Add files via upload

任务管理器通过匹配 Rule_Process_TrustedPaths 中的 *\\Windows\\* 规则被误判为可信进程，导致黑名单检查失效。

Engine/Heuristic/Rules_General_A1.yar

@@ -1437,3 +1437,22 @@ rule General_52 {
       uint16(0) == 0x5a4d and filesize < 2000KB and
       8 of them
 }
+
+rule General_53 {
+   meta:
+      description = "53"
+      author = "PYAS Security"
+      date = "2026-07-02"
+   strings:
+      $s1 = "VUZsQlUxO" wide
+      $s2 = "VRaV04xY21s" wide
+      $s3 = "MGVW" wide
+      $s4 = "OUJkWFJvYjNKc" wide
+      $s5 = "GVtRjBhVz" wide
+      $s6 = "l1WDFabGNtbG" ascii
+      $s7 = "1hV05o" fullword ascii
+      $s8 = "ZEdsdmJnPT0=" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize > 20MB and
+      7 of them
+}

Engine/Properties/scanner.py

@@ -5,7 +5,7 @@ import onnxruntime as ort
 
 ####################################################################################################
 
-MODEL_FILE = "Pefile_General_S1.onnx"
+MODEL_FILE = "Pefile_General_T1.onnx"
 FEATURE_FILE = "features.json"
 MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024
 
@@ -588,9 +588,15 @@ class ModelPredictor:
         expected_dim = self.sess.get_inputs()[0].shape[1]
         current_dim = len(self.model_features)
         if current_dim != expected_dim:
-            raise ValueError(f"Dimension mismatch! Model expects {expected_dim} features, but feature file lists {current_dim}.")
+            raise ValueError(f"Dimension error: Model expects {expected_dim}, but feature file has {current_dim}")
 
         self.feat_map = {feat: i for i, feat in enumerate(self.model_features)}
+        
+        self.dll_hash_dim = 512
+        self.api_hash_dim = 4096
+        self.dll_hash_pad = 3
+        self.api_hash_pad = 4
+        self._parse_hash_dims()
 
     def _load_features(self, path):
         if not os.path.exists(path):
@@ -599,6 +605,31 @@ class ModelPredictor:
         with open(path, 'r') as f:
             return json.load(f)
 
+    def _parse_hash_dims(self):
+        max_dll = -1
+        max_api = -1
+        
+        for feat in self.model_features:
+            if feat.startswith("DllHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_dll = max(max_dll, int(val_str))
+                    self.dll_hash_pad = len(val_str)
+                except Exception:
+                    pass
+            elif feat.startswith("ApiHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_api = max(max_api, int(val_str))
+                    self.api_hash_pad = len(val_str)
+                except Exception:
+                    pass
+                    
+        if max_dll >= 0:
+            self.dll_hash_dim = max_dll + 1
+        if max_api >= 0:
+            self.api_hash_dim = max_api + 1
+
     def predict(self, raw_data):
         vec = np.zeros((1, len(self.model_features)), dtype=np.float32)
         base = raw_data.get('Base', {})
@@ -610,14 +641,14 @@ class ModelPredictor:
                 vec[0, self.feat_map[k]] = v
 
         for d in dlls:
-            h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
-            feat_name = f"DllHash_{h:03d}"
+            h = zlib.crc32(d.encode('utf-8', 'ignore')) % self.dll_hash_dim
+            feat_name = f"DllHash_{h:0{self.dll_hash_pad}d}"
             if feat_name in self.feat_map:
                 vec[0, self.feat_map[feat_name]] += 1.0
 
         for a in apis:
-            h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
-            feat_name = f"ApiHash_{h:04d}"
+            h = zlib.crc32(a.encode('utf-8', 'ignore')) % self.api_hash_dim
+            feat_name = f"ApiHash_{h:0{self.api_hash_pad}d}"
             if feat_name in self.feat_map:
                 vec[0, self.feat_map[feat_name]] += 1.0
 
@@ -633,7 +664,7 @@ class ModelPredictor:
             elif isinstance(result, np.ndarray):
                 if result.ndim == 2 and result.shape[1] > 1:
                     return float(result[0][1])
-
+                    
         return 0.0
 
 ####################################################################################################
@@ -652,46 +683,83 @@ def scan_target(target, predictor):
         print("[-] No valid PE files found.")
         return
 
-    print(f"\n[*] Scanning {len(files)} files...\n")
-    print(f"{'RESULT':<10} | {'PROB':<8} | {'FILE'}")
-    print("-" * 80)
+    log_buffer = []
+
+    def _log(message):
+        print(message)
+        log_buffer.append(message)
+
+    _log(f"[*] Scanning {len(files)} files...\n")
+    _log(f"{'RESULT':<10} | {'PROB':<8} | {'FILE'}")
+    _log("-" * 80)
 
     safe_count = 0
     mal_count = 0
+    unsupport_count = 0
+    error_count = 0
     
-    for fpath in files:
-        try:
-            data = FeatureExtractor.extract(fpath)
-            if not data:
-                print(f"{'ERROR':<10} | {'----':<8} | {fpath}")
-                continue
-            
-            prob = predictor.predict(data)
-            is_malware = prob > 0.5
-            
-            label = "MALWARE" if is_malware else "SAFE"
-            if is_malware:
-                mal_count += 1
-            else:
-                safe_count += 1
+    try:
+        for fpath in files:
+            try:
+                data = FeatureExtractor.extract(fpath)
+                if not data:
+                    _log(f"{'UNSUPPORT':<10} | {'-':<8} | {fpath}")
+                    unsupport_count += 1
+                    continue
+                
+                prob = predictor.predict(data)
+                is_malware = prob > 0.5
+                
+                label = "MALWARE" if is_malware else "SAFE"
+                if is_malware:
+                    mal_count += 1
+                else:
+                    safe_count += 1
 
-            print(f"{label:<10} | {prob:.4f}   | {fpath}")
-            
-        except Exception as e:
-            print(f"{'FAIL':<10} | {'----':<8} | {fpath} ({str(e)})")
+                _log(f"{label:<10} | {prob:.4f}   | {fpath}")
+                
+            except Exception as e:
+                _log(f"{'FAIL':<10} | {'-':<8} | {fpath} ({str(e)})")
+                error_count += 1
+                
+    except KeyboardInterrupt:
+        _log("\n[-] Scan aborted by user (Ctrl+C).\n")
 
-    print("-" * 80)
-    print(f"[*] Summary: Safe={safe_count}, Malware={mal_count}, Total={len(files)}")
+    _log("-" * 80)
+    _log(f"\n[*] Summary: Safe={safe_count}, Malware={mal_count}, Unsupport={unsupport_count}, Error={error_count}, Total={len(files)}")
+
+    log_filename = datetime.datetime.now().strftime("%Y%m%d_%H%M%S.log")
+    try:
+        with open(log_filename, "w", encoding="utf-8") as f:
+            f.write("\n".join(log_buffer) + "\n")
+        print(f"[*] Log saved successfully: {log_filename}")
+    except Exception as e:
+        print(f"[-] Failed to save log: {e}")
 
 ####################################################################################################
 
 if __name__ == "__main__":
+    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
+    
+    custom_model = MODEL_FILE
+    targets = []
+    
+    args = sys.argv[1:]
+    i = 0
+    while i < len(args):
+        if args[i] in ("-m", "-model", "--model") and i + 1 < len(args):
+            custom_model = args[i+1]
+            i += 2
+        else:
+            targets.append(args[i])
+            i += 1
+
     print("\n-------------------------- PE Malware Predictor v4.0 --------------------------\n")
     print(f"[*] © 2020-2026 87owo (PYAS Security)")
-    print(f"[*] Loading model features and weights...")
+    print(f"[*] Official Website: https://github.com/87owo/PYAS")
+    print(f"[*] Loading model: {custom_model}")
 
-    base_dir = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
-    model_path = os.path.join(base_dir, MODEL_FILE)
+    model_path = os.path.join(base_dir, custom_model) if not os.path.isabs(custom_model) else custom_model
     feature_path = os.path.join(base_dir, FEATURE_FILE)
 
     try:
@@ -700,14 +768,13 @@ if __name__ == "__main__":
         print(f"[-] Critical Error: {e}")
         sys.exit(1)
 
-    if len(sys.argv) > 1:
-        for path in sys.argv[1:]:
+    if targets:
+        for path in targets:
             target = path.strip('"').strip("'")
             if os.path.exists(target):
                 print()
                 print("-" * 80)
                 scan_target(target, predictor)
-
             else:
                 print(f"[-] Path does not exist: {target}")
     else:

Engine/Properties/train_server.py

@@ -25,8 +25,8 @@ FEATURE_FILE = "features.json"
 
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
-DLL_HASH_DIM = 256
-API_HASH_DIM = 1024
+DLL_HASH_DIM = 512
+API_HASH_DIM = 4096
 
 EXCLUDE_FEATURES = {
     'label', 'filehash',

Engine/Properties/train_user.py

@@ -25,8 +25,8 @@ FEATURE_FILE = "features.json"
 
 TEST_SIZE = 0.0001
 RANDOM_SEED = 42
-DLL_HASH_DIM = 256
-API_HASH_DIM = 1024
+DLL_HASH_DIM = 512
+API_HASH_DIM = 4096
 
 EXCLUDE_FEATURES = {
     'label', 'filehash',
@@ -211,7 +211,7 @@ def train_process(X, y, feature_names):
         params,
         train_data,
         valid_sets=[valid_data],
-        num_boost_round=300,
+        num_boost_round=350,
         callbacks=[
             lgb.log_evaluation(period=50),
             lgb.reset_parameter(learning_rate=_calculate_dynamic_lr)

Interface/static/js/i18n.js

@@ -182,8 +182,12 @@ window.AppI18n = {
             "Clean Junk": "清理垃圾",
             "protect_suspend": "進程暫停",
             "protect_suspend_desc": "此選項可以暫停進程等待掃描",
+            "protect_load": "加載防護",
+            "protect_load_desc": "此選項可以攔截惡意進程加載",
             "opt_autostart": "開機啟動",
             "opt_autostart_desc": "此選項可以設定開機自動執行",
+            "opt_ext_filter": "副檔名過濾",
+            "opt_ext_filter_desc": "此選項僅掃描指定檔案副檔名",
         },
         "simplified_switch": {
             "app_name": "PYAS Security",
@@ -367,8 +371,12 @@ window.AppI18n = {
             "Clean Junk": "清理垃圾",
             "protect_suspend": "进程暂停",
             "protect_suspend_desc": "此选项可以暂停进程等待扫描",
+            "protect_load": "加载防护",
+            "protect_load_desc": "此选项可以拦截恶意进程加载",
             "opt_autostart": "开机启动",
             "opt_autostart_desc": "此选项可以设定开机自动运行",
+            "opt_ext_filter": "后缀名过滤",
+            "opt_ext_filter_desc": "此选项仅扫描指定文件后缀名",
         },
         "english_switch": {
             "app_name": "PYAS Security",
@@ -552,8 +560,12 @@ window.AppI18n = {
             "Clean Junk": "Clean Junk",
             "protect_suspend": "Process Suspend",
             "protect_suspend_desc": "Suspend processes while waiting for scanning",
+            "protect_load": "Load Protection",
+            "protect_load_desc": "Intercept malicious process loading",
             "opt_autostart": "Auto Start",
             "opt_autostart_desc": "Run automatically at system startup",
+            "opt_ext_filter": "Suffix Filter",
+            "opt_ext_filter_desc": "This option only scans specified file extensions",
         },
         "japanese_switch": {
             "app_name": "PYAS Security",
@@ -737,8 +749,12 @@ window.AppI18n = {
             "Clean Junk": "ジャンククリーンアップ",
             "protect_suspend": "プロセスの一時停止",
             "protect_suspend_desc": "スキャン待ちの間プロセスを一時停止します",
+            "protect_load": "ロード保護",
+            "protect_load_desc": "悪意のあるプロセスの読み込みをインターセプトします",
             "opt_autostart": "自動起動",
             "opt_autostart_desc": "システム起動時に自動的に実行します",
+            "opt_ext_filter": "拡張子フィルタ",
+            "opt_ext_filter_desc": "このオプションは指定された拡張子のファイルのみをスキャンします",
         },
         "korean_switch": {
             "app_name": "PYAS Security",
@@ -922,8 +938,12 @@ window.AppI18n = {
             "Clean Junk": "정크 정리",
             "protect_suspend": "프로세스 일시 중지",
             "protect_suspend_desc": "스캔을 기다리는 동안 프로세스를 일시 중지합니다",
+            "protect_load": "로드 보호",
+            "protect_load_desc": "악성 프로세스 로딩을 차단합니다",
             "opt_autostart": "자동 시작",
             "opt_autostart_desc": "시스템 시작 시 자동으로 실행합니다",
+            "opt_ext_filter": "확장자 필터",
+            "opt_ext_filter_desc": "이 옵션은 지정된 파일 확장자만 스캔합니다",
         },
         "french_switch": {
             "app_name": "PYAS Security",
@@ -1107,8 +1127,12 @@ window.AppI18n = {
             "Clean Junk": "Nettoyage",
             "protect_suspend": "Suspendre processus",
             "protect_suspend_desc": "Suspend les processus en attente d'analyse",
+            "protect_load": "Protection de chargement",
+            "protect_load_desc": "Intercepte le chargement de processus malveillants",
             "opt_autostart": "Démarrage auto",
             "opt_autostart_desc": "Exécuter automatiquement au démarrage",
+            "opt_ext_filter": "Filtre d'extension",
+            "opt_ext_filter_desc": "Cette option analyse uniquement les extensions de fichiers spécifiées",
         },
         "spanish_switch": {
             "app_name": "PYAS Security",
@@ -1292,8 +1316,12 @@ window.AppI18n = {
             "Clean Junk": "Limpieza de basura",
             "protect_suspend": "Suspender procesos",
             "protect_suspend_desc": "Suspender procesos mientras espera el escaneo",
+            "protect_load": "Protección de carga",
+            "protect_load_desc": "Interceptar la carga de procesos maliciosos",
             "opt_autostart": "Inicio automático",
             "opt_autostart_desc": "Ejecutar automáticamente al inicio",
+            "opt_ext_filter": "Filtro de extensión",
+            "opt_ext_filter_desc": "Esta opción solo escanea extensiones de archivo especificadas",
         },
         "hindi_switch": {
             "app_name": "PYAS Security",
@@ -1477,8 +1505,12 @@ window.AppI18n = {
             "Clean Junk": "कचरा साफ़ करें",
             "protect_suspend": "प्रक्रिया रोकें",
             "protect_suspend_desc": "स्कैन की प्रतीक्षा करते समय प्रक्रियाओं को रोकें",
+            "protect_load": "लोड सुरक्षा",
+            "protect_load_desc": "दुर्भावनापूर्ण प्रक्रिया लोडिंग को रोकें",
             "opt_autostart": "स्वतः प्रारंभ",
             "opt_autostart_desc": "सिस्टम स्टार्टअप पर स्वचालित रूप से चलाएं",
+            "opt_ext_filter": "एक्सटेंशन फ़िल्टर",
+            "opt_ext_filter_desc": "यह विकल्प केवल निर्दिष्ट फ़ाइल एक्सटेंशन को स्कैन करता है",
         },
         "arabic_switch": {
             "app_name": "PYAS Security",
@@ -1662,8 +1694,12 @@ window.AppI18n = {
             "Clean Junk": "تنظيف المخلفات",
             "protect_suspend": "تعليق العمليات",
             "protect_suspend_desc": "تعليق العمليات أثناء انتظار الفحص",
+            "protect_load": "حماية التحميل",
+            "protect_load_desc": "اعتراض تحميل العمليات الخبيثة",
             "opt_autostart": "بدء تلقائي",
             "opt_autostart_desc": "التشغيل تلقائيًا عند بدء التشغيل",
+            "opt_ext_filter": "تصفية الامتداد",
+            "opt_ext_filter_desc": "يقوم هذا الخيار بفحص امتدادات الملفات المحددة فقط",
         },
         "russian_switch": {
             "app_name": "PYAS Security",
@@ -1847,8 +1883,12 @@ window.AppI18n = {
             "Clean Junk": "Очистка мусора",
             "protect_suspend": "Приостановка процессов",
             "protect_suspend_desc": "Приостановка процессов в ожидании сканирования",
+            "protect_load": "Защита загрузки",
+            "protect_load_desc": "Перехват загрузки вредоносных процессов",
             "opt_autostart": "Автозапуск",
             "opt_autostart_desc": "Автоматический запуск при старте системы",
+            "opt_ext_filter": "Фильтр расширений",
+            "opt_ext_filter_desc": "Этот параметр сканирует только указанные расширения файлов",
         },
         "slovenian_switch": {
             "app_name": "PYAS Security",
@@ -2032,8 +2072,12 @@ window.AppI18n = {
             "Clean Junk": "Čiščenje nesnage",
             "protect_suspend": "Začasna ustavitev",
             "protect_suspend_desc": "Zaustavite procese med čakanjem na skeniranje",
+            "protect_load": "Zaščita nalaganja",
+            "protect_load_desc": "Prestrezi nalaganje zlonamernih procesov",
             "opt_autostart": "Samodejni zagon",
             "opt_autostart_desc": "Samodejni zagon ob zagonu sistema",
+            "opt_ext_filter": "Filter končnic",
+            "opt_ext_filter_desc": "Ta možnost skenira samo določene končnice datotek",
         }
     },
     langMap: {

Interface/static/js/main.js

@@ -781,7 +781,7 @@ document.addEventListener('DOMContentLoaded', () => {
 
     document.querySelectorAll('.toggle-switch input').forEach((toggle, index) => {
         toggle.addEventListener('change', async (e) => {
-            const switchMap = ["process_switch", "suspend_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "autostart_switch", "context_switch"];
+            const switchMap = ["process_switch", "suspend_switch", "load_switch", "document_switch", "system_switch", "network_switch", "driver_switch", "sensitive_switch", "extension_switch", "cloud_switch", "suffix_switch", "autostart_switch", "context_switch"];
             const key = switchMap[index];
             if (window.pywebview && key) {
                 toggle.disabled = true;
@@ -917,13 +917,17 @@ document.addEventListener('DOMContentLoaded', () => {
                         if (rule) window.pywebview.api.add_popup_rule(rule).then(ok => ok && refreshConfigLists());
                     });
                 } else {
-                    window.pywebview.api.select_files().then(files => {
-                        if (files?.length > 0) window.pywebview.api.manage_named_list(listKey, files, 'add').then(refreshConfigLists);
+                    const fTypes = id === 'custom_protect_window' ? ['JSON Files (*.json)'] : null;
+                    const currentListKey = id === 'custom_protect_window' ? 'custom_rule' : listKey;
+                    window.pywebview.api.select_files(fTypes).then(files => {
+                        if (files?.length > 0) window.pywebview.api.manage_named_list(currentListKey, files, 'add').then(refreshConfigLists);
                     });
                 }
             } else if (val === 'add_file') {
-                window.pywebview.api.select_files().then(files => {
-                    if (files?.length > 0) window.pywebview.api.manage_named_list(listKey, files, 'add').then(refreshConfigLists);
+                const fTypes = id === 'custom_protect_window' ? ['JSON Files (*.json)'] : null;
+                const currentListKey = id === 'custom_protect_window' ? 'custom_rule' : listKey;
+                window.pywebview.api.select_files(fTypes).then(files => {
+                    if (files?.length > 0) window.pywebview.api.manage_named_list(currentListKey, files, 'add').then(refreshConfigLists);
                 });
             } else if (val === 'add_path') {
                 window.pywebview.api.select_folder().then(folder => {
@@ -1082,7 +1086,7 @@ document.addEventListener('DOMContentLoaded', () => {
             updateCustomSelectUI('theme_select', theme);
             updateCustomSelectUI('lang_select', lang);
 
-            const switchMap = ["process_switch", "suspend_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "autostart_switch", "context_switch"];
+            const switchMap = ["process_switch", "suspend_switch", "load_switch", "document_switch", "system_switch", "network_switch", "driver_switch", "sensitive_switch", "extension_switch", "cloud_switch", "suffix_switch", "autostart_switch", "context_switch"];
             document.querySelectorAll('.toggle-switch input').forEach((toggle, index) => {
                 if (appState.firstLaunch) { 
                     toggle.checked = false; 
@@ -1102,8 +1106,8 @@ document.addEventListener('DOMContentLoaded', () => {
     window.onEngineReady = async () => {
         if (!appState.firstLaunch) return;
         await window.pywebview.api.update_config("first_launch", false);
-        const switchMap = ["process_switch", "suspend_switch", "document_switch", "system_switch", "driver_switch", "network_switch", "sensitive_switch", "extension_switch", "cloud_switch", "autostart_switch", "context_switch"];
-        const seq = ["cloud_switch", "autostart_switch", "process_switch", "suspend_switch", "document_switch", "system_switch", "network_switch", "driver_switch"];
+        const switchMap = ["process_switch", "suspend_switch", "load_switch", "document_switch", "system_switch", "network_switch", "driver_switch", "sensitive_switch", "extension_switch", "cloud_switch", "suffix_switch", "autostart_switch", "context_switch"];
+        const seq = ["cloud_switch", "autostart_switch", "suffix_switch", "process_switch", "suspend_switch", "load_switch", "document_switch", "system_switch", "network_switch", "driver_switch", "context_switch"];
         
         for (const key of seq) {
             const index = switchMap.indexOf(key);

Interface/templates/index.html

@@ -115,6 +115,12 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>加載防護</h2><p data-i18n>此選項可以攔截惡意進程加載</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>檔案防護</h2><p data-i18n>此選項可以隔離惡意檔案建立</p>
@@ -129,13 +135,13 @@
                         </div>
                         <div class="list-item">
                             <div class="item-info">
-                                <h2 data-i18n>驅動防護</h2><p data-i18n>此選項可以實時攔截惡意行為</p>
+                                <h2 data-i18n>網路防護</h2><p data-i18n>此選項可以攔截惡意網路連接</p>
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
                         <div class="list-item">
                             <div class="item-info">
-                                <h2 data-i18n>網路防護</h2><p data-i18n>此選項可以攔截惡意網路連接</p>
+                                <h2 data-i18n>驅動防護</h2><p data-i18n>此選項可以實時攔截惡意行為</p>
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
@@ -221,6 +227,12 @@
                             </div>
                             <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
                         </div>
+                        <div class="list-item">
+                            <div class="item-info">
+                                <h2 data-i18n>副檔名過濾</h2><p data-i18n>此選項僅掃描指定檔案副檔名</p>
+                            </div>
+                            <label class="toggle-switch"><input type="checkbox" checked><span class="slider"></span></label>
+                        </div>
                         <div class="list-item">
                             <div class="item-info">
                                 <h2 data-i18n>開機啟動</h2><p data-i18n>此選項可以設定開機自動執行</p>

PYAS_Engine.py

@@ -1,5 +1,6 @@
-import os, re, yara, time, math, json, zlib, mmap, numpy, datetime, requests
-import ctypes, ctypes.wintypes, pefile, threading, onnxruntime
+import os, re, yara, time, math, json, zlib, mmap, numpy
+import pefile, threading, onnxruntime, datetime, requests
+import ctypes, ctypes.wintypes
 
 ####################################################################################################
 
