN_LOCK PortMutex;
+    KSPIN_LOCK TrackerMutex;
+    KSPIN_LOCK PidLock;
+    BOOLEAN Initialized;
+    volatile LONG DriverState;
+    volatile LONG UnloadAuthorized;
+    volatile LONG PortStopping;
+    volatile LONG ClientCloseActive;
+    EX_RUNDOWN_REF PortRundown;
+    KEVENT CleanupCompleteEvent;
+    PVOID ObRegistrationHandle;
+    UNICODE_STRING ClientImagePath;
+    WCHAR ClientImagePathBuffer[MAX_PATH_LEN];
+} DRIVER_DATA, * PDRIVER_DATA;
+
+typedef struct _RULE_NODE {
+    struct _RULE_NODE* Next;
+    UNICODE_STRING Pattern;
+} RULE_NODE, * PRULE_NODE;
+
+typedef enum _RULE_CATEGORY {
+    RuleCategoryProcess,
+    RuleCategoryFile,
+    RuleCategoryRegistry,
+    RuleCategoryDevice,
+    RuleCategoryMemory,
+    RuleCategoryThread,
+    RuleCategoryUnknown
+} RULE_CATEGORY;
+
+#define OP_WRITE                   0x00000001
+#define OP_DELETE                  0x00000002
+#define OP_CREATE                  0x00000004
+#define OP_EXECUTE                 0x00000008
+#define OP_RENAME                  0x00000010
+#define OP_IOCTL                   0x00000020
+#define OP_VM_READ                 0x00000040
+#define OP_VM_WRITE                0x00000080
+#define OP_TERMINATE               0x00000100
+#define OP_SUSPEND_RESUME          0x00000200
+#define OP_DUP_HANDLE              0x00000400
+#define OP_SET_INFORMATION         0x00000800
+#define OP_VM_OPERATION            0x00001000
+#define OP_CREATE_THREAD           0x00002000
+#define OP_THREAD_SET_CONTEXT      0x00004000
+#define OP_THREAD_SET_TOKEN        0x00008000
+#define OP_CREATE_PROCESS          0x00010000
+#define OP_IMAGE_LOAD              0x00020000
+#define OP_IMPERSONATE             0x00040000
+
+#define PYAS_HANDLE_CREATE         0x00000001
+#define PYAS_HANDLE_DUPLICATE      0x00000002
+
+#define PYAS_OBJECT_PROCESS        0x00000001
+#define PYAS_OBJECT_THREAD         0x00000002
+
+#define PYAS_MEMORY_PRIVATE        0x00000001
+#define PYAS_MEMORY_MAPPED         0x00000002
+#define PYAS_MEMORY_IMAGE          0x00000004
+
+#define PYAS_PROTECT_EXECUTE       0x00000001
+#define PYAS_PROTECT_EXECUTE_WRITE 0x00000002
+
+typedef enum _RULE_TRI_STATE {
+    RuleTriAny = 0,
+    RuleTriTrue = 1,
+    RuleTriFalse = 2
+} RULE_TRI_STATE;
+
+typedef enum _RULE_OPERATION_MATCH {
+    RuleOperationAny = 0,
+    RuleOperationAll = 1
+} RULE_OPERATION_MATCH;
+
+typedef struct _DYNAMIC_RULE {
+    ULONG Code;
+    BOOLEAN Kill;
+    ULONG Priority;
+    RULE_CATEGORY Category;
+    ULONG Operations;
+    RULE_OPERATION_MATCH OperationMatch;
+    BOOLEAN Invalid;
+
+    PRULE_NODE Initiator;
+    PRULE_NODE InitiatorExclude;
+    PRULE_NODE InitiatorParent;
+    PRULE_NODE InitiatorParentExclude;
+    PRULE_NODE InitiatorProcessTree;
+    PRULE_NODE InitiatorProcessTreeExclude;
+    PRULE_NODE Target;
+    PRULE_NODE TargetExclude;
+    PRULE_NODE TargetProcessTree;
+    PRULE_NODE TargetProcessTreeExclude;
+    PRULE_NODE Creator;
+    PRULE_NODE CreatorExclude;
+    PRULE_NODE Parent;
+    PRULE_NODE ParentExclude;
+    PRULE_NODE CommandLine;
+    PRULE_NODE CommandLineExclude;
+    PRULE_NODE Extensions;
+
+    ULONG HandleTypes;
+    ULONG ObjectTypes;
+    ULONG MinimumRiskScore;
+    ULONG MaximumRiskScore;
+    ULONG ThreadMemoryTypes;
+    ULONG ThreadMemoryProtections;
+    ULONGLONG MinimumRegionSize;
+    ULONGLONG MaximumRegionSize;
+    RULE_TRI_STATE ParentMismatch;
+    RULE_TRI_STATE FileOpenNameAvailable;
+    RULE_TRI_STATE SubsystemProcess;
+
+    ULONG Threshold;
+    ULONG TimeWindow;
+
+    struct _DYNAMIC_RULE* Next;
+} DYNAMIC_RULE, * PDYNAMIC_RULE;
+
+BOOLEAN EvaluateDeviceRule(HANDLE ProcessId, PULONG OutCode, PBOOLEAN OutKill);
+
+extern DRIVER_DATA GlobalData;
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+
+NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
+NTSTATUS UninitializeRegistryProtection();
+
+NTSTATUS InitializeProcessProtection();
+NTSTATUS UninitializeProcessProtection();
+BOOLEAN GetProcessRelation(HANDLE ProcessId, PHANDLE ParentProcessId, PHANDLE CreatorProcessId);
+
+NTSTATUS InitializeMemoryProtection(PDRIVER_OBJECT DriverObject);
+NTSTATUS UninitializeMemoryProtection(BOOLEAN WaitWithoutTimeout);
+
+NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
+VOID UnloadRules();
+
+NTSTATUS InitializeRulesEngine();
+VOID UninitializeRulesEngine();
+
+VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
+VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
+
+NTSTATUS LoadRuleFile(PCUNICODE_STRING FilePath);
+VOID ClearDynamicRules();
+
+VOID ProcessNotifyCallbackEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo);
+NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
+
+ULONG SafeGetPyasPid();
+VOID SafeSetPyasPid(ULONG Pid);
+
+BOOLEAN IsProcessTrusted(HANDLE ProcessId);
+BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
+
+BOOLEAN EvaluateProcessCreateRule(
+    HANDLE CreatorPid,
+    HANDLE ParentPid,
+    HANDLE ProcessId,
+    PCUNICODE_STRING TargetPath,
+    PCUNICODE_STRING CommandLine,
+    BOOLEAN FileOpenNameAvailable,
+    BOOLEAN IsSubsystemProcess,
+    PULONG OutCode,
+    PBOOLEAN OutKill
+);
+BOOLEAN EvaluateProcessAccessRule(
+    HANDLE SourcePid,
+    HANDLE TargetPid,
+    ULONG RequestedOperations,
+    ULONG HandleType,
+    ULONG ObjectType,
+    PULONG DeniedOperations,
+    PULONG OutCode,
+    PBOOLEAN OutKill
+);
+BOOLEAN EvaluateThreadRule(
+    HANDLE SourcePid,
+    HANDLE TargetPid,
+    PVOID StartAddress,
+    ULONG MemoryType,
+    ULONG MemoryProtection,
+    SIZE_T RegionSize,
+    PULONG OutCode,
+    PBOOLEAN OutKill
+);
+BOOLEAN EvaluateImageLoadRule(HANDLE ProcessId, PCUNICODE_STRING ImagePath, PIMAGE_INFO ImageInfo, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateProcessRule(HANDLE ProcessId, PCUNICODE_STRING TargetPath, PCUNICODE_STRING CommandLine, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateFileRule(HANDLE ProcessId, PCUNICODE_STRING TargetPath, ULONG Operation, PVOID WriteBuffer, ULONG WriteLength, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateRegistryRule(HANDLE ProcessId, PCUNICODE_STRING KeyName, ULONG Operation, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateMemoryRule(HANDLE SourcePid, HANDLE TargetPid, ULONG Operation, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateProcessHandleRule(HANDLE SourcePid, HANDLE TargetPid, ULONG Operation, PULONG OutCode, PBOOLEAN OutKill);
+
+VOID QueueRuleProcessTermination(HANDLE ProcessId, BOOLEAN Kill);
+NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
+
+FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
+    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
+}
+
+FORCEINLINE VOID PyasFree(PVOID Ptr) {
+    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
 }