@@ -205,6 +206,10 @@ class pe_scanner:
         self.model = None
         self.input_name = None
         self.feature_order = []
+        self.dll_hash_dim = 512
+        self.api_hash_dim = 4096
+        self.dll_hash_pad = 3
+        self.api_hash_pad = 4
         self.signer = sign_scanner()
         self.signer.init_windll(["wintrust"])
 
@@ -232,9 +237,35 @@ class pe_scanner:
                 with open(feat_path, 'r', encoding='utf-8') as f:
                     self.feature_order = json.load(f)
 
+            self._parse_hash_dims()
         except Exception:
             pass
 
+    def _parse_hash_dims(self):
+        max_dll = -1
+        max_api = -1
+        
+        for feat in self.feature_order:
+            if feat.startswith("DllHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_dll = max(max_dll, int(val_str))
+                    self.dll_hash_pad = len(val_str)
+                except Exception:
+                    pass
+            elif feat.startswith("ApiHash_"):
+                try:
+                    val_str = feat.split("_")[1]
+                    max_api = max(max_api, int(val_str))
+                    self.api_hash_pad = len(val_str)
+                except Exception:
+                    pass
+                    
+        if max_dll >= 0:
+            self.dll_hash_dim = max_dll + 1
+        if max_api >= 0:
+            self.api_hash_dim = max_api + 1
+
     def _safe_float(self, val):
         try:
             f = float(val)
@@ -761,8 +792,8 @@ class pe_scanner:
                 if old_fn in feat_map: 
                     vec[0, feat_map[old_fn]] = 1.0
 
-                h = zlib.crc32(d.encode('utf-8', 'ignore')) % 256
-                new_fn = f"DllHash_{h:03d}"
+                h = zlib.crc32(d.encode('utf-8', 'ignore')) % self.dll_hash_dim
+                new_fn = f"DllHash_{h:0{self.dll_hash_pad}d}"
                 if new_fn in feat_map: 
                     vec[0, feat_map[new_fn]] += 1.0
 
@@ -771,8 +802,8 @@ class pe_scanner:
                 if old_fn in feat_map: 
                     vec[0, feat_map[old_fn]] = 1.0
 
-                h = zlib.crc32(a.encode('utf-8', 'ignore')) % 1024
-                new_fn = f"ApiHash_{h:04d}"
+                h = zlib.crc32(a.encode('utf-8', 'ignore')) % self.api_hash_dim
+                new_fn = f"ApiHash_{h:0{self.api_hash_pad}d}"
                 if new_fn in feat_map: 
                     vec[0, feat_map[new_fn]] += 1.0
 

PYAS_Inno.iss

@@ -1,6 +1,6 @@
 #define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
 #define AppName "PYAS"
-#define AppVersion "3.6.0.0"
+#define AppVersion "3.6.2.0"
 #define AppPublisher "PYAS Security"
 #define AppURL "https://github.com/87owo/PYAS"
 #define AppExeName "PYAS.exe"

PYAS_Scanner.py

@@ -0,0 +1,509 @@
+import os, gc, json, time, stat, threading
+import ctypes, ctypes.wintypes
+
+from PYAS_Tools import MEMORY_BASIC_INFORMATION
+
+####################################################################################################
+
+class ScannerMixin:
+    def init_engine_thread(self):
+        try:
+            self.start_daemon_thread(self.backup_mbr)
+            self.start_daemon_thread(self.relock_file)
+            self.start_daemon_thread(self.init_whitelist)
+            self.start_daemon_thread(self.popup_intercept_thread)
+
+            def log_callback(x):
+                self.write_log("INFO", "Load Engine", source=os.path.basename(x))
+
+            self.heuristic.load_path(self.path_heuristic, callback=log_callback)
+            self.properties.load_path(self.path_properties, callback=log_callback)
+            self.write_log("INFO", "System", detail="Engine Initialization Complete")
+
+            if "-scan" in self.args_pyas:
+                try:
+                    idx = self.args_pyas.index("-scan")
+                    self.trigger_context_scan(self.args_pyas[idx+1])
+                except Exception:
+                    pass
+
+            with self.lock_config:
+                first_launch = self.pyas_config.get("first_launch", True)
+                driver_enabled = self.pyas_config.get("driver_switch", False)
+                context_enabled = self.pyas_config.get("context_switch", True)
+                autostart_enabled = self.pyas_config.get("autostart_switch", True)
+
+            self.register_context_menu(context_enabled)
+            self.manage_autostart(autostart_enabled)
+
+            if not first_launch:
+                with self.lock_config:
+                    if self.pyas_config.get("process_switch"):
+                        self.start_daemon_thread(self.protect_proc_thread)
+                    if self.pyas_config.get("document_switch"):
+                        self.start_daemon_thread(self.protect_file_thread)
+                    if self.pyas_config.get("system_switch"):
+                        self.start_daemon_thread(self.protect_system_thread)
+                    if self.pyas_config.get("network_switch"):
+                        self.start_daemon_thread(self.protect_net_thread)
+
+                if driver_enabled:
+                    if self.install_system_driver() and self.start_driver_listener(wait_ready=True):
+                        pass
+                    else:
+                        self.stop_system_driver()
+                        with self.lock_config:
+                            self.pyas_config["driver_switch"] = False
+                            self.save_config()
+
+                        self.write_log("WARN", "System", detail="Driver Protection Failed to Start", success=False)
+
+        except Exception as e:
+            self.write_log("WARN", "init_engine_thread", detail=str(e), success=False)
+
+####################################################################################################
+
+    def yield_files(self, targets):
+        if isinstance(targets, str):
+            if os.path.isdir(targets):
+                for root, dirs, files in os.walk(targets):
+                    dirs[:] = [d for d in dirs if not self._is_reparse_point(os.path.join(root, d))]
+                    for f in files:
+                        yield self.norm_path(os.path.join(root, f)), False
+
+            elif os.path.isfile(targets):
+                yield self.norm_path(targets), True
+
+        elif isinstance(targets, (list, tuple, set)):
+            for t in targets:
+                yield from self.yield_files(t)
+
+    def _is_reparse_point(self, path):
+        try:
+            if os.path.islink(path):
+                return True
+            if hasattr(os.path, 'isjunction') and os.path.isjunction(path):
+                return True
+
+            st = os.lstat(path)
+            return bool(getattr(st, 'st_file_attributes', 0) & 0x400)
+        except OSError:
+            return False
+
+####################################################################################################
+
+    def scan_engine(self, file_path):
+        with self.lock_config:
+            ext_switch = self.pyas_config.get("extension_switch", False)
+            sen_switch = self.pyas_config.get("sensitive_switch", False)
+
+        try:
+            pe_label, _ = self.properties.pe_scan(file_path, enhanced_mode=sen_switch)
+            if pe_label:
+                return pe_label
+        except Exception:
+            pass
+
+        try:
+            if ext_switch:
+                yara_label, _ = self.heuristic.yara_scan(file_path)
+                if yara_label:
+                    return yara_label
+        except Exception:
+            pass
+
+        return False
+
+    def safe_scan_engine(self, file_path):
+        norm_path = self.norm_path(file_path)
+        if not norm_path:
+            return False
+
+        file_hash = self.calc_file_hash(norm_path)
+        cache_key = file_hash if file_hash else os.path.normcase(norm_path)
+
+        with self.lock_file_ops:
+            if cache_key in self.hash_cache:
+                return self.hash_cache[cache_key]
+
+            if cache_key in self.scan_events:
+                event = self.scan_events[cache_key]
+                needs_scan = False
+            else:
+                event = threading.Event()
+                self.scan_events[cache_key] = event
+                needs_scan = True
+
+        if not needs_scan:
+            event.wait(timeout=60)
+            with self.lock_file_ops:
+                return self.hash_cache.get(cache_key, False)
+
+        try:
+            result = self.scan_engine(norm_path)
+            with self.lock_file_ops:
+                if len(self.hash_cache) > 10000:
+                    for k in list(self.hash_cache.keys())[:1000]:
+                        del self.hash_cache[k]
+
+                self.hash_cache[cache_key] = result
+            return result
+
+        finally:
+            with self.lock_file_ops:
+                if cache_key in self.scan_events:
+                    self.scan_events[cache_key].set()
+                    del self.scan_events[cache_key]
+
+            gc.collect()
+
+####################################################################################################
+
+    def start_scan(self, targets):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False):
+                return
+
+            self.scan_running = True
+            self.scan_finished = False
+            self.virus_results = []
+            self.scan_count = 0
+            self.scan_start = time.time()
+
+        self.scan_pool.submit(self.scan_worker, targets)
+
+    def scan_worker(self, targets):
+        last_update = 0.0
+        try:
+            for file_path, is_explicit in self.yield_files(targets):
+                with self.lock_virus:
+                    if not self.scan_running:
+                        break
+
+                norm_path = self.norm_path(file_path)
+                if not norm_path:
+                    continue
+
+                current_time = time.time()
+                if current_time - last_update >= 0.05:
+                    if self._window:
+                        js_cmd = f"if(window.updateScanProgress) window.updateScanProgress({json.dumps(norm_path.replace(os.sep, '/'))});"
+                        self.ui_queue.put(js_cmd)
+
+                    last_update = current_time
+
+                was_locked = False
+                try:
+                    with self.lock_file_ops:
+                        if norm_path in self.virus_lock:
+                            self.lock_file(norm_path, False)
+                            was_locked = True
+
+                    if self.is_in_whitelist(norm_path):
+                        continue
+
+                    with self.lock_virus:
+                        self.scan_count += 1
+
+                    with self.lock_config:
+                        ext_filter = self.pyas_config.get("suffix_switch", True)
+                        suffix = self.pyas_config.get("suffix", [])
+
+                    if not is_explicit and ext_filter and os.path.splitext(norm_path)[-1].lower() not in suffix:
+                        continue
+
+                    result = self.safe_scan_engine(norm_path)
+                    if result:
+                        with self.lock_virus:
+                            self.virus_results.append(norm_path)
+
+                        if self._window: 
+                            js_cmd = f"if(window.addVirusResult) window.addVirusResult({json.dumps(result)}, {json.dumps(norm_path.replace(os.sep, '/'))});"
+                            self.ui_queue.put(js_cmd)
+
+                        self.write_log("SCAN", "Virus Detected", source=norm_path, file_hash=self.calc_file_hash(norm_path))
+
+                    self.cloud_check(norm_path)
+                except Exception as e:
+                    self.write_log("WARN", "Scan Engine", source=norm_path, detail=str(e), success=False)
+
+                finally:
+                    if was_locked:
+                        self.lock_file(norm_path, True)
+
+        finally:
+            with self.lock_virus:
+                self.scan_running = False
+                self.scan_finished = True
+                count, scanned, elapsed = len(self.virus_results), self.scan_count, int(time.time() - self.scan_start)
+
+            messages = {
+                "traditional_switch": f"發現 {count} 個病毒，掃描 {scanned} 個檔案，耗時 {elapsed} 秒",
+                "simplified_switch": f"发现 {count} 个病毒，扫描 {scanned} 个文件，耗时 {elapsed} 秒",
+                "english_switch": f"Found {count} viruses, scanned {scanned} files, time {elapsed}s",
+                "japanese_switch": f"{count} 個のウイルスを発見し、{scanned} 個のファイルをスキャンしました（所要時間 {elapsed} 秒）",
+                "korean_switch": f"바이러스 {count}개 발견, 파일 {scanned}개 검사, 소요 시간 {elapsed}초",
+                "french_switch": f"{count} virus trouvés, {scanned} fichiers analysés, temps {elapsed}s",
+                "spanish_switch": f"Se encontraron {count} virus, {scanned} archivos escaneados, tiempo {elapsed}s",
+                "hindi_switch": f"{count} वायरस मिले, {scanned} फ़ाइलें स्कैन की गईं, समय {elapsed}s",
+                "arabic_switch": f"تم العثور على {count} فيروسات، تم فحص {scanned} ملفات، الوقت {elapsed} ثانية",
+                "russian_switch": f"Найдено {count} вирусов, проверено {scanned} файлов, время {elapsed}с",
+                "slovenian_switch": f"Najdenih {count} virusov, skeniranih {scanned} datotek, čas {elapsed}s"
+            }
+            if self._window:
+                js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
+                self.ui_queue.put(js_cmd)
+
+            self.write_log("INFO", "Scan Completed", detail=f"Found {count} viruses, scanned {scanned} files, time {elapsed}s")
+
+####################################################################################################
+
+    def stop_scan(self):
+        with self.lock_virus: self.scan_running = False
+
+    def trigger_scan(self, method):
+        messages = {
+            "traditional_switch": "已取消掃描",
+            "simplified_switch": "已取消扫描", "english_switch":
+            "Scan cancelled", "japanese_switch": "スキャンがキャンセルされました",
+            "korean_switch": "스캔이 취소되었습니다",
+            "french_switch": "Analyse annulée",
+            "spanish_switch": "Escaneo cancelado",
+            "hindi_switch": "स्कैन रद्द कर दिया गया",
+            "arabic_switch": "تم إلغاء الفحص",
+            "russian_switch": "Сканирование отменено",
+            "slovenian_switch": "Skeniranje preklicano"
+        }
+        targets = []
+
+        if method == "smart":
+            for folder in ["Desktop", "Downloads", "AppData"]:
+                fp = os.path.join(self.path_user, folder)
+                if os.path.exists(fp):
+                    targets.append(fp)
+
+            if os.path.exists(self.path_config):
+                targets.append(self.path_config)
+
+            buf = ctypes.create_unicode_buffer(1024)
+            max_address = 0x7FFFFFFFFFFF if ctypes.sizeof(ctypes.c_void_p) == 8 else 0x7FFFFFFF
+            system_dir = self.path_system.lower()
+
+            for proc in self.get_process_list():
+                if proc["path"] and proc["path"] != "None": 
+                    targets.append(proc["path"])
+
+                pid = proc["pid"]
+                if pid <= 4:
+                    continue
+
+                h_process = self.kernel32.OpenProcess(0x1000, False, pid)
+                if h_process:
+                    try:
+                        address = 0
+                        mbi = MEMORY_BASIC_INFORMATION()
+                        while address < max_address and self.kernel32.VirtualQueryEx(h_process, ctypes.c_void_p(address), ctypes.byref(mbi), ctypes.sizeof(mbi)):
+                            if mbi.State == 0x1000 and mbi.Type == 0x1000000:
+                                if self.psapi.GetMappedFileNameW(h_process, ctypes.c_void_p(address), buf, 1024):
+                                    raw_path = buf.value
+                                    if raw_path.startswith("\\"):
+                                        raw_path = self.device_path_to_drive(raw_path)
+
+                                    file_path = self.norm_path(raw_path)
+                                    if file_path and not file_path.lower().startswith(system_dir):
+                                        targets.append(file_path)
+
+                            if mbi.RegionSize == 0:
+                                break
+                            address += mbi.RegionSize
+                    finally:
+                        self.kernel32.CloseHandle(h_process)
+
+            self.start_scan(list(set(targets)))
+
+        elif method == "file":
+            targets = self.select_files()
+            if targets:
+                self.start_scan(targets)
+
+            elif self._window:
+                self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, 0);")
+
+        elif method == "path":
+            targets = self.select_folder()
+            if targets:
+                self.start_scan(targets)
+
+            elif self._window:
+                self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, 0);")
+
+        elif method == "full":
+            targets = [f"{chr(d)}:/" for d in range(65, 91) if os.path.exists(f"{chr(d)}:/")]
+            self.start_scan(targets)
+
+####################################################################################################
+
+    def solve_scan(self, file_paths):
+        deleted_paths = []
+        proc_map = {}
+        for proc in self.get_process_list():
+            if proc["path"] and proc["path"] != "None":
+
+                norm_p = self.norm_path(proc["path"], must_exist=False)
+                if norm_p:
+                    proc_map.setdefault(os.path.normcase(norm_p), []).append(proc["pid"])
+
+        last_update = 0.0
+        with self.lock_virus:
+            deleted_set = set()
+            for raw_path in file_paths:
+
+                path = self.norm_path(raw_path, must_exist=False)
+                if not path:
+                    continue
+
+                current_time = time.time()
+                if current_time - last_update >= 0.05:
+                    if self._window:
+                        self._window.evaluate_js(f"if(window.updateDeleteProgress) window.updateDeleteProgress({json.dumps(path.replace(os.sep, '/'))});")
+
+                    last_update = current_time
+
+                try:
+                    if path in self.virus_lock:
+                        self.lock_file(path, False)
+
+                    path_key = os.path.normcase(path)
+                    if path_key in proc_map:
+                        for pid in proc_map[path_key]:
+                            self.kill_process(pid)
+
+                    try:
+                        os.chmod(path, stat.S_IWRITE)
+                    except Exception:
+                        pass
+
+                    delete_success = False
+                    for _ in range(5):
+                        try:
+                            os.remove(path)
+                            delete_success = True
+                            break
+
+                        except Exception:
+                            time.sleep(0.1)
+
+                    if not delete_success:
+                        os.remove(path)
+
+                    self.remove_list_items("quarantine", [path])
+                    deleted_paths.append(raw_path) 
+                    deleted_set.add(path)
+                    self.write_log("INFO", "Virus Delete", source=path, file_hash=self.calc_file_hash(path), operate=True, success=True)
+
+                except Exception as e:
+                    self.lock_file(path, True)
+                    self.write_log("SCAN", "Virus Delete", source=path, file_hash=self.calc_file_hash(path), detail=str(e), operate=True, success=False)
+
+            if deleted_set:
+                self.virus_results = [p for p in self.virus_results if p not in deleted_set]
+
+            remaining = len(self.virus_results)
+
+        messages = {
+            "traditional_switch": f"剩餘 {remaining} 個病毒，已刪除 {len(deleted_paths)} 個檔案。",
+            "simplified_switch": f"剩余 {remaining} 个病毒，已删除 {len(deleted_paths)} 个文件。",
+            "english_switch": f"Remaining {remaining} viruses, deleted {len(deleted_paths)} files.",
+            "japanese_switch": f"残りのウイルス {remaining} 個、削除されたファイル {len(deleted_paths)} 個。",
+            "korean_switch": f"남은 바이러스 {remaining}개, 삭제된 파일 {len(deleted_paths)}개.",
+            "french_switch": f"Virus restants : {remaining}, fichiers supprimés : {len(deleted_paths)}.",
+            "spanish_switch": f"Virus restantes: {remaining}, archivos eliminados: {len(deleted_paths)}.",
+            "hindi_switch": f"शेष वायरस {remaining}, हटाए गए फ़ाइलें {len(deleted_paths)}.",
+            "arabic_switch": f"الفيروسات المتبقية {remaining}، تم حذف {len(deleted_paths)} ملفات.",
+            "russian_switch": f"Осталось вирусов: {remaining}, удалено файлов: {len(deleted_paths)}.",
+            "slovenian_switch": f"Preostalih virusov: {remaining}, izbrisanih datotek: {len(deleted_paths)}."
+        }
+        if self._window:
+            self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {remaining});")
+
+        return deleted_paths
+
+    def remove_virus_result(self, paths):
+        with self.lock_virus:
+            norm_paths = set(self.norm_path(p, must_exist=False) for p in paths)
+            self.virus_results = [p for p in self.virus_results if p not in norm_paths]
+            return len(self.virus_results)
+
+####################################################################################################
+
+    def cloud_check(self, file_path):
+        norm_path = self.norm_path(file_path)
+        if not norm_path:
+            return
+
+        cache_key = os.path.normcase(norm_path)
+        with self.lock_file_ops:
+            if cache_key in self.cloud_pending:
+                return
+
+            self.cloud_pending.add(cache_key)
+
+        self.cloud_queue.put(norm_path)
+
+    def cloud_worker(self):
+        while True:
+            try:
+                file_path = self.cloud_queue.get()
+                cache_key = os.path.normcase(file_path)
+
+                try:
+                    self.perform_cloud_scan(file_path)
+                finally:
+                    with self.lock_file_ops:
+                        self.cloud_pending.discard(cache_key)
+
+                    self.cloud_queue.task_done()
+            except Exception:
+                pass
+
+    def perform_cloud_scan(self, file_path):
+        was_locked = False
+        try:
+            with self.lock_config:
+                if not self.pyas_config.get("cloud_switch", True):
+                    return False
+
+                api_host, api_key, max_size = self.pyas_config.get("api_host"), self.pyas_config.get("api_key"), self.pyas_config.get("size", 256 * 1024 * 1024)
+
+            if not os.path.exists(file_path) or not os.path.isfile(file_path):
+                return False
+
+            with self.lock_file_ops:
+                if file_path in self.virus_lock:
+                    self.lock_file(file_path, False)
+                    was_locked = True
+
+            if os.path.getsize(file_path) > max_size:
+                if was_locked:
+                    self.lock_file(file_path, True)
+                return False
+
+            file_hash = self.calc_file_hash(file_path)
+            success, sha256 = self.cloud.upload_file(file_path, api_host, api_key, file_hash=file_hash)
+            if was_locked:
+                self.lock_file(file_path, True)
+                was_locked = False
+
+            if not success:
+                self.write_log("WARN", "Cloud API", source=file_path, detail="Failed", success=False)
+
+        except Exception as e:
+            self.write_log("WARN", "perform_cloud_scan", detail=str(e), success=False)
+
+        finally:
+            if was_locked:
+                try:
+                    self.lock_file(file_path, True)
+                except Exception:
+                    pass
+        return False