Plugins/Filter/DriverEntry.cpp

@@ -1,220 +1,728 @@
-#include "DriverCommon.h"
-
-DRIVER_DATA GlobalData;
-static BOOLEAN g_ImageNotifyRegistered = FALSE;
-
-static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-    UNREFERENCED_PARAMETER(VolumeDeviceType);
-    UNREFERENCED_PARAMETER(VolumeFilesystemType);
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS InstanceQueryTeardown(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-    return STATUS_SUCCESS;
-}
-
-static VOID InstanceTeardownStart(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-}
-
-static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-}
-
-static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(Flags);
-
-    if (GlobalData.ServerPort) {
-        FltCloseCommunicationPort(GlobalData.ServerPort);
-        GlobalData.ServerPort = NULL;
-    }
-
-    if (GlobalData.FilterHandle) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-        GlobalData.FilterHandle = NULL;
-    }
-
-    if (g_ImageNotifyRegistered) {
-        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
-        g_ImageNotifyRegistered = FALSE;
-    }
-
-    UninitializeRegistryProtection();
-    UninitializeProcessProtection();
-
-    UnloadRules();
-    UninitializeRulesEngine();
-
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength) {
-    UNREFERENCED_PARAMETER(PortCookie);
-    UNREFERENCED_PARAMETER(OutputBuffer);
-    UNREFERENCED_PARAMETER(OutputBufferLength);
-
-    if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
-        PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
-        if (msg->Command == 1 || msg->Command == 2) {
-            msg->Path[MAX_PATH_LEN - 1] = L'\0';
-            UNICODE_STRING us;
-            RtlInitUnicodeString(&us, msg->Path);
-            if (us.Length > 0) {
-                if (msg->Command == 1) {
-                    AddDynamicWhitelist(&us);
-                }
-                else {
-                    RemoveDynamicWhitelist(&us);
-                }
-            }
-        }
-    }
-
-    if (ReturnOutputBufferLength) {
-        *ReturnOutputBufferLength = 0;
-    }
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID* ConnectionPortCookie) {
-    UNREFERENCED_PARAMETER(ServerPortCookie);
-    UNREFERENCED_PARAMETER(ConnectionContext);
-    UNREFERENCED_PARAMETER(SizeOfContext);
-    UNREFERENCED_PARAMETER(ConnectionPortCookie);
-
-    KIRQL OldIrql;
-    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
-
-    GlobalData.ClientPort = ClientPort;
-    GlobalData.PyasPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
-    GlobalData.PyasProcess = PsGetCurrentProcess();
-
-    ExReInitializeRundownProtection(&GlobalData.PortRundown);
-
-    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
-
-    return STATUS_SUCCESS;
-}
-
-static VOID PortDisconnect(PVOID ConnectionCookie) {
-    UNREFERENCED_PARAMETER(ConnectionCookie);
-
-    KIRQL OldIrql;
-    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
-
-    GlobalData.ClientPort = NULL;
-    GlobalData.PyasPid = 0;
-    GlobalData.PyasProcess = NULL;
-
-    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
-
-    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
-}
-
-CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
-    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
-    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
-    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
-    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
-    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
-    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
-    { IRP_MJ_OPERATION_END }
-};
-
-CONST FLT_REGISTRATION FilterRegistration = {
-    sizeof(FLT_REGISTRATION),
-    FLT_REGISTRATION_VERSION,
-    0,
-    NULL,
-    Callbacks,
-    DriverUnload,
-    InstanceSetup,
-    InstanceQueryTeardown,
-    InstanceTeardownStart,
-    InstanceTeardownComplete,
-    NULL,
-    NULL,
-    NULL
-};
-
-extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
-    NTSTATUS status = STATUS_SUCCESS;
-    PSECURITY_DESCRIPTOR sd = NULL;
-    OBJECT_ATTRIBUTES oa = { 0 };
-    UNICODE_STRING name = { 0 };
-
-    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
-    GlobalData.DriverObject = DriverObject;
-    KeInitializeSpinLock(&GlobalData.PortMutex);
-    KeInitializeSpinLock(&GlobalData.TrackerMutex);
-
-    ExInitializeRundownProtection(&GlobalData.PortRundown);
-
-    InitializeRulesEngine();
-
-    status = LoadRulesFromDisk(RegistryPath);
-
-    status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) {
-        UnloadRules();
-        UninitializeRulesEngine();
-        return status;
-    }
-
-    status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
-    if (NT_SUCCESS(status)) {
-        RtlInitUnicodeString(&name, PYAS_PORT_NAME);
-        InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, sd);
-        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, PortMessage, 1);
-        FltFreeSecurityDescriptor(sd);
-    }
-
-    if (!NT_SUCCESS(status)) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-        GlobalData.FilterHandle = NULL;
-        UnloadRules();
-        UninitializeRulesEngine();
-        return status;
-    }
-
-    InitializeProcessProtection();
-
-    InitializeRegistryProtection(DriverObject);
-
-    NTSTATUS imageNotifyStatus = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
-    if (NT_SUCCESS(imageNotifyStatus)) {
-        g_ImageNotifyRegistered = TRUE;
-    }
-
-    status = FltStartFiltering(GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) {
-        if (g_ImageNotifyRegistered) {
-            PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
-            g_ImageNotifyRegistered = FALSE;
-        }
-
-        UninitializeRegistryProtection();
-        UninitializeProcessProtection();
-
-        if (GlobalData.ServerPort) {
-            FltCloseCommunicationPort(GlobalData.ServerPort);
-            GlobalData.ServerPort = NULL;
-        }
-
-        if (GlobalData.FilterHandle) {
-            FltUnregisterFilter(GlobalData.FilterHandle);
-            GlobalData.FilterHandle = NULL;
-        }
-
-        UnloadRules();
-        UninitializeRulesEngine();
-    }
-
-    return status;
-}
+#include "DriverCommon.h"
+
+DRIVER_DATA GlobalData;
+static BOOLEAN g_ProcessNotifyRegistered = FALSE;
+static BOOLEAN g_ProcessProtectionInitialized = FALSE;
+static BOOLEAN g_RegistryProtectionInitialized = FALSE;
+static BOOLEAN g_RulesEngineInitialized = FALSE;
+
+static NTSTATUS InstanceSetup(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_SETUP_FLAGS Flags,
+    DEVICE_TYPE VolumeDeviceType,
+    FLT_FILESYSTEM_TYPE VolumeFilesystemType
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    UNREFERENCED_PARAMETER(VolumeDeviceType);
+    UNREFERENCED_PARAMETER(VolumeFilesystemType);
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS InstanceQueryTeardown(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    return STATUS_SUCCESS;
+}
+
+static VOID InstanceTeardownStart(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_TEARDOWN_FLAGS Flags
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static VOID InstanceTeardownComplete(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_TEARDOWN_FLAGS Flags
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static NTSTATUS SelectFailure(NTSTATUS CurrentStatus, NTSTATUS CandidateStatus) {
+    if (!NT_SUCCESS(CurrentStatus)) return CurrentStatus;
+    return CandidateStatus;
+}
+
+static NTSTATUS LoadClientIdentityFromRegistry(PUNICODE_STRING RegistryPath) {
+    if (!RegistryPath || !RegistryPath->Buffer || !GlobalData.ClientImagePath.Buffer) return STATUS_INVALID_PARAMETER;
+
+    UNICODE_STRING ValueName = RTL_CONSTANT_STRING(L"ClientImagePath");
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(&ObjectAttributes, RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+    HANDLE KeyHandle = NULL;
+    NTSTATUS Status = ZwOpenKey(&KeyHandle, KEY_READ, &ObjectAttributes);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    ULONG ResultLength = 0;
+    Status = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, NULL, 0, &ResultLength);
+    if (Status != STATUS_BUFFER_TOO_SMALL && Status != STATUS_BUFFER_OVERFLOW) {
+        ZwClose(KeyHandle);
+        return Status;
+    }
+
+    if (ResultLength == 0 || ResultLength > FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) + GlobalData.ClientImagePath.MaximumLength) {
+        ZwClose(KeyHandle);
+        return STATUS_NAME_TOO_LONG;
+    }
+
+    PKEY_VALUE_PARTIAL_INFORMATION Information = (PKEY_VALUE_PARTIAL_INFORMATION)PyasAllocate(ResultLength);
+    if (!Information) {
+        ZwClose(KeyHandle);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    Status = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, Information, ResultLength, &ResultLength);
+    ZwClose(KeyHandle);
+
+    if (NT_SUCCESS(Status)) {
+        if ((Information->Type != REG_SZ && Information->Type != REG_EXPAND_SZ) ||
+            Information->DataLength < sizeof(WCHAR) ||
+            (Information->DataLength % sizeof(WCHAR)) != 0 ||
+            Information->DataLength > GlobalData.ClientImagePath.MaximumLength - sizeof(WCHAR)) {
+            Status = STATUS_INVALID_PARAMETER;
+        }
+        else {
+            RtlZeroMemory(GlobalData.ClientImagePath.Buffer, GlobalData.ClientImagePath.MaximumLength);
+            RtlCopyMemory(GlobalData.ClientImagePath.Buffer, Information->Data, Information->DataLength);
+
+            USHORT CharacterCount = (USHORT)(Information->DataLength / sizeof(WCHAR));
+            while (CharacterCount > 0 && GlobalData.ClientImagePath.Buffer[CharacterCount - 1] == L'\0') {
+                CharacterCount--;
+            }
+
+            if (CharacterCount == 0) {
+                Status = STATUS_INVALID_PARAMETER;
+            }
+            else {
+                GlobalData.ClientImagePath.Buffer[CharacterCount] = L'\0';
+                GlobalData.ClientImagePath.Length = CharacterCount * sizeof(WCHAR);
+                Status = STATUS_SUCCESS;
+            }
+        }
+    }
+
+    PyasFree(Information);
+    return Status;
+}
+
+static BOOLEAN IsAuthorizedClientConnection(PVOID ConnectionContext, ULONG SizeOfContext) {
+    if (!ConnectionContext || SizeOfContext < sizeof(PYAS_CONNECTION_CONTEXT)) return FALSE;
+    if (!GlobalData.ClientImagePath.Buffer || GlobalData.ClientImagePath.Length == 0) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    PYAS_CONNECTION_CONTEXT Context = { 0 };
+    __try {
+        RtlCopyMemory(&Context, ConnectionContext, sizeof(Context));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        return FALSE;
+    }
+
+    if (Context.Size < sizeof(PYAS_CONNECTION_CONTEXT)) return FALSE;
+    if (Context.Version != PYAS_CONNECTION_VERSION) return FALSE;
+    if (Context.Magic != PYAS_CONNECTION_MAGIC) return FALSE;
+    if (Context.ProcessId != (ULONG)(ULONG_PTR)PsGetCurrentProcessId()) return FALSE;
+
+    PUNICODE_STRING ImagePath = NULL;
+    NTSTATUS Status = SeLocateProcessImageName(PsGetCurrentProcess(), &ImagePath);
+    if (!NT_SUCCESS(Status) || !ImagePath || !ImagePath->Buffer) {
+        if (ImagePath) ExFreePool(ImagePath);
+        return FALSE;
+    }
+
+    BOOLEAN Authorized = RtlEqualUnicodeString(ImagePath, &GlobalData.ClientImagePath, TRUE);
+    ExFreePool(ImagePath);
+    return Authorized;
+}
+
+static NTSTATUS UnregisterRuntimeCallbacksPass(BOOLEAN WaitWithoutTimeout) {
+    NTSTATUS Status = STATUS_SUCCESS;
+
+    NTSTATUS MemoryStatus = UninitializeMemoryProtection(WaitWithoutTimeout);
+    if (!NT_SUCCESS(MemoryStatus)) {
+        Status = SelectFailure(Status, MemoryStatus);
+    }
+
+    if (g_ProcessNotifyRegistered) {
+        NTSTATUS ProcessNotifyStatus = PsSetCreateProcessNotifyRoutineEx(
+            ProcessNotifyCallbackEx,
+            TRUE
+        );
+
+        if (NT_SUCCESS(ProcessNotifyStatus) || ProcessNotifyStatus == STATUS_INVALID_PARAMETER) {
+            g_ProcessNotifyRegistered = FALSE;
+        }
+        else {
+            Status = SelectFailure(Status, ProcessNotifyStatus);
+        }
+    }
+
+    if (!g_ProcessNotifyRegistered && g_ProcessProtectionInitialized) {
+        NTSTATUS ProcessStatus = UninitializeProcessProtection();
+        if (NT_SUCCESS(ProcessStatus)) {
+            g_ProcessProtectionInitialized = FALSE;
+        }
+        else {
+            Status = SelectFailure(Status, ProcessStatus);
+        }
+    }
+
+    if (g_RegistryProtectionInitialized) {
+        NTSTATUS RegistryStatus = UninitializeRegistryProtection();
+        if (NT_SUCCESS(RegistryStatus)) {
+            g_RegistryProtectionInitialized = FALSE;
+        }
+        else {
+            Status = SelectFailure(Status, RegistryStatus);
+        }
+    }
+
+    return Status;
+}
+
+static NTSTATUS UnregisterRuntimeCallbacks(BOOLEAN WaitWithoutTimeout) {
+    for (;;) {
+        NTSTATUS Status = UnregisterRuntimeCallbacksPass(WaitWithoutTimeout);
+        if (NT_SUCCESS(Status) || !WaitWithoutTimeout) return Status;
+
+        LARGE_INTEGER Delay;
+        Delay.QuadPart = -(10LL * 10 * 1000);
+        KeDelayExecutionThread(KernelMode, FALSE, &Delay);
+    }
+}
+
+static PEPROCESS DetachConnectedProcessReference(PEPROCESS ExpectedProcess) {
+    PEPROCESS Process = NULL;
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
+    if (!ExpectedProcess || GlobalData.PyasProcess == ExpectedProcess) {
+        Process = GlobalData.PyasProcess;
+        GlobalData.PyasProcess = NULL;
+    }
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+    return Process;
+}
+
+static VOID ReleaseConnectedProcessReference() {
+    PEPROCESS Process = DetachConnectedProcessReference(NULL);
+
+    SafeSetPyasPid(0);
+    InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+
+    if (Process) {
+        ObDereferenceObject(Process);
+    }
+}
+
+static VOID CloseCurrentClientPort() {
+    if (InterlockedCompareExchange(&GlobalData.ClientCloseActive, 1, 0) != 0) return;
+
+    PFLT_FILTER FilterHandle = NULL;
+    PFLT_PORT ClientPort = NULL;
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+    FilterHandle = GlobalData.FilterHandle;
+    ClientPort = GlobalData.ClientPort;
+    GlobalData.ClientPort = NULL;
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+
+    if (FilterHandle && ClientPort) {
+        FltCloseClientPort(FilterHandle, &ClientPort);
+    }
+
+    InterlockedExchange(&GlobalData.ClientCloseActive, 0);
+}
+
+static VOID WaitForClientPortClose() {
+    LARGE_INTEGER Delay;
+    Delay.QuadPart = -(10LL * 1000);
+
+    while (InterlockedCompareExchange(&GlobalData.ClientCloseActive, 0, 0) != 0) {
+        KeDelayExecutionThread(KernelMode, FALSE, &Delay);
+    }
+}
+
+static VOID ReleaseFilterResources() {
+    InterlockedExchange(&GlobalData.PortStopping, 1);
+
+    if (GlobalData.ServerPort) {
+        PFLT_PORT ServerPort = GlobalData.ServerPort;
+        GlobalData.ServerPort = NULL;
+        FltCloseCommunicationPort(ServerPort);
+    }
+
+    CloseCurrentClientPort();
+    WaitForClientPortClose();
+    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
+
+    if (GlobalData.FilterHandle) {
+        PFLT_FILTER FilterHandle = GlobalData.FilterHandle;
+        FltUnregisterFilter(FilterHandle);
+        GlobalData.FilterHandle = NULL;
+    }
+
+    ReleaseConnectedProcessReference();
+}
+
+static NTSTATUS CleanupDriverState(BOOLEAN WaitWithoutTimeout) {
+    NTSTATUS Status = UnregisterRuntimeCallbacks(WaitWithoutTimeout);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    GlobalData.Initialized = FALSE;
+    ReleaseFilterResources();
+
+    if (g_RulesEngineInitialized) {
+        UnloadRules();
+        UninitializeRulesEngine();
+        g_RulesEngineInitialized = FALSE;
+    }
+
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS BeginUnload(BOOLEAN MandatoryUnload) {
+    for (;;) {
+        LONG State = InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateCold,
+            PyasDriverStateCold
+        );
+
+        if (State == PyasDriverStateStopped) return STATUS_SUCCESS;
+
+        if (State == PyasDriverStateStopping) {
+            LARGE_INTEGER Timeout;
+            PLARGE_INTEGER TimeoutPointer = NULL;
+
+            if (!MandatoryUnload) {
+                Timeout.QuadPart = -(2LL * 10 * 1000 * 1000);
+                TimeoutPointer = &Timeout;
+            }
+
+            NTSTATUS WaitStatus = KeWaitForSingleObject(
+                &GlobalData.CleanupCompleteEvent,
+                Executive,
+                KernelMode,
+                FALSE,
+                TimeoutPointer
+            );
+
+            if (!MandatoryUnload && WaitStatus == STATUS_TIMEOUT) {
+                return STATUS_DEVICE_BUSY;
+            }
+
+            if (!NT_SUCCESS(WaitStatus)) return WaitStatus;
+            continue;
+        }
+
+        if (State != PyasDriverStateRunning && State != PyasDriverStateStopRetry) {
+            return STATUS_DEVICE_NOT_READY;
+        }
+
+        if (!MandatoryUnload && InterlockedCompareExchange(&GlobalData.UnloadAuthorized, 0, 1) != 1) {
+            return STATUS_ACCESS_DENIED;
+        }
+
+        if (MandatoryUnload) {
+            InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+        }
+
+        if (InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateStopping,
+            State
+        ) != State) {
+            if (!MandatoryUnload) return STATUS_DEVICE_BUSY;
+            continue;
+        }
+
+        KeClearEvent(&GlobalData.CleanupCompleteEvent);
+        return STATUS_SUCCESS;
+    }
+}
+
+static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
+    BOOLEAN MandatoryUnload = FlagOn(Flags, FLTFL_FILTER_UNLOAD_MANDATORY) ? TRUE : FALSE;
+
+    NTSTATUS Status = BeginUnload(MandatoryUnload);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    LONG State = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (State == PyasDriverStateStopped) return STATUS_SUCCESS;
+
+    Status = CleanupDriverState(MandatoryUnload);
+
+    InterlockedExchange(
+        &GlobalData.DriverState,
+        NT_SUCCESS(Status) ? PyasDriverStateStopped : PyasDriverStateStopRetry
+    );
+
+    KeSetEvent(&GlobalData.CleanupCompleteEvent, IO_NO_INCREMENT, FALSE);
+    return Status;
+}
+
+static NTSTATUS PortMessage(
+    PVOID PortCookie,
+    PVOID InputBuffer,
+    ULONG InputBufferLength,
+    PVOID OutputBuffer,
+    ULONG OutputBufferLength,
+    PULONG ReturnOutputBufferLength
+) {
+    if (ReturnOutputBufferLength) *ReturnOutputBufferLength = 0;
+
+    if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    NTSTATUS Status = STATUS_SUCCESS;
+    PYAS_USER_MESSAGE Message = { 0 };
+    UNICODE_STRING Path = { 0 };
+    LONG DriverState = PyasDriverStateCold;
+    ULONG StateValue = PyasDriverStateCold;
+
+    if (!PortCookie || PortCookie != GlobalData.PyasProcess) {
+        Status = STATUS_ACCESS_DENIED;
+        goto Exit;
+    }
+
+    if (!InputBuffer || InputBufferLength < sizeof(PYAS_USER_MESSAGE)) {
+        Status = STATUS_INVALID_PARAMETER;
+        goto Exit;
+    }
+
+    __try {
+        RtlCopyMemory(&Message, InputBuffer, sizeof(Message));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        Status = GetExceptionCode();
+        goto Exit;
+    }
+
+    Message.Path[MAX_PATH_LEN - 1] = L'\0';
+
+    if (Message.Command == PyasCommandQueryState) {
+        if (!OutputBuffer || OutputBufferLength < sizeof(ULONG) || !ReturnOutputBufferLength) {
+            Status = STATUS_BUFFER_TOO_SMALL;
+            goto Exit;
+        }
+
+        StateValue = (ULONG)InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateCold,
+            PyasDriverStateCold
+        );
+
+        __try {
+            *(PULONG)OutputBuffer = StateValue;
+            *ReturnOutputBufferLength = sizeof(ULONG);
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            Status = GetExceptionCode();
+        }
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandAuthorizeUnload) {
+        DriverState = InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateCold,
+            PyasDriverStateCold
+        );
+
+        if (DriverState != PyasDriverStateRunning && DriverState != PyasDriverStateStopRetry) {
+            Status = STATUS_DEVICE_NOT_READY;
+            goto Exit;
+        }
+
+        InterlockedExchange(&GlobalData.UnloadAuthorized, 1);
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandRevokeUnload) {
+        InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+        goto Exit;
+    }
+
+    if (Message.Command < PyasCommandAddWhitelist || Message.Command > PyasCommandClearRules) {
+        Status = STATUS_INVALID_DEVICE_REQUEST;
+        goto Exit;
+    }
+
+    DriverState = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (DriverState != PyasDriverStateRunning) {
+        Status = STATUS_DEVICE_NOT_READY;
+        goto Exit;
+    }
+
+    RtlInitUnicodeString(&Path, Message.Path);
+
+    if (Message.Command == PyasCommandAddWhitelist) {
+        if (Path.Length == 0) {
+            Status = STATUS_INVALID_PARAMETER;
+            goto Exit;
+        }
+
+        AddDynamicWhitelist(&Path);
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandRemoveWhitelist) {
+        if (Path.Length == 0) {
+            Status = STATUS_INVALID_PARAMETER;
+            goto Exit;
+        }
+
+        RemoveDynamicWhitelist(&Path);
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandLoadRuleFile) {
+        if (Path.Length == 0) {
+            Status = STATUS_INVALID_PARAMETER;
+            goto Exit;
+        }
+
+        Status = LoadRuleFile(&Path);
+        goto Exit;
+    }
+
+    ClearDynamicRules();
+
+Exit:
+    ExReleaseRundownProtection(&GlobalData.PortRundown);
+    return Status;
+}
+
+static NTSTATUS PortConnect(
+    PFLT_PORT ClientPort,
+    PVOID ServerPortCookie,
+    PVOID ConnectionContext,
+    ULONG SizeOfContext,
+    PVOID* ConnectionPortCookie
+) {
+    UNREFERENCED_PARAMETER(ServerPortCookie);
+
+    if (!ConnectionPortCookie) return STATUS_INVALID_PARAMETER;
+    if (!IsAuthorizedClientConnection(ConnectionContext, SizeOfContext)) return STATUS_ACCESS_DENIED;
+    *ConnectionPortCookie = NULL;
+
+    if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    LONG DriverState = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (DriverState != PyasDriverStateRunning && DriverState != PyasDriverStateStopRetry) {
+        return STATUS_DEVICE_NOT_READY;
+    }
+
+    if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    PEPROCESS ConnectingProcess = PsGetCurrentProcess();
+    ObReferenceObject(ConnectingProcess);
+
+    NTSTATUS Status = STATUS_SUCCESS;
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
+    DriverState = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
+        Status = STATUS_DELETE_PENDING;
+    }
+    else if (DriverState != PyasDriverStateRunning && DriverState != PyasDriverStateStopRetry) {
+        Status = STATUS_DEVICE_NOT_READY;
+    }
+    else if (GlobalData.ClientPort || GlobalData.PyasProcess) {
+        Status = STATUS_DEVICE_BUSY;
+    }
+    else {
+        GlobalData.ClientPort = ClientPort;
+        GlobalData.PyasProcess = ConnectingProcess;
+        *ConnectionPortCookie = ConnectingProcess;
+    }
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+
+    if (!NT_SUCCESS(Status)) {
+        ObDereferenceObject(ConnectingProcess);
+        ExReleaseRundownProtection(&GlobalData.PortRundown);
+        return Status;
+    }
+
+    SafeSetPyasPid((ULONG)(ULONG_PTR)PsGetCurrentProcessId());
+    InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+    ExReleaseRundownProtection(&GlobalData.PortRundown);
+    return STATUS_SUCCESS;
+}
+
+static VOID PortDisconnect(PVOID ConnectionCookie) {
+    if (!ConnectionCookie) return;
+
+    PEPROCESS Process = DetachConnectedProcessReference((PEPROCESS)ConnectionCookie);
+    if (!Process) return;
+
+    CloseCurrentClientPort();
+    InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+    SafeSetPyasPid(0);
+    ObDereferenceObject(Process);
+}
+
+CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
+    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
+    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
+    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
+    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
+    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
+    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
+    { IRP_MJ_OPERATION_END }
+};
+
+CONST FLT_REGISTRATION FilterRegistration = {
+    sizeof(FLT_REGISTRATION),
+    FLT_REGISTRATION_VERSION,
+    0,
+    NULL,
+    Callbacks,
+    DriverUnload,
+    InstanceSetup,
+    InstanceQueryTeardown,
+    InstanceTeardownStart,
+    InstanceTeardownComplete,
+    NULL,
+    NULL,
+    NULL
+};
+
+extern "C" NTSTATUS DriverEntry(
+    PDRIVER_OBJECT DriverObject,
+    PUNICODE_STRING RegistryPath
+) {
+    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
+    GlobalData.DriverObject = DriverObject;
+    GlobalData.ClientImagePath.Buffer = GlobalData.ClientImagePathBuffer;
+    GlobalData.ClientImagePath.MaximumLength = sizeof(GlobalData.ClientImagePathBuffer);
+    KeInitializeSpinLock(&GlobalData.PortMutex);
+    KeInitializeSpinLock(&GlobalData.TrackerMutex);
+    KeInitializeSpinLock(&GlobalData.PidLock);
+    ExInitializeRundownProtection(&GlobalData.PortRundown);
+    KeInitializeEvent(&GlobalData.CleanupCompleteEvent, NotificationEvent, FALSE);
+    InterlockedExchange(&GlobalData.PortStopping, 0);
+    InterlockedExchange(&GlobalData.ClientCloseActive, 0);
+    InterlockedExchange(&GlobalData.DriverState, PyasDriverStateStarting);
+
+    NTSTATUS Status = STATUS_SUCCESS;
+    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
+
+    Status = InitializeRulesEngine();
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&GlobalData.DriverState, PyasDriverStateStopped);
+        KeSetEvent(&GlobalData.CleanupCompleteEvent, IO_NO_INCREMENT, FALSE);
+        return Status;
+    }
+    g_RulesEngineInitialized = TRUE;
+
+    Status = LoadRulesFromDisk(RegistryPath);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = LoadClientIdentityFromRegistry(RegistryPath);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = FltBuildDefaultSecurityDescriptor(&SecurityDescriptor, FLT_PORT_ALL_ACCESS);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    {
+        UNICODE_STRING PortName;
+        RtlInitUnicodeString(&PortName, PYAS_PORT_NAME);
+
+        OBJECT_ATTRIBUTES ObjectAttributes;
+        InitializeObjectAttributes(
+            &ObjectAttributes,
+            &PortName,
+            OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
+            NULL,
+            SecurityDescriptor
+        );
+
+        Status = FltCreateCommunicationPort(
+            GlobalData.FilterHandle,
+            &GlobalData.ServerPort,
+            &ObjectAttributes,
+            NULL,
+            PortConnect,
+            PortDisconnect,
+            PortMessage,
+            1
+        );
+    }
+
+    FltFreeSecurityDescriptor(SecurityDescriptor);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = InitializeRegistryProtection(DriverObject);
+    if (!NT_SUCCESS(Status)) goto Failure;
+    g_RegistryProtectionInitialized = TRUE;
+
+    Status = InitializeProcessProtection();
+    if (!NT_SUCCESS(Status)) goto Failure;
+    g_ProcessProtectionInitialized = TRUE;
+
+    Status = PsSetCreateProcessNotifyRoutineEx(ProcessNotifyCallbackEx, FALSE);
+    if (!NT_SUCCESS(Status)) goto Failure;
+    g_ProcessNotifyRegistered = TRUE;
+
+    Status = InitializeMemoryProtection(DriverObject);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = FltStartFiltering(GlobalData.FilterHandle);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    GlobalData.Initialized = TRUE;
+    InterlockedExchange(&GlobalData.DriverState, PyasDriverStateRunning);
+    return STATUS_SUCCESS;
+
+Failure:
+    CleanupDriverState(TRUE);
+    InterlockedExchange(&GlobalData.DriverState, PyasDriverStateStopped);
+    KeSetEvent(&GlobalData.CleanupCompleteEvent, IO_NO_INCREMENT, FALSE);
+    return Status;
+}