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.6.0.0',
+version='3.6.2.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -1,171 +1,349 @@
-#pragma once
-#include <fltKernel.h>
-#include <ntddk.h>      
-#include <ntdddisk.h>   
-#include <ntddscsi.h> 
-#include <ntstrsafe.h>
-
-constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
-constexpr auto MAX_PATH_LEN = 1024;
-constexpr auto PYAS_POOL_TAG = 'SAYP';
-
-#ifndef PROCESS_TERMINATE
-#define PROCESS_TERMINATE                  (0x0001)
-#endif
-#ifndef PROCESS_CREATE_THREAD
-#define PROCESS_CREATE_THREAD              (0x0002)
-#endif
-#ifndef PROCESS_VM_OPERATION
-#define PROCESS_VM_OPERATION               (0x0008)
-#endif
-#ifndef PROCESS_VM_READ
-#define PROCESS_VM_READ                    (0x0010)
-#endif
-#ifndef PROCESS_VM_WRITE
-#define PROCESS_VM_WRITE                   (0x0020)
-#endif
-#ifndef PROCESS_DUP_HANDLE
-#define PROCESS_DUP_HANDLE                 (0x0040)
-#endif
-#ifndef PROCESS_CREATE_PROCESS
-#define PROCESS_CREATE_PROCESS             (0x0080)
-#endif
-#ifndef PROCESS_SET_INFORMATION
-#define PROCESS_SET_INFORMATION            (0x0200)
-#endif
-#ifndef PROCESS_QUERY_INFORMATION
-#define PROCESS_QUERY_INFORMATION          (0x0400)
-#endif
-#ifndef PROCESS_SUSPEND_RESUME
-#define PROCESS_SUSPEND_RESUME             (0x0800)
-#endif
-#ifndef PROCESS_QUERY_LIMITED_INFORMATION
-#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
-#endif
-#ifndef PROCESS_SET_QUOTA
-#define PROCESS_SET_QUOTA                  (0x0100)
-#endif
-#ifndef THREAD_TERMINATE
-#define THREAD_TERMINATE                   (0x0001)
-#endif
-#ifndef THREAD_SUSPEND_RESUME
-#define THREAD_SUSPEND_RESUME              (0x0002)
-#endif
-#ifndef THREAD_SET_CONTEXT
-#define THREAD_SET_CONTEXT                 (0x0010)
-#endif
-#ifndef THREAD_SET_INFORMATION
-#define THREAD_SET_INFORMATION             (0x0020)
-#endif
-#ifndef THREAD_SET_THREAD_TOKEN
-#define THREAD_SET_THREAD_TOKEN            (0x0080)
-#endif
-#ifndef POOL_FLAG_NON_PAGED
-#define POOL_FLAG_NON_PAGED                0x0000000000000040UI64
-#endif
-
-#ifndef FSCTL_MANAGE_BYPASS_IO
-#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
-
-typedef enum _FS_BPIO_OPERATIONS {
-    FS_BPIO_OP_ENABLE = 1,
-    FS_BPIO_OP_DISABLE = 2,
-    FS_BPIO_OP_QUERY = 3,
-    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
-    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
-    FS_BPIO_OP_STREAM_PAUSE = 6,
-    FS_BPIO_OP_STREAM_RESUME = 7,
-    FS_BPIO_OP_GET_INFO = 8
-} FS_BPIO_OPERATIONS;
-
-typedef struct _FS_BPIO_INPUT {
-    FS_BPIO_OPERATIONS Operation;
-    ULONG InFlags;
-    ULONGLONG Reserved1;
-    ULONGLONG Reserved2;
-} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
-
-typedef struct _FS_BPIO_OUTPUT {
-    FS_BPIO_OPERATIONS Operation;
-    ULONG OutFlags;
-    ULONGLONG Reserved1;
-    ULONGLONG Reserved2;
-    NTSTATUS Status;
-} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
-
-#endif
-
-typedef struct _PYAS_MESSAGE {
-    ULONG MessageCode;
-    ULONG ProcessId;
-    WCHAR Path[MAX_PATH_LEN];
-} PYAS_MESSAGE, * PPYAS_MESSAGE;
-
-typedef struct _PYAS_USER_MESSAGE {
-    ULONG Command;
-    WCHAR Path[MAX_PATH_LEN];
-} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
-
-typedef struct _DRIVER_DATA {
-    PDRIVER_OBJECT DriverObject;
-    PFLT_FILTER FilterHandle;
-    PFLT_PORT ServerPort;
-    PFLT_PORT ClientPort;
-    PEPROCESS PyasProcess;
-    ULONG PyasPid;
-    LARGE_INTEGER Cookie;
-    KSPIN_LOCK PortMutex;
-    KSPIN_LOCK TrackerMutex;
-    EX_RUNDOWN_REF PortRundown;
-} DRIVER_DATA, * PDRIVER_DATA;
-
-typedef struct _RULE_NODE {
-    struct _RULE_NODE* Next;
-    UNICODE_STRING Pattern;
-} RULE_NODE, * PRULE_NODE;
-
-extern DRIVER_DATA GlobalData;
-
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
-
-NTSTATUS InitializeProcessProtection();
-VOID UninitializeProcessProtection();
-NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
-VOID UninitializeRegistryProtection();
-
-NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
-VOID UnloadRules();
-
-VOID InitializeRulesEngine();
-VOID UninitializeRulesEngine();
-
-VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
-VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
-
-VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
-
-NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
-
-BOOLEAN IsProcessTrusted(HANDLE ProcessId);
-BOOLEAN IsTargetProtected(HANDLE ProcessId);
-BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
-
-BOOLEAN CheckRegistryRule(PCUNICODE_STRING KeyName);
-BOOLEAN CheckFileExtensionRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckProtectedPathRule(PCUNICODE_STRING FileName);
-BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID WriteBuffer, ULONG WriteLength, BOOLEAN IsWrite);
-
-NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
-
-FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
-    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
-}
-
-FORCEINLINE VOID PyasFree(PVOID Ptr) {
-    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
+#pragma once
+#include <fltKernel.h>
+#include <ntddk.h>      
+#include <ntdddisk.h>   
+#include <ntddscsi.h> 
+#include <ntstrsafe.h>
+
+constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
+constexpr auto MAX_PATH_LEN = 1024;
+constexpr auto PYAS_POOL_TAG = 'SAYP';
+constexpr auto PYAS_OB_ALTITUDE = L"320000.4101";
+
+#ifndef PROCESS_TERMINATE
+#define PROCESS_TERMINATE                  (0x0001)
+#endif
+#ifndef PROCESS_CREATE_THREAD
+#define PROCESS_CREATE_THREAD              (0x0002)
+#endif
+#ifndef PROCESS_VM_OPERATION
+#define PROCESS_VM_OPERATION               (0x0008)
+#endif
+#ifndef PROCESS_VM_READ
+#define PROCESS_VM_READ                    (0x0010)
+#endif
+#ifndef PROCESS_VM_WRITE
+#define PROCESS_VM_WRITE                   (0x0020)
+#endif
+#ifndef PROCESS_DUP_HANDLE
+#define PROCESS_DUP_HANDLE                 (0x0040)
+#endif
+#ifndef PROCESS_CREATE_PROCESS
+#define PROCESS_CREATE_PROCESS             (0x0080)
+#endif
+#ifndef PROCESS_SET_INFORMATION
+#define PROCESS_SET_INFORMATION            (0x0200)
+#endif
+#ifndef PROCESS_QUERY_INFORMATION
+#define PROCESS_QUERY_INFORMATION          (0x0400)
+#endif
+#ifndef PROCESS_SUSPEND_RESUME
+#define PROCESS_SUSPEND_RESUME             (0x0800)
+#endif
+#ifndef PROCESS_QUERY_LIMITED_INFORMATION
+#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
+#endif
+#ifndef PROCESS_SET_QUOTA
+#define PROCESS_SET_QUOTA                  (0x0100)
+#endif
+#ifndef THREAD_TERMINATE
+#define THREAD_TERMINATE                   (0x0001)
+#endif
+#ifndef THREAD_SUSPEND_RESUME
+#define THREAD_SUSPEND_RESUME              (0x0002)
+#endif
+#ifndef THREAD_SET_CONTEXT
+#define THREAD_SET_CONTEXT                 (0x0010)
+#endif
+#ifndef THREAD_SET_INFORMATION
+#define THREAD_SET_INFORMATION             (0x0020)
+#endif
+#ifndef THREAD_SET_THREAD_TOKEN
+#define THREAD_SET_THREAD_TOKEN            (0x0080)
+#endif
+#ifndef THREAD_IMPERSONATE
+#define THREAD_IMPERSONATE                 (0x0100)
+#endif
+#ifndef THREAD_DIRECT_IMPERSONATION
+#define THREAD_DIRECT_IMPERSONATION        (0x0200)
+#endif
+#ifndef POOL_FLAG_NON_PAGED
+#define POOL_FLAG_NON_PAGED                0x0000000000000040UI64
+#endif
+
+#ifndef FSCTL_MANAGE_BYPASS_IO
+#define FSCTL_MANAGE_BYPASS_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+typedef enum _FS_BPIO_OPERATIONS {
+    FS_BPIO_OP_ENABLE = 1,
+    FS_BPIO_OP_DISABLE = 2,
+    FS_BPIO_OP_QUERY = 3,
+    FS_BPIO_OP_VOLUME_STACK_PAUSE = 4,
+    FS_BPIO_OP_VOLUME_STACK_RESUME = 5,
+    FS_BPIO_OP_STREAM_PAUSE = 6,
+    FS_BPIO_OP_STREAM_RESUME = 7,
+    FS_BPIO_OP_GET_INFO = 8
+} FS_BPIO_OPERATIONS;
+
+typedef struct _FS_BPIO_INPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG InFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+} FS_BPIO_INPUT, * PFS_BPIO_INPUT;
+
+typedef struct _FS_BPIO_OUTPUT {
+    FS_BPIO_OPERATIONS Operation;
+    ULONG OutFlags;
+    ULONGLONG Reserved1;
+    ULONGLONG Reserved2;
+    NTSTATUS Status;
+} FS_BPIO_OUTPUT, * PFS_BPIO_OUTPUT;
+#endif
+
+
+typedef enum _PYAS_DRIVER_STATE {
+    PyasDriverStateCold = 0,
+    PyasDriverStateStarting = 1,
+    PyasDriverStateRunning = 2,
+    PyasDriverStateStopping = 3,
+    PyasDriverStateStopRetry = 4,
+    PyasDriverStateStopped = 5
+} PYAS_DRIVER_STATE;
+
+typedef struct _PYAS_MESSAGE {
+    ULONG MessageCode;
+    ULONG ProcessId;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_MESSAGE, * PPYAS_MESSAGE;
+
+typedef enum _PYAS_COMMAND {
+    PyasCommandAddWhitelist = 1,
+    PyasCommandRemoveWhitelist = 2,
+    PyasCommandLoadRuleFile = 3,
+    PyasCommandClearRules = 4,
+    PyasCommandAuthorizeUnload = 5,
+    PyasCommandRevokeUnload = 6,
+    PyasCommandQueryState = 7
+} PYAS_COMMAND;
+
+typedef struct _PYAS_USER_MESSAGE {
+    ULONG Command;
+    WCHAR Path[MAX_PATH_LEN];
+} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+
+typedef struct _DRIVER_DATA {
+    PDRIVER_OBJECT DriverObject;
+    PFLT_FILTER FilterHandle;
+    PFLT_PORT ServerPort;
+    PFLT_PORT ClientPort;
+    PEPROCESS PyasProcess;
+    ULONG PyasPid;
+    LARGE_INTEGER Cookie;
+    KSPIN_LOCK PortMutex;
+    KSPIN_LOCK TrackerMutex;
+    KSPIN_LOCK PidLock;
+    BOOLEAN Initialized;
+    volatile LONG DriverState;
+    volatile LONG UnloadAuthorized;
+    volatile LONG PortStopping;
+    volatile LONG ClientCloseActive;
+    EX_RUNDOWN_REF PortRundown;
+    KEVENT CleanupCompleteEvent;
+    PVOID ObRegistrationHandle;
+} DRIVER_DATA, * PDRIVER_DATA;
+
+typedef struct _RULE_NODE {
+    struct _RULE_NODE* Next;
+    UNICODE_STRING Pattern;
+} RULE_NODE, * PRULE_NODE;
+
+typedef enum _RULE_CATEGORY {
+    RuleCategoryProcess,
+    RuleCategoryFile,
+    RuleCategoryRegistry,
+    RuleCategoryDevice,
+    RuleCategoryMemory,
+    RuleCategoryThread,
+    RuleCategoryUnknown
+} RULE_CATEGORY;
+
+#define OP_WRITE                   0x00000001
+#define OP_DELETE                  0x00000002
+#define OP_CREATE                  0x00000004
+#define OP_EXECUTE                 0x00000008
+#define OP_RENAME                  0x00000010
+#define OP_IOCTL                   0x00000020
+#define OP_VM_READ                 0x00000040
+#define OP_VM_WRITE                0x00000080
+#define OP_TERMINATE               0x00000100
+#define OP_SUSPEND_RESUME          0x00000200
+#define OP_DUP_HANDLE              0x00000400
+#define OP_SET_INFORMATION         0x00000800
+#define OP_VM_OPERATION            0x00001000
+#define OP_CREATE_THREAD           0x00002000
+#define OP_THREAD_SET_CONTEXT      0x00004000
+#define OP_THREAD_SET_TOKEN        0x00008000
+#define OP_CREATE_PROCESS          0x00010000
+#define OP_IMAGE_LOAD              0x00020000
+#define OP_IMPERSONATE             0x00040000
+
+#define PYAS_HANDLE_CREATE         0x00000001
+#define PYAS_HANDLE_DUPLICATE      0x00000002
+
+#define PYAS_OBJECT_PROCESS        0x00000001
+#define PYAS_OBJECT_THREAD         0x00000002
+
+#define PYAS_MEMORY_PRIVATE        0x00000001
+#define PYAS_MEMORY_MAPPED         0x00000002
+#define PYAS_MEMORY_IMAGE          0x00000004
+
+#define PYAS_PROTECT_EXECUTE       0x00000001
+#define PYAS_PROTECT_EXECUTE_WRITE 0x00000002
+
+typedef enum _RULE_TRI_STATE {
+    RuleTriAny = 0,
+    RuleTriTrue = 1,
+    RuleTriFalse = 2
+} RULE_TRI_STATE;
+
+typedef enum _RULE_OPERATION_MATCH {
+    RuleOperationAny = 0,
+    RuleOperationAll = 1
+} RULE_OPERATION_MATCH;
+
+typedef struct _DYNAMIC_RULE {
+    ULONG Code;
+    BOOLEAN Kill;
+    ULONG Priority;
+    RULE_CATEGORY Category;
+    ULONG Operations;
+    RULE_OPERATION_MATCH OperationMatch;
+    BOOLEAN Invalid;
+
+    PRULE_NODE Initiator;
+    PRULE_NODE InitiatorExclude;
+    PRULE_NODE InitiatorParent;
+    PRULE_NODE InitiatorParentExclude;
+    PRULE_NODE InitiatorProcessTree;
+    PRULE_NODE InitiatorProcessTreeExclude;
+    PRULE_NODE Target;
+    PRULE_NODE TargetExclude;
+    PRULE_NODE TargetProcessTree;
+    PRULE_NODE TargetProcessTreeExclude;
+    PRULE_NODE Creator;
+    PRULE_NODE CreatorExclude;
+    PRULE_NODE Parent;
+    PRULE_NODE ParentExclude;
+    PRULE_NODE CommandLine;
+    PRULE_NODE CommandLineExclude;
+    PRULE_NODE Extensions;
+
+    ULONG HandleTypes;
+    ULONG ObjectTypes;
+    ULONG MinimumRiskScore;
+    ULONG MaximumRiskScore;
+    ULONG ThreadMemoryTypes;
+    ULONG ThreadMemoryProtections;
+    ULONGLONG MinimumRegionSize;
+    ULONGLONG MaximumRegionSize;
+    RULE_TRI_STATE ParentMismatch;
+    RULE_TRI_STATE FileOpenNameAvailable;
+    RULE_TRI_STATE SubsystemProcess;
+
+    ULONG Threshold;
+    ULONG TimeWindow;
+
+    struct _DYNAMIC_RULE* Next;
+} DYNAMIC_RULE, * PDYNAMIC_RULE;
+
+BOOLEAN EvaluateDeviceRule(HANDLE ProcessId, PULONG OutCode, PBOOLEAN OutKill);
+
+extern DRIVER_DATA GlobalData;
+
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
+
+NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject);
+NTSTATUS UninitializeRegistryProtection();
+
+NTSTATUS InitializeProcessProtection();
+NTSTATUS UninitializeProcessProtection();
+BOOLEAN GetProcessRelation(HANDLE ProcessId, PHANDLE ParentProcessId, PHANDLE CreatorProcessId);
+
+NTSTATUS InitializeMemoryProtection(PDRIVER_OBJECT DriverObject);
+NTSTATUS UninitializeMemoryProtection(BOOLEAN WaitWithoutTimeout);
+
+NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath);
+VOID UnloadRules();
+
+NTSTATUS InitializeRulesEngine();
+VOID UninitializeRulesEngine();
+
+VOID AddDynamicWhitelist(PUNICODE_STRING RuleStr);
+VOID RemoveDynamicWhitelist(PUNICODE_STRING RuleStr);
+
+NTSTATUS LoadRuleFile(PCUNICODE_STRING FilePath);
+VOID ClearDynamicRules();
+
+VOID ProcessNotifyCallbackEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo);
+NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName);
+
+ULONG SafeGetPyasPid();
+VOID SafeSetPyasPid(ULONG Pid);
+
+BOOLEAN IsProcessTrusted(HANDLE ProcessId);
+BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes);
+
+BOOLEAN EvaluateProcessCreateRule(
+    HANDLE CreatorPid,
+    HANDLE ParentPid,
+    HANDLE ProcessId,
+    PCUNICODE_STRING TargetPath,
+    PCUNICODE_STRING CommandLine,
+    BOOLEAN FileOpenNameAvailable,
+    BOOLEAN IsSubsystemProcess,
+    PULONG OutCode,
+    PBOOLEAN OutKill
+);
+BOOLEAN EvaluateProcessAccessRule(
+    HANDLE SourcePid,
+    HANDLE TargetPid,
+    ULONG RequestedOperations,
+    ULONG HandleType,
+    ULONG ObjectType,
+    PULONG DeniedOperations,
+    PULONG OutCode,
+    PBOOLEAN OutKill
+);
+BOOLEAN EvaluateThreadRule(
+    HANDLE SourcePid,
+    HANDLE TargetPid,
+    PVOID StartAddress,
+    ULONG MemoryType,
+    ULONG MemoryProtection,
+    SIZE_T RegionSize,
+    PULONG OutCode,
+    PBOOLEAN OutKill
+);
+BOOLEAN EvaluateImageLoadRule(HANDLE ProcessId, PCUNICODE_STRING ImagePath, PIMAGE_INFO ImageInfo, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateProcessRule(HANDLE ProcessId, PCUNICODE_STRING TargetPath, PCUNICODE_STRING CommandLine, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateFileRule(HANDLE ProcessId, PCUNICODE_STRING TargetPath, ULONG Operation, PVOID WriteBuffer, ULONG WriteLength, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateRegistryRule(HANDLE ProcessId, PCUNICODE_STRING KeyName, ULONG Operation, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateMemoryRule(HANDLE SourcePid, HANDLE TargetPid, ULONG Operation, PULONG OutCode, PBOOLEAN OutKill);
+BOOLEAN EvaluateProcessHandleRule(HANDLE SourcePid, HANDLE TargetPid, ULONG Operation, PULONG OutCode, PBOOLEAN OutKill);
+
+VOID QueueRuleProcessTermination(HANDLE ProcessId, BOOLEAN Kill);
+NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize);
+
+FORCEINLINE PVOID PyasAllocate(SIZE_T Size) {
+    return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG);
+}
+
+FORCEINLINE VOID PyasFree(PVOID Ptr) {
+    if (Ptr) ExFreePoolWithTag(Ptr, PYAS_POOL_TAG);
 }