Plugins/Filter/PYAS_Driver.vcxproj

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|x64">
@@ -92,6 +92,7 @@
     </ClCompile>
     <Link>
       <AdditionalDependencies>$(DDK_LIB_PATH)fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -103,6 +104,7 @@
     </ClCompile>
     <Link>
       <AdditionalDependencies>$(DDK_LIB_PATH)fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
@@ -118,6 +120,7 @@
     <ClCompile Include="DriverEntry.cpp" />
     <ClCompile Include="ProtectBoot.cpp" />
     <ClCompile Include="ProtectFile.cpp" />
+    <ClCompile Include="ProtectMemory.cpp" />
     <ClCompile Include="ProtectProcess.cpp" />
     <ClCompile Include="ProtectRegistry.cpp" />
     <ClCompile Include="ProtectRules.cpp" />

Plugins/Filter/PYAS_Driver.vcxproj.filters

@@ -47,5 +47,8 @@
     <ClCompile Include="DriverEntry.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="ProtectMemory.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
   </ItemGroup>
 </Project>

Plugins/Filter/ProtectBoot.cpp

@@ -22,9 +22,13 @@ FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data,
         IoControlCode == IOCTL_DISK_FORMAT_TRACKS_EX) {
 
         HANDLE Pid = PsGetCurrentProcessId();
-        if (!IsProcessTrusted(Pid)) {
+        ULONG RuleCode = 0;
+        BOOLEAN Kill = FALSE;
+
+        if (EvaluateDeviceRule(Pid, &RuleCode, &Kill)) {
             UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
-            SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
+            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
+            QueueRuleProcessTermination(Pid, Kill);
             Data->IoStatus.Status = STATUS_ACCESS_DENIED;
             return FLT_PREOP_COMPLETE;
         }

Plugins/Filter/ProtectFile.cpp

@@ -1,14 +1,5 @@
 #include "DriverCommon.h"
 
-static BOOLEAN IsHoneyToken(PUNICODE_STRING Path) {
-    if (!Path || !Path->Buffer) return FALSE;
-    if (WildcardMatch(L"*PYAS_Honey*", Path->Buffer, Path->Length) ||
-        WildcardMatch(L"*Backup_Secret*", Path->Buffer, Path->Length)) {
-        return TRUE;
-    }
-    return FALSE;
-}
-
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
     UNREFERENCED_PARAMETER(FltObjects);
     UNREFERENCED_PARAMETER(CompletionContext);
@@ -17,93 +8,39 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    UNICODE_STRING FileName = { 0 };
-    NTSTATUS status = STATUS_SUCCESS;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
+    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+    if (!NT_SUCCESS(status) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status)) {
-        FltReleaseFileNameInformation(nameInfo);
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
-
-    FileName = nameInfo->Name;
-    if (!FileName.Buffer || FileName.Length == 0) {
+    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer || nameInfo->Name.Length == 0) {
         FltReleaseFileNameInformation(nameInfo);
         return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
 
     HANDLE Pid = PsGetCurrentProcessId();
-    BOOLEAN Trusted = IsProcessTrusted(Pid);
+    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     ULONG CreateDisposition = (Data->Iopb->Parameters.Create.Options >> 24) & 0xFF;
-    BOOLEAN IsCreateAction = (CreateDisposition == FILE_CREATE ||
-        CreateDisposition == FILE_SUPERSEDE ||
-        CreateDisposition == FILE_OVERWRITE ||
-        CreateDisposition == FILE_OVERWRITE_IF ||
-        CreateDisposition == FILE_OPEN_IF);
+    BOOLEAN IsCreateAction = (CreateDisposition == FILE_CREATE || CreateDisposition == FILE_SUPERSEDE || CreateDisposition == FILE_OVERWRITE || CreateDisposition == FILE_OVERWRITE_IF || CreateDisposition == FILE_OPEN_IF);
+    ULONG DesiredAccess = Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;
 
-    if (IsHoneyToken(&FileName)) {
-        if (!Trusted) {
-            if ((Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE)) || IsCreateAction) {
-                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
+    ULONG Operation = 0;
+    if (IsCreateAction) Operation |= OP_CREATE;
+    if (DesiredAccess & (FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | WRITE_DAC | WRITE_OWNER | GENERIC_WRITE)) Operation |= OP_WRITE;
+    if (DesiredAccess & (DELETE | FILE_DELETE_CHILD)) Operation |= OP_DELETE;
+
+    if (Operation != 0) {
+        ULONG RuleCode = 0;
+        BOOLEAN Kill = FALSE;
+        if (EvaluateFileRule(Pid, &nameInfo->Name, Operation, NULL, 0, &RuleCode, &Kill)) {
+            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+            QueueRuleProcessTermination(Pid, Kill);
+            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+            callbackStatus = FLT_PREOP_COMPLETE;
         }
     }
 
-    if (WildcardMatch(L"\\Device\\PhysicalDrive*", FileName.Buffer, FileName.Length) ||
-        (WildcardMatch(L"\\Device\\Harddisk*", FileName.Buffer, FileName.Length) && !WildcardMatch(L"*Volume*", FileName.Buffer, FileName.Length))) {
-
-        if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
-            (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE | WRITE_DAC | WRITE_OWNER)) {
-
-            if (!Trusted) {
-                UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
-                SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
-    }
-
-    if (CheckProtectedPathRule(&FileName)) {
-        if (!Trusted) {
-            if ((Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
-                (FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | DELETE | WRITE_DAC | GENERIC_WRITE)) || IsCreateAction) {
-                SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
-    }
-
-    if (CheckFileExtensionRule(&FileName)) {
-        if (!Trusted) {
-            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (DELETE | FILE_DELETE_CHILD)) {
-                if (CheckRansomActivity(Pid, &FileName, NULL, 0, FALSE)) {
-                    SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
-                    Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                    callbackStatus = FLT_PREOP_COMPLETE;
-                    goto cleanup;
-                }
-            }
-        }
-    }
-
-cleanup:
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
-    }
+    FltReleaseFileNameInformation(nameInfo);
     return callbackStatus;
 }
 
@@ -115,178 +52,92 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     FILE_INFORMATION_CLASS infoClass = Data->Iopb->Parameters.SetFileInformation.FileInformationClass;
-
-    if (infoClass != FileDispositionInformation &&
-        infoClass != FileRenameInformation &&
-        infoClass != FileRenameInformationEx) {
+    if (infoClass != FileDispositionInformation && infoClass != FileRenameInformation && infoClass != FileRenameInformationEx) {
         return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
 
     PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
-
-    if (!NT_SUCCESS(status) || !nameInfo) goto cleanup;
-
-    status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup;
+    if (!NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (!NT_SUCCESS(FltParseFileNameInformation(nameInfo)) || !nameInfo->Name.Buffer) {
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
 
     HANDLE Pid = PsGetCurrentProcessId();
-    if (!IsProcessTrusted(Pid)) {
-        if (CheckProtectedPathRule(&nameInfo->Name)) {
-            SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-            callbackStatus = FLT_PREOP_COMPLETE;
-            goto cleanup;
-        }
-
-        if (CheckFileExtensionRule(&nameInfo->Name)) {
-            if (CheckRansomActivity(Pid, &nameInfo->Name, NULL, 0, FALSE)) {
-                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
-    }
-
-cleanup:
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
-    }
-    return callbackStatus;
-}
-
-FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(CompletionContext);
-
-    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
     FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+    ULONG Operation = 0;
 
-    if (!NT_SUCCESS(status) || !nameInfo) goto cleanup;
-
-    status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup;
-
-    SECURITY_INFORMATION SecurityInfo = Data->Iopb->Parameters.SetSecurity.SecurityInformation;
-
-    if (SecurityInfo & (OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION)) {
-        if (CheckProtectedPathRule(&nameInfo->Name)) {
-            HANDLE Pid = PsGetCurrentProcessId();
-            if (!IsProcessTrusted(Pid)) {
-                SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
+    if (infoClass == FileDispositionInformation) {
+        Operation = OP_DELETE;
+    }
+    else {
+        Operation = OP_RENAME;
     }
 
-cleanup:
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (EvaluateFileRule(Pid, &nameInfo->Name, Operation, NULL, 0, &RuleCode, &Kill)) {
+        SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+        QueueRuleProcessTermination(Pid, Kill);
+        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+        callbackStatus = FLT_PREOP_COMPLETE;
     }
+
+    FltReleaseFileNameInformation(nameInfo);
     return callbackStatus;
 }
 
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
-    UNREFERENCED_PARAMETER(CompletionContext);
     UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
 
     if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
+    if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     ULONG WriteLength = Data->Iopb->Parameters.Write.Length;
     if (WriteLength == 0) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
-
-    if (!NT_SUCCESS(status) || !nameInfo) goto cleanup;
-
-    status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup;
-
-    if (CheckFileExtensionRule(&nameInfo->Name)) {
-        HANDLE Pid = PsGetCurrentProcessId();
-
-        if (!IsProcessTrusted(Pid)) {
-            PVOID SystemBuffer = NULL;
-            PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
-
-            if (!Mdl) {
-                if (Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) {
-                    if (NT_SUCCESS(FltLockUserBuffer(Data))) {
-                        Mdl = Data->Iopb->Parameters.Write.MdlAddress;
-                    }
-                }
-            }
-
-            if (Mdl) {
-                SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
-            }
-
-            if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
-                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-            }
-        }
-    }
-
-cleanup:
-    if (nameInfo) {
+    if (!NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (!NT_SUCCESS(FltParseFileNameInformation(nameInfo)) || !nameInfo->Name.Buffer) {
         FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
+
+    HANDLE Pid = PsGetCurrentProcessId();
+    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    PVOID SystemBuffer = NULL;
+    PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
+    if (!Mdl && Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) {
+        if (NT_SUCCESS(FltLockUserBuffer(Data))) Mdl = Data->Iopb->Parameters.Write.MdlAddress;
+    }
+    if (Mdl) SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
+
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (EvaluateFileRule(Pid, &nameInfo->Name, OP_WRITE, SystemBuffer, WriteLength, &RuleCode, &Kill)) {
+        SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+        QueueRuleProcessTermination(Pid, Kill);
+        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+        callbackStatus = FLT_PREOP_COMPLETE;
+    }
+
+    FltReleaseFileNameInformation(nameInfo);
     return callbackStatus;
 }
 
-FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(Data);
     UNREFERENCED_PARAMETER(FltObjects);
     UNREFERENCED_PARAMETER(CompletionContext);
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
 
-    if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode != FSCTL_MANAGE_BYPASS_IO) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
-
-    PFS_BPIO_INPUT InputBuffer = (PFS_BPIO_INPUT)Data->Iopb->Parameters.FileSystemControl.Neither.InputBuffer;
-    if (!InputBuffer) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    FS_BPIO_OPERATIONS Operation;
-
-    __try {
-        Operation = InputBuffer->Operation;
-    }
-    __except (EXCEPTION_EXECUTE_HANDLER) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
-
-    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    if (Operation == FS_BPIO_OP_ENABLE) {
-        if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) {
-            if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) {
-                if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
-                    Data->IoStatus.Status = STATUS_NOT_SUPPORTED;
-                    callbackStatus = FLT_PREOP_COMPLETE;
-                }
-            }
-        }
-    }
-
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
-    }
-    return callbackStatus;
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(Data);
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
 }