Plugins/Filter/DriverEntry.cpp

@@ -1,220 +1,631 @@
-#include "DriverCommon.h"
-
-DRIVER_DATA GlobalData;
-static BOOLEAN g_ImageNotifyRegistered = FALSE;
-
-static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-    UNREFERENCED_PARAMETER(VolumeDeviceType);
-    UNREFERENCED_PARAMETER(VolumeFilesystemType);
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS InstanceQueryTeardown(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-    return STATUS_SUCCESS;
-}
-
-static VOID InstanceTeardownStart(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-}
-
-static VOID InstanceTeardownComplete(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_TEARDOWN_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(Flags);
-}
-
-static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
-    UNREFERENCED_PARAMETER(Flags);
-
-    if (GlobalData.ServerPort) {
-        FltCloseCommunicationPort(GlobalData.ServerPort);
-        GlobalData.ServerPort = NULL;
-    }
-
-    if (GlobalData.FilterHandle) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-        GlobalData.FilterHandle = NULL;
-    }
-
-    if (g_ImageNotifyRegistered) {
-        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
-        g_ImageNotifyRegistered = FALSE;
-    }
-
-    UninitializeRegistryProtection();
-    UninitializeProcessProtection();
-
-    UnloadRules();
-    UninitializeRulesEngine();
-
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength) {
-    UNREFERENCED_PARAMETER(PortCookie);
-    UNREFERENCED_PARAMETER(OutputBuffer);
-    UNREFERENCED_PARAMETER(OutputBufferLength);
-
-    if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
-        PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
-        if (msg->Command == 1 || msg->Command == 2) {
-            msg->Path[MAX_PATH_LEN - 1] = L'\0';
-            UNICODE_STRING us;
-            RtlInitUnicodeString(&us, msg->Path);
-            if (us.Length > 0) {
-                if (msg->Command == 1) {
-                    AddDynamicWhitelist(&us);
-                }
-                else {
-                    RemoveDynamicWhitelist(&us);
-                }
-            }
-        }
-    }
-
-    if (ReturnOutputBufferLength) {
-        *ReturnOutputBufferLength = 0;
-    }
-    return STATUS_SUCCESS;
-}
-
-static NTSTATUS PortConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID* ConnectionPortCookie) {
-    UNREFERENCED_PARAMETER(ServerPortCookie);
-    UNREFERENCED_PARAMETER(ConnectionContext);
-    UNREFERENCED_PARAMETER(SizeOfContext);
-    UNREFERENCED_PARAMETER(ConnectionPortCookie);
-
-    KIRQL OldIrql;
-    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
-
-    GlobalData.ClientPort = ClientPort;
-    GlobalData.PyasPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
-    GlobalData.PyasProcess = PsGetCurrentProcess();
-
-    ExReInitializeRundownProtection(&GlobalData.PortRundown);
-
-    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
-
-    return STATUS_SUCCESS;
-}
-
-static VOID PortDisconnect(PVOID ConnectionCookie) {
-    UNREFERENCED_PARAMETER(ConnectionCookie);
-
-    KIRQL OldIrql;
-    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
-
-    GlobalData.ClientPort = NULL;
-    GlobalData.PyasPid = 0;
-    GlobalData.PyasProcess = NULL;
-
-    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
-
-    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
-}
-
-CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
-    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
-    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
-    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
-    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
-    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
-    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
-    { IRP_MJ_OPERATION_END }
-};
-
-CONST FLT_REGISTRATION FilterRegistration = {
-    sizeof(FLT_REGISTRATION),
-    FLT_REGISTRATION_VERSION,
-    0,
-    NULL,
-    Callbacks,
-    DriverUnload,
-    InstanceSetup,
-    InstanceQueryTeardown,
-    InstanceTeardownStart,
-    InstanceTeardownComplete,
-    NULL,
-    NULL,
-    NULL
-};
-
-extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
-    NTSTATUS status = STATUS_SUCCESS;
-    PSECURITY_DESCRIPTOR sd = NULL;
-    OBJECT_ATTRIBUTES oa = { 0 };
-    UNICODE_STRING name = { 0 };
-
-    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
-    GlobalData.DriverObject = DriverObject;
-    KeInitializeSpinLock(&GlobalData.PortMutex);
-    KeInitializeSpinLock(&GlobalData.TrackerMutex);
-
-    ExInitializeRundownProtection(&GlobalData.PortRundown);
-
-    InitializeRulesEngine();
-
-    status = LoadRulesFromDisk(RegistryPath);
-
-    status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) {
-        UnloadRules();
-        UninitializeRulesEngine();
-        return status;
-    }
-
-    status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);
-    if (NT_SUCCESS(status)) {
-        RtlInitUnicodeString(&name, PYAS_PORT_NAME);
-        InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, sd);
-        status = FltCreateCommunicationPort(GlobalData.FilterHandle, &GlobalData.ServerPort, &oa, NULL, PortConnect, PortDisconnect, PortMessage, 1);
-        FltFreeSecurityDescriptor(sd);
-    }
-
-    if (!NT_SUCCESS(status)) {
-        FltUnregisterFilter(GlobalData.FilterHandle);
-        GlobalData.FilterHandle = NULL;
-        UnloadRules();
-        UninitializeRulesEngine();
-        return status;
-    }
-
-    InitializeProcessProtection();
-
-    InitializeRegistryProtection(DriverObject);
-
-    NTSTATUS imageNotifyStatus = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
-    if (NT_SUCCESS(imageNotifyStatus)) {
-        g_ImageNotifyRegistered = TRUE;
-    }
-
-    status = FltStartFiltering(GlobalData.FilterHandle);
-    if (!NT_SUCCESS(status)) {
-        if (g_ImageNotifyRegistered) {
-            PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
-            g_ImageNotifyRegistered = FALSE;
-        }
-
-        UninitializeRegistryProtection();
-        UninitializeProcessProtection();
-
-        if (GlobalData.ServerPort) {
-            FltCloseCommunicationPort(GlobalData.ServerPort);
-            GlobalData.ServerPort = NULL;
-        }
-
-        if (GlobalData.FilterHandle) {
-            FltUnregisterFilter(GlobalData.FilterHandle);
-            GlobalData.FilterHandle = NULL;
-        }
-
-        UnloadRules();
-        UninitializeRulesEngine();
-    }
-
-    return status;
-}
+#include "DriverCommon.h"
+
+DRIVER_DATA GlobalData;
+static BOOLEAN g_ProcessNotifyRegistered = FALSE;
+static BOOLEAN g_ProcessProtectionInitialized = FALSE;
+static BOOLEAN g_RegistryProtectionInitialized = FALSE;
+static BOOLEAN g_RulesEngineInitialized = FALSE;
+
+static NTSTATUS InstanceSetup(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_SETUP_FLAGS Flags,
+    DEVICE_TYPE VolumeDeviceType,
+    FLT_FILESYSTEM_TYPE VolumeFilesystemType
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    UNREFERENCED_PARAMETER(VolumeDeviceType);
+    UNREFERENCED_PARAMETER(VolumeFilesystemType);
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS InstanceQueryTeardown(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+    return STATUS_SUCCESS;
+}
+
+static VOID InstanceTeardownStart(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_TEARDOWN_FLAGS Flags
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static VOID InstanceTeardownComplete(
+    PCFLT_RELATED_OBJECTS FltObjects,
+    FLT_INSTANCE_TEARDOWN_FLAGS Flags
+) {
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(Flags);
+}
+
+static NTSTATUS SelectFailure(NTSTATUS CurrentStatus, NTSTATUS CandidateStatus) {
+    if (!NT_SUCCESS(CurrentStatus)) return CurrentStatus;
+    return CandidateStatus;
+}
+
+static NTSTATUS UnregisterRuntimeCallbacksPass(BOOLEAN WaitWithoutTimeout) {
+    NTSTATUS Status = STATUS_SUCCESS;
+
+    NTSTATUS MemoryStatus = UninitializeMemoryProtection(WaitWithoutTimeout);
+    if (!NT_SUCCESS(MemoryStatus)) {
+        Status = SelectFailure(Status, MemoryStatus);
+    }
+
+    if (g_ProcessNotifyRegistered) {
+        NTSTATUS ProcessNotifyStatus = PsSetCreateProcessNotifyRoutineEx(
+            ProcessNotifyCallbackEx,
+            TRUE
+        );
+
+        if (NT_SUCCESS(ProcessNotifyStatus) || ProcessNotifyStatus == STATUS_INVALID_PARAMETER) {
+            g_ProcessNotifyRegistered = FALSE;
+        }
+        else {
+            Status = SelectFailure(Status, ProcessNotifyStatus);
+        }
+    }
+
+    if (!g_ProcessNotifyRegistered && g_ProcessProtectionInitialized) {
+        NTSTATUS ProcessStatus = UninitializeProcessProtection();
+        if (NT_SUCCESS(ProcessStatus)) {
+            g_ProcessProtectionInitialized = FALSE;
+        }
+        else {
+            Status = SelectFailure(Status, ProcessStatus);
+        }
+    }
+
+    if (g_RegistryProtectionInitialized) {
+        NTSTATUS RegistryStatus = UninitializeRegistryProtection();
+        if (NT_SUCCESS(RegistryStatus)) {
+            g_RegistryProtectionInitialized = FALSE;
+        }
+        else {
+            Status = SelectFailure(Status, RegistryStatus);
+        }
+    }
+
+    return Status;
+}
+
+static NTSTATUS UnregisterRuntimeCallbacks(BOOLEAN WaitWithoutTimeout) {
+    for (;;) {
+        NTSTATUS Status = UnregisterRuntimeCallbacksPass(WaitWithoutTimeout);
+        if (NT_SUCCESS(Status) || !WaitWithoutTimeout) return Status;
+
+        LARGE_INTEGER Delay;
+        Delay.QuadPart = -(10LL * 10 * 1000);
+        KeDelayExecutionThread(KernelMode, FALSE, &Delay);
+    }
+}
+
+static PEPROCESS DetachConnectedProcessReference(PEPROCESS ExpectedProcess) {
+    PEPROCESS Process = NULL;
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
+    if (!ExpectedProcess || GlobalData.PyasProcess == ExpectedProcess) {
+        Process = GlobalData.PyasProcess;
+        GlobalData.PyasProcess = NULL;
+    }
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+    return Process;
+}
+
+static VOID ReleaseConnectedProcessReference() {
+    PEPROCESS Process = DetachConnectedProcessReference(NULL);
+
+    SafeSetPyasPid(0);
+    InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+
+    if (Process) {
+        ObDereferenceObject(Process);
+    }
+}
+
+static VOID CloseCurrentClientPort() {
+    if (InterlockedCompareExchange(&GlobalData.ClientCloseActive, 1, 0) != 0) return;
+
+    PFLT_FILTER FilterHandle = NULL;
+    PFLT_PORT ClientPort = NULL;
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+    FilterHandle = GlobalData.FilterHandle;
+    ClientPort = GlobalData.ClientPort;
+    GlobalData.ClientPort = NULL;
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+
+    if (FilterHandle && ClientPort) {
+        FltCloseClientPort(FilterHandle, &ClientPort);
+    }
+
+    InterlockedExchange(&GlobalData.ClientCloseActive, 0);
+}
+
+static VOID WaitForClientPortClose() {
+    LARGE_INTEGER Delay;
+    Delay.QuadPart = -(10LL * 1000);
+
+    while (InterlockedCompareExchange(&GlobalData.ClientCloseActive, 0, 0) != 0) {
+        KeDelayExecutionThread(KernelMode, FALSE, &Delay);
+    }
+}
+
+static VOID ReleaseFilterResources() {
+    InterlockedExchange(&GlobalData.PortStopping, 1);
+
+    if (GlobalData.ServerPort) {
+        PFLT_PORT ServerPort = GlobalData.ServerPort;
+        GlobalData.ServerPort = NULL;
+        FltCloseCommunicationPort(ServerPort);
+    }
+
+    CloseCurrentClientPort();
+    WaitForClientPortClose();
+    ExWaitForRundownProtectionRelease(&GlobalData.PortRundown);
+
+    if (GlobalData.FilterHandle) {
+        PFLT_FILTER FilterHandle = GlobalData.FilterHandle;
+        FltUnregisterFilter(FilterHandle);
+        GlobalData.FilterHandle = NULL;
+    }
+
+    ReleaseConnectedProcessReference();
+}
+
+static NTSTATUS CleanupDriverState(BOOLEAN WaitWithoutTimeout) {
+    NTSTATUS Status = UnregisterRuntimeCallbacks(WaitWithoutTimeout);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    GlobalData.Initialized = FALSE;
+    ReleaseFilterResources();
+
+    if (g_RulesEngineInitialized) {
+        UnloadRules();
+        UninitializeRulesEngine();
+        g_RulesEngineInitialized = FALSE;
+    }
+
+    return STATUS_SUCCESS;
+}
+
+static NTSTATUS BeginUnload(BOOLEAN MandatoryUnload) {
+    for (;;) {
+        LONG State = InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateCold,
+            PyasDriverStateCold
+        );
+
+        if (State == PyasDriverStateStopped) return STATUS_SUCCESS;
+
+        if (State == PyasDriverStateStopping) {
+            LARGE_INTEGER Timeout;
+            PLARGE_INTEGER TimeoutPointer = NULL;
+
+            if (!MandatoryUnload) {
+                Timeout.QuadPart = -(2LL * 10 * 1000 * 1000);
+                TimeoutPointer = &Timeout;
+            }
+
+            NTSTATUS WaitStatus = KeWaitForSingleObject(
+                &GlobalData.CleanupCompleteEvent,
+                Executive,
+                KernelMode,
+                FALSE,
+                TimeoutPointer
+            );
+
+            if (!MandatoryUnload && WaitStatus == STATUS_TIMEOUT) {
+                return STATUS_DEVICE_BUSY;
+            }
+
+            if (!NT_SUCCESS(WaitStatus)) return WaitStatus;
+            continue;
+        }
+
+        if (State != PyasDriverStateRunning && State != PyasDriverStateStopRetry) {
+            return STATUS_DEVICE_NOT_READY;
+        }
+
+        if (!MandatoryUnload && InterlockedCompareExchange(&GlobalData.UnloadAuthorized, 0, 1) != 1) {
+            return STATUS_ACCESS_DENIED;
+        }
+
+        if (MandatoryUnload) {
+            InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+        }
+
+        if (InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateStopping,
+            State
+        ) != State) {
+            if (!MandatoryUnload) return STATUS_DEVICE_BUSY;
+            continue;
+        }
+
+        KeClearEvent(&GlobalData.CleanupCompleteEvent);
+        return STATUS_SUCCESS;
+    }
+}
+
+static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
+    BOOLEAN MandatoryUnload = FlagOn(Flags, FLTFL_FILTER_UNLOAD_MANDATORY) ? TRUE : FALSE;
+
+    NTSTATUS Status = BeginUnload(MandatoryUnload);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    LONG State = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (State == PyasDriverStateStopped) return STATUS_SUCCESS;
+
+    Status = CleanupDriverState(MandatoryUnload);
+
+    InterlockedExchange(
+        &GlobalData.DriverState,
+        NT_SUCCESS(Status) ? PyasDriverStateStopped : PyasDriverStateStopRetry
+    );
+
+    KeSetEvent(&GlobalData.CleanupCompleteEvent, IO_NO_INCREMENT, FALSE);
+    return Status;
+}
+
+static NTSTATUS PortMessage(
+    PVOID PortCookie,
+    PVOID InputBuffer,
+    ULONG InputBufferLength,
+    PVOID OutputBuffer,
+    ULONG OutputBufferLength,
+    PULONG ReturnOutputBufferLength
+) {
+    if (ReturnOutputBufferLength) *ReturnOutputBufferLength = 0;
+
+    if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    NTSTATUS Status = STATUS_SUCCESS;
+    PYAS_USER_MESSAGE Message = { 0 };
+    UNICODE_STRING Path = { 0 };
+    LONG DriverState = PyasDriverStateCold;
+    ULONG StateValue = PyasDriverStateCold;
+
+    if (!PortCookie || PortCookie != GlobalData.PyasProcess) {
+        Status = STATUS_ACCESS_DENIED;
+        goto Exit;
+    }
+
+    if (!InputBuffer || InputBufferLength < sizeof(PYAS_USER_MESSAGE)) {
+        Status = STATUS_INVALID_PARAMETER;
+        goto Exit;
+    }
+
+    __try {
+        RtlCopyMemory(&Message, InputBuffer, sizeof(Message));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        Status = GetExceptionCode();
+        goto Exit;
+    }
+
+    Message.Path[MAX_PATH_LEN - 1] = L'\0';
+
+    if (Message.Command == PyasCommandQueryState) {
+        if (!OutputBuffer || OutputBufferLength < sizeof(ULONG) || !ReturnOutputBufferLength) {
+            Status = STATUS_BUFFER_TOO_SMALL;
+            goto Exit;
+        }
+
+        StateValue = (ULONG)InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateCold,
+            PyasDriverStateCold
+        );
+
+        __try {
+            *(PULONG)OutputBuffer = StateValue;
+            *ReturnOutputBufferLength = sizeof(ULONG);
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            Status = GetExceptionCode();
+        }
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandAuthorizeUnload) {
+        DriverState = InterlockedCompareExchange(
+            &GlobalData.DriverState,
+            PyasDriverStateCold,
+            PyasDriverStateCold
+        );
+
+        if (DriverState != PyasDriverStateRunning && DriverState != PyasDriverStateStopRetry) {
+            Status = STATUS_DEVICE_NOT_READY;
+            goto Exit;
+        }
+
+        InterlockedExchange(&GlobalData.UnloadAuthorized, 1);
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandRevokeUnload) {
+        InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+        goto Exit;
+    }
+
+    if (Message.Command < PyasCommandAddWhitelist || Message.Command > PyasCommandClearRules) {
+        Status = STATUS_INVALID_DEVICE_REQUEST;
+        goto Exit;
+    }
+
+    DriverState = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (DriverState != PyasDriverStateRunning) {
+        Status = STATUS_DEVICE_NOT_READY;
+        goto Exit;
+    }
+
+    RtlInitUnicodeString(&Path, Message.Path);
+
+    if (Message.Command == PyasCommandAddWhitelist) {
+        if (Path.Length == 0) {
+            Status = STATUS_INVALID_PARAMETER;
+            goto Exit;
+        }
+
+        AddDynamicWhitelist(&Path);
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandRemoveWhitelist) {
+        if (Path.Length == 0) {
+            Status = STATUS_INVALID_PARAMETER;
+            goto Exit;
+        }
+
+        RemoveDynamicWhitelist(&Path);
+        goto Exit;
+    }
+
+    if (Message.Command == PyasCommandLoadRuleFile) {
+        if (Path.Length == 0) {
+            Status = STATUS_INVALID_PARAMETER;
+            goto Exit;
+        }
+
+        Status = LoadRuleFile(&Path);
+        goto Exit;
+    }
+
+    ClearDynamicRules();
+
+Exit:
+    ExReleaseRundownProtection(&GlobalData.PortRundown);
+    return Status;
+}
+
+static NTSTATUS PortConnect(
+    PFLT_PORT ClientPort,
+    PVOID ServerPortCookie,
+    PVOID ConnectionContext,
+    ULONG SizeOfContext,
+    PVOID* ConnectionPortCookie
+) {
+    UNREFERENCED_PARAMETER(ServerPortCookie);
+    UNREFERENCED_PARAMETER(ConnectionContext);
+    UNREFERENCED_PARAMETER(SizeOfContext);
+
+    if (!ConnectionPortCookie) return STATUS_INVALID_PARAMETER;
+    *ConnectionPortCookie = NULL;
+
+    if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    LONG DriverState = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (DriverState != PyasDriverStateRunning && DriverState != PyasDriverStateStopRetry) {
+        return STATUS_DEVICE_NOT_READY;
+    }
+
+    if (!ExAcquireRundownProtection(&GlobalData.PortRundown)) {
+        return STATUS_DELETE_PENDING;
+    }
+
+    PEPROCESS ConnectingProcess = PsGetCurrentProcess();
+    ObReferenceObject(ConnectingProcess);
+
+    NTSTATUS Status = STATUS_SUCCESS;
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&GlobalData.PortMutex, &OldIrql);
+
+    DriverState = InterlockedCompareExchange(
+        &GlobalData.DriverState,
+        PyasDriverStateCold,
+        PyasDriverStateCold
+    );
+
+    if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
+        Status = STATUS_DELETE_PENDING;
+    }
+    else if (DriverState != PyasDriverStateRunning && DriverState != PyasDriverStateStopRetry) {
+        Status = STATUS_DEVICE_NOT_READY;
+    }
+    else if (GlobalData.ClientPort || GlobalData.PyasProcess) {
+        Status = STATUS_DEVICE_BUSY;
+    }
+    else {
+        GlobalData.ClientPort = ClientPort;
+        GlobalData.PyasProcess = ConnectingProcess;
+        *ConnectionPortCookie = ConnectingProcess;
+    }
+
+    KeReleaseSpinLock(&GlobalData.PortMutex, OldIrql);
+
+    if (!NT_SUCCESS(Status)) {
+        ObDereferenceObject(ConnectingProcess);
+        ExReleaseRundownProtection(&GlobalData.PortRundown);
+        return Status;
+    }
+
+    SafeSetPyasPid((ULONG)(ULONG_PTR)PsGetCurrentProcessId());
+    InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+    ExReleaseRundownProtection(&GlobalData.PortRundown);
+    return STATUS_SUCCESS;
+}
+
+static VOID PortDisconnect(PVOID ConnectionCookie) {
+    if (!ConnectionCookie) return;
+
+    PEPROCESS Process = DetachConnectedProcessReference((PEPROCESS)ConnectionCookie);
+    if (!Process) return;
+
+    CloseCurrentClientPort();
+    InterlockedExchange(&GlobalData.UnloadAuthorized, 0);
+    SafeSetPyasPid(0);
+    ObDereferenceObject(Process);
+}
+
+CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
+    { IRP_MJ_CREATE, 0, ProtectFile_PreCreate, NULL },
+    { IRP_MJ_WRITE, 0, ProtectFile_PreWrite, NULL },
+    { IRP_MJ_SET_INFORMATION, 0, ProtectFile_PreSetInfo, NULL },
+    { IRP_MJ_SET_SECURITY, 0, ProtectFile_SetSecurity, NULL },
+    { IRP_MJ_FILE_SYSTEM_CONTROL, 0, ProtectFile_FileSystemControl, NULL },
+    { IRP_MJ_DEVICE_CONTROL, 0, ProtectBoot_PreDeviceControl, NULL },
+    { IRP_MJ_OPERATION_END }
+};
+
+CONST FLT_REGISTRATION FilterRegistration = {
+    sizeof(FLT_REGISTRATION),
+    FLT_REGISTRATION_VERSION,
+    0,
+    NULL,
+    Callbacks,
+    DriverUnload,
+    InstanceSetup,
+    InstanceQueryTeardown,
+    InstanceTeardownStart,
+    InstanceTeardownComplete,
+    NULL,
+    NULL,
+    NULL
+};
+
+extern "C" NTSTATUS DriverEntry(
+    PDRIVER_OBJECT DriverObject,
+    PUNICODE_STRING RegistryPath
+) {
+    RtlZeroMemory(&GlobalData, sizeof(GlobalData));
+    GlobalData.DriverObject = DriverObject;
+    KeInitializeSpinLock(&GlobalData.PortMutex);
+    KeInitializeSpinLock(&GlobalData.TrackerMutex);
+    KeInitializeSpinLock(&GlobalData.PidLock);
+    ExInitializeRundownProtection(&GlobalData.PortRundown);
+    KeInitializeEvent(&GlobalData.CleanupCompleteEvent, NotificationEvent, FALSE);
+    InterlockedExchange(&GlobalData.PortStopping, 0);
+    InterlockedExchange(&GlobalData.ClientCloseActive, 0);
+    InterlockedExchange(&GlobalData.DriverState, PyasDriverStateStarting);
+
+    NTSTATUS Status = STATUS_SUCCESS;
+    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
+
+    Status = InitializeRulesEngine();
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&GlobalData.DriverState, PyasDriverStateStopped);
+        KeSetEvent(&GlobalData.CleanupCompleteEvent, IO_NO_INCREMENT, FALSE);
+        return Status;
+    }
+    g_RulesEngineInitialized = TRUE;
+
+    Status = LoadRulesFromDisk(RegistryPath);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = FltBuildDefaultSecurityDescriptor(&SecurityDescriptor, FLT_PORT_ALL_ACCESS);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    {
+        UNICODE_STRING PortName;
+        RtlInitUnicodeString(&PortName, PYAS_PORT_NAME);
+
+        OBJECT_ATTRIBUTES ObjectAttributes;
+        InitializeObjectAttributes(
+            &ObjectAttributes,
+            &PortName,
+            OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
+            NULL,
+            SecurityDescriptor
+        );
+
+        Status = FltCreateCommunicationPort(
+            GlobalData.FilterHandle,
+            &GlobalData.ServerPort,
+            &ObjectAttributes,
+            NULL,
+            PortConnect,
+            PortDisconnect,
+            PortMessage,
+            1
+        );
+    }
+
+    FltFreeSecurityDescriptor(SecurityDescriptor);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = InitializeRegistryProtection(DriverObject);
+    if (!NT_SUCCESS(Status)) goto Failure;
+    g_RegistryProtectionInitialized = TRUE;
+
+    Status = InitializeProcessProtection();
+    if (!NT_SUCCESS(Status)) goto Failure;
+    g_ProcessProtectionInitialized = TRUE;
+
+    Status = PsSetCreateProcessNotifyRoutineEx(ProcessNotifyCallbackEx, FALSE);
+    if (!NT_SUCCESS(Status)) goto Failure;
+    g_ProcessNotifyRegistered = TRUE;
+
+    Status = InitializeMemoryProtection(DriverObject);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    Status = FltStartFiltering(GlobalData.FilterHandle);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
+    GlobalData.Initialized = TRUE;
+    InterlockedExchange(&GlobalData.DriverState, PyasDriverStateRunning);
+    return STATUS_SUCCESS;
+
+Failure:
+    CleanupDriverState(TRUE);
+    InterlockedExchange(&GlobalData.DriverState, PyasDriverStateStopped);
+    KeSetEvent(&GlobalData.CleanupCompleteEvent, IO_NO_INCREMENT, FALSE);
+    return Status;
+}

Plugins/Filter/PYAS_Driver.vcxproj

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|x64">
@@ -92,6 +92,7 @@
     </ClCompile>
     <Link>
       <AdditionalDependencies>$(DDK_LIB_PATH)fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -103,6 +104,7 @@
     </ClCompile>
     <Link>
       <AdditionalDependencies>$(DDK_LIB_PATH)fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
@@ -118,6 +120,7 @@
     <ClCompile Include="DriverEntry.cpp" />
     <ClCompile Include="ProtectBoot.cpp" />
     <ClCompile Include="ProtectFile.cpp" />
+    <ClCompile Include="ProtectMemory.cpp" />
     <ClCompile Include="ProtectProcess.cpp" />
     <ClCompile Include="ProtectRegistry.cpp" />
     <ClCompile Include="ProtectRules.cpp" />

Plugins/Filter/PYAS_Driver.vcxproj.filters

@@ -47,5 +47,8 @@
     <ClCompile Include="DriverEntry.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="ProtectMemory.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
   </ItemGroup>
 </Project>

Plugins/Filter/ProtectBoot.cpp

@@ -22,9 +22,13 @@ FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data,
         IoControlCode == IOCTL_DISK_FORMAT_TRACKS_EX) {
 
         HANDLE Pid = PsGetCurrentProcessId();
-        if (!IsProcessTrusted(Pid)) {
+        ULONG RuleCode = 0;
+        BOOLEAN Kill = FALSE;
+
+        if (EvaluateDeviceRule(Pid, &RuleCode, &Kill)) {
             UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
-            SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
+            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
+            QueueRuleProcessTermination(Pid, Kill);
             Data->IoStatus.Status = STATUS_ACCESS_DENIED;
             return FLT_PREOP_COMPLETE;
         }

Plugins/Filter/ProtectFile.cpp

@@ -1,14 +1,5 @@
 #include "DriverCommon.h"
 