Plugins/Filter/ProtectMemory.cpp

@@ -0,0 +1,818 @@
+#include "DriverCommon.h"
+
+extern "C" {
+    NTSTATUS ZwOpenThread(
+        PHANDLE ThreadHandle,
+        ACCESS_MASK DesiredAccess,
+        POBJECT_ATTRIBUTES ObjectAttributes,
+        PCLIENT_ID ClientId
+    );
+
+    NTSTATUS ZwQueryInformationThread(
+        HANDLE ThreadHandle,
+        THREADINFOCLASS ThreadInformationClass,
+        PVOID ThreadInformation,
+        ULONG ThreadInformationLength,
+        PULONG ReturnLength
+    );
+}
+
+#ifndef THREAD_QUERY_INFORMATION
+#define THREAD_QUERY_INFORMATION 0x0040
+#endif
+
+#define THREAD_QUERY_SET_WIN32_START_ADDRESS 9
+
+constexpr ULONG PYAS_MEM_IMAGE_TYPE = 0x01000000UL;
+
+typedef enum _MEMORY_WORK_TYPE {
+    MemoryWorkThreadAnalysis = 1,
+    MemoryWorkViolationReport = 2
+} MEMORY_WORK_TYPE;
+
+typedef struct _MEMORY_WORK_ITEM {
+    LIST_ENTRY Entry;
+    MEMORY_WORK_TYPE Type;
+    PEPROCESS SourceProcess;
+    PEPROCESS TargetProcess;
+    HANDLE SourcePid;
+    HANDLE TargetPid;
+    HANDLE ThreadId;
+    ULONG RuleCode;
+    BOOLEAN Kill;
+    WCHAR FallbackMessage[64];
+} MEMORY_WORK_ITEM, * PMEMORY_WORK_ITEM;
+
+typedef struct _THREAD_MEMORY_REGION {
+    PVOID StartAddress;
+    ULONG MemoryType;
+    ULONG MemoryProtection;
+    SIZE_T RegionSize;
+} THREAD_MEMORY_REGION, * PTHREAD_MEMORY_REGION;
+
+static BOOLEAN g_ThreadNotifyRegistered = FALSE;
+static BOOLEAN g_LoadImageNotifyRegistered = FALSE;
+static BOOLEAN g_MemoryProtectionInitialized = FALSE;
+static BOOLEAN g_MemoryRundownCompleted = FALSE;
+static EX_RUNDOWN_REF g_MemoryRundown;
+static volatile LONG g_MemoryStopping = 1;
+static volatile LONG g_PendingMemoryWork = 0;
+static LIST_ENTRY g_MemoryWorkQueue;
+static KSPIN_LOCK g_MemoryWorkLock;
+static KSEMAPHORE g_MemoryWorkSemaphore;
+static HANDLE g_MemoryWorkerHandle = NULL;
+constexpr auto MAX_PENDING_MEMORY_WORK = 256;
+constexpr auto MEMORY_WORKER_STOP_TIMEOUT_MS = 2000;
+
+static PACCESS_MASK GetDesiredAccessPointer(POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE) {
+        return &OperationInformation->Parameters->CreateHandleInformation.DesiredAccess;
+    }
+
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+        return &OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess;
+    }
+
+    return NULL;
+}
+
+static ULONG GetHandleType(POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE) {
+        return PYAS_HANDLE_CREATE;
+    }
+
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+        return PYAS_HANDLE_DUPLICATE;
+    }
+
+    return 0;
+}
+
+static ULONG GetProcessOperations(ACCESS_MASK Access) {
+    ULONG Operations = 0;
+
+    if (Access & PROCESS_VM_READ) Operations |= OP_VM_READ;
+    if (Access & PROCESS_VM_WRITE) Operations |= OP_VM_WRITE;
+    if (Access & PROCESS_VM_OPERATION) Operations |= OP_VM_OPERATION;
+    if (Access & PROCESS_CREATE_THREAD) Operations |= OP_CREATE_THREAD;
+    if (Access & PROCESS_TERMINATE) Operations |= OP_TERMINATE;
+    if (Access & PROCESS_SUSPEND_RESUME) Operations |= OP_SUSPEND_RESUME;
+    if (Access & PROCESS_DUP_HANDLE) Operations |= OP_DUP_HANDLE;
+    if (Access & (PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA)) Operations |= OP_SET_INFORMATION;
+    if (Access & PROCESS_CREATE_PROCESS) Operations |= OP_CREATE_PROCESS;
+
+    return Operations;
+}
+
+static ULONG GetThreadOperations(ACCESS_MASK Access) {
+    ULONG Operations = 0;
+
+    if (Access & THREAD_SET_CONTEXT) Operations |= OP_THREAD_SET_CONTEXT;
+    if (Access & THREAD_TERMINATE) Operations |= OP_TERMINATE;
+    if (Access & THREAD_SUSPEND_RESUME) Operations |= OP_SUSPEND_RESUME;
+    if (Access & THREAD_SET_INFORMATION) Operations |= OP_SET_INFORMATION;
+    if (Access & THREAD_SET_THREAD_TOKEN) Operations |= OP_THREAD_SET_TOKEN;
+    if (Access & (THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION)) Operations |= OP_IMPERSONATE;
+
+    return Operations;
+}
+
+static ACCESS_MASK GetProcessDeniedAccess(ULONG Operations) {
+    ACCESS_MASK DeniedAccess = 0;
+
+    if (Operations & OP_VM_READ) DeniedAccess |= PROCESS_VM_READ;
+    if (Operations & OP_VM_WRITE) DeniedAccess |= PROCESS_VM_WRITE;
+    if (Operations & OP_VM_OPERATION) DeniedAccess |= PROCESS_VM_OPERATION;
+    if (Operations & OP_CREATE_THREAD) DeniedAccess |= PROCESS_CREATE_THREAD;
+    if (Operations & OP_TERMINATE) DeniedAccess |= PROCESS_TERMINATE;
+    if (Operations & OP_SUSPEND_RESUME) DeniedAccess |= PROCESS_SUSPEND_RESUME;
+    if (Operations & OP_DUP_HANDLE) DeniedAccess |= PROCESS_DUP_HANDLE;
+    if (Operations & OP_SET_INFORMATION) DeniedAccess |= PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA;
+    if (Operations & OP_CREATE_PROCESS) DeniedAccess |= PROCESS_CREATE_PROCESS;
+
+    return DeniedAccess;
+}
+
+static ACCESS_MASK GetThreadDeniedAccess(ULONG Operations) {
+    ACCESS_MASK DeniedAccess = 0;
+
+    if (Operations & OP_THREAD_SET_CONTEXT) DeniedAccess |= THREAD_SET_CONTEXT;
+    if (Operations & OP_TERMINATE) DeniedAccess |= THREAD_TERMINATE;
+    if (Operations & OP_SUSPEND_RESUME) DeniedAccess |= THREAD_SUSPEND_RESUME;
+    if (Operations & OP_SET_INFORMATION) DeniedAccess |= THREAD_SET_INFORMATION;
+    if (Operations & OP_THREAD_SET_TOKEN) DeniedAccess |= THREAD_SET_THREAD_TOKEN;
+    if (Operations & OP_IMPERSONATE) DeniedAccess |= THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION;
+
+    return DeniedAccess;
+}
+
+static BOOLEAN IsProcessIdentityCurrent(HANDLE ProcessId, PEPROCESS ExpectedProcess);
+
+static VOID ReleaseMemoryWork(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return;
+
+    if (Work->TargetProcess) ObDereferenceObject(Work->TargetProcess);
+    if (Work->SourceProcess) ObDereferenceObject(Work->SourceProcess);
+    InterlockedDecrement(&g_PendingMemoryWork);
+    PyasFree(Work);
+}
+
+static PMEMORY_WORK_ITEM PopMemoryWork() {
+    PMEMORY_WORK_ITEM Work = NULL;
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_MemoryWorkLock, &OldIrql);
+
+    if (!IsListEmpty(&g_MemoryWorkQueue)) {
+        PLIST_ENTRY Entry = RemoveHeadList(&g_MemoryWorkQueue);
+        Work = CONTAINING_RECORD(Entry, MEMORY_WORK_ITEM, Entry);
+    }
+
+    KeReleaseSpinLock(&g_MemoryWorkLock, OldIrql);
+    return Work;
+}
+
+static VOID CancelQueuedMemoryWork() {
+    for (;;) {
+        PMEMORY_WORK_ITEM Work = PopMemoryWork();
+        if (!Work) return;
+        ReleaseMemoryWork(Work);
+    }
+}
+
+static BOOLEAN QueueMemoryWork(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return FALSE;
+
+    LONG Pending = InterlockedIncrement(&g_PendingMemoryWork);
+    if (Pending > MAX_PENDING_MEMORY_WORK) {
+        InterlockedDecrement(&g_PendingMemoryWork);
+        return FALSE;
+    }
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_MemoryWorkLock, &OldIrql);
+
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) {
+        KeReleaseSpinLock(&g_MemoryWorkLock, OldIrql);
+        InterlockedDecrement(&g_PendingMemoryWork);
+        return FALSE;
+    }
+
+    InsertTailList(&g_MemoryWorkQueue, &Work->Entry);
+    KeReleaseSpinLock(&g_MemoryWorkLock, OldIrql);
+    KeReleaseSemaphore(&g_MemoryWorkSemaphore, IO_NO_INCREMENT, 1, FALSE);
+    return TRUE;
+}
+
+static VOID DeliverViolation(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    BOOLEAN SourceMatches = IsProcessIdentityCurrent(Work->SourcePid, Work->SourceProcess);
+    BOOLEAN TargetMatches = IsProcessIdentityCurrent(Work->TargetPid, Work->TargetProcess);
+    if (!SourceMatches || !TargetMatches) return;
+
+    PUNICODE_STRING TargetPath = NULL;
+
+    if (NT_SUCCESS(GetProcessImageName(Work->TargetPid, &TargetPath)) && TargetPath && TargetPath->Buffer) {
+        SendMessageToUser(
+            Work->RuleCode,
+            (ULONG)(ULONG_PTR)Work->SourcePid,
+            TargetPath->Buffer,
+            TargetPath->Length
+        );
+    }
+    else {
+        UNICODE_STRING MessageString;
+        RtlInitUnicodeString(&MessageString, Work->FallbackMessage);
+        SendMessageToUser(
+            Work->RuleCode,
+            (ULONG)(ULONG_PTR)Work->SourcePid,
+            MessageString.Buffer,
+            MessageString.Length
+        );
+    }
+
+    if (TargetPath) ExFreePool(TargetPath);
+    QueueRuleProcessTermination(Work->SourcePid, Work->Kill);
+}
+
+static VOID ReportViolation(
+    ULONG RuleCode,
+    BOOLEAN Kill,
+    HANDLE SourcePid,
+    HANDLE TargetPid,
+    PCWSTR FallbackMessage
+) {
+    if (!RuleCode || !SourcePid || !TargetPid || !FallbackMessage) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    PEPROCESS SourceProcess = NULL;
+    PEPROCESS TargetProcess = NULL;
+
+    NTSTATUS Status = PsLookupProcessByProcessId(SourcePid, &SourceProcess);
+    if (NT_SUCCESS(Status)) {
+        Status = PsLookupProcessByProcessId(TargetPid, &TargetProcess);
+    }
+
+    if (!NT_SUCCESS(Status)) {
+        if (SourceProcess) ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    PMEMORY_WORK_ITEM Work = (PMEMORY_WORK_ITEM)PyasAllocate(sizeof(MEMORY_WORK_ITEM));
+    if (!Work) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    RtlZeroMemory(Work, sizeof(*Work));
+    Work->Type = MemoryWorkViolationReport;
+    Work->SourceProcess = SourceProcess;
+    Work->TargetProcess = TargetProcess;
+    Work->SourcePid = SourcePid;
+    Work->TargetPid = TargetPid;
+    Work->RuleCode = RuleCode;
+    Work->Kill = Kill;
+    RtlStringCchCopyW(Work->FallbackMessage, RTL_NUMBER_OF(Work->FallbackMessage), FallbackMessage);
+
+    if (!QueueMemoryWork(Work)) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        PyasFree(Work);
+    }
+}
+
+static BOOLEAN IsExecuteProtection(ULONG Protect) {
+    ULONG BaseProtect = Protect & 0xFF;
+
+    return BaseProtect == PAGE_EXECUTE ||
+        BaseProtect == PAGE_EXECUTE_READ ||
+        BaseProtect == PAGE_EXECUTE_READWRITE ||
+        BaseProtect == PAGE_EXECUTE_WRITECOPY;
+}
+
+static BOOLEAN IsExecuteWriteProtection(ULONG Protect) {
+    ULONG BaseProtect = Protect & 0xFF;
+
+    return BaseProtect == PAGE_EXECUTE_READWRITE ||
+        BaseProtect == PAGE_EXECUTE_WRITECOPY;
+}
+
+static BOOLEAN QueryThreadMemoryRegionForProcess(
+    PEPROCESS Process,
+    PVOID Address,
+    PTHREAD_MEMORY_REGION Region
+) {
+    if (!Process || !Region || !Address || KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    RtlZeroMemory(Region, sizeof(*Region));
+
+    KAPC_STATE ApcState;
+    KeStackAttachProcess(Process, &ApcState);
+
+    MEMORY_BASIC_INFORMATION MemoryInformation = { 0 };
+    SIZE_T ReturnLength = 0;
+    NTSTATUS Status = ZwQueryVirtualMemory(
+        ZwCurrentProcess(),
+        Address,
+        MemoryBasicInformation,
+        &MemoryInformation,
+        sizeof(MemoryInformation),
+        &ReturnLength
+    );
+
+    KeUnstackDetachProcess(&ApcState);
+
+    if (!NT_SUCCESS(Status)) return FALSE;
+    if (MemoryInformation.State != MEM_COMMIT) return FALSE;
+    if (!IsExecuteProtection(MemoryInformation.Protect)) return FALSE;
+
+    Region->StartAddress = Address;
+    Region->RegionSize = MemoryInformation.RegionSize;
+
+    if (MemoryInformation.Type == MEM_PRIVATE) Region->MemoryType = PYAS_MEMORY_PRIVATE;
+    else if (MemoryInformation.Type == MEM_MAPPED) Region->MemoryType = PYAS_MEMORY_MAPPED;
+    else if (MemoryInformation.Type == PYAS_MEM_IMAGE_TYPE) Region->MemoryType = PYAS_MEMORY_IMAGE;
+    else return FALSE;
+
+    Region->MemoryProtection = PYAS_PROTECT_EXECUTE;
+    if (IsExecuteWriteProtection(MemoryInformation.Protect)) {
+        Region->MemoryProtection |= PYAS_PROTECT_EXECUTE_WRITE;
+    }
+
+    return TRUE;
+}
+
+static BOOLEAN QueryThreadMemoryRegion(
+    HANDLE ProcessId,
+    PVOID Address,
+    PTHREAD_MEMORY_REGION Region
+) {
+    if (!ProcessId) return FALSE;
+
+    PEPROCESS Process = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
+    BOOLEAN Result = QueryThreadMemoryRegionForProcess(Process, Address, Region);
+    ObDereferenceObject(Process);
+    return Result;
+}
+
+BOOLEAN IsAddressInUnmappedMemory(HANDLE ProcessId, PVOID Address) {
+    THREAD_MEMORY_REGION Region = { 0 };
+    if (!QueryThreadMemoryRegion(ProcessId, Address, &Region)) return FALSE;
+    return Region.MemoryType == PYAS_MEMORY_PRIVATE;
+}
+
+static BOOLEAN IsProcessIdentityCurrent(HANDLE ProcessId, PEPROCESS ExpectedProcess) {
+    if (!ProcessId || !ExpectedProcess) return FALSE;
+
+    PEPROCESS CurrentProcess = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &CurrentProcess);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
+    BOOLEAN Matches = CurrentProcess == ExpectedProcess;
+    ObDereferenceObject(CurrentProcess);
+    return Matches;
+}
+
+static OB_PREOP_CALLBACK_STATUS ObjectPreCallbackCore(
+    POB_PRE_OPERATION_INFORMATION OperationInformation
+) {
+    if (!OperationInformation || OperationInformation->KernelHandle) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    PACCESS_MASK DesiredAccess = GetDesiredAccessPointer(OperationInformation);
+    ULONG HandleType = GetHandleType(OperationInformation);
+
+    if (!DesiredAccess || *DesiredAccess == 0 || HandleType == 0) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    HANDLE SourcePid = PsGetCurrentProcessId();
+    if (!SourcePid || IsProcessTrusted(SourcePid)) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    HANDLE TargetPid = NULL;
+    ULONG ObjectType = 0;
+    ULONG RequestedOperations = 0;
+    ACCESS_MASK OriginalAccess = *DesiredAccess;
+
+    if (OperationInformation->ObjectType == *PsProcessType) {
+        TargetPid = PsGetProcessId((PEPROCESS)OperationInformation->Object);
+        ObjectType = PYAS_OBJECT_PROCESS;
+        RequestedOperations = GetProcessOperations(OriginalAccess);
+    }
+    else if (OperationInformation->ObjectType == *PsThreadType) {
+        TargetPid = PsGetThreadProcessId((PETHREAD)OperationInformation->Object);
+        ObjectType = PYAS_OBJECT_THREAD;
+        RequestedOperations = GetThreadOperations(OriginalAccess);
+    }
+    else {
+        return OB_PREOP_SUCCESS;
+    }
+
+    if (!TargetPid || SourcePid == TargetPid || RequestedOperations == 0) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    ULONG DeniedOperations = 0;
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+
+    if (!EvaluateProcessAccessRule(
+        SourcePid,
+        TargetPid,
+        RequestedOperations,
+        HandleType,
+        ObjectType,
+        &DeniedOperations,
+        &RuleCode,
+        &Kill
+    )) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    ACCESS_MASK DeniedAccess = ObjectType == PYAS_OBJECT_PROCESS
+        ? GetProcessDeniedAccess(DeniedOperations)
+        : GetThreadDeniedAccess(DeniedOperations);
+
+    ACCESS_MASK EffectiveDeniedAccess = OriginalAccess & DeniedAccess;
+    if (EffectiveDeniedAccess == 0) return OB_PREOP_SUCCESS;
+
+    *DesiredAccess = OriginalAccess & ~EffectiveDeniedAccess;
+
+    ReportViolation(
+        RuleCode,
+        Kill,
+        SourcePid,
+        TargetPid,
+        ObjectType == PYAS_OBJECT_PROCESS
+        ? L"Process_Handle_Access_Denied"
+        : L"Thread_Handle_Access_Denied"
+    );
+
+    return OB_PREOP_SUCCESS;
+}
+
+static OB_PREOP_CALLBACK_STATUS ObjectPreCallback(
+    PVOID RegistrationContext,
+    POB_PRE_OPERATION_INFORMATION OperationInformation
+) {
+    UNREFERENCED_PARAMETER(RegistrationContext);
+
+    if (!g_MemoryProtectionInitialized) return OB_PREOP_SUCCESS;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return OB_PREOP_SUCCESS;
+    if (!ExAcquireRundownProtection(&g_MemoryRundown)) return OB_PREOP_SUCCESS;
+
+    OB_PREOP_CALLBACK_STATUS Result = ObjectPreCallbackCore(OperationInformation);
+    ExReleaseRundownProtection(&g_MemoryRundown);
+    return Result;
+}
+
+static VOID ProcessThreadAnalysis(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    PVOID StartAddress = NULL;
+    HANDLE ThreadHandle = NULL;
+    BOOLEAN IdentityValid =
+        IsProcessIdentityCurrent(Work->SourcePid, Work->SourceProcess) &&
+        IsProcessIdentityCurrent(Work->TargetPid, Work->TargetProcess);
+    CLIENT_ID ClientId = { Work->TargetPid, Work->ThreadId };
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
+
+    NTSTATUS Status = STATUS_PROCESS_IS_TERMINATING;
+    if (IdentityValid) {
+        Status = ZwOpenThread(
+            &ThreadHandle,
+            THREAD_QUERY_INFORMATION,
+            &ObjectAttributes,
+            &ClientId
+        );
+    }
+
+    if (NT_SUCCESS(Status)) {
+        Status = ZwQueryInformationThread(
+            ThreadHandle,
+            (THREADINFOCLASS)THREAD_QUERY_SET_WIN32_START_ADDRESS,
+            &StartAddress,
+            sizeof(StartAddress),
+            NULL
+        );
+        ZwClose(ThreadHandle);
+    }
+
+    if (!NT_SUCCESS(Status) || !StartAddress) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    THREAD_MEMORY_REGION Region = { 0 };
+    if (!QueryThreadMemoryRegionForProcess(Work->TargetProcess, StartAddress, &Region)) return;
+
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (!EvaluateThreadRule(
+        Work->SourcePid,
+        Work->TargetPid,
+        StartAddress,
+        Region.MemoryType,
+        Region.MemoryProtection,
+        Region.RegionSize,
+        &RuleCode,
+        &Kill
+    )) {
+        return;
+    }
+
+    Work->RuleCode = RuleCode;
+    Work->Kill = Kill;
+    RtlStringCchCopyW(
+        Work->FallbackMessage,
+        RTL_NUMBER_OF(Work->FallbackMessage),
+        L"Remote_Executable_Thread_Detected"
+    );
+    DeliverViolation(Work);
+}
+
+static VOID MemoryWorkerThread(PVOID Parameter) {
+    UNREFERENCED_PARAMETER(Parameter);
+
+    for (;;) {
+        KeWaitForSingleObject(
+            &g_MemoryWorkSemaphore,
+            Executive,
+            KernelMode,
+            FALSE,
+            NULL
+        );
+
+        if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) {
+            CancelQueuedMemoryWork();
+            break;
+        }
+
+        PMEMORY_WORK_ITEM Work = PopMemoryWork();
+        if (!Work) continue;
+
+        if (Work->Type == MemoryWorkThreadAnalysis) {
+            ProcessThreadAnalysis(Work);
+        }
+        else if (Work->Type == MemoryWorkViolationReport) {
+            DeliverViolation(Work);
+        }
+
+        ReleaseMemoryWork(Work);
+    }
+
+    PsTerminateSystemThread(STATUS_SUCCESS);
+}
+
+static VOID ThreadNotifyCallback(
+    HANDLE ProcessId,
+    HANDLE ThreadId,
+    BOOLEAN IsCreated
+) {
+    if (!IsCreated || !g_MemoryProtectionInitialized) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    HANDLE SourcePid = PsGetCurrentProcessId();
+    if (!SourcePid || SourcePid == ProcessId || IsProcessTrusted(SourcePid)) return;
+
+    PEPROCESS SourceProcess = PsGetCurrentProcess();
+    PEPROCESS TargetProcess = NULL;
+    ObReferenceObject(SourceProcess);
+
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &TargetProcess);
+    if (!NT_SUCCESS(Status)) {
+        ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    PMEMORY_WORK_ITEM Work = (PMEMORY_WORK_ITEM)PyasAllocate(sizeof(MEMORY_WORK_ITEM));
+    if (!Work) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    RtlZeroMemory(Work, sizeof(*Work));
+    Work->Type = MemoryWorkThreadAnalysis;
+    Work->SourceProcess = SourceProcess;
+    Work->TargetProcess = TargetProcess;
+    Work->SourcePid = SourcePid;
+    Work->TargetPid = ProcessId;
+    Work->ThreadId = ThreadId;
+
+    if (!QueueMemoryWork(Work)) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        PyasFree(Work);
+    }
+}
+
+static VOID LoadImageNotifyCallback(
+    PUNICODE_STRING FullImageName,
+    HANDLE ProcessId,
+    PIMAGE_INFO ImageInfo
+) {
+    if (!g_MemoryProtectionInitialized) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+    if (!FullImageName || !FullImageName->Buffer || !ImageInfo || ImageInfo->SystemModeImage) return;
+    if (!ProcessId || !ExAcquireRundownProtection(&g_MemoryRundown)) return;
+
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (EvaluateImageLoadRule(ProcessId, FullImageName, ImageInfo, &RuleCode, &Kill)) {
+        SendMessageToUser(
+            RuleCode,
+            (ULONG)(ULONG_PTR)ProcessId,
+            FullImageName->Buffer,
+            FullImageName->Length
+        );
+        QueueRuleProcessTermination(ProcessId, Kill);
+    }
+
+    ExReleaseRundownProtection(&g_MemoryRundown);
+}
+
+static NTSTATUS RemoveMemoryCallbacks() {
+    NTSTATUS FirstFailure = STATUS_SUCCESS;
+
+    if (GlobalData.ObRegistrationHandle) {
+        ObUnRegisterCallbacks(GlobalData.ObRegistrationHandle);
+        GlobalData.ObRegistrationHandle = NULL;
+    }
+
+    if (g_ThreadNotifyRegistered) {
+        NTSTATUS Status = PsRemoveCreateThreadNotifyRoutine(ThreadNotifyCallback);
+        if (NT_SUCCESS(Status) || Status == STATUS_PROCEDURE_NOT_FOUND) {
+            g_ThreadNotifyRegistered = FALSE;
+        }
+        else if (NT_SUCCESS(FirstFailure)) {
+            FirstFailure = Status;
+        }
+    }
+
+    if (g_LoadImageNotifyRegistered) {
+        NTSTATUS Status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyCallback);
+        if (NT_SUCCESS(Status) || Status == STATUS_PROCEDURE_NOT_FOUND) {
+            g_LoadImageNotifyRegistered = FALSE;
+        }
+        else if (NT_SUCCESS(FirstFailure)) {
+            FirstFailure = Status;
+        }
+    }
+
+    return FirstFailure;
+}
+
+static NTSTATUS StartMemoryWorker() {
+    if (g_MemoryWorkerHandle) return STATUS_SUCCESS;
+
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(
+        &ObjectAttributes,
+        NULL,
+        OBJ_KERNEL_HANDLE,
+        NULL,
+        NULL
+    );
+
+    return PsCreateSystemThread(
+        &g_MemoryWorkerHandle,
+        SYNCHRONIZE,
+        &ObjectAttributes,
+        NULL,
+        NULL,
+        MemoryWorkerThread,
+        NULL
+    );
+}
+
+static NTSTATUS StopMemoryWorker(BOOLEAN WaitWithoutTimeout) {
+    CancelQueuedMemoryWork();
+
+    if (!g_MemoryWorkerHandle) return STATUS_SUCCESS;
+
+    KeReleaseSemaphore(&g_MemoryWorkSemaphore, IO_NO_INCREMENT, 1, FALSE);
+
+    LARGE_INTEGER Timeout;
+    PLARGE_INTEGER TimeoutPointer = NULL;
+
+    if (!WaitWithoutTimeout) {
+        Timeout.QuadPart = -((LONGLONG)MEMORY_WORKER_STOP_TIMEOUT_MS * 10 * 1000);
+        TimeoutPointer = &Timeout;
+    }
+
+    NTSTATUS Status = ZwWaitForSingleObject(
+        g_MemoryWorkerHandle,
+        FALSE,
+        TimeoutPointer
+    );
+
+    if (Status == STATUS_TIMEOUT) return STATUS_DEVICE_BUSY;
+    if (!NT_SUCCESS(Status)) return Status;
+
+    ZwClose(g_MemoryWorkerHandle);
+    g_MemoryWorkerHandle = NULL;
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS InitializeMemoryProtection(PDRIVER_OBJECT DriverObject) {
+    UNREFERENCED_PARAMETER(DriverObject);
+
+    if (g_MemoryProtectionInitialized) return STATUS_SUCCESS;
+
+    InitializeListHead(&g_MemoryWorkQueue);
+    KeInitializeSpinLock(&g_MemoryWorkLock);
+    KeInitializeSemaphore(&g_MemoryWorkSemaphore, 0, MAXLONG);
+    ExInitializeRundownProtection(&g_MemoryRundown);
+    g_MemoryRundownCompleted = FALSE;
+    InterlockedExchange(&g_PendingMemoryWork, 0);
+    InterlockedExchange(&g_MemoryStopping, 0);
+    g_MemoryProtectionInitialized = TRUE;
+
+    NTSTATUS Status = StartMemoryWorker();
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&g_MemoryStopping, 1);
+        g_MemoryProtectionInitialized = FALSE;
+        return Status;
+    }
+
+    Status = PsSetCreateThreadNotifyRoutine(ThreadNotifyCallback);
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&g_MemoryStopping, 1);
+        StopMemoryWorker(TRUE);
+        g_MemoryProtectionInitialized = FALSE;
+        return Status;
+    }
+    g_ThreadNotifyRegistered = TRUE;
+
+    Status = PsSetLoadImageNotifyRoutine(LoadImageNotifyCallback);
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&g_MemoryStopping, 1);
+        RemoveMemoryCallbacks();
+        ExWaitForRundownProtectionRelease(&g_MemoryRundown);
+        g_MemoryRundownCompleted = TRUE;
+        StopMemoryWorker(TRUE);
+        g_MemoryProtectionInitialized = FALSE;
+        return Status;
+    }
+    g_LoadImageNotifyRegistered = TRUE;
+
+    OB_OPERATION_REGISTRATION OperationRegistration[2] = { 0 };
+    OperationRegistration[0].ObjectType = PsProcessType;
+    OperationRegistration[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    OperationRegistration[0].PreOperation = ObjectPreCallback;
+
+    OperationRegistration[1].ObjectType = PsThreadType;
+    OperationRegistration[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    OperationRegistration[1].PreOperation = ObjectPreCallback;
+
+    OB_CALLBACK_REGISTRATION CallbackRegistration = { 0 };
+    CallbackRegistration.Version = OB_FLT_REGISTRATION_VERSION;
+    CallbackRegistration.OperationRegistrationCount = RTL_NUMBER_OF(OperationRegistration);
+    CallbackRegistration.OperationRegistration = OperationRegistration;
+    RtlInitUnicodeString(&CallbackRegistration.Altitude, PYAS_OB_ALTITUDE);
+
+    Status = ObRegisterCallbacks(&CallbackRegistration, &GlobalData.ObRegistrationHandle);
+    if (NT_SUCCESS(Status)) return STATUS_SUCCESS;
+
+    InterlockedExchange(&g_MemoryStopping, 1);
+    RemoveMemoryCallbacks();
+    ExWaitForRundownProtectionRelease(&g_MemoryRundown);
+    g_MemoryRundownCompleted = TRUE;
+    StopMemoryWorker(TRUE);
+    g_MemoryProtectionInitialized = FALSE;
+    return Status;
+}
+
+NTSTATUS UninitializeMemoryProtection(BOOLEAN WaitWithoutTimeout) {
+    if (!g_MemoryProtectionInitialized) return STATUS_SUCCESS;
+
+    InterlockedExchange(&g_MemoryStopping, 1);
+
+    NTSTATUS CallbackStatus = RemoveMemoryCallbacks();
+
+    if (!g_MemoryRundownCompleted) {
+        ExWaitForRundownProtectionRelease(&g_MemoryRundown);
+        g_MemoryRundownCompleted = TRUE;
+    }
+
+    NTSTATUS WorkerStatus = StopMemoryWorker(WaitWithoutTimeout);
+    if (!NT_SUCCESS(CallbackStatus)) return CallbackStatus;
+    if (!NT_SUCCESS(WorkerStatus)) return WorkerStatus;
+
+    if (g_ThreadNotifyRegistered || g_LoadImageNotifyRegistered || GlobalData.ObRegistrationHandle) {
+        return STATUS_DEVICE_BUSY;
+    }
+
+    g_MemoryProtectionInitialized = FALSE;
+    return STATUS_SUCCESS;
+}
+