-static BOOLEAN IsHoneyToken(PUNICODE_STRING Path) {
-    if (!Path || !Path->Buffer) return FALSE;
-    if (WildcardMatch(L"*PYAS_Honey*", Path->Buffer, Path->Length) ||
-        WildcardMatch(L"*Backup_Secret*", Path->Buffer, Path->Length)) {
-        return TRUE;
-    }
-    return FALSE;
-}
-
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
     UNREFERENCED_PARAMETER(FltObjects);
     UNREFERENCED_PARAMETER(CompletionContext);
@@ -17,93 +8,39 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreCreate(PFLT_CALLBACK_DATA Data, PCFLT_R
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    UNICODE_STRING FileName = { 0 };
-    NTSTATUS status = STATUS_SUCCESS;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
+    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+    if (!NT_SUCCESS(status) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status)) {
-        FltReleaseFileNameInformation(nameInfo);
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
-
-    FileName = nameInfo->Name;
-    if (!FileName.Buffer || FileName.Length == 0) {
+    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer || nameInfo->Name.Length == 0) {
         FltReleaseFileNameInformation(nameInfo);
         return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
 
     HANDLE Pid = PsGetCurrentProcessId();
-    BOOLEAN Trusted = IsProcessTrusted(Pid);
+    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     ULONG CreateDisposition = (Data->Iopb->Parameters.Create.Options >> 24) & 0xFF;
-    BOOLEAN IsCreateAction = (CreateDisposition == FILE_CREATE ||
-        CreateDisposition == FILE_SUPERSEDE ||
-        CreateDisposition == FILE_OVERWRITE ||
-        CreateDisposition == FILE_OVERWRITE_IF ||
-        CreateDisposition == FILE_OPEN_IF);
+    BOOLEAN IsCreateAction = (CreateDisposition == FILE_CREATE || CreateDisposition == FILE_SUPERSEDE || CreateDisposition == FILE_OVERWRITE || CreateDisposition == FILE_OVERWRITE_IF || CreateDisposition == FILE_OPEN_IF);
+    ULONG DesiredAccess = Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;
 
-    if (IsHoneyToken(&FileName)) {
-        if (!Trusted) {
-            if ((Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (FILE_WRITE_DATA | DELETE)) || IsCreateAction) {
-                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
+    ULONG Operation = 0;
+    if (IsCreateAction) Operation |= OP_CREATE;
+    if (DesiredAccess & (FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | WRITE_DAC | WRITE_OWNER | GENERIC_WRITE)) Operation |= OP_WRITE;
+    if (DesiredAccess & (DELETE | FILE_DELETE_CHILD)) Operation |= OP_DELETE;
+
+    if (Operation != 0) {
+        ULONG RuleCode = 0;
+        BOOLEAN Kill = FALSE;
+        if (EvaluateFileRule(Pid, &nameInfo->Name, Operation, NULL, 0, &RuleCode, &Kill)) {
+            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+            QueueRuleProcessTermination(Pid, Kill);
+            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+            callbackStatus = FLT_PREOP_COMPLETE;
         }
     }
 
-    if (WildcardMatch(L"\\Device\\PhysicalDrive*", FileName.Buffer, FileName.Length) ||
-        (WildcardMatch(L"\\Device\\Harddisk*", FileName.Buffer, FileName.Length) && !WildcardMatch(L"*Volume*", FileName.Buffer, FileName.Length))) {
-
-        if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
-            (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE | WRITE_DAC | WRITE_OWNER)) {
-
-            if (!Trusted) {
-                UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt");
-                SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
-    }
-
-    if (CheckProtectedPathRule(&FileName)) {
-        if (!Trusted) {
-            if ((Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
-                (FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | DELETE | WRITE_DAC | GENERIC_WRITE)) || IsCreateAction) {
-                SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
-    }
-
-    if (CheckFileExtensionRule(&FileName)) {
-        if (!Trusted) {
-            if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess & (DELETE | FILE_DELETE_CHILD)) {
-                if (CheckRansomActivity(Pid, &FileName, NULL, 0, FALSE)) {
-                    SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, FileName.Buffer, FileName.Length);
-                    Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                    callbackStatus = FLT_PREOP_COMPLETE;
-                    goto cleanup;
-                }
-            }
-        }
-    }
-
-cleanup:
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
-    }
+    FltReleaseFileNameInformation(nameInfo);
     return callbackStatus;
 }
 
@@ -115,178 +52,92 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     FILE_INFORMATION_CLASS infoClass = Data->Iopb->Parameters.SetFileInformation.FileInformationClass;
-
-    if (infoClass != FileDispositionInformation &&
-        infoClass != FileRenameInformation &&
-        infoClass != FileRenameInformationEx) {
+    if (infoClass != FileDispositionInformation && infoClass != FileRenameInformation && infoClass != FileRenameInformationEx) {
         return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
 
     PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
-
-    if (!NT_SUCCESS(status) || !nameInfo) goto cleanup;
-
-    status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup;
+    if (!NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (!NT_SUCCESS(FltParseFileNameInformation(nameInfo)) || !nameInfo->Name.Buffer) {
+        FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    }
 
     HANDLE Pid = PsGetCurrentProcessId();
-    if (!IsProcessTrusted(Pid)) {
-        if (CheckProtectedPathRule(&nameInfo->Name)) {
-            SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-            Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-            callbackStatus = FLT_PREOP_COMPLETE;
-            goto cleanup;
-        }
-
-        if (CheckFileExtensionRule(&nameInfo->Name)) {
-            if (CheckRansomActivity(Pid, &nameInfo->Name, NULL, 0, FALSE)) {
-                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
-    }
-
-cleanup:
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
-    }
-    return callbackStatus;
-}
-
-FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
-    UNREFERENCED_PARAMETER(FltObjects);
-    UNREFERENCED_PARAMETER(CompletionContext);
-
-    if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
     FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
+    ULONG Operation = 0;
 
-    if (!NT_SUCCESS(status) || !nameInfo) goto cleanup;
-
-    status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup;
-
-    SECURITY_INFORMATION SecurityInfo = Data->Iopb->Parameters.SetSecurity.SecurityInformation;
-
-    if (SecurityInfo & (OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION)) {
-        if (CheckProtectedPathRule(&nameInfo->Name)) {
-            HANDLE Pid = PsGetCurrentProcessId();
-            if (!IsProcessTrusted(Pid)) {
-                SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-                goto cleanup;
-            }
-        }
+    if (infoClass == FileDispositionInformation) {
+        Operation = OP_DELETE;
+    }
+    else {
+        Operation = OP_RENAME;
     }
 
-cleanup:
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (EvaluateFileRule(Pid, &nameInfo->Name, Operation, NULL, 0, &RuleCode, &Kill)) {
+        SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+        QueueRuleProcessTermination(Pid, Kill);
+        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+        callbackStatus = FLT_PREOP_COMPLETE;
     }
+
+    FltReleaseFileNameInformation(nameInfo);
     return callbackStatus;
 }
 
 FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
-    UNREFERENCED_PARAMETER(CompletionContext);
     UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
 
     if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK;
     if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
+    if (Data->Iopb->IrpFlags & (IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO | IRP_NOCACHE)) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     ULONG WriteLength = Data->Iopb->Parameters.Write.Length;
     if (WriteLength == 0) return FLT_PREOP_SUCCESS_NO_CALLBACK;
 
     PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-    NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
-
-    if (!NT_SUCCESS(status) || !nameInfo) goto cleanup;
-
-    status = FltParseFileNameInformation(nameInfo);
-    if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup;
-
-    if (CheckFileExtensionRule(&nameInfo->Name)) {
-        HANDLE Pid = PsGetCurrentProcessId();
-
-        if (!IsProcessTrusted(Pid)) {
-            PVOID SystemBuffer = NULL;
-            PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
-
-            if (!Mdl) {
-                if (Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) {
-                    if (NT_SUCCESS(FltLockUserBuffer(Data))) {
-                        Mdl = Data->Iopb->Parameters.Write.MdlAddress;
-                    }
-                }
-            }
-
-            if (Mdl) {
-                SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
-            }
-
-            if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) {
-                SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
-                Data->IoStatus.Status = STATUS_ACCESS_DENIED;
-                callbackStatus = FLT_PREOP_COMPLETE;
-            }
-        }
-    }
-
-cleanup:
-    if (nameInfo) {
+    if (!NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK;
+    if (!NT_SUCCESS(FltParseFileNameInformation(nameInfo)) || !nameInfo->Name.Buffer) {
         FltReleaseFileNameInformation(nameInfo);
+        return FLT_PREOP_SUCCESS_NO_CALLBACK;
     }
+
+    HANDLE Pid = PsGetCurrentProcessId();
+    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
+
+    PVOID SystemBuffer = NULL;
+    PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress;
+    if (!Mdl && Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) {
+        if (NT_SUCCESS(FltLockUserBuffer(Data))) Mdl = Data->Iopb->Parameters.Write.MdlAddress;
+    }
+    if (Mdl) SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute);
+
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (EvaluateFileRule(Pid, &nameInfo->Name, OP_WRITE, SystemBuffer, WriteLength, &RuleCode, &Kill)) {
+        SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length);
+        QueueRuleProcessTermination(Pid, Kill);
+        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
+        callbackStatus = FLT_PREOP_COMPLETE;
+    }
+
+    FltReleaseFileNameInformation(nameInfo);
     return callbackStatus;
 }
 
-FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(Data);
     UNREFERENCED_PARAMETER(FltObjects);
     UNREFERENCED_PARAMETER(CompletionContext);
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
+}
 
-    if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode != FSCTL_MANAGE_BYPASS_IO) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
-
-    PFS_BPIO_INPUT InputBuffer = (PFS_BPIO_INPUT)Data->Iopb->Parameters.FileSystemControl.Neither.InputBuffer;
-    if (!InputBuffer) return FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    FS_BPIO_OPERATIONS Operation;
-
-    __try {
-        Operation = InputBuffer->Operation;
-    }
-    __except (EXCEPTION_EXECUTE_HANDLER) {
-        return FLT_PREOP_SUCCESS_NO_CALLBACK;
-    }
-
-    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
-    FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;
-
-    if (Operation == FS_BPIO_OP_ENABLE) {
-        if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) {
-            if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) {
-                if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) {
-                    Data->IoStatus.Status = STATUS_NOT_SUPPORTED;
-                    callbackStatus = FLT_PREOP_COMPLETE;
-                }
-            }
-        }
-    }
-
-    if (nameInfo) {
-        FltReleaseFileNameInformation(nameInfo);
-    }
-    return callbackStatus;
+FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
+    UNREFERENCED_PARAMETER(Data);
+    UNREFERENCED_PARAMETER(FltObjects);
+    UNREFERENCED_PARAMETER(CompletionContext);
+    return FLT_PREOP_SUCCESS_NO_CALLBACK;
 }