Plugins/Filter/ProtectProcess.cpp

@@ -1,226 +1,285 @@
 #include "DriverCommon.h"
 
-static PVOID ObRegistrationHandle = NULL;
-static OB_CALLBACK_REGISTRATION ObRegistration;
-static OB_OPERATION_REGISTRATION ObCallbacks[2];
+constexpr auto PROCESS_RELATION_BUCKET_COUNT = 1024;
+constexpr auto PROCESS_RELATION_BUCKET_WAYS = 4;
 
-static BOOLEAN IsSystemImage(PUNICODE_STRING FullImageName) {
-    if (!FullImageName || !FullImageName->Buffer) return FALSE;
+typedef HANDLE(NTAPI* PPS_GET_PROCESS_INHERITED_FROM_UNIQUE_PROCESS_ID)(PEPROCESS Process);
 
-    if (WildcardMatch(L"*\\Windows\\System32\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\SysWOW64\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\WinSxS\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\Microsoft.NET\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Common Files\\Microsoft Shared\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Program Files*\\*", FullImageName->Buffer, FullImageName->Length)) {
-        return TRUE;
-    }
-    return FALSE;
+typedef struct _PROCESS_RELATION_ENTRY {
+    HANDLE ProcessId;
+    HANDLE ParentProcessId;
+    HANDLE CreatorProcessId;
+    LARGE_INTEGER CreateTime;
+    LARGE_INTEGER ParentCreateTime;
+    ULONGLONG Sequence;
+} PROCESS_RELATION_ENTRY, * PPROCESS_RELATION_ENTRY;
+
+static PROCESS_RELATION_ENTRY g_ProcessRelations[PROCESS_RELATION_BUCKET_COUNT][PROCESS_RELATION_BUCKET_WAYS];
+static KSPIN_LOCK g_ProcessRelationLock;
+static EX_RUNDOWN_REF g_ProcessRundown;
+static volatile LONG g_ProcessStopping = 1;
+static volatile LONG64 g_ProcessRelationSequence = 0;
+static BOOLEAN g_ProcessProtectionInitialized = FALSE;
+static PPS_GET_PROCESS_INHERITED_FROM_UNIQUE_PROCESS_ID g_GetInheritedProcessId = NULL;
+
+static ULONG GetProcessRelationBucket(HANDLE ProcessId) {
+    return ((ULONG)(ULONG_PTR)ProcessId >> 2) & (PROCESS_RELATION_BUCKET_COUNT - 1);
 }
 
-VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo) {
-    UNREFERENCED_PARAMETER(ImageInfo);
+static BOOLEAN QueryProcessCreateTime(HANDLE ProcessId, PLARGE_INTEGER CreateTime) {
+    if (CreateTime) CreateTime->QuadPart = 0;
+    if (!ProcessId || !CreateTime || KeGetCurrentIrql() > APC_LEVEL) return FALSE;
 
-    if (KeGetCurrentIrql() > APC_LEVEL) return;
-    if (!FullImageName || !FullImageName->Buffer) return;
-    if (ProcessId == (HANDLE)0) return;
-
-    if (IsSystemImage(FullImageName)) return;
-
-    if (IsTargetProtected(ProcessId)) {
-        if (CheckFileExtensionRule(FullImageName)) {
-            SendMessageToUser(6001, (ULONG)(ULONG_PTR)ProcessId, FullImageName->Buffer, FullImageName->Length);
-        }
-    }
-}
-
-static BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId) {
-    if (ProcessId == (HANDLE)4) return TRUE;
-
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
-
-    NTSTATUS status;
-    BOOLEAN isCritical = FALSE;
     PEPROCESS Process = NULL;
-    PUNICODE_STRING imageFileName = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(Status)) return FALSE;
 
-    status = PsLookupProcessByProcessId(ProcessId, &Process);
-    if (!NT_SUCCESS(status)) return FALSE;
+    CreateTime->QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+    ObDereferenceObject(Process);
+    return TRUE;
+}
 
-    status = SeLocateProcessImageName(Process, &imageFileName);
+static VOID StoreProcessRelation(
+    PEPROCESS Process,
+    HANDLE ProcessId,
+    HANDLE ParentProcessId,
+    HANDLE CreatorProcessId,
+    PLARGE_INTEGER KnownParentCreateTime
+) {
+    if (!Process || !ProcessId) return;
 
-    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
-        if (WildcardMatch(L"*\\Windows\\System32\\csrss.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\lsass.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\services.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\wininit.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\smss.exe", imageFileName->Buffer, imageFileName->Length)) {
-            isCritical = TRUE;
-        }
-        ExFreePool(imageFileName);
+    PROCESS_RELATION_ENTRY NewEntry = { 0 };
+    NewEntry.ProcessId = ProcessId;
+    NewEntry.ParentProcessId = ParentProcessId;
+    NewEntry.CreatorProcessId = CreatorProcessId;
+    NewEntry.CreateTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+
+    if (KnownParentCreateTime) {
+        NewEntry.ParentCreateTime = *KnownParentCreateTime;
     }
+    else if (ParentProcessId) {
+        QueryProcessCreateTime(ParentProcessId, &NewEntry.ParentCreateTime);
+    }
+
+    NewEntry.Sequence = (ULONGLONG)InterlockedIncrement64(&g_ProcessRelationSequence);
+
+    ULONG Bucket = GetProcessRelationBucket(ProcessId);
+    ULONG Selected = 0;
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+
+    for (ULONG Index = 0; Index < PROCESS_RELATION_BUCKET_WAYS; Index++) {
+        PPROCESS_RELATION_ENTRY Entry = &g_ProcessRelations[Bucket][Index];
+
+        if (Entry->ProcessId == ProcessId || Entry->ProcessId == NULL) {
+            Selected = Index;
+            break;
+        }
+
+        if (Entry->Sequence < g_ProcessRelations[Bucket][Selected].Sequence) {
+            Selected = Index;
+        }
+    }
+
+    g_ProcessRelations[Bucket][Selected] = NewEntry;
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+}
+
+static VOID RemoveProcessRelation(HANDLE ProcessId) {
+    if (!ProcessId) return;
+
+    ULONG Bucket = GetProcessRelationBucket(ProcessId);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+
+    for (ULONG Index = 0; Index < PROCESS_RELATION_BUCKET_WAYS; Index++) {
+        PPROCESS_RELATION_ENTRY Entry = &g_ProcessRelations[Bucket][Index];
+        if (Entry->ProcessId == ProcessId) {
+            RtlZeroMemory(Entry, sizeof(*Entry));
+            break;
+        }
+    }
+
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+}
+
+BOOLEAN GetProcessRelation(
+    HANDLE ProcessId,
+    PHANDLE ParentProcessId,
+    PHANDLE CreatorProcessId
+) {
+    if (ParentProcessId) *ParentProcessId = NULL;
+    if (CreatorProcessId) *CreatorProcessId = NULL;
+    if (!ProcessId || !g_ProcessProtectionInitialized || KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
+    PEPROCESS Process = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
+    LARGE_INTEGER CurrentCreateTime = { 0 };
+    CurrentCreateTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+
+    PROCESS_RELATION_ENTRY Snapshot = { 0 };
+    ULONG Bucket = GetProcessRelationBucket(ProcessId);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+
+    for (ULONG Index = 0; Index < PROCESS_RELATION_BUCKET_WAYS; Index++) {
+        PPROCESS_RELATION_ENTRY Entry = &g_ProcessRelations[Bucket][Index];
+        if (Entry->ProcessId == ProcessId) {
+            Snapshot = *Entry;
+            break;
+        }
+    }
+
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+
+    BOOLEAN CacheValid = Snapshot.ProcessId == ProcessId &&
+        Snapshot.CreateTime.QuadPart == CurrentCreateTime.QuadPart;
+
+    if (CacheValid && Snapshot.ParentProcessId && Snapshot.ParentCreateTime.QuadPart != 0) {
+        LARGE_INTEGER LiveParentCreateTime = { 0 };
+        if (QueryProcessCreateTime(Snapshot.ParentProcessId, &LiveParentCreateTime) &&
+            LiveParentCreateTime.QuadPart != Snapshot.ParentCreateTime.QuadPart) {
+            CacheValid = FALSE;
+        }
+    }
+
+    if (CacheValid) {
+        if (ParentProcessId) *ParentProcessId = Snapshot.ParentProcessId;
+        if (CreatorProcessId) *CreatorProcessId = Snapshot.CreatorProcessId;
+        ObDereferenceObject(Process);
+        return Snapshot.ParentProcessId != NULL || Snapshot.CreatorProcessId != NULL;
+    }
+
+    if (Snapshot.ProcessId == ProcessId) {
+        RemoveProcessRelation(ProcessId);
+    }
+
+    HANDLE LiveParentProcessId = NULL;
+    LARGE_INTEGER LiveParentCreateTime = { 0 };
+
+    if (g_GetInheritedProcessId) {
+        LiveParentProcessId = g_GetInheritedProcessId(Process);
+    }
+
+    if (!LiveParentProcessId || LiveParentProcessId == ProcessId) {
+        ObDereferenceObject(Process);
+        return FALSE;
+    }
+
+    if (!QueryProcessCreateTime(LiveParentProcessId, &LiveParentCreateTime) ||
+        LiveParentCreateTime.QuadPart > CurrentCreateTime.QuadPart) {
+        ObDereferenceObject(Process);
+        return FALSE;
+    }
+
+    StoreProcessRelation(
+        Process,
+        ProcessId,
+        LiveParentProcessId,
+        NULL,
+        &LiveParentCreateTime
+    );
+
+    if (ParentProcessId) *ParentProcessId = LiveParentProcessId;
+    if (CreatorProcessId) *CreatorProcessId = NULL;
 
     ObDereferenceObject(Process);
-    return isCritical;
-}
-
-static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
-
-    NTSTATUS status;
-    BOOLEAN isBlacklisted = FALSE;
-    PEPROCESS Process = NULL;
-    PUNICODE_STRING imageFileName = NULL;
-
-    status = PsLookupProcessByProcessId(ProcessId, &Process);
-    if (!NT_SUCCESS(status)) return FALSE;
-
-    status = SeLocateProcessImageName(Process, &imageFileName);
-
-    if (NT_SUCCESS(status) && imageFileName) {
-        if (imageFileName->Buffer) {
-            if (WildcardMatch(L"*Taskmgr.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*taskkill.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*ProcessHacker.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*procmon.exe", imageFileName->Buffer, imageFileName->Length)) {
-                isBlacklisted = TRUE;
-            }
-        }
-        ExFreePool(imageFileName);
-    }
-
-    ObDereferenceObject(Process);
-    return isBlacklisted;
-}
-
-static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
-    UNREFERENCED_PARAMETER(RegistrationContext);
-
-    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
-
-    PEPROCESS TargetProcess = (PEPROCESS)OperationInformation->Object;
-    if (!TargetProcess) return OB_PREOP_SUCCESS;
-
-    HANDLE TargetPid = PsGetProcessId(TargetProcess);
-    HANDLE SourcePid = PsGetCurrentProcessId();
-
-    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
-    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
-
-    if (IsTargetProtected(TargetPid)) {
-        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
-
-        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
-
-        if (bIsTrusted) {
-            if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsTrusted = FALSE;
-            }
-        }
-
-        if (bIsTrusted) return OB_PREOP_SUCCESS;
-
-        ACCESS_MASK DenyMask = PROCESS_TERMINATE |
-            PROCESS_VM_OPERATION |
-            PROCESS_VM_WRITE |
-            PROCESS_CREATE_THREAD |
-            PROCESS_VM_READ |
-            PROCESS_DUP_HANDLE |
-            PROCESS_SUSPEND_RESUME |
-            PROCESS_SET_INFORMATION |
-            PROCESS_SET_QUOTA;
-
-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-
-        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-        }
-    }
-
-    return OB_PREOP_SUCCESS;
-}
-
-static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
-    UNREFERENCED_PARAMETER(RegistrationContext);
-
-    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
-
-    PETHREAD TargetThread = (PETHREAD)OperationInformation->Object;
-    if (!TargetThread) return OB_PREOP_SUCCESS;
-
-    PEPROCESS TargetProcess = IoThreadToProcess(TargetThread);
-    if (!TargetProcess) return OB_PREOP_SUCCESS;
-
-    HANDLE TargetPid = PsGetProcessId(TargetProcess);
-    HANDLE SourcePid = PsGetCurrentProcessId();
-
-    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
-    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
-
-    if (IsTargetProtected(TargetPid)) {
-        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
-
-        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
-
-        if (bIsTrusted) {
-            if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsTrusted = FALSE;
-            }
-        }
-
-        if (bIsTrusted) return OB_PREOP_SUCCESS;
-
-        ACCESS_MASK DenyMask = THREAD_TERMINATE |
-            THREAD_SUSPEND_RESUME |
-            THREAD_SET_CONTEXT |
-            THREAD_SET_INFORMATION |
-            THREAD_SET_THREAD_TOKEN;
-
-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-
-        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-        }
-    }
-
-    return OB_PREOP_SUCCESS;
+    return TRUE;
 }
 
 NTSTATUS InitializeProcessProtection() {
-    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob");
+    if (g_ProcessProtectionInitialized) return STATUS_SUCCESS;
 
-    ObCallbacks[0].ObjectType = PsProcessType;
-    ObCallbacks[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
-    ObCallbacks[0].PreOperation = PreOpenProcess;
-    ObCallbacks[0].PostOperation = NULL;
+    KeInitializeSpinLock(&g_ProcessRelationLock);
+    RtlZeroMemory(g_ProcessRelations, sizeof(g_ProcessRelations));
+    InterlockedExchange64(&g_ProcessRelationSequence, 0);
+    ExInitializeRundownProtection(&g_ProcessRundown);
 
-    ObCallbacks[1].ObjectType = PsThreadType;
-    ObCallbacks[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
-    ObCallbacks[1].PreOperation = PreOpenThread;
-    ObCallbacks[1].PostOperation = NULL;
+    UNICODE_STRING RoutineName = RTL_CONSTANT_STRING(L"PsGetProcessInheritedFromUniqueProcessId");
+    g_GetInheritedProcessId = reinterpret_cast<PPS_GET_PROCESS_INHERITED_FROM_UNIQUE_PROCESS_ID>(
+        MmGetSystemRoutineAddress(&RoutineName)
+        );
 
-    ObRegistration.Version = OB_FLT_REGISTRATION_VERSION;
-    ObRegistration.OperationRegistrationCount = 2;
-    ObRegistration.Altitude = Altitude;
-    ObRegistration.RegistrationContext = NULL;
-    ObRegistration.OperationRegistration = ObCallbacks;
-
-    NTSTATUS status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
-
-    if (!NT_SUCCESS(status) && (status == STATUS_FLT_INSTANCE_ALTITUDE_COLLISION || status == STATUS_OBJECT_NAME_COLLISION)) {
-        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob.Fallback");
-        ObRegistration.Altitude = FallbackAltitude;
-        status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
-    }
-
-    return status;
+    InterlockedExchange(&g_ProcessStopping, 0);
+    g_ProcessProtectionInitialized = TRUE;
+    return STATUS_SUCCESS;
 }
 
-VOID UninitializeProcessProtection() {
-    if (ObRegistrationHandle) {
-        ObUnRegisterCallbacks(ObRegistrationHandle);
-        ObRegistrationHandle = NULL;
+NTSTATUS UninitializeProcessProtection() {
+    if (!g_ProcessProtectionInitialized) return STATUS_SUCCESS;
+
+    InterlockedExchange(&g_ProcessStopping, 1);
+    ExWaitForRundownProtectionRelease(&g_ProcessRundown);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+    RtlZeroMemory(g_ProcessRelations, sizeof(g_ProcessRelations));
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+
+    g_GetInheritedProcessId = NULL;
+    g_ProcessProtectionInitialized = FALSE;
+    return STATUS_SUCCESS;
+}
+
+VOID ProcessNotifyCallbackEx(
+    PEPROCESS Process,
+    HANDLE ProcessId,
+    PPS_CREATE_NOTIFY_INFO CreateInfo
+) {
+    if (!g_ProcessProtectionInitialized) return;
+    if (InterlockedCompareExchange(&g_ProcessStopping, 0, 0) != 0) return;
+    if (!ExAcquireRundownProtection(&g_ProcessRundown)) return;
+
+    if (!CreateInfo) {
+        RemoveProcessRelation(ProcessId);
+        ExReleaseRundownProtection(&g_ProcessRundown);
+        return;
     }
-}
+
+    if (!NT_SUCCESS(CreateInfo->CreationStatus)) {
+        ExReleaseRundownProtection(&g_ProcessRundown);
+        return;
+    }
+
+    HANDLE CreatorPid = CreateInfo->CreatingThreadId.UniqueProcess;
+    HANDLE ParentPid = CreateInfo->ParentProcessId;
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+
+    BOOLEAN Blocked = EvaluateProcessCreateRule(
+        CreatorPid,
+        ParentPid,
+        ProcessId,
+        CreateInfo->ImageFileName,
+        CreateInfo->CommandLine,
+        CreateInfo->FileOpenNameAvailable ? TRUE : FALSE,
+        CreateInfo->IsSubsystemProcess ? TRUE : FALSE,
+        &RuleCode,
+        &Kill
+    );
+
+    if (Blocked) {
+        CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
+
+        if (CreateInfo->ImageFileName && CreateInfo->ImageFileName->Buffer) {
+            SendMessageToUser(
+                RuleCode,
+                (ULONG)(ULONG_PTR)CreatorPid,
+                CreateInfo->ImageFileName->Buffer,
+                CreateInfo->ImageFileName->Length
+            );
+        }
+
+        QueueRuleProcessTermination(CreatorPid, Kill);
+    }
+    else {
+        StoreProcessRelation(Process, ProcessId, ParentPid, CreatorPid, NULL);
+    }
+
+    ExReleaseRundownProtection(&g_ProcessRundown);
+}