Plugins/Filter/ProtectMemory.cpp

@@ -0,0 +1,818 @@
+#include "DriverCommon.h"
+
+extern "C" {
+    NTSTATUS ZwOpenThread(
+        PHANDLE ThreadHandle,
+        ACCESS_MASK DesiredAccess,
+        POBJECT_ATTRIBUTES ObjectAttributes,
+        PCLIENT_ID ClientId
+    );
+
+    NTSTATUS ZwQueryInformationThread(
+        HANDLE ThreadHandle,
+        THREADINFOCLASS ThreadInformationClass,
+        PVOID ThreadInformation,
+        ULONG ThreadInformationLength,
+        PULONG ReturnLength
+    );
+}
+
+#ifndef THREAD_QUERY_INFORMATION
+#define THREAD_QUERY_INFORMATION 0x0040
+#endif
+
+#define THREAD_QUERY_SET_WIN32_START_ADDRESS 9
+
+constexpr ULONG PYAS_MEM_IMAGE_TYPE = 0x01000000UL;
+
+typedef enum _MEMORY_WORK_TYPE {
+    MemoryWorkThreadAnalysis = 1,
+    MemoryWorkViolationReport = 2
+} MEMORY_WORK_TYPE;
+
+typedef struct _MEMORY_WORK_ITEM {
+    LIST_ENTRY Entry;
+    MEMORY_WORK_TYPE Type;
+    PEPROCESS SourceProcess;
+    PEPROCESS TargetProcess;
+    HANDLE SourcePid;
+    HANDLE TargetPid;
+    HANDLE ThreadId;
+    ULONG RuleCode;
+    BOOLEAN Kill;
+    WCHAR FallbackMessage[64];
+} MEMORY_WORK_ITEM, * PMEMORY_WORK_ITEM;
+
+typedef struct _THREAD_MEMORY_REGION {
+    PVOID StartAddress;
+    ULONG MemoryType;
+    ULONG MemoryProtection;
+    SIZE_T RegionSize;
+} THREAD_MEMORY_REGION, * PTHREAD_MEMORY_REGION;
+
+static BOOLEAN g_ThreadNotifyRegistered = FALSE;
+static BOOLEAN g_LoadImageNotifyRegistered = FALSE;
+static BOOLEAN g_MemoryProtectionInitialized = FALSE;
+static BOOLEAN g_MemoryRundownCompleted = FALSE;
+static EX_RUNDOWN_REF g_MemoryRundown;
+static volatile LONG g_MemoryStopping = 1;
+static volatile LONG g_PendingMemoryWork = 0;
+static LIST_ENTRY g_MemoryWorkQueue;
+static KSPIN_LOCK g_MemoryWorkLock;
+static KSEMAPHORE g_MemoryWorkSemaphore;
+static HANDLE g_MemoryWorkerHandle = NULL;
+constexpr auto MAX_PENDING_MEMORY_WORK = 256;
+constexpr auto MEMORY_WORKER_STOP_TIMEOUT_MS = 2000;
+
+static PACCESS_MASK GetDesiredAccessPointer(POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE) {
+        return &OperationInformation->Parameters->CreateHandleInformation.DesiredAccess;
+    }
+
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+        return &OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess;
+    }
+
+    return NULL;
+}
+
+static ULONG GetHandleType(POB_PRE_OPERATION_INFORMATION OperationInformation) {
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE) {
+        return PYAS_HANDLE_CREATE;
+    }
+
+    if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
+        return PYAS_HANDLE_DUPLICATE;
+    }
+
+    return 0;
+}
+
+static ULONG GetProcessOperations(ACCESS_MASK Access) {
+    ULONG Operations = 0;
+
+    if (Access & PROCESS_VM_READ) Operations |= OP_VM_READ;
+    if (Access & PROCESS_VM_WRITE) Operations |= OP_VM_WRITE;
+    if (Access & PROCESS_VM_OPERATION) Operations |= OP_VM_OPERATION;
+    if (Access & PROCESS_CREATE_THREAD) Operations |= OP_CREATE_THREAD;
+    if (Access & PROCESS_TERMINATE) Operations |= OP_TERMINATE;
+    if (Access & PROCESS_SUSPEND_RESUME) Operations |= OP_SUSPEND_RESUME;
+    if (Access & PROCESS_DUP_HANDLE) Operations |= OP_DUP_HANDLE;
+    if (Access & (PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA)) Operations |= OP_SET_INFORMATION;
+    if (Access & PROCESS_CREATE_PROCESS) Operations |= OP_CREATE_PROCESS;
+
+    return Operations;
+}
+
+static ULONG GetThreadOperations(ACCESS_MASK Access) {
+    ULONG Operations = 0;
+
+    if (Access & THREAD_SET_CONTEXT) Operations |= OP_THREAD_SET_CONTEXT;
+    if (Access & THREAD_TERMINATE) Operations |= OP_TERMINATE;
+    if (Access & THREAD_SUSPEND_RESUME) Operations |= OP_SUSPEND_RESUME;
+    if (Access & THREAD_SET_INFORMATION) Operations |= OP_SET_INFORMATION;
+    if (Access & THREAD_SET_THREAD_TOKEN) Operations |= OP_THREAD_SET_TOKEN;
+    if (Access & (THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION)) Operations |= OP_IMPERSONATE;
+
+    return Operations;
+}
+
+static ACCESS_MASK GetProcessDeniedAccess(ULONG Operations) {
+    ACCESS_MASK DeniedAccess = 0;
+
+    if (Operations & OP_VM_READ) DeniedAccess |= PROCESS_VM_READ;
+    if (Operations & OP_VM_WRITE) DeniedAccess |= PROCESS_VM_WRITE;
+    if (Operations & OP_VM_OPERATION) DeniedAccess |= PROCESS_VM_OPERATION;
+    if (Operations & OP_CREATE_THREAD) DeniedAccess |= PROCESS_CREATE_THREAD;
+    if (Operations & OP_TERMINATE) DeniedAccess |= PROCESS_TERMINATE;
+    if (Operations & OP_SUSPEND_RESUME) DeniedAccess |= PROCESS_SUSPEND_RESUME;
+    if (Operations & OP_DUP_HANDLE) DeniedAccess |= PROCESS_DUP_HANDLE;
+    if (Operations & OP_SET_INFORMATION) DeniedAccess |= PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA;
+    if (Operations & OP_CREATE_PROCESS) DeniedAccess |= PROCESS_CREATE_PROCESS;
+
+    return DeniedAccess;
+}
+
+static ACCESS_MASK GetThreadDeniedAccess(ULONG Operations) {
+    ACCESS_MASK DeniedAccess = 0;
+
+    if (Operations & OP_THREAD_SET_CONTEXT) DeniedAccess |= THREAD_SET_CONTEXT;
+    if (Operations & OP_TERMINATE) DeniedAccess |= THREAD_TERMINATE;
+    if (Operations & OP_SUSPEND_RESUME) DeniedAccess |= THREAD_SUSPEND_RESUME;
+    if (Operations & OP_SET_INFORMATION) DeniedAccess |= THREAD_SET_INFORMATION;
+    if (Operations & OP_THREAD_SET_TOKEN) DeniedAccess |= THREAD_SET_THREAD_TOKEN;
+    if (Operations & OP_IMPERSONATE) DeniedAccess |= THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION;
+
+    return DeniedAccess;
+}
+
+static BOOLEAN IsProcessIdentityCurrent(HANDLE ProcessId, PEPROCESS ExpectedProcess);
+
+static VOID ReleaseMemoryWork(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return;
+
+    if (Work->TargetProcess) ObDereferenceObject(Work->TargetProcess);
+    if (Work->SourceProcess) ObDereferenceObject(Work->SourceProcess);
+    InterlockedDecrement(&g_PendingMemoryWork);
+    PyasFree(Work);
+}
+
+static PMEMORY_WORK_ITEM PopMemoryWork() {
+    PMEMORY_WORK_ITEM Work = NULL;
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_MemoryWorkLock, &OldIrql);
+
+    if (!IsListEmpty(&g_MemoryWorkQueue)) {
+        PLIST_ENTRY Entry = RemoveHeadList(&g_MemoryWorkQueue);
+        Work = CONTAINING_RECORD(Entry, MEMORY_WORK_ITEM, Entry);
+    }
+
+    KeReleaseSpinLock(&g_MemoryWorkLock, OldIrql);
+    return Work;
+}
+
+static VOID CancelQueuedMemoryWork() {
+    for (;;) {
+        PMEMORY_WORK_ITEM Work = PopMemoryWork();
+        if (!Work) return;
+        ReleaseMemoryWork(Work);
+    }
+}
+
+static BOOLEAN QueueMemoryWork(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return FALSE;
+
+    LONG Pending = InterlockedIncrement(&g_PendingMemoryWork);
+    if (Pending > MAX_PENDING_MEMORY_WORK) {
+        InterlockedDecrement(&g_PendingMemoryWork);
+        return FALSE;
+    }
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_MemoryWorkLock, &OldIrql);
+
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) {
+        KeReleaseSpinLock(&g_MemoryWorkLock, OldIrql);
+        InterlockedDecrement(&g_PendingMemoryWork);
+        return FALSE;
+    }
+
+    InsertTailList(&g_MemoryWorkQueue, &Work->Entry);
+    KeReleaseSpinLock(&g_MemoryWorkLock, OldIrql);
+    KeReleaseSemaphore(&g_MemoryWorkSemaphore, IO_NO_INCREMENT, 1, FALSE);
+    return TRUE;
+}
+
+static VOID DeliverViolation(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    BOOLEAN SourceMatches = IsProcessIdentityCurrent(Work->SourcePid, Work->SourceProcess);
+    BOOLEAN TargetMatches = IsProcessIdentityCurrent(Work->TargetPid, Work->TargetProcess);
+    if (!SourceMatches || !TargetMatches) return;
+
+    PUNICODE_STRING TargetPath = NULL;
+
+    if (NT_SUCCESS(GetProcessImageName(Work->TargetPid, &TargetPath)) && TargetPath && TargetPath->Buffer) {
+        SendMessageToUser(
+            Work->RuleCode,
+            (ULONG)(ULONG_PTR)Work->SourcePid,
+            TargetPath->Buffer,
+            TargetPath->Length
+        );
+    }
+    else {
+        UNICODE_STRING MessageString;
+        RtlInitUnicodeString(&MessageString, Work->FallbackMessage);
+        SendMessageToUser(
+            Work->RuleCode,
+            (ULONG)(ULONG_PTR)Work->SourcePid,
+            MessageString.Buffer,
+            MessageString.Length
+        );
+    }
+
+    if (TargetPath) ExFreePool(TargetPath);
+    QueueRuleProcessTermination(Work->SourcePid, Work->Kill);
+}
+
+static VOID ReportViolation(
+    ULONG RuleCode,
+    BOOLEAN Kill,
+    HANDLE SourcePid,
+    HANDLE TargetPid,
+    PCWSTR FallbackMessage
+) {
+    if (!RuleCode || !SourcePid || !TargetPid || !FallbackMessage) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    PEPROCESS SourceProcess = NULL;
+    PEPROCESS TargetProcess = NULL;
+
+    NTSTATUS Status = PsLookupProcessByProcessId(SourcePid, &SourceProcess);
+    if (NT_SUCCESS(Status)) {
+        Status = PsLookupProcessByProcessId(TargetPid, &TargetProcess);
+    }
+
+    if (!NT_SUCCESS(Status)) {
+        if (SourceProcess) ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    PMEMORY_WORK_ITEM Work = (PMEMORY_WORK_ITEM)PyasAllocate(sizeof(MEMORY_WORK_ITEM));
+    if (!Work) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    RtlZeroMemory(Work, sizeof(*Work));
+    Work->Type = MemoryWorkViolationReport;
+    Work->SourceProcess = SourceProcess;
+    Work->TargetProcess = TargetProcess;
+    Work->SourcePid = SourcePid;
+    Work->TargetPid = TargetPid;
+    Work->RuleCode = RuleCode;
+    Work->Kill = Kill;
+    RtlStringCchCopyW(Work->FallbackMessage, RTL_NUMBER_OF(Work->FallbackMessage), FallbackMessage);
+
+    if (!QueueMemoryWork(Work)) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        PyasFree(Work);
+    }
+}
+
+static BOOLEAN IsExecuteProtection(ULONG Protect) {
+    ULONG BaseProtect = Protect & 0xFF;
+
+    return BaseProtect == PAGE_EXECUTE ||
+        BaseProtect == PAGE_EXECUTE_READ ||
+        BaseProtect == PAGE_EXECUTE_READWRITE ||
+        BaseProtect == PAGE_EXECUTE_WRITECOPY;
+}
+
+static BOOLEAN IsExecuteWriteProtection(ULONG Protect) {
+    ULONG BaseProtect = Protect & 0xFF;
+
+    return BaseProtect == PAGE_EXECUTE_READWRITE ||
+        BaseProtect == PAGE_EXECUTE_WRITECOPY;
+}
+
+static BOOLEAN QueryThreadMemoryRegionForProcess(
+    PEPROCESS Process,
+    PVOID Address,
+    PTHREAD_MEMORY_REGION Region
+) {
+    if (!Process || !Region || !Address || KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    RtlZeroMemory(Region, sizeof(*Region));
+
+    KAPC_STATE ApcState;
+    KeStackAttachProcess(Process, &ApcState);
+
+    MEMORY_BASIC_INFORMATION MemoryInformation = { 0 };
+    SIZE_T ReturnLength = 0;
+    NTSTATUS Status = ZwQueryVirtualMemory(
+        ZwCurrentProcess(),
+        Address,
+        MemoryBasicInformation,
+        &MemoryInformation,
+        sizeof(MemoryInformation),
+        &ReturnLength
+    );
+
+    KeUnstackDetachProcess(&ApcState);
+
+    if (!NT_SUCCESS(Status)) return FALSE;
+    if (MemoryInformation.State != MEM_COMMIT) return FALSE;
+    if (!IsExecuteProtection(MemoryInformation.Protect)) return FALSE;
+
+    Region->StartAddress = Address;
+    Region->RegionSize = MemoryInformation.RegionSize;
+
+    if (MemoryInformation.Type == MEM_PRIVATE) Region->MemoryType = PYAS_MEMORY_PRIVATE;
+    else if (MemoryInformation.Type == MEM_MAPPED) Region->MemoryType = PYAS_MEMORY_MAPPED;
+    else if (MemoryInformation.Type == PYAS_MEM_IMAGE_TYPE) Region->MemoryType = PYAS_MEMORY_IMAGE;
+    else return FALSE;
+
+    Region->MemoryProtection = PYAS_PROTECT_EXECUTE;
+    if (IsExecuteWriteProtection(MemoryInformation.Protect)) {
+        Region->MemoryProtection |= PYAS_PROTECT_EXECUTE_WRITE;
+    }
+
+    return TRUE;
+}
+
+static BOOLEAN QueryThreadMemoryRegion(
+    HANDLE ProcessId,
+    PVOID Address,
+    PTHREAD_MEMORY_REGION Region
+) {
+    if (!ProcessId) return FALSE;
+
+    PEPROCESS Process = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
+    BOOLEAN Result = QueryThreadMemoryRegionForProcess(Process, Address, Region);
+    ObDereferenceObject(Process);
+    return Result;
+}
+
+BOOLEAN IsAddressInUnmappedMemory(HANDLE ProcessId, PVOID Address) {
+    THREAD_MEMORY_REGION Region = { 0 };
+    if (!QueryThreadMemoryRegion(ProcessId, Address, &Region)) return FALSE;
+    return Region.MemoryType == PYAS_MEMORY_PRIVATE;
+}
+
+static BOOLEAN IsProcessIdentityCurrent(HANDLE ProcessId, PEPROCESS ExpectedProcess) {
+    if (!ProcessId || !ExpectedProcess) return FALSE;
+
+    PEPROCESS CurrentProcess = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &CurrentProcess);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
+    BOOLEAN Matches = CurrentProcess == ExpectedProcess;
+    ObDereferenceObject(CurrentProcess);
+    return Matches;
+}
+
+static OB_PREOP_CALLBACK_STATUS ObjectPreCallbackCore(
+    POB_PRE_OPERATION_INFORMATION OperationInformation
+) {
+    if (!OperationInformation || OperationInformation->KernelHandle) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    PACCESS_MASK DesiredAccess = GetDesiredAccessPointer(OperationInformation);
+    ULONG HandleType = GetHandleType(OperationInformation);
+
+    if (!DesiredAccess || *DesiredAccess == 0 || HandleType == 0) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    HANDLE SourcePid = PsGetCurrentProcessId();
+    if (!SourcePid || IsProcessTrusted(SourcePid)) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    HANDLE TargetPid = NULL;
+    ULONG ObjectType = 0;
+    ULONG RequestedOperations = 0;
+    ACCESS_MASK OriginalAccess = *DesiredAccess;
+
+    if (OperationInformation->ObjectType == *PsProcessType) {
+        TargetPid = PsGetProcessId((PEPROCESS)OperationInformation->Object);
+        ObjectType = PYAS_OBJECT_PROCESS;
+        RequestedOperations = GetProcessOperations(OriginalAccess);
+    }
+    else if (OperationInformation->ObjectType == *PsThreadType) {
+        TargetPid = PsGetThreadProcessId((PETHREAD)OperationInformation->Object);
+        ObjectType = PYAS_OBJECT_THREAD;
+        RequestedOperations = GetThreadOperations(OriginalAccess);
+    }
+    else {
+        return OB_PREOP_SUCCESS;
+    }
+
+    if (!TargetPid || SourcePid == TargetPid || RequestedOperations == 0) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    ULONG DeniedOperations = 0;
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+
+    if (!EvaluateProcessAccessRule(
+        SourcePid,
+        TargetPid,
+        RequestedOperations,
+        HandleType,
+        ObjectType,
+        &DeniedOperations,
+        &RuleCode,
+        &Kill
+    )) {
+        return OB_PREOP_SUCCESS;
+    }
+
+    ACCESS_MASK DeniedAccess = ObjectType == PYAS_OBJECT_PROCESS
+        ? GetProcessDeniedAccess(DeniedOperations)
+        : GetThreadDeniedAccess(DeniedOperations);
+
+    ACCESS_MASK EffectiveDeniedAccess = OriginalAccess & DeniedAccess;
+    if (EffectiveDeniedAccess == 0) return OB_PREOP_SUCCESS;
+
+    *DesiredAccess = OriginalAccess & ~EffectiveDeniedAccess;
+
+    ReportViolation(
+        RuleCode,
+        Kill,
+        SourcePid,
+        TargetPid,
+        ObjectType == PYAS_OBJECT_PROCESS
+        ? L"Process_Handle_Access_Denied"
+        : L"Thread_Handle_Access_Denied"
+    );
+
+    return OB_PREOP_SUCCESS;
+}
+
+static OB_PREOP_CALLBACK_STATUS ObjectPreCallback(
+    PVOID RegistrationContext,
+    POB_PRE_OPERATION_INFORMATION OperationInformation
+) {
+    UNREFERENCED_PARAMETER(RegistrationContext);
+
+    if (!g_MemoryProtectionInitialized) return OB_PREOP_SUCCESS;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return OB_PREOP_SUCCESS;
+    if (!ExAcquireRundownProtection(&g_MemoryRundown)) return OB_PREOP_SUCCESS;
+
+    OB_PREOP_CALLBACK_STATUS Result = ObjectPreCallbackCore(OperationInformation);
+    ExReleaseRundownProtection(&g_MemoryRundown);
+    return Result;
+}
+
+static VOID ProcessThreadAnalysis(PMEMORY_WORK_ITEM Work) {
+    if (!Work) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    PVOID StartAddress = NULL;
+    HANDLE ThreadHandle = NULL;
+    BOOLEAN IdentityValid =
+        IsProcessIdentityCurrent(Work->SourcePid, Work->SourceProcess) &&
+        IsProcessIdentityCurrent(Work->TargetPid, Work->TargetProcess);
+    CLIENT_ID ClientId = { Work->TargetPid, Work->ThreadId };
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
+
+    NTSTATUS Status = STATUS_PROCESS_IS_TERMINATING;
+    if (IdentityValid) {
+        Status = ZwOpenThread(
+            &ThreadHandle,
+            THREAD_QUERY_INFORMATION,
+            &ObjectAttributes,
+            &ClientId
+        );
+    }
+
+    if (NT_SUCCESS(Status)) {
+        Status = ZwQueryInformationThread(
+            ThreadHandle,
+            (THREADINFOCLASS)THREAD_QUERY_SET_WIN32_START_ADDRESS,
+            &StartAddress,
+            sizeof(StartAddress),
+            NULL
+        );
+        ZwClose(ThreadHandle);
+    }
+
+    if (!NT_SUCCESS(Status) || !StartAddress) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    THREAD_MEMORY_REGION Region = { 0 };
+    if (!QueryThreadMemoryRegionForProcess(Work->TargetProcess, StartAddress, &Region)) return;
+
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (!EvaluateThreadRule(
+        Work->SourcePid,
+        Work->TargetPid,
+        StartAddress,
+        Region.MemoryType,
+        Region.MemoryProtection,
+        Region.RegionSize,
+        &RuleCode,
+        &Kill
+    )) {
+        return;
+    }
+
+    Work->RuleCode = RuleCode;
+    Work->Kill = Kill;
+    RtlStringCchCopyW(
+        Work->FallbackMessage,
+        RTL_NUMBER_OF(Work->FallbackMessage),
+        L"Remote_Executable_Thread_Detected"
+    );
+    DeliverViolation(Work);
+}
+
+static VOID MemoryWorkerThread(PVOID Parameter) {
+    UNREFERENCED_PARAMETER(Parameter);
+
+    for (;;) {
+        KeWaitForSingleObject(
+            &g_MemoryWorkSemaphore,
+            Executive,
+            KernelMode,
+            FALSE,
+            NULL
+        );
+
+        if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) {
+            CancelQueuedMemoryWork();
+            break;
+        }
+
+        PMEMORY_WORK_ITEM Work = PopMemoryWork();
+        if (!Work) continue;
+
+        if (Work->Type == MemoryWorkThreadAnalysis) {
+            ProcessThreadAnalysis(Work);
+        }
+        else if (Work->Type == MemoryWorkViolationReport) {
+            DeliverViolation(Work);
+        }
+
+        ReleaseMemoryWork(Work);
+    }
+
+    PsTerminateSystemThread(STATUS_SUCCESS);
+}
+
+static VOID ThreadNotifyCallback(
+    HANDLE ProcessId,
+    HANDLE ThreadId,
+    BOOLEAN IsCreated
+) {
+    if (!IsCreated || !g_MemoryProtectionInitialized) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+
+    HANDLE SourcePid = PsGetCurrentProcessId();
+    if (!SourcePid || SourcePid == ProcessId || IsProcessTrusted(SourcePid)) return;
+
+    PEPROCESS SourceProcess = PsGetCurrentProcess();
+    PEPROCESS TargetProcess = NULL;
+    ObReferenceObject(SourceProcess);
+
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &TargetProcess);
+    if (!NT_SUCCESS(Status)) {
+        ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    PMEMORY_WORK_ITEM Work = (PMEMORY_WORK_ITEM)PyasAllocate(sizeof(MEMORY_WORK_ITEM));
+    if (!Work) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        return;
+    }
+
+    RtlZeroMemory(Work, sizeof(*Work));
+    Work->Type = MemoryWorkThreadAnalysis;
+    Work->SourceProcess = SourceProcess;
+    Work->TargetProcess = TargetProcess;
+    Work->SourcePid = SourcePid;
+    Work->TargetPid = ProcessId;
+    Work->ThreadId = ThreadId;
+
+    if (!QueueMemoryWork(Work)) {
+        ObDereferenceObject(TargetProcess);
+        ObDereferenceObject(SourceProcess);
+        PyasFree(Work);
+    }
+}
+
+static VOID LoadImageNotifyCallback(
+    PUNICODE_STRING FullImageName,
+    HANDLE ProcessId,
+    PIMAGE_INFO ImageInfo
+) {
+    if (!g_MemoryProtectionInitialized) return;
+    if (InterlockedCompareExchange(&g_MemoryStopping, 0, 0) != 0) return;
+    if (!FullImageName || !FullImageName->Buffer || !ImageInfo || ImageInfo->SystemModeImage) return;
+    if (!ProcessId || !ExAcquireRundownProtection(&g_MemoryRundown)) return;
+
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+    if (EvaluateImageLoadRule(ProcessId, FullImageName, ImageInfo, &RuleCode, &Kill)) {
+        SendMessageToUser(
+            RuleCode,
+            (ULONG)(ULONG_PTR)ProcessId,
+            FullImageName->Buffer,
+            FullImageName->Length
+        );
+        QueueRuleProcessTermination(ProcessId, Kill);
+    }
+
+    ExReleaseRundownProtection(&g_MemoryRundown);
+}
+
+static NTSTATUS RemoveMemoryCallbacks() {
+    NTSTATUS FirstFailure = STATUS_SUCCESS;
+
+    if (GlobalData.ObRegistrationHandle) {
+        ObUnRegisterCallbacks(GlobalData.ObRegistrationHandle);
+        GlobalData.ObRegistrationHandle = NULL;
+    }
+
+    if (g_ThreadNotifyRegistered) {
+        NTSTATUS Status = PsRemoveCreateThreadNotifyRoutine(ThreadNotifyCallback);
+        if (NT_SUCCESS(Status) || Status == STATUS_PROCEDURE_NOT_FOUND) {
+            g_ThreadNotifyRegistered = FALSE;
+        }
+        else if (NT_SUCCESS(FirstFailure)) {
+            FirstFailure = Status;
+        }
+    }
+
+    if (g_LoadImageNotifyRegistered) {
+        NTSTATUS Status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyCallback);
+        if (NT_SUCCESS(Status) || Status == STATUS_PROCEDURE_NOT_FOUND) {
+            g_LoadImageNotifyRegistered = FALSE;
+        }
+        else if (NT_SUCCESS(FirstFailure)) {
+            FirstFailure = Status;
+        }
+    }
+
+    return FirstFailure;
+}
+
+static NTSTATUS StartMemoryWorker() {
+    if (g_MemoryWorkerHandle) return STATUS_SUCCESS;
+
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(
+        &ObjectAttributes,
+        NULL,
+        OBJ_KERNEL_HANDLE,
+        NULL,
+        NULL
+    );
+
+    return PsCreateSystemThread(
+        &g_MemoryWorkerHandle,
+        SYNCHRONIZE,
+        &ObjectAttributes,
+        NULL,
+        NULL,
+        MemoryWorkerThread,
+        NULL
+    );
+}
+
+static NTSTATUS StopMemoryWorker(BOOLEAN WaitWithoutTimeout) {
+    CancelQueuedMemoryWork();
+
+    if (!g_MemoryWorkerHandle) return STATUS_SUCCESS;
+
+    KeReleaseSemaphore(&g_MemoryWorkSemaphore, IO_NO_INCREMENT, 1, FALSE);
+
+    LARGE_INTEGER Timeout;
+    PLARGE_INTEGER TimeoutPointer = NULL;
+
+    if (!WaitWithoutTimeout) {
+        Timeout.QuadPart = -((LONGLONG)MEMORY_WORKER_STOP_TIMEOUT_MS * 10 * 1000);
+        TimeoutPointer = &Timeout;
+    }
+
+    NTSTATUS Status = ZwWaitForSingleObject(
+        g_MemoryWorkerHandle,
+        FALSE,
+        TimeoutPointer
+    );
+
+    if (Status == STATUS_TIMEOUT) return STATUS_DEVICE_BUSY;
+    if (!NT_SUCCESS(Status)) return Status;
+
+    ZwClose(g_MemoryWorkerHandle);
+    g_MemoryWorkerHandle = NULL;
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS InitializeMemoryProtection(PDRIVER_OBJECT DriverObject) {
+    UNREFERENCED_PARAMETER(DriverObject);
+
+    if (g_MemoryProtectionInitialized) return STATUS_SUCCESS;
+
+    InitializeListHead(&g_MemoryWorkQueue);
+    KeInitializeSpinLock(&g_MemoryWorkLock);
+    KeInitializeSemaphore(&g_MemoryWorkSemaphore, 0, MAXLONG);
+    ExInitializeRundownProtection(&g_MemoryRundown);
+    g_MemoryRundownCompleted = FALSE;
+    InterlockedExchange(&g_PendingMemoryWork, 0);
+    InterlockedExchange(&g_MemoryStopping, 0);
+    g_MemoryProtectionInitialized = TRUE;
+
+    NTSTATUS Status = StartMemoryWorker();
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&g_MemoryStopping, 1);
+        g_MemoryProtectionInitialized = FALSE;
+        return Status;
+    }
+
+    Status = PsSetCreateThreadNotifyRoutine(ThreadNotifyCallback);
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&g_MemoryStopping, 1);
+        StopMemoryWorker(TRUE);
+        g_MemoryProtectionInitialized = FALSE;
+        return Status;
+    }
+    g_ThreadNotifyRegistered = TRUE;
+
+    Status = PsSetLoadImageNotifyRoutine(LoadImageNotifyCallback);
+    if (!NT_SUCCESS(Status)) {
+        InterlockedExchange(&g_MemoryStopping, 1);
+        RemoveMemoryCallbacks();
+        ExWaitForRundownProtectionRelease(&g_MemoryRundown);
+        g_MemoryRundownCompleted = TRUE;
+        StopMemoryWorker(TRUE);
+        g_MemoryProtectionInitialized = FALSE;
+        return Status;
+    }
+    g_LoadImageNotifyRegistered = TRUE;
+
+    OB_OPERATION_REGISTRATION OperationRegistration[2] = { 0 };
+    OperationRegistration[0].ObjectType = PsProcessType;
+    OperationRegistration[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    OperationRegistration[0].PreOperation = ObjectPreCallback;
+
+    OperationRegistration[1].ObjectType = PsThreadType;
+    OperationRegistration[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+    OperationRegistration[1].PreOperation = ObjectPreCallback;
+
+    OB_CALLBACK_REGISTRATION CallbackRegistration = { 0 };
+    CallbackRegistration.Version = OB_FLT_REGISTRATION_VERSION;
+    CallbackRegistration.OperationRegistrationCount = RTL_NUMBER_OF(OperationRegistration);
+    CallbackRegistration.OperationRegistration = OperationRegistration;
+    RtlInitUnicodeString(&CallbackRegistration.Altitude, PYAS_OB_ALTITUDE);
+
+    Status = ObRegisterCallbacks(&CallbackRegistration, &GlobalData.ObRegistrationHandle);
+    if (NT_SUCCESS(Status)) return STATUS_SUCCESS;
+
+    InterlockedExchange(&g_MemoryStopping, 1);
+    RemoveMemoryCallbacks();
+    ExWaitForRundownProtectionRelease(&g_MemoryRundown);
+    g_MemoryRundownCompleted = TRUE;
+    StopMemoryWorker(TRUE);
+    g_MemoryProtectionInitialized = FALSE;
+    return Status;
+}
+
+NTSTATUS UninitializeMemoryProtection(BOOLEAN WaitWithoutTimeout) {
+    if (!g_MemoryProtectionInitialized) return STATUS_SUCCESS;
+
+    InterlockedExchange(&g_MemoryStopping, 1);
+
+    NTSTATUS CallbackStatus = RemoveMemoryCallbacks();
+
+    if (!g_MemoryRundownCompleted) {
+        ExWaitForRundownProtectionRelease(&g_MemoryRundown);
+        g_MemoryRundownCompleted = TRUE;
+    }
+
+    NTSTATUS WorkerStatus = StopMemoryWorker(WaitWithoutTimeout);
+    if (!NT_SUCCESS(CallbackStatus)) return CallbackStatus;
+    if (!NT_SUCCESS(WorkerStatus)) return WorkerStatus;
+
+    if (g_ThreadNotifyRegistered || g_LoadImageNotifyRegistered || GlobalData.ObRegistrationHandle) {
+        return STATUS_DEVICE_BUSY;
+    }
+
+    g_MemoryProtectionInitialized = FALSE;
+    return STATUS_SUCCESS;
+}
+

Plugins/Filter/ProtectProcess.cpp

@@ -1,226 +1,285 @@
 #include "DriverCommon.h"
 
-static PVOID ObRegistrationHandle = NULL;
-static OB_CALLBACK_REGISTRATION ObRegistration;
-static OB_OPERATION_REGISTRATION ObCallbacks[2];
+constexpr auto PROCESS_RELATION_BUCKET_COUNT = 1024;
+constexpr auto PROCESS_RELATION_BUCKET_WAYS = 4;
 
-static BOOLEAN IsSystemImage(PUNICODE_STRING FullImageName) {
-    if (!FullImageName || !FullImageName->Buffer) return FALSE;
+typedef HANDLE(NTAPI* PPS_GET_PROCESS_INHERITED_FROM_UNIQUE_PROCESS_ID)(PEPROCESS Process);
 
-    if (WildcardMatch(L"*\\Windows\\System32\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\SysWOW64\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\WinSxS\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Windows\\Microsoft.NET\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Common Files\\Microsoft Shared\\*", FullImageName->Buffer, FullImageName->Length) ||
-        WildcardMatch(L"*\\Program Files*\\*", FullImageName->Buffer, FullImageName->Length)) {
-        return TRUE;
-    }
-    return FALSE;
+typedef struct _PROCESS_RELATION_ENTRY {
+    HANDLE ProcessId;
+    HANDLE ParentProcessId;
+    HANDLE CreatorProcessId;
+    LARGE_INTEGER CreateTime;
+    LARGE_INTEGER ParentCreateTime;
+    ULONGLONG Sequence;
+} PROCESS_RELATION_ENTRY, * PPROCESS_RELATION_ENTRY;
+
+static PROCESS_RELATION_ENTRY g_ProcessRelations[PROCESS_RELATION_BUCKET_COUNT][PROCESS_RELATION_BUCKET_WAYS];
+static KSPIN_LOCK g_ProcessRelationLock;
+static EX_RUNDOWN_REF g_ProcessRundown;
+static volatile LONG g_ProcessStopping = 1;
+static volatile LONG64 g_ProcessRelationSequence = 0;
+static BOOLEAN g_ProcessProtectionInitialized = FALSE;
+static PPS_GET_PROCESS_INHERITED_FROM_UNIQUE_PROCESS_ID g_GetInheritedProcessId = NULL;
+
+static ULONG GetProcessRelationBucket(HANDLE ProcessId) {
+    return ((ULONG)(ULONG_PTR)ProcessId >> 2) & (PROCESS_RELATION_BUCKET_COUNT - 1);
 }
 
-VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo) {
-    UNREFERENCED_PARAMETER(ImageInfo);
+static BOOLEAN QueryProcessCreateTime(HANDLE ProcessId, PLARGE_INTEGER CreateTime) {
+    if (CreateTime) CreateTime->QuadPart = 0;
+    if (!ProcessId || !CreateTime || KeGetCurrentIrql() > APC_LEVEL) return FALSE;
 
-    if (KeGetCurrentIrql() > APC_LEVEL) return;
-    if (!FullImageName || !FullImageName->Buffer) return;
-    if (ProcessId == (HANDLE)0) return;
-
-    if (IsSystemImage(FullImageName)) return;
-
-    if (IsTargetProtected(ProcessId)) {
-        if (CheckFileExtensionRule(FullImageName)) {
-            SendMessageToUser(6001, (ULONG)(ULONG_PTR)ProcessId, FullImageName->Buffer, FullImageName->Length);
-        }
-    }
-}
-
-static BOOLEAN IsCriticalSystemProcess(HANDLE ProcessId) {
-    if (ProcessId == (HANDLE)4) return TRUE;
-
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
-
-    NTSTATUS status;
-    BOOLEAN isCritical = FALSE;
     PEPROCESS Process = NULL;
-    PUNICODE_STRING imageFileName = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(Status)) return FALSE;
 