Plugins/Filter/ProtectRegistry.cpp

@@ -2,14 +2,6 @@
 
 static LARGE_INTEGER Cookie;
 
-static BOOLEAN IsBamRegistryPath(PCUNICODE_STRING KeyName) {
-    if (!KeyName || !KeyName->Buffer) return FALSE;
-    if (WildcardMatch(L"*\\Services\\bam\\*", KeyName->Buffer, KeyName->Length)) {
-        return TRUE;
-    }
-    return FALSE;
-}
-
 static BOOLEAN IsWriteAccess(ACCESS_MASK Access) {
     if (Access & (KEY_SET_VALUE | KEY_CREATE_SUB_KEY | KEY_CREATE_LINK |
         DELETE | WRITE_DAC | WRITE_OWNER | GENERIC_WRITE)) {
@@ -106,12 +98,13 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
             UNICODE_STRING FullPath;
             RtlInitUnicodeString(&FullPath, FullPathBuffer);
 
-            if (CheckRegistryRule(&FullPath)) {
-                HANDLE Pid = PsGetCurrentProcessId();
-                if (!IsProcessTrusted(Pid)) {
-                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                    status = STATUS_ACCESS_DENIED;
-                }
+            HANDLE Pid = PsGetCurrentProcessId();
+            ULONG RuleCode = 0;
+            BOOLEAN Kill = FALSE;
+            if (EvaluateRegistryRule(Pid, &FullPath, OP_CREATE | OP_WRITE, &RuleCode, &Kill)) {
+                SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                QueueRuleProcessTermination(Pid, Kill);
+                status = STATUS_ACCESS_DENIED;
             }
             PyasFree(FullPathBuffer);
         }
@@ -124,12 +117,13 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 
         if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
             if (KeyName) {
-                if (CheckRegistryRule(KeyName)) {
-                    HANDLE Pid = PsGetCurrentProcessId();
-                    if (!IsProcessTrusted(Pid)) {
-                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
-                        status = STATUS_ACCESS_DENIED;
-                    }
+                HANDLE Pid = PsGetCurrentProcessId();
+                ULONG RuleCode = 0;
+                BOOLEAN Kill = FALSE;
+                if (EvaluateRegistryRule(Pid, KeyName, OP_DELETE, &RuleCode, &Kill)) {
+                    SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
+                    QueueRuleProcessTermination(Pid, Kill);
+                    status = STATUS_ACCESS_DENIED;
                 }
                 CmCallbackReleaseKeyObjectIDEx(KeyName);
             }
@@ -142,44 +136,41 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
         PCUNICODE_STRING KeyName = NULL;
 
         if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
-            if (KeyName) {
-                if (KeyName->Buffer) {
-                    if (!IsBamRegistryPath(KeyName)) {
-                        ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
-                            (Info->ValueName ? Info->ValueName->Length : 0) +
-                            sizeof(WCHAR);
+            if (KeyName && KeyName->Buffer) {
+                ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
+                    (Info->ValueName ? Info->ValueName->Length : 0) +
+                    sizeof(WCHAR);
 
-                        if (FullSize <= 0xFFFF) {
-                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                            if (Buffer) {
-                                UNICODE_STRING FullPath;
-                                FullPath.Buffer = Buffer;
-                                FullPath.Length = 0;
-                                FullPath.MaximumLength = (USHORT)FullSize;
+                if (FullSize <= 0xFFFF) {
+                    PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                    if (Buffer) {
+                        UNICODE_STRING FullPath;
+                        FullPath.Buffer = Buffer;
+                        FullPath.Length = 0;
+                        FullPath.MaximumLength = (USHORT)FullSize;
 
-                                RtlCopyUnicodeString(&FullPath, KeyName);
+                        RtlCopyUnicodeString(&FullPath, KeyName);
 
-                                if (Info->ValueName && Info->ValueName->Length > 0) {
-                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                        RtlAppendUnicodeToString(&FullPath, L"\\");
-                                    }
-                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                                }
-
-                                if (CheckRegistryRule(&FullPath)) {
-                                    HANDLE Pid = PsGetCurrentProcessId();
-                                    if (!IsProcessTrusted(Pid)) {
-                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                        status = STATUS_ACCESS_DENIED;
-                                    }
-                                }
-                                PyasFree(Buffer);
+                        if (Info->ValueName && Info->ValueName->Length > 0) {
+                            if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                RtlAppendUnicodeToString(&FullPath, L"\\");
                             }
+                            RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                         }
+
+                        HANDLE Pid = PsGetCurrentProcessId();
+                        ULONG RuleCode = 0;
+                        BOOLEAN Kill = FALSE;
+                        if (EvaluateRegistryRule(Pid, &FullPath, OP_WRITE, &RuleCode, &Kill)) {
+                            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                            QueueRuleProcessTermination(Pid, Kill);
+                            status = STATUS_ACCESS_DENIED;
+                        }
+                        PyasFree(Buffer);
                     }
                 }
-                CmCallbackReleaseKeyObjectIDEx(KeyName);
             }
+            if (KeyName) CmCallbackReleaseKeyObjectIDEx(KeyName);
         }
         return status;
     }
@@ -189,44 +180,41 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
         PCUNICODE_STRING KeyName = NULL;
 
         if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
-            if (KeyName) {
-                if (KeyName->Buffer) {
-                    if (!IsBamRegistryPath(KeyName)) {
-                        ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
-                            (Info->ValueName ? Info->ValueName->Length : 0) +
-                            sizeof(WCHAR);
+            if (KeyName && KeyName->Buffer) {
+                ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
+                    (Info->ValueName ? Info->ValueName->Length : 0) +
+                    sizeof(WCHAR);
 
-                        if (FullSize <= 0xFFFF) {
-                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                            if (Buffer) {
-                                UNICODE_STRING FullPath;
-                                FullPath.Buffer = Buffer;
-                                FullPath.Length = 0;
-                                FullPath.MaximumLength = (USHORT)FullSize;
+                if (FullSize <= 0xFFFF) {
+                    PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                    if (Buffer) {
+                        UNICODE_STRING FullPath;
+                        FullPath.Buffer = Buffer;
+                        FullPath.Length = 0;
+                        FullPath.MaximumLength = (USHORT)FullSize;
 
-                                RtlCopyUnicodeString(&FullPath, KeyName);
+                        RtlCopyUnicodeString(&FullPath, KeyName);
 
-                                if (Info->ValueName && Info->ValueName->Length > 0) {
-                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                        RtlAppendUnicodeToString(&FullPath, L"\\");
-                                    }
-                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                                }
-
-                                if (CheckRegistryRule(&FullPath)) {
-                                    HANDLE Pid = PsGetCurrentProcessId();
-                                    if (!IsProcessTrusted(Pid)) {
-                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                        status = STATUS_ACCESS_DENIED;
-                                    }
-                                }
-                                PyasFree(Buffer);
+                        if (Info->ValueName && Info->ValueName->Length > 0) {
+                            if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                RtlAppendUnicodeToString(&FullPath, L"\\");
                             }
+                            RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                         }
+
+                        HANDLE Pid = PsGetCurrentProcessId();
+                        ULONG RuleCode = 0;
+                        BOOLEAN Kill = FALSE;
+                        if (EvaluateRegistryRule(Pid, &FullPath, OP_DELETE, &RuleCode, &Kill)) {
+                            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                            QueueRuleProcessTermination(Pid, Kill);
+                            status = STATUS_ACCESS_DENIED;
+                        }
+                        PyasFree(Buffer);
                     }
                 }
-                CmCallbackReleaseKeyObjectIDEx(KeyName);
             }
+            if (KeyName) CmCallbackReleaseKeyObjectIDEx(KeyName);
         }
         return status;
     }
@@ -235,20 +223,20 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 }
 
 NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject) {
-    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm");
-    NTSTATUS status = CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+    if (Cookie.QuadPart != 0) return STATUS_SUCCESS;
 
-    if (!NT_SUCCESS(status)) {
-        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm.Fallback");
-        status = CmRegisterCallbackEx(RegistryCallback, &FallbackAltitude, DriverObject, NULL, &Cookie, NULL);
-    }
-
-    return status;
+    UNICODE_STRING Altitude;
+    RtlInitUnicodeString(&Altitude, L"320000.4201");
+    return CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
 }
 
-VOID UninitializeRegistryProtection() {
-    if (Cookie.QuadPart != 0) {
-        CmUnRegisterCallback(Cookie);
+NTSTATUS UninitializeRegistryProtection() {
+    if (Cookie.QuadPart == 0) return STATUS_SUCCESS;
+
+    NTSTATUS Status = CmUnRegisterCallback(Cookie);
+    if (NT_SUCCESS(Status)) {
         Cookie.QuadPart = 0;
     }
-}
+
+    return Status;
+}

Plugins/Rules/Rules_Driver_P1.json

@@ -1,233 +1,706 @@
 {
-    "Rule_Registry_BlockList": [
-        "\\REGISTRY\\MACHINE\\BCD00000000",
-        "\\REGISTRY\\MACHINE\\BCD00000000\\*",
-
-        "*\\Classes\\.exe",
-        "*\\Classes\\.bat",
-        "*\\Classes\\.cmd",
-        "*\\Classes\\.com",
-        "*\\Classes\\exefile\\*",
-        "*\\Classes\\batfile\\*",
-        "*\\Classes\\cmdfile\\*",
-        "*\\Classes\\comfile\\*",
-
-        "*\\mouclass",
-        "*\\kbdclass",
-        "*\\DisableAntiSpyware",
-        "*\\DisableWindowsUpdateAccess",
-        "*\\EnableLUA",
-        "*\\ConsentPromptBehaviorAdmin",
-        "*\\NoControlPanel",
-        "*\\NoDrives",
-        "*\\NoFileMenu",
-        "*\\NoFind",
-        "*\\NoStartMenuPinnedList",
-        "*\\NoSetFolders",
-        "*\\NoSetFolderOptions",
-        "*\\NoViewOnDrive",
-        "*\\NoClose",
-        "*\\NoDesktop",
-        "*\\NoLogoff",
-        "*\\NoFolderOptions",
-        "*\\RestrictRun",
-        "*\\NoViewContextMenu",
-        "*\\HideClock",
-        "*\\NoStartMenuMyGames",
-        "*\\NoStartMenuMyMusic",
-        "*\\DisableCMD",
-        "*\\NoAddingComponents",
-        "*\\NoWinKeys",
-        "*\\NoStartMenuLogOff",
-        "*\\NoSimpleNetIDList",
-        "*\\NoLowDiskSpaceChecks",
-        "*\\DisableLockWorkstation",
-        "*\\Restrict_Run",
-        "*\\DisableTaskMgr",
-        "*\\DisableRegistryTools",
-        "*\\DisableChangePassword",
-        "*\\NoComponents",
-        "*\\NoStartMenuMorePrograms",
-        "*\\NoActiveDesktop",
-        "*\\NoSetActiveDesktop",
-        "*\\NoRecentDocsMenu",
-        "*\\NoWindowsUpdate",
-        "*\\NoChangeStartMenu",
-        "*\\NoFavoritesMenu",
-        "*\\NoRecentDocsHistory",
-        "*\\NoSetTaskbar",
-        "*\\NoSMHelp",
-        "*\\NoTrayContextMenu",
-        "*\\NoManageMyComputerVerb",
-        "*\\NoRealMode",
-        "*\\NoRun",
-        "*\\ClearRecentDocsOnExit",
-        "*\\NoActiveDesktopChanges",
-        "*\\NoStartMenuNetworkPlaces",
-        "*\\NoLockScreen",
-        "*\\HideFastUserSwitching",
-        "*\\ConsentPromptBehaviorUser",
-        "*\\EnableSecureUIAPaths",
-        "*\\NoSRM",
-        "*\\NoInteractiveServices",
-        "*\\ShutdownWithoutLogon",
-        "*\\AutoAdminLogon",
-        "*\\BootExecute",
-        "*\\SubSystems",
-        "*\\FirmwareBootDevice",
-        "*\\BootDriverFlags",
-        "*\\SystemStartOptions",
-        "*\\DisableAutomaticRestartOnFailure",
-        "*\\SystemBiosVersion",
-        "*\\NoTheme",
-        "*\\SystemSetupInProgress",
-        "*\\SetupType",
-        "*\\AutoReboot",
-        "*\\Userinit",
-        "*\\UIHost",
-        "*\\Debugger",
-        "*\\DefaultUserName",
-        "*\\DefaultPassword",
-        "*\\AltDefaultUserName",
-        "*\\AltDefaultPassword",
-        "*\\DisableCAD",
-        "*\\LegalNoticeCaption",
-        "*\\LegalNoticeText",
-    ],
-    "Rule_Registry_TrustedList": [
-    ],
-    "Rule_Process_TrustedPaths": [
-        "\\Device\\HarddiskVolume*\\Windows\\*",
-        "\\Device\\HarddiskVolume*\\Program Files\\*",
-        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-
-        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-        "*\\Sources\\SetupHost.exe",
-        "*\\Work\\*\\DismHost.exe",
-
-        "*\\Google\\Chrome\\Application\\chrome.exe",
-        "*\\Microsoft\\Edge\\Application\\msedge.exe",
-        "*\\Mozilla Firefox\\firefox.exe",
-        "*\\Thorium\\Application\\thorium.exe",
-
-        "*\\Steam\\steam.exe",
-        "*\\steam\\*\\steam.exe",
-        "*\\Battle.net\\*\\Battle.net.exe",
-        "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
-
-        "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
-        "*\\ThunderEv.exe",
-        "*\\ThunderStart.exe",
-        "*\\KuGou.exe",
-        "*\\XLGame.exe",
-        "*\\XLLiveUD.exe",
-
-        "*\\hrkill-*.exe",
-        "*\\bin\\HipsDaemon.exe",
-        "*\\360Safe.exe",
-        "*\\bilibili\\bilibili.exe",
-
-        "*\\Kingsoft\\WPS Office\\ksolaunch.exe",
-        "*\\Kingsoft\\WPS Office\\*\\wps.exe",
-        "*\\Kingsoft\\WPS Office\\*\\*.exe",
-
-        "*\\PC4399_WPFLauncher.exe",
-        "*\\bin\\APlayer.exe",
-        "*\\Neverness To Everness\\NTELauncher.exe",
-        "*\\Application\\AndrowsLauncher.exe",
-        "*\\bin\\*\\codex.exe",
-        "*\\bin\\codex.exe",
-    ],
-    "Rule_Process_ExploitableBlacklist": [
-        "*\\cmd.exe",
-        "*\\powershell.exe",
-        "*\\pwsh.exe",
-        "*\\wscript.exe",
-        "*\\cscript.exe",
-        "*\\mshta.exe",
-        "*\\regsvr32.exe",
-        "*\\certutil.exe",
-        "*\\bitsadmin.exe",
-        "*\\wmic.exe",
-        "*\\hh.exe",
-        "*\\cmstp.exe",
-        "*\\installutil.exe",
-        "*\\regasm.exe",
-        "*\\regsvcs.exe",
-        "*\\msbuild.exe",
-        "*\\csc.exe",
-        "*\\vbc.exe",
-        "*\\jsc.exe",
-        "*\\bash.exe",
-        "*\\scrcons.exe",
-        "*\\schtasks.exe",
-        "*\\at.exe",
-        "*\\reg.exe",
-        "*\\sc.exe",
-        "*\\net.exe",
-        "*\\net1.exe",
-        "*\\whoami.exe",
-        "*\\ipconfig.exe",
-        "*\\taskkill.exe",
-        "*\\ProcessHacker.exe",
-        "*\\procmon.exe",
-        "*\\procexp.exe",
-    ],
-    "Rule_File_ProtectedPaths": [
-        "*\\PYAS.exe",
-        "*\\Plugins\\Filter\\PYAS_Driver.sys",
-        "*\\Plugins\\Rules\\Rules_Driver_P1.json",
-        "*\\ProgramData\\PYAS\\*.json",
-        "*\\Engine\\Pattern\\*.onnx",
-        "*\\Engine\\Properties\\*.onnx",
-
-        "\\Device\\HarddiskVolume*\\bootmgr",
-        "\\Device\\HarddiskVolume*\\boot.ini",
-        "\\Device\\HarddiskVolume*\\BOOTNXT",
-        "\\Device\\HarddiskVolume*\\EFI\\*",
-        "\\Device\\HarddiskVolume*\\Boot\\*",
-        "\\Device\\HarddiskVolume*\\Recovery\\*",
-        "\\Device\\HarddiskVolume*\\System Volume Information\\*",
-        "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
-
-        "*\\CON",
-        "*\\CON\\*",
-        "*\\PRN",
-        "*\\PRN\\*",
-        "*\\AUX",
-        "*\\AUX\\*",
-        "*\\NUL",
-        "*\\NUL\\*",
-        "*\\COM?",
-        "*\\COM?\\*",
-        "*\\LPT?",
-        "*\\LPT?\\*",
-        "*\\OSDATA",
-        "*\\OSDATA\\*",
-        "*\\*<*",
-        "*\\*>*",
-    ],
-    "Rule_File_ExceptionPaths": [
-        "*\\Users\\*\\steam\\*",
-        "*\\AppData\\*",
-        "*\\Temp\\*",
-        "*\\Local\\Temp\\*",
-        "*\\ventoy\\Boot\\*",
-        "*\\AdminRegionConfig.*",
-        "*\\nt_qq\\nt_*\\*",
-        "*\\cache\\*",
-        "*\\Documents\\My Games\\*",
-        "*\\Documents\\Tencent Files\\*",
-        "*\\Documents\\WeChat Files\\*",
-        "*\\Documents\\WPS Cloud Files\\*"
-    ],
-    "Rule_File_RansomwareExtensions": [
-        ".zip", ".7z", ".rar", ".tar", ".gz",
-        ".ppt", ".pptx", ".wps", ".txt", ".rtf",
-        ".pdf", ".xls", ".xlsx", ".doc", ".docx",
-        ".jpg", ".jpeg", ".png", ".webp", ".gif",
-        ".mp3", ".wav", ".aac", ".ogg", ".flac",
-        ".mp4", ".avi", ".mov", ".wmv", ".mkv",
+    "DynamicRules": [
+        {
+            "Name": "Self_Antivirus_Protect_Command",
+            "Code": 1001,
+            "Kill": false,
+            "Category": "Process",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wsl.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\bash.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\regsvr32.exe",
+            ],
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+            ],
+            "CommandLine": [
+                "*taskkill*PYAS.exe*",
+                "*taskkill*msedgewebview2.exe*",
+                "*Stop-Process*PYAS*",
+                "*Stop-Process*msedgewebview2*",
+                "*Get-Process*PYAS*Stop-Process*",
+                "*Get-Process*msedgewebview2*Stop-Process*",
+                "*wmic*PYAS.exe*call terminate*",
+                "*wmic*PYAS.exe*delete*",
+                "*wmic*msedgewebview2.exe*call terminate*",
+                "*wmic*msedgewebview2.exe*delete*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Target": [
+                "*\\taskkill.exe",
+                "*\\cmd.exe",
+                "*\\powershell.exe",
+                "*\\pwsh.exe",
+                "*\\wmic.exe",
+            ],
+            "Priority": 110,
+            "FileOpenNameAvailable": true,
+            "SubsystemProcess": false,
+        },
+        {
+            "Name": "Self_Antivirus_Protect_Handle",
+            "Code": 1002,
+            "Kill": false,
+            "Category": "Process",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
+                "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\games\\Arknights Game\\Arknights.exe",
+                "*\\games\\EndField Game\\EndField.exe",
+            ],
+            "Target": [
+                "*\\PYAS.exe",
+                "*\\msedgewebview2.exe",
+            ],
+            "TargetProcessTree": [
+                "*\\PYAS.exe",
+            ],
+            "Operations": [
+                "Terminate",
+                "SuspendResume",
+                "DuplicateHandle",
+                "CreateProcess",
+                "SetThreadToken",
+                "Impersonate",
+            ],
+            "Priority": 130,
+            "InitiatorProcessTreeExclude": [
+                "*\\PYAS.exe",
+            ],
+            "HandleTypes": [
+                "Create",
+                "Duplicate",
+            ],
+            "OperationMatch": "Any",
+            "MinimumRiskScore": 20,
+            "ObjectTypes": [
+                "Process",
+                "Thread",
+            ]
+        },
+        {
+            "Name": "Attack_Command_Block_EFI_Mount",
+            "Code": 1003,
+            "Kill": false,
+            "Category": "Process",
+            "Target": [
+                "*\\mountvol.exe",
+            ],
+            "CommandLine": [
+                "*mountvol* /S*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 170,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Attack_Command_Block_Destructive_Cmd_Delete",
+            "Code": 1004,
+            "Kill": true,
+            "Category": "Process",
+            "Target": [
+                "*\\cmd.exe",
+            ],
+            "CommandLine": [
+                "*rd /s /q C:\\*",
+                "*rmdir /s /q C:\\*",
+                "*del X:\\* /s /f /q*",
+                "*rd /s /q X:\\EFI*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 190,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Attack_Command_Block_Forced_OOBE_Sysprep",
+            "Code": 1005,
+            "Kill": false,
+            "Category": "Process",
+            "Target": [
+                "*\\sysprep.exe",
+            ],
+            "CommandLine": [
+                "*sysprep* /oobe*",
+                "*sysprep*/oobe*",
+                "* /oobe* /reboot*",
+                "* /generalize* /oobe*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 185,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Process_Protect_UserWritable_SystemName_Dll_Load",
+            "Code": 1006,
+            "Kill": false,
+            "Category": "Process",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\dllhost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\msiexec.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\spoolsv.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\regsvr32.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\*.dll",
+            ],
+            "Operations": [
+                "ImageLoad",
+            ],
+            "Priority": 160,
+        },
+        {
+            "Name": "Self_Antivirus_Protect_File",
+            "Code": 2001,
+            "Kill": false,
+            "Category": "File",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "*\\notepad*.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
+                "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
+            ],
+            "Target": [
+                "*\\PYAS.exe",
+                "*\\ProgramData\\PYAS\\*.json",
+                "*\\Engine\\Heuristic\\*.yar",
+                "*\\Engine\\Heuristic\\*.yara",
+                "*\\Engine\\Heuristic\\*.yc",
+                "*\\Engine\\Heuristic\\*.yrc",
+                "*\\Engine\\Heuristic\\*.ip",
+                "*\\Engine\\Heuristic\\*.txt",
+                "*\\Engine\\Pattern\\*.onnx",
+                "*\\Engine\\Properties\\*.json",
+                "*\\Engine\\Properties\\*.onnx",
+                "*\\Interface\\static\\css\\*.css",
+                "*\\Interface\\static\\img\\*.ico",
+                "*\\Interface\\static\\js\\*.js",
+                "*\\Interface\\templates\\*.html",
+                "*\\Plugins\\Filter\\*.sys",
+                "*\\Plugins\\Rules\\*.json",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+            ]
+        },
+        {
+            "Name": "System_Boot_Protect_File",
+            "Code": 2002,
+            "Kill": true,
+            "Category": "File",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
+                "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\bootmgr",
+                "\\Device\\HarddiskVolume*\\boot.ini",
+                "\\Device\\HarddiskVolume*\\BOOTNXT",
+                "\\Device\\HarddiskVolume*\\EFI\\*",
+                "\\Device\\HarddiskVolume*\\Boot\\*",
+                "\\Device\\HarddiskVolume*\\Recovery\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+            ]
+        },
+        {
+            "Name": "Illegal_Characters_Protect_File",
+            "Code": 2003,
+            "Kill": false,
+            "Category": "File",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\CON",
+                "*\\CON\\*",
+                "*\\PRN",
+                "*\\PRN\\*",
+                "*\\AUX",
+                "*\\AUX\\*",
+                "*\\NUL",
+                "*\\NUL\\*",
+                "*\\COM?",
+                "*\\COM?\\*",
+                "*\\LPT?",
+                "*\\LPT?\\*",
+                "*\\OSDATA",
+                "*\\OSDATA\\*",
+                "*\\*<*",
+                "*\\*>*",
+            ],
+            "Operations": [
+                "Create",
+                "Write",
+                "Rename",
+            ]
+        },
+        {
+            "Name": "System_Ransom_Protect_File",
+            "Code": 2004,
+            "Kill": true,
+            "Category": "File",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+            ],
+            "TargetExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\Temp\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
+            ],
+            "Operations": [
+                "Delete",
+                "Rename",
+            ],
+            "Threshold": 50,
+            "TimeWindow": 3000,
+        },
+        {
+            "Name": "User_Ransom_Protect_File",
+            "Code": 2005,
+            "Kill": true,
+            "Category": "File",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\Google\\Chrome\\Application\\chrome.exe",
+                "*\\Microsoft\\Edge\\Application\\msedge.exe",
+                "*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe",
+                "*\\Microsoft\\Edge*\\Install\\*\\setup.exe",
+                "*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe",
+                "*\\Mozilla Firefox\\firefox.exe",
+                "*\\Thorium\\Application\\thorium.exe",
+                "*\\Steam\\steam.exe",
+                "*\\steam\\*\\steam.exe",
+                "*\\Steam\\steamapps\\common\\*",
+                "*\\Battle.net\\*\\Battle.net.exe",
+                "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+                "*\\PC4399_WPFLauncher.exe",
+                "*\\Neverness To Everness\\NTELauncher.exe",
+                "*\\ThunderEv.exe",
+                "*\\ThunderStart.exe",
+                "*\\bin\\APlayer.exe",
+                "*\\bilibili\\bilibili.exe",
+                "*\\KuGou.exe",
+                "*\\XLGame.exe",
+                "*\\XLLiveUD.exe",
+                "*\\hrkill-*.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+                "*\\WPS Office\\ksolaunch.exe",
+                "*\\WPS Office\\*\\wps.exe",
+                "*\\Application\\AndrowsLauncher.exe",
+                "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+                "*\\bin\\*\\codex.exe",
+                "*\\bin\\codex.exe",
+                "*\\Weixin\\Weixin.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Users\\*",
+            ],
+            "TargetExclude": [
+                "*\\Documents\\My Games\\*",
+                "*\\Documents\\Tencent Files\\*",
+                "*\\Documents\\WeChat Files\\*",
+                "*\\Documents\\WPS Cloud Files\\*",
+                "*\\Users\\*\\steam\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.cache\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.aws\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.codex\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.designer\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.idlerc\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.keras\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.matplotlib\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.ssh\\*",
+                "*\\ventoy\\Boot\\*",
+                "*\\AdminRegionConfig.*",
+                "*\\nt_qq\\nt_*\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Documents\\Tencent Files\\*\\nt_qq\\nt_*\\*",
+            ],
+            "Extensions": [
+                ".zip",
+                ".7z",
+                ".rar",
+                ".tar",
+                ".gz",
+                ".ppt",
+                ".pptx",
+                ".wps",
+                ".txt",
+                ".rtf",
+                ".pdf",
+                ".xls",
+                ".xlsx",
+                ".doc",
+                ".docx",
+                ".jpg",
+                ".jpeg",
+                ".png",
+                ".webp",
+                ".gif",
+                ".mp3",
+                ".wav",
+                ".aac",
+                ".ogg",
+                ".flac",
+                ".mp4",
+                ".avi",
+                ".mov",
+                ".wmv",
+                ".mkv",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Rename",
+            ],
+            "Threshold": 10,
+            "TimeWindow": 3000,
+        },
+        {
+            "Name": "System_Boot_Protect_Disk_Wiper",
+            "Code": 2006,
+            "Kill": false,
+            "Category": "Device",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "*\\rufus-*.exe",
+                "*\\DiskInfo*.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
+            ],
+            "Operations": [
+                "Ioctl",
+            ]
+        },
+        {
+            "Name": "Registry_Protect_System_Suspicious",
+            "Code": 3001,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\hrkill-*.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\mouclass",
+                "*\\kbdclass",
+                "*\\DisableAntiSpyware",
+                "*\\DisableWindowsUpdateAccess",
+                "*\\NoWindowsUpdate",
+                "*\\AutoAdminLogon",
+                "*\\DefaultUserName",
+                "*\\DefaultPassword",
+                "*\\AltDefaultUserName",
+                "*\\AltDefaultPassword",
+                "*\\LegalNoticeCaption",
+                "*\\LegalNoticeText",
+                "*\\AutoReboot",
+                "*\\DisableAutomaticRestartOnFailure",
+                "*\\SystemBiosVersion",
+                "*\\ClearRecentDocsOnExit",
+                "*\\HideClock",
+                "*\\HideFastUserSwitching",
+                "*\\ShutdownWithoutLogon",
+                "*\\DisableCAD",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 130,
+        },
+        {
+            "Name": "Registry_Protect_Open_With_Suspicious",
+            "Code": 3002,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\Classes\\.exe",
+                "*\\Classes\\.com",
+                "*\\Classes\\.bat",
+                "*\\Classes\\.cmd",
+                "*\\Classes\\exefile\\*",
+                "*\\Classes\\comfile\\*",
+                "*\\Classes\\batfile\\*",
+                "*\\Classes\\cmdfile\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 150,
+        },
+        {
+            "Name": "Registry_Protect_BCD_Suspicious",
+            "Code": 3003,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\BCD00000000",
+                "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 140,
+        },
+        {
+            "Name": "Registry_Protect_System_Critical",
+            "Code": 3004,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\EnableLUA",
+                "*\\ConsentPromptBehaviorAdmin",
+                "*\\ConsentPromptBehaviorUser",
+                "*\\EnableSecureUIAPaths",
+                "*\\BootExecute",
+                "*\\SubSystems",
+                "*\\FirmwareBootDevice",
+                "*\\BootDriverFlags",
+                "*\\SystemStartOptions",
+                "*\\Userinit",
+                "*\\UIHost",
+                "*\\NoControlPanel",
+                "*\\NoDrives",
+                "*\\NoFileMenu",
+                "*\\NoFind",
+                "*\\NoStartMenuPinnedList",
+                "*\\NoSetFolders",
+                "*\\NoSetFolderOptions",
+                "*\\NoViewOnDrive",
+                "*\\NoClose",
+                "*\\NoDesktop",
+                "*\\NoLogoff",
+                "*\\NoFolderOptions",
+                "*\\RestrictRun",
+                "*\\NoViewContextMenu",
+                "*\\NoStartMenuMyGames",
+                "*\\NoStartMenuMyMusic",
+                "*\\DisableCMD",
+                "*\\NoAddingComponents",
+                "*\\NoWinKeys",
+                "*\\NoStartMenuLogOff",
+                "*\\NoSimpleNetIDList",
+                "*\\NoLowDiskSpaceChecks",
+                "*\\DisableLockWorkstation",
+                "*\\Restrict_Run",
+                "*\\DisableTaskMgr",
+                "*\\DisableRegistryTools",
+                "*\\DisableChangePassword",
+                "*\\NoComponents",
+                "*\\NoStartMenuMorePrograms",
+                "*\\NoActiveDesktop",
+                "*\\NoSetActiveDesktop",
+                "*\\NoRecentDocsMenu",
+                "*\\NoChangeStartMenu",
+                "*\\NoFavoritesMenu",
+                "*\\NoRecentDocsHistory",
+                "*\\NoSetTaskbar",
+                "*\\NoSMHelp",
+                "*\\NoTrayContextMenu",
+                "*\\NoManageMyComputerVerb",
+                "*\\NoRealMode",
+                "*\\NoRun",
+                "*\\NoActiveDesktopChanges",
+                "*\\NoStartMenuNetworkPlaces",
+                "*\\NoLockScreen",
+                "*\\NoSRM",
+                "*\\NoInteractiveServices",
+                "*\\NoTheme",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 180,
+        },
+        {
+            "Name": "Registry_Protect_SafeMode_Autostart",
+            "Code": 3005,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Minimal\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Network\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 170,
+        },
+        {
+            "Name": "Registry_Protect_OOBE_Reset",
+            "Code": 3006,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+                "*\\Windows\\System32\\MoUsoCoreWorker.exe",
+                "*\\Windows\\System32\\Sysprep\\sysprep.exe",
+                "*\\Windows\\System32\\oobe\\*",
+                "*\\Windows\\System32\\svchost.exe",
+                "*\\Windows\\explorer.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupType",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\CmdLine",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\AuditInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\MiniSetupInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupPhase",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\SysprepStatus\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\ChildCompletion\\*",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE\\*",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\*",
+            ],
+            "TargetExclude": [
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\TelemetryCorrelation",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 175,
+        },
     ]
-}
+}