-    status = PsLookupProcessByProcessId(ProcessId, &Process);
-    if (!NT_SUCCESS(status)) return FALSE;
+    CreateTime->QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+    ObDereferenceObject(Process);
+    return TRUE;
+}
 
-    status = SeLocateProcessImageName(Process, &imageFileName);
+static VOID StoreProcessRelation(
+    PEPROCESS Process,
+    HANDLE ProcessId,
+    HANDLE ParentProcessId,
+    HANDLE CreatorProcessId,
+    PLARGE_INTEGER KnownParentCreateTime
+) {
+    if (!Process || !ProcessId) return;
 
-    if (NT_SUCCESS(status) && imageFileName && imageFileName->Buffer) {
-        if (WildcardMatch(L"*\\Windows\\System32\\csrss.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\lsass.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\services.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\wininit.exe", imageFileName->Buffer, imageFileName->Length) ||
-            WildcardMatch(L"*\\Windows\\System32\\smss.exe", imageFileName->Buffer, imageFileName->Length)) {
-            isCritical = TRUE;
-        }
-        ExFreePool(imageFileName);
+    PROCESS_RELATION_ENTRY NewEntry = { 0 };
+    NewEntry.ProcessId = ProcessId;
+    NewEntry.ParentProcessId = ParentProcessId;
+    NewEntry.CreatorProcessId = CreatorProcessId;
+    NewEntry.CreateTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+
+    if (KnownParentCreateTime) {
+        NewEntry.ParentCreateTime = *KnownParentCreateTime;
     }
+    else if (ParentProcessId) {
+        QueryProcessCreateTime(ParentProcessId, &NewEntry.ParentCreateTime);
+    }
+
+    NewEntry.Sequence = (ULONGLONG)InterlockedIncrement64(&g_ProcessRelationSequence);
+
+    ULONG Bucket = GetProcessRelationBucket(ProcessId);
+    ULONG Selected = 0;
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+
+    for (ULONG Index = 0; Index < PROCESS_RELATION_BUCKET_WAYS; Index++) {
+        PPROCESS_RELATION_ENTRY Entry = &g_ProcessRelations[Bucket][Index];
+
+        if (Entry->ProcessId == ProcessId || Entry->ProcessId == NULL) {
+            Selected = Index;
+            break;
+        }
+
+        if (Entry->Sequence < g_ProcessRelations[Bucket][Selected].Sequence) {
+            Selected = Index;
+        }
+    }
+
+    g_ProcessRelations[Bucket][Selected] = NewEntry;
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+}
+
+static VOID RemoveProcessRelation(HANDLE ProcessId) {
+    if (!ProcessId) return;
+
+    ULONG Bucket = GetProcessRelationBucket(ProcessId);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+
+    for (ULONG Index = 0; Index < PROCESS_RELATION_BUCKET_WAYS; Index++) {
+        PPROCESS_RELATION_ENTRY Entry = &g_ProcessRelations[Bucket][Index];
+        if (Entry->ProcessId == ProcessId) {
+            RtlZeroMemory(Entry, sizeof(*Entry));
+            break;
+        }
+    }
+
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+}
+
+BOOLEAN GetProcessRelation(
+    HANDLE ProcessId,
+    PHANDLE ParentProcessId,
+    PHANDLE CreatorProcessId
+) {
+    if (ParentProcessId) *ParentProcessId = NULL;
+    if (CreatorProcessId) *CreatorProcessId = NULL;
+    if (!ProcessId || !g_ProcessProtectionInitialized || KeGetCurrentIrql() > APC_LEVEL) return FALSE;
+
+    PEPROCESS Process = NULL;
+    NTSTATUS Status = PsLookupProcessByProcessId(ProcessId, &Process);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
+    LARGE_INTEGER CurrentCreateTime = { 0 };
+    CurrentCreateTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
+
+    PROCESS_RELATION_ENTRY Snapshot = { 0 };
+    ULONG Bucket = GetProcessRelationBucket(ProcessId);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+
+    for (ULONG Index = 0; Index < PROCESS_RELATION_BUCKET_WAYS; Index++) {
+        PPROCESS_RELATION_ENTRY Entry = &g_ProcessRelations[Bucket][Index];
+        if (Entry->ProcessId == ProcessId) {
+            Snapshot = *Entry;
+            break;
+        }
+    }
+
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+
+    BOOLEAN CacheValid = Snapshot.ProcessId == ProcessId &&
+        Snapshot.CreateTime.QuadPart == CurrentCreateTime.QuadPart;
+
+    if (CacheValid && Snapshot.ParentProcessId && Snapshot.ParentCreateTime.QuadPart != 0) {
+        LARGE_INTEGER LiveParentCreateTime = { 0 };
+        if (QueryProcessCreateTime(Snapshot.ParentProcessId, &LiveParentCreateTime) &&
+            LiveParentCreateTime.QuadPart != Snapshot.ParentCreateTime.QuadPart) {
+            CacheValid = FALSE;
+        }
+    }
+
+    if (CacheValid) {
+        if (ParentProcessId) *ParentProcessId = Snapshot.ParentProcessId;
+        if (CreatorProcessId) *CreatorProcessId = Snapshot.CreatorProcessId;
+        ObDereferenceObject(Process);
+        return Snapshot.ParentProcessId != NULL || Snapshot.CreatorProcessId != NULL;
+    }
+
+    if (Snapshot.ProcessId == ProcessId) {
+        RemoveProcessRelation(ProcessId);
+    }
+
+    HANDLE LiveParentProcessId = NULL;
+    LARGE_INTEGER LiveParentCreateTime = { 0 };
+
+    if (g_GetInheritedProcessId) {
+        LiveParentProcessId = g_GetInheritedProcessId(Process);
+    }
+
+    if (!LiveParentProcessId || LiveParentProcessId == ProcessId) {
+        ObDereferenceObject(Process);
+        return FALSE;
+    }
+
+    if (!QueryProcessCreateTime(LiveParentProcessId, &LiveParentCreateTime) ||
+        LiveParentCreateTime.QuadPart > CurrentCreateTime.QuadPart) {
+        ObDereferenceObject(Process);
+        return FALSE;
+    }
+
+    StoreProcessRelation(
+        Process,
+        ProcessId,
+        LiveParentProcessId,
+        NULL,
+        &LiveParentCreateTime
+    );
+
+    if (ParentProcessId) *ParentProcessId = LiveParentProcessId;
+    if (CreatorProcessId) *CreatorProcessId = NULL;
 
     ObDereferenceObject(Process);
-    return isCritical;
-}
-
-static BOOLEAN IsBlacklistedAdminTool(HANDLE ProcessId) {
-    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
-
-    NTSTATUS status;
-    BOOLEAN isBlacklisted = FALSE;
-    PEPROCESS Process = NULL;
-    PUNICODE_STRING imageFileName = NULL;
-
-    status = PsLookupProcessByProcessId(ProcessId, &Process);
-    if (!NT_SUCCESS(status)) return FALSE;
-
-    status = SeLocateProcessImageName(Process, &imageFileName);
-
-    if (NT_SUCCESS(status) && imageFileName) {
-        if (imageFileName->Buffer) {
-            if (WildcardMatch(L"*Taskmgr.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*taskkill.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*ProcessHacker.exe", imageFileName->Buffer, imageFileName->Length) ||
-                WildcardMatch(L"*procmon.exe", imageFileName->Buffer, imageFileName->Length)) {
-                isBlacklisted = TRUE;
-            }
-        }
-        ExFreePool(imageFileName);
-    }
-
-    ObDereferenceObject(Process);
-    return isBlacklisted;
-}
-
-static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
-    UNREFERENCED_PARAMETER(RegistrationContext);
-
-    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
-
-    PEPROCESS TargetProcess = (PEPROCESS)OperationInformation->Object;
-    if (!TargetProcess) return OB_PREOP_SUCCESS;
-
-    HANDLE TargetPid = PsGetProcessId(TargetProcess);
-    HANDLE SourcePid = PsGetCurrentProcessId();
-
-    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
-    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
-
-    if (IsTargetProtected(TargetPid)) {
-        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
-
-        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
-
-        if (bIsTrusted) {
-            if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsTrusted = FALSE;
-            }
-        }
-
-        if (bIsTrusted) return OB_PREOP_SUCCESS;
-
-        ACCESS_MASK DenyMask = PROCESS_TERMINATE |
-            PROCESS_VM_OPERATION |
-            PROCESS_VM_WRITE |
-            PROCESS_CREATE_THREAD |
-            PROCESS_VM_READ |
-            PROCESS_DUP_HANDLE |
-            PROCESS_SUSPEND_RESUME |
-            PROCESS_SET_INFORMATION |
-            PROCESS_SET_QUOTA;
-
-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-
-        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-        }
-    }
-
-    return OB_PREOP_SUCCESS;
-}
-
-static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
-    UNREFERENCED_PARAMETER(RegistrationContext);
-
-    if (OperationInformation->KernelHandle) return OB_PREOP_SUCCESS;
-
-    PETHREAD TargetThread = (PETHREAD)OperationInformation->Object;
-    if (!TargetThread) return OB_PREOP_SUCCESS;
-
-    PEPROCESS TargetProcess = IoThreadToProcess(TargetThread);
-    if (!TargetProcess) return OB_PREOP_SUCCESS;
-
-    HANDLE TargetPid = PsGetProcessId(TargetProcess);
-    HANDLE SourcePid = PsGetCurrentProcessId();
-
-    if (SourcePid == TargetPid) return OB_PREOP_SUCCESS;
-    if ((ULONG)(ULONG_PTR)SourcePid == GlobalData.PyasPid) return OB_PREOP_SUCCESS;
-    if (SourcePid == (HANDLE)4) return OB_PREOP_SUCCESS;
-
-    if (IsTargetProtected(TargetPid)) {
-        if (IsCriticalSystemProcess(SourcePid)) return OB_PREOP_SUCCESS;
-
-        BOOLEAN bIsTrusted = IsProcessTrusted(SourcePid);
-
-        if (bIsTrusted) {
-            if (IsBlacklistedAdminTool(SourcePid)) {
-                bIsTrusted = FALSE;
-            }
-        }
-
-        if (bIsTrusted) return OB_PREOP_SUCCESS;
-
-        ACCESS_MASK DenyMask = THREAD_TERMINATE |
-            THREAD_SUSPEND_RESUME |
-            THREAD_SET_CONTEXT |
-            THREAD_SET_INFORMATION |
-            THREAD_SET_THREAD_TOKEN;
-
-        OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-
-        if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) {
-            OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= (ACCESS_MASK)(~DenyMask);
-        }
-    }
-
-    return OB_PREOP_SUCCESS;
+    return TRUE;
 }
 
 NTSTATUS InitializeProcessProtection() {
-    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob");
+    if (g_ProcessProtectionInitialized) return STATUS_SUCCESS;
 
-    ObCallbacks[0].ObjectType = PsProcessType;
-    ObCallbacks[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
-    ObCallbacks[0].PreOperation = PreOpenProcess;
-    ObCallbacks[0].PostOperation = NULL;
+    KeInitializeSpinLock(&g_ProcessRelationLock);
+    RtlZeroMemory(g_ProcessRelations, sizeof(g_ProcessRelations));
+    InterlockedExchange64(&g_ProcessRelationSequence, 0);
+    ExInitializeRundownProtection(&g_ProcessRundown);
 
-    ObCallbacks[1].ObjectType = PsThreadType;
-    ObCallbacks[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
-    ObCallbacks[1].PreOperation = PreOpenThread;
-    ObCallbacks[1].PostOperation = NULL;
+    UNICODE_STRING RoutineName = RTL_CONSTANT_STRING(L"PsGetProcessInheritedFromUniqueProcessId");
+    g_GetInheritedProcessId = reinterpret_cast<PPS_GET_PROCESS_INHERITED_FROM_UNIQUE_PROCESS_ID>(
+        MmGetSystemRoutineAddress(&RoutineName)
+        );
 
-    ObRegistration.Version = OB_FLT_REGISTRATION_VERSION;
-    ObRegistration.OperationRegistrationCount = 2;
-    ObRegistration.Altitude = Altitude;
-    ObRegistration.RegistrationContext = NULL;
-    ObRegistration.OperationRegistration = ObCallbacks;
-
-    NTSTATUS status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
-
-    if (!NT_SUCCESS(status) && (status == STATUS_FLT_INSTANCE_ALTITUDE_COLLISION || status == STATUS_OBJECT_NAME_COLLISION)) {
-        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob.Fallback");
-        ObRegistration.Altitude = FallbackAltitude;
-        status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
-    }
-
-    return status;
+    InterlockedExchange(&g_ProcessStopping, 0);
+    g_ProcessProtectionInitialized = TRUE;
+    return STATUS_SUCCESS;
 }
 
-VOID UninitializeProcessProtection() {
-    if (ObRegistrationHandle) {
-        ObUnRegisterCallbacks(ObRegistrationHandle);
-        ObRegistrationHandle = NULL;
+NTSTATUS UninitializeProcessProtection() {
+    if (!g_ProcessProtectionInitialized) return STATUS_SUCCESS;
+
+    InterlockedExchange(&g_ProcessStopping, 1);
+    ExWaitForRundownProtectionRelease(&g_ProcessRundown);
+
+    KIRQL OldIrql;
+    KeAcquireSpinLock(&g_ProcessRelationLock, &OldIrql);
+    RtlZeroMemory(g_ProcessRelations, sizeof(g_ProcessRelations));
+    KeReleaseSpinLock(&g_ProcessRelationLock, OldIrql);
+
+    g_GetInheritedProcessId = NULL;
+    g_ProcessProtectionInitialized = FALSE;
+    return STATUS_SUCCESS;
+}
+
+VOID ProcessNotifyCallbackEx(
+    PEPROCESS Process,
+    HANDLE ProcessId,
+    PPS_CREATE_NOTIFY_INFO CreateInfo
+) {
+    if (!g_ProcessProtectionInitialized) return;
+    if (InterlockedCompareExchange(&g_ProcessStopping, 0, 0) != 0) return;
+    if (!ExAcquireRundownProtection(&g_ProcessRundown)) return;
+
+    if (!CreateInfo) {
+        RemoveProcessRelation(ProcessId);
+        ExReleaseRundownProtection(&g_ProcessRundown);
+        return;
     }
-}
+
+    if (!NT_SUCCESS(CreateInfo->CreationStatus)) {
+        ExReleaseRundownProtection(&g_ProcessRundown);
+        return;
+    }
+
+    HANDLE CreatorPid = CreateInfo->CreatingThreadId.UniqueProcess;
+    HANDLE ParentPid = CreateInfo->ParentProcessId;
+    ULONG RuleCode = 0;
+    BOOLEAN Kill = FALSE;
+
+    BOOLEAN Blocked = EvaluateProcessCreateRule(
+        CreatorPid,
+        ParentPid,
+        ProcessId,
+        CreateInfo->ImageFileName,
+        CreateInfo->CommandLine,
+        CreateInfo->FileOpenNameAvailable ? TRUE : FALSE,
+        CreateInfo->IsSubsystemProcess ? TRUE : FALSE,
+        &RuleCode,
+        &Kill
+    );
+
+    if (Blocked) {
+        CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
+
+        if (CreateInfo->ImageFileName && CreateInfo->ImageFileName->Buffer) {
+            SendMessageToUser(
+                RuleCode,
+                (ULONG)(ULONG_PTR)CreatorPid,
+                CreateInfo->ImageFileName->Buffer,
+                CreateInfo->ImageFileName->Length
+            );
+        }
+
+        QueueRuleProcessTermination(CreatorPid, Kill);
+    }
+    else {
+        StoreProcessRelation(Process, ProcessId, ParentPid, CreatorPid, NULL);
+    }
+
+    ExReleaseRundownProtection(&g_ProcessRundown);
+}

Plugins/Filter/ProtectRegistry.cpp

@@ -2,14 +2,6 @@
 
 static LARGE_INTEGER Cookie;
 
-static BOOLEAN IsBamRegistryPath(PCUNICODE_STRING KeyName) {
-    if (!KeyName || !KeyName->Buffer) return FALSE;
-    if (WildcardMatch(L"*\\Services\\bam\\*", KeyName->Buffer, KeyName->Length)) {
-        return TRUE;
-    }
-    return FALSE;
-}
-
 static BOOLEAN IsWriteAccess(ACCESS_MASK Access) {
     if (Access & (KEY_SET_VALUE | KEY_CREATE_SUB_KEY | KEY_CREATE_LINK |
         DELETE | WRITE_DAC | WRITE_OWNER | GENERIC_WRITE)) {
@@ -106,12 +98,13 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
             UNICODE_STRING FullPath;
             RtlInitUnicodeString(&FullPath, FullPathBuffer);
 
-            if (CheckRegistryRule(&FullPath)) {
-                HANDLE Pid = PsGetCurrentProcessId();
-                if (!IsProcessTrusted(Pid)) {
-                    SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                    status = STATUS_ACCESS_DENIED;
-                }
+            HANDLE Pid = PsGetCurrentProcessId();
+            ULONG RuleCode = 0;
+            BOOLEAN Kill = FALSE;
+            if (EvaluateRegistryRule(Pid, &FullPath, OP_CREATE | OP_WRITE, &RuleCode, &Kill)) {
+                SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                QueueRuleProcessTermination(Pid, Kill);
+                status = STATUS_ACCESS_DENIED;
             }
             PyasFree(FullPathBuffer);
         }
@@ -124,12 +117,13 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 
         if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
             if (KeyName) {
-                if (CheckRegistryRule(KeyName)) {
-                    HANDLE Pid = PsGetCurrentProcessId();
-                    if (!IsProcessTrusted(Pid)) {
-                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
-                        status = STATUS_ACCESS_DENIED;
-                    }
+                HANDLE Pid = PsGetCurrentProcessId();
+                ULONG RuleCode = 0;
+                BOOLEAN Kill = FALSE;
+                if (EvaluateRegistryRule(Pid, KeyName, OP_DELETE, &RuleCode, &Kill)) {
+                    SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, KeyName->Buffer, KeyName->Length);
+                    QueueRuleProcessTermination(Pid, Kill);
+                    status = STATUS_ACCESS_DENIED;
                 }
                 CmCallbackReleaseKeyObjectIDEx(KeyName);
             }
@@ -142,44 +136,41 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
         PCUNICODE_STRING KeyName = NULL;
 
         if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
-            if (KeyName) {
-                if (KeyName->Buffer) {
-                    if (!IsBamRegistryPath(KeyName)) {
-                        ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
-                            (Info->ValueName ? Info->ValueName->Length : 0) +
-                            sizeof(WCHAR);
+            if (KeyName && KeyName->Buffer) {
+                ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
+                    (Info->ValueName ? Info->ValueName->Length : 0) +
+                    sizeof(WCHAR);
 
-                        if (FullSize <= 0xFFFF) {
-                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                            if (Buffer) {
-                                UNICODE_STRING FullPath;
-                                FullPath.Buffer = Buffer;
-                                FullPath.Length = 0;
-                                FullPath.MaximumLength = (USHORT)FullSize;
+                if (FullSize <= 0xFFFF) {
+                    PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                    if (Buffer) {
+                        UNICODE_STRING FullPath;
+                        FullPath.Buffer = Buffer;
+                        FullPath.Length = 0;
+                        FullPath.MaximumLength = (USHORT)FullSize;
 
-                                RtlCopyUnicodeString(&FullPath, KeyName);
+                        RtlCopyUnicodeString(&FullPath, KeyName);
 
-                                if (Info->ValueName && Info->ValueName->Length > 0) {
-                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                        RtlAppendUnicodeToString(&FullPath, L"\\");
-                                    }
-                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                                }
-
-                                if (CheckRegistryRule(&FullPath)) {
-                                    HANDLE Pid = PsGetCurrentProcessId();
-                                    if (!IsProcessTrusted(Pid)) {
-                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                        status = STATUS_ACCESS_DENIED;
-                                    }
-                                }
-                                PyasFree(Buffer);
+                        if (Info->ValueName && Info->ValueName->Length > 0) {
+                            if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                RtlAppendUnicodeToString(&FullPath, L"\\");
                             }
+                            RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                         }
+
+                        HANDLE Pid = PsGetCurrentProcessId();
+                        ULONG RuleCode = 0;
+                        BOOLEAN Kill = FALSE;
+                        if (EvaluateRegistryRule(Pid, &FullPath, OP_WRITE, &RuleCode, &Kill)) {
+                            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                            QueueRuleProcessTermination(Pid, Kill);
+                            status = STATUS_ACCESS_DENIED;
+                        }
+                        PyasFree(Buffer);
                     }
                 }
-                CmCallbackReleaseKeyObjectIDEx(KeyName);
             }
+            if (KeyName) CmCallbackReleaseKeyObjectIDEx(KeyName);
         }
         return status;
     }
@@ -189,44 +180,41 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
         PCUNICODE_STRING KeyName = NULL;
 
         if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) {
-            if (KeyName) {
-                if (KeyName->Buffer) {
-                    if (!IsBamRegistryPath(KeyName)) {
-                        ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
-                            (Info->ValueName ? Info->ValueName->Length : 0) +
-                            sizeof(WCHAR);
+            if (KeyName && KeyName->Buffer) {
+                ULONG FullSize = KeyName->Length + sizeof(WCHAR) +
+                    (Info->ValueName ? Info->ValueName->Length : 0) +
+                    sizeof(WCHAR);
 
-                        if (FullSize <= 0xFFFF) {
-                            PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
-                            if (Buffer) {
-                                UNICODE_STRING FullPath;
-                                FullPath.Buffer = Buffer;
-                                FullPath.Length = 0;
-                                FullPath.MaximumLength = (USHORT)FullSize;
+                if (FullSize <= 0xFFFF) {
+                    PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize);
+                    if (Buffer) {
+                        UNICODE_STRING FullPath;
+                        FullPath.Buffer = Buffer;
+                        FullPath.Length = 0;
+                        FullPath.MaximumLength = (USHORT)FullSize;
 
-                                RtlCopyUnicodeString(&FullPath, KeyName);
+                        RtlCopyUnicodeString(&FullPath, KeyName);
 
-                                if (Info->ValueName && Info->ValueName->Length > 0) {
-                                    if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
-                                        RtlAppendUnicodeToString(&FullPath, L"\\");
-                                    }
-                                    RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
-                                }
-
-                                if (CheckRegistryRule(&FullPath)) {
-                                    HANDLE Pid = PsGetCurrentProcessId();
-                                    if (!IsProcessTrusted(Pid)) {
-                                        SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
-                                        status = STATUS_ACCESS_DENIED;
-                                    }
-                                }
-                                PyasFree(Buffer);
+                        if (Info->ValueName && Info->ValueName->Length > 0) {
+                            if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') {
+                                RtlAppendUnicodeToString(&FullPath, L"\\");
                             }
+                            RtlAppendUnicodeStringToString(&FullPath, Info->ValueName);
                         }
+
+                        HANDLE Pid = PsGetCurrentProcessId();
+                        ULONG RuleCode = 0;
+                        BOOLEAN Kill = FALSE;
+                        if (EvaluateRegistryRule(Pid, &FullPath, OP_DELETE, &RuleCode, &Kill)) {
+                            SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length);
+                            QueueRuleProcessTermination(Pid, Kill);
+                            status = STATUS_ACCESS_DENIED;
+                        }
+                        PyasFree(Buffer);
                     }
                 }
-                CmCallbackReleaseKeyObjectIDEx(KeyName);
             }
+            if (KeyName) CmCallbackReleaseKeyObjectIDEx(KeyName);
         }
         return status;
     }
@@ -235,20 +223,20 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 }
 
 NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject) {
-    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm");
-    NTSTATUS status = CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+    if (Cookie.QuadPart != 0) return STATUS_SUCCESS;
 
-    if (!NT_SUCCESS(status)) {
-        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm.Fallback");
-        status = CmRegisterCallbackEx(RegistryCallback, &FallbackAltitude, DriverObject, NULL, &Cookie, NULL);
-    }
-
-    return status;
+    UNICODE_STRING Altitude;
+    RtlInitUnicodeString(&Altitude, L"320000.4201");
+    return CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
 }
 
-VOID UninitializeRegistryProtection() {
-    if (Cookie.QuadPart != 0) {
-        CmUnRegisterCallback(Cookie);
+NTSTATUS UninitializeRegistryProtection() {
+    if (Cookie.QuadPart == 0) return STATUS_SUCCESS;
+
+    NTSTATUS Status = CmUnRegisterCallback(Cookie);
+    if (NT_SUCCESS(Status)) {
         Cookie.QuadPart = 0;
     }
-}
+
+    return Status;
+}

Plugins/Rules/Rules_Driver_P1.json

@@ -1,233 +1,479 @@
 {
-    "Rule_Registry_BlockList": [
-        "\\REGISTRY\\MACHINE\\BCD00000000",
-        "\\REGISTRY\\MACHINE\\BCD00000000\\*",
-
-        "*\\Classes\\.exe",
-        "*\\Classes\\.bat",
-        "*\\Classes\\.cmd",
-        "*\\Classes\\.com",
-        "*\\Classes\\exefile\\*",
-        "*\\Classes\\batfile\\*",
-        "*\\Classes\\cmdfile\\*",
-        "*\\Classes\\comfile\\*",
-
-        "*\\mouclass",
-        "*\\kbdclass",
-        "*\\DisableAntiSpyware",
-        "*\\DisableWindowsUpdateAccess",
-        "*\\EnableLUA",
-        "*\\ConsentPromptBehaviorAdmin",
-        "*\\NoControlPanel",
-        "*\\NoDrives",
-        "*\\NoFileMenu",
-        "*\\NoFind",
-        "*\\NoStartMenuPinnedList",
-        "*\\NoSetFolders",
-        "*\\NoSetFolderOptions",
-        "*\\NoViewOnDrive",
-        "*\\NoClose",
-        "*\\NoDesktop",
-        "*\\NoLogoff",
-        "*\\NoFolderOptions",
-        "*\\RestrictRun",
-        "*\\NoViewContextMenu",
-        "*\\HideClock",
-        "*\\NoStartMenuMyGames",
-        "*\\NoStartMenuMyMusic",
-        "*\\DisableCMD",
-        "*\\NoAddingComponents",
-        "*\\NoWinKeys",
-        "*\\NoStartMenuLogOff",
-        "*\\NoSimpleNetIDList",
-        "*\\NoLowDiskSpaceChecks",
-        "*\\DisableLockWorkstation",
-        "*\\Restrict_Run",
-        "*\\DisableTaskMgr",
-        "*\\DisableRegistryTools",
-        "*\\DisableChangePassword",
-        "*\\NoComponents",
-        "*\\NoStartMenuMorePrograms",
-        "*\\NoActiveDesktop",
-        "*\\NoSetActiveDesktop",
-        "*\\NoRecentDocsMenu",
-        "*\\NoWindowsUpdate",
-        "*\\NoChangeStartMenu",
-        "*\\NoFavoritesMenu",
-        "*\\NoRecentDocsHistory",
-        "*\\NoSetTaskbar",
-        "*\\NoSMHelp",
-        "*\\NoTrayContextMenu",
-        "*\\NoManageMyComputerVerb",
-        "*\\NoRealMode",
-        "*\\NoRun",
-        "*\\ClearRecentDocsOnExit",
-        "*\\NoActiveDesktopChanges",
-        "*\\NoStartMenuNetworkPlaces",
-        "*\\NoLockScreen",
-        "*\\HideFastUserSwitching",
-        "*\\ConsentPromptBehaviorUser",
-        "*\\EnableSecureUIAPaths",
-        "*\\NoSRM",
-        "*\\NoInteractiveServices",
-        "*\\ShutdownWithoutLogon",
-        "*\\AutoAdminLogon",
-        "*\\BootExecute",
-        "*\\SubSystems",
-        "*\\FirmwareBootDevice",
-        "*\\BootDriverFlags",
-        "*\\SystemStartOptions",
-        "*\\DisableAutomaticRestartOnFailure",
-        "*\\SystemBiosVersion",
-        "*\\NoTheme",
-        "*\\SystemSetupInProgress",
-        "*\\SetupType",
-        "*\\AutoReboot",
-        "*\\Userinit",
-        "*\\UIHost",
-        "*\\Debugger",
-        "*\\DefaultUserName",
-        "*\\DefaultPassword",
-        "*\\AltDefaultUserName",
-        "*\\AltDefaultPassword",
-        "*\\DisableCAD",
-        "*\\LegalNoticeCaption",
-        "*\\LegalNoticeText",
-    ],
-    "Rule_Registry_TrustedList": [
-    ],
-    "Rule_Process_TrustedPaths": [
-        "\\Device\\HarddiskVolume*\\Windows\\*",
-        "\\Device\\HarddiskVolume*\\Program Files\\*",
-        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-
-        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-        "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-        "*\\Sources\\SetupHost.exe",
-        "*\\Work\\*\\DismHost.exe",
-
-        "*\\Google\\Chrome\\Application\\chrome.exe",
-        "*\\Microsoft\\Edge\\Application\\msedge.exe",
-        "*\\Mozilla Firefox\\firefox.exe",
-        "*\\Thorium\\Application\\thorium.exe",
-
-        "*\\Steam\\steam.exe",
-        "*\\steam\\*\\steam.exe",
-        "*\\Battle.net\\*\\Battle.net.exe",
-        "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
-
-        "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
-        "*\\ThunderEv.exe",
-        "*\\ThunderStart.exe",
-        "*\\KuGou.exe",
-        "*\\XLGame.exe",
-        "*\\XLLiveUD.exe",
-
-        "*\\hrkill-*.exe",
-        "*\\bin\\HipsDaemon.exe",
-        "*\\360Safe.exe",
-        "*\\bilibili\\bilibili.exe",
-
-        "*\\Kingsoft\\WPS Office\\ksolaunch.exe",
-        "*\\Kingsoft\\WPS Office\\*\\wps.exe",
-        "*\\Kingsoft\\WPS Office\\*\\*.exe",
-
-        "*\\PC4399_WPFLauncher.exe",
-        "*\\bin\\APlayer.exe",
-        "*\\Neverness To Everness\\NTELauncher.exe",
-        "*\\Application\\AndrowsLauncher.exe",
-        "*\\bin\\*\\codex.exe",
-        "*\\bin\\codex.exe",
-    ],
-    "Rule_Process_ExploitableBlacklist": [
-        "*\\cmd.exe",
-        "*\\powershell.exe",
-        "*\\pwsh.exe",
-        "*\\wscript.exe",
-        "*\\cscript.exe",
-        "*\\mshta.exe",
-        "*\\regsvr32.exe",
-        "*\\certutil.exe",
-        "*\\bitsadmin.exe",
-        "*\\wmic.exe",
-        "*\\hh.exe",
-        "*\\cmstp.exe",
-        "*\\installutil.exe",
-        "*\\regasm.exe",
-        "*\\regsvcs.exe",
-        "*\\msbuild.exe",
-        "*\\csc.exe",
-        "*\\vbc.exe",
-        "*\\jsc.exe",
-        "*\\bash.exe",
-        "*\\scrcons.exe",
-        "*\\schtasks.exe",
-        "*\\at.exe",
-        "*\\reg.exe",
-        "*\\sc.exe",
-        "*\\net.exe",
-        "*\\net1.exe",
-        "*\\whoami.exe",
-        "*\\ipconfig.exe",
-        "*\\taskkill.exe",
-        "*\\ProcessHacker.exe",
-        "*\\procmon.exe",
-        "*\\procexp.exe",
-    ],
-    "Rule_File_ProtectedPaths": [
-        "*\\PYAS.exe",
-        "*\\Plugins\\Filter\\PYAS_Driver.sys",
-        "*\\Plugins\\Rules\\Rules_Driver_P1.json",
-        "*\\ProgramData\\PYAS\\*.json",
-        "*\\Engine\\Pattern\\*.onnx",
-        "*\\Engine\\Properties\\*.onnx",
-
-        "\\Device\\HarddiskVolume*\\bootmgr",
-        "\\Device\\HarddiskVolume*\\boot.ini",
-        "\\Device\\HarddiskVolume*\\BOOTNXT",
-        "\\Device\\HarddiskVolume*\\EFI\\*",
-        "\\Device\\HarddiskVolume*\\Boot\\*",
-        "\\Device\\HarddiskVolume*\\Recovery\\*",
-        "\\Device\\HarddiskVolume*\\System Volume Information\\*",
-        "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
-
-        "*\\CON",
-        "*\\CON\\*",
-        "*\\PRN",
-        "*\\PRN\\*",
-        "*\\AUX",
-        "*\\AUX\\*",
-        "*\\NUL",
-        "*\\NUL\\*",
-        "*\\COM?",
-        "*\\COM?\\*",
-        "*\\LPT?",
-        "*\\LPT?\\*",
-        "*\\OSDATA",
-        "*\\OSDATA\\*",
-        "*\\*<*",
-        "*\\*>*",
-    ],
-    "Rule_File_ExceptionPaths": [
-        "*\\Users\\*\\steam\\*",
-        "*\\AppData\\*",
-        "*\\Temp\\*",
-        "*\\Local\\Temp\\*",
-        "*\\ventoy\\Boot\\*",
-        "*\\AdminRegionConfig.*",
-        "*\\nt_qq\\nt_*\\*",
-        "*\\cache\\*",
-        "*\\Documents\\My Games\\*",
-        "*\\Documents\\Tencent Files\\*",
-        "*\\Documents\\WeChat Files\\*",
-        "*\\Documents\\WPS Cloud Files\\*"
-    ],
-    "Rule_File_RansomwareExtensions": [
-        ".zip", ".7z", ".rar", ".tar", ".gz",
-        ".ppt", ".pptx", ".wps", ".txt", ".rtf",
-        ".pdf", ".xls", ".xlsx", ".doc", ".docx",
-        ".jpg", ".jpeg", ".png", ".webp", ".gif",
-        ".mp3", ".wav", ".aac", ".ogg", ".flac",
-        ".mp4", ".avi", ".mov", ".wmv", ".mkv",
+    "DynamicRules": [
+        {
+            "Name": "Process_Protect_Antivirus_Command",
+            "Code": 1001,
+            "Kill": false,
+            "Category": "Process",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe",
+            ],
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+            ],
+            "CommandLine": [
+                "*taskkill*PYAS.exe*",
+                "*taskkill*msedgewebview2.exe*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Target": [
+                "*\\taskkill.exe",
+                "*\\cmd.exe",
+                "*\\powershell.exe",
+                "*\\pwsh.exe",
+                "*\\wmic.exe",
+                "*\\net.exe",
+                "*\\net1.exe",
+            ],
+            "Priority": 110,
+            "FileOpenNameAvailable": true,
+            "SubsystemProcess": false,
+        },
+        {
+            "Name": "Process_Protect_PYAS_Handle",
+            "Code": 1002,
+            "Kill": false,
+            "Category": "Process",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
+            ],
+            "Target": [
+                "*\\PYAS.exe",
+                "*\\msedgewebview2.exe",
+            ],
+            "TargetProcessTree": [
+                "*\\PYAS.exe",
+            ],
+            "Operations": [
+                "Terminate",
+                "SuspendResume",
+                "DuplicateHandle",
+                "CreateProcess",
+                "SetThreadToken",
+                "Impersonate",
+            ],
+            "Priority": 130,
+            "InitiatorProcessTreeExclude": [
+                "*\\PYAS.exe",
+            ],
+            "HandleTypes": [
+                "Create",
+                "Duplicate",
+            ],
+            "OperationMatch": "Any",
+            "MinimumRiskScore": 20,
+            "ObjectTypes": [
+                "Process",
+                "Thread",
+            ]
+        },
+        {
+            "Name": "File_Protect_Antivirus",
+            "Code": 2001,
+            "Kill": false,
+            "Category": "File",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "*\\PYAS_Setup.exe",
+                "*\\unins000.exe",
+                "*\\notepad*.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+            ],
+            "Target": [
+                "*\\PYAS.exe",
+                "*\\ProgramData\\PYAS\\*.json",
+                "*\\Engine\\Heuristic\\*.yar",
+                "*\\Engine\\Heuristic\\*.yara",
+                "*\\Engine\\Heuristic\\*.yc",
+                "*\\Engine\\Heuristic\\*.yrc",
+                "*\\Engine\\Heuristic\\*.ip",
+                "*\\Engine\\Heuristic\\*.txt",
+                "*\\Engine\\Pattern\\*.onnx",
+                "*\\Engine\\Properties\\*.json",
+                "*\\Engine\\Properties\\*.onnx",
+                "*\\Interface\\static\\css\\*.css",
+                "*\\Interface\\static\\img\\*.ico",
+                "*\\Interface\\static\\js\\*.js",
+                "*\\Interface\\templates\\*.html",
+                "*\\Plugins\\Filter\\PYAS_Driver.sys",
+                "*\\Plugins\\Rules\\*.json",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+            ]
+        },
+        {
+            "Name": "File_Protect_System",
+            "Code": 2002,
+            "Kill": true,
+            "Category": "File",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\bootmgr",
+                "\\Device\\HarddiskVolume*\\boot.ini",
+                "\\Device\\HarddiskVolume*\\BOOTNXT",
+                "\\Device\\HarddiskVolume*\\EFI\\*",
+                "\\Device\\HarddiskVolume*\\Boot\\*",
+                "\\Device\\HarddiskVolume*\\Recovery\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+            ]
+        },
+        {
+            "Name": "File_Protect_System_Exploit",
+            "Code": 2003,
+            "Kill": true,
+            "Category": "File",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\CON",
+                "*\\CON\\*",
+                "*\\PRN",
+                "*\\PRN\\*",
+                "*\\AUX",
+                "*\\AUX\\*",
+                "*\\NUL",
+                "*\\NUL\\*",
+                "*\\COM?",
+                "*\\COM?\\*",
+                "*\\LPT?",
+                "*\\LPT?\\*",
+                "*\\OSDATA",
+                "*\\OSDATA\\*",
+                "*\\*<*",
+                "*\\*>*",
+            ],
+            "Operations": [
+                "Create",
+                "Write",
+                "Rename",
+            ]
+        },
+        {
+            "Name": "File_Protect_System_Ransom",
+            "Code": 2004,
+            "Kill": true,
+            "Category": "File",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+            ],
+            "TargetExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\Temp\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
+            ],
+            "Operations": [
+                "Delete",
+                "Rename",
+            ],
+            "Threshold": 50,
+            "TimeWindow": 3000,
+        },
+        {
+            "Name": "File_Protect_Ransom",
+            "Code": 2005,
+            "Kill": true,
+            "Category": "File",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\Google\\Chrome\\Application\\chrome.exe",
+                "*\\Microsoft\\Edge\\Application\\msedge.exe",
+                "*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe",
+                "*\\Microsoft\\Edge*\\Install\\*\\setup.exe",
+                "*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe",
+                "*\\Mozilla Firefox\\firefox.exe",
+                "*\\Thorium\\Application\\thorium.exe",
+                "*\\Steam\\steam.exe",
+                "*\\steam\\*\\steam.exe",
+                "*\\Steam\\steamapps\\common\\*",
+                "*\\Battle.net\\*\\Battle.net.exe",
+                "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+                "*\\PC4399_WPFLauncher.exe",
+                "*\\Neverness To Everness\\NTELauncher.exe",
+                "*\\ThunderEv.exe",
+                "*\\ThunderStart.exe",
+                "*\\bin\\APlayer.exe",
+                "*\\bilibili\\bilibili.exe",
+                "*\\KuGou.exe",
+                "*\\XLGame.exe",
+                "*\\XLLiveUD.exe",
+                "*\\hrkill-*.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+                "*\\WPS Office\\ksolaunch.exe",
+                "*\\WPS Office\\*\\wps.exe",
+                "*\\Application\\AndrowsLauncher.exe",
+                "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+                "*\\bin\\*\\codex.exe",
+                "*\\bin\\codex.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Users\\*",
+            ],
+            "TargetExclude": [
+                "*\\Documents\\My Games\\*",
+                "*\\Documents\\Tencent Files\\*",
+                "*\\Documents\\WeChat Files\\*",
+                "*\\Documents\\WPS Cloud Files\\*",
+                "*\\Users\\*\\steam\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
+                "*\\ventoy\\Boot\\*",
+                "*\\AdminRegionConfig.*",
+                "*\\nt_qq\\nt_*\\*",
+            ],
+            "Extensions": [
+                ".zip",
+                ".7z",
+                ".rar",
+                ".tar",
+                ".gz",
+                ".ppt",
+                ".pptx",
+                ".wps",
+                ".txt",
+                ".rtf",
+                ".pdf",
+                ".xls",
+                ".xlsx",
+                ".doc",
+                ".docx",
+                ".jpg",
+                ".jpeg",
+                ".png",
+                ".webp",
+                ".gif",
+                ".mp3",
+                ".wav",
+                ".aac",
+                ".ogg",
+                ".flac",
+                ".mp4",
+                ".avi",
+                ".mov",
+                ".wmv",
+                ".mkv",
+                ".apk",
+                ".jar",
+                ".class",
+                ".db",
+                ".sqlite",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Rename",
+            ],
+            "Threshold": 5,
+            "TimeWindow": 3000,
+        },
+        {
+            "Name": "Device_Protect_Disk_Wiper",
+            "Code": 2006,
+            "Kill": false,
+            "Category": "Device",
+            "InitiatorExclude": [
+                "*\\PYAS.exe",
+                "*\\rufus-*.exe",
+                "*\\DiskInfo*.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
+            ],
+            "Operations": [
+                "Ioctl",
+            ]
+        },
+        {
+            "Name": "Registry_Protect_System",
+            "Code": 3001,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Google\\Chrome\\Application\\chrome.exe",
+                "*\\Microsoft\\Edge\\Application\\msedge.exe",
+                "*\\Mozilla Firefox\\firefox.exe",
+                "*\\Thorium\\Application\\thorium.exe",
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Steam\\steam.exe",
+                "*\\steam\\*\\steam.exe",
+                "*\\Steam\\steamapps\\common\\*",
+                "*\\Battle.net\\*\\Battle.net.exe",
+                "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
+                "*\\PC4399_WPFLauncher.exe",
+                "*\\Neverness To Everness\\NTELauncher.exe",
+                "*\\ThunderEv.exe",
+                "*\\ThunderStart.exe",
+                "*\\bin\\APlayer.exe",
+                "*\\bilibili\\bilibili.exe",
+                "*\\KuGou.exe",
+                "*\\XLGame.exe",
+                "*\\XLLiveUD.exe",
+                "*\\hrkill-*.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+                "*\\WPS Office\\ksolaunch.exe",
+                "*\\WPS Office\\*\\wps.exe",
+                "*\\WPS Office\\*\\*.exe",
+                "*\\Application\\AndrowsLauncher.exe",
+                "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
+                "*\\bin\\*\\codex.exe",
+                "*\\bin\\codex.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\BCD00000000",
+                "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+                "*\\Classes\\.exe",
+                "*\\Classes\\.bat",
+                "*\\Classes\\.cmd",
+                "*\\Classes\\.com",
+                "*\\Classes\\exefile\\*",
+                "*\\Classes\\batfile\\*",
+                "*\\Classes\\cmdfile\\*",
+                "*\\Classes\\comfile\\*",
+                "*\\mouclass",
+                "*\\kbdclass",
+                "*\\DisableAntiSpyware",
+                "*\\DisableWindowsUpdateAccess",
+                "*\\EnableLUA",
+                "*\\ConsentPromptBehaviorAdmin",
+                "*\\NoControlPanel",
+                "*\\NoDrives",
+                "*\\NoFileMenu",
+                "*\\NoFind",
+                "*\\NoStartMenuPinnedList",
+                "*\\NoSetFolders",
+                "*\\NoSetFolderOptions",
+                "*\\NoViewOnDrive",
+                "*\\NoClose",
+                "*\\NoDesktop",
+                "*\\NoLogoff",
+                "*\\NoFolderOptions",
+                "*\\RestrictRun",
+                "*\\NoViewContextMenu",
+                "*\\HideClock",
+                "*\\NoStartMenuMyGames",
+                "*\\NoStartMenuMyMusic",
+                "*\\DisableCMD",
+                "*\\NoAddingComponents",
+                "*\\NoWinKeys",
+                "*\\NoStartMenuLogOff",
+                "*\\NoSimpleNetIDList",
+                "*\\NoLowDiskSpaceChecks",
+                "*\\DisableLockWorkstation",
+                "*\\Restrict_Run",
+                "*\\DisableTaskMgr",
+                "*\\DisableRegistryTools",
+                "*\\DisableChangePassword",
+                "*\\NoComponents",
+                "*\\NoStartMenuMorePrograms",
+                "*\\NoActiveDesktop",
+                "*\\NoSetActiveDesktop",
+                "*\\NoRecentDocsMenu",
+                "*\\NoWindowsUpdate",
+                "*\\NoChangeStartMenu",
+                "*\\NoFavoritesMenu",
+                "*\\NoRecentDocsHistory",
+                "*\\NoSetTaskbar",
+                "*\\NoSMHelp",
+                "*\\NoTrayContextMenu",
+                "*\\NoManageMyComputerVerb",
+                "*\\NoRealMode",
+                "*\\NoRun",
+                "*\\ClearRecentDocsOnExit",
+                "*\\NoActiveDesktopChanges",
+                "*\\NoStartMenuNetworkPlaces",
+                "*\\NoLockScreen",
+                "*\\HideFastUserSwitching",
+                "*\\ConsentPromptBehaviorUser",
+                "*\\EnableSecureUIAPaths",
+                "*\\NoSRM",
+                "*\\NoInteractiveServices",
+                "*\\ShutdownWithoutLogon",
+                "*\\AutoAdminLogon",
+                "*\\BootExecute",
+                "*\\SubSystems",
+                "*\\FirmwareBootDevice",
+                "*\\BootDriverFlags",
+                "*\\SystemStartOptions",
+                "*\\DisableAutomaticRestartOnFailure",
+                "*\\SystemBiosVersion",
+                "*\\NoTheme",
+                "*\\SystemSetupInProgress",
+                "*\\SetupType",
+                "*\\AutoReboot",
+                "*\\Userinit",
+                "*\\UIHost",
+                "*\\Debugger",
+                "*\\DefaultUserName",
+                "*\\DefaultPassword",
+                "*\\AltDefaultUserName",
+                "*\\AltDefaultPassword",
+                "*\\DisableCAD",
+                "*\\LegalNoticeCaption",
+                "*\\LegalNoticeText",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ]
+        }
     ]
-}
+}