Add files via upload

Interface/static/css/style.css

@@ -648,9 +648,38 @@ select.hidden + .custom-select-wrapper {
     transition: opacity 0.4s ease, visibility 0.4s ease;
 }
 
-#loading_overlay.fade-out {
-    opacity: 0;
-    visibility: hidden;
+#loading_overlay.fade-out {
+    opacity: 0;
+    visibility: hidden;
+}
+
+#loading_overlay.startup-error {
+    padding: 28px;
+    background-color: #f5f5f7;
+    color: #1d1d1f;
+}
+
+.startup-error-box {
+    max-width: 520px;
+    padding: 24px;
+    border: 1px solid rgba(0, 0, 0, 0.12);
+    border-radius: 8px;
+    background: #ffffff;
+    box-shadow: 0 16px 40px rgba(0, 0, 0, 0.12);
+}
+
+.startup-error-box h1 {
+    margin: 0 0 10px;
+    font-size: 18px;
+    font-weight: 700;
+}
+
+.startup-error-box p {
+    margin: 0;
+    font-size: 13px;
+    line-height: 1.6;
+    color: #515154;
+    word-break: break-word;
 }
 
 .spinner {

Interface/templates/index.html

@@ -6,7 +6,17 @@
     <title>PYAS Security</title>
     <link rel="stylesheet" href="/static/css/style.css">
     <script defer src="/static/js/i18n.js"></script>
-    <script defer src="/static/js/main.js"></script>
+    <script defer src="/static/js/main.js"></script>
+    <script>
+        window.addEventListener('DOMContentLoaded', function () {
+            window.setTimeout(function () {
+                var app = document.querySelector('.app-container');
+                var overlay = document.getElementById('loading_overlay');
+                if (app) app.classList.add('fade-in');
+                if (overlay && !overlay.classList.contains('fade-out')) overlay.classList.add('fade-out');
+            }, 15000);
+        });
+    </script>
 </head>
 <body>
     <div id="loading_overlay">

PYAS.py

@@ -13,6 +13,12 @@ from PYAS_Protect import ProtectMixin
 from PYAS_Scanner import ScannerMixin
 from PYAS_Tools import COPYDATASTRUCT, FILE_NOTIFY_INFORMATION, FILTER_MESSAGE_HEADER, IO_COUNTERS, LUID, LUID_AND_ATTRIBUTES, MEMORY_BASIC_INFORMATION, MIB_TCPROW_OWNER_PID, POINT, PROCESSENTRY32W, PROCESS_BASIC_INFORMATION, PYAS_FULL_MESSAGE, PYAS_MESSAGE, PYAS_USER_MESSAGE, RECT, SERVICE_STATUS_PROCESS, SHQUERYRBINFO, TOKEN_PRIVILEGES, ToolsMixin, UNICODE_STRING
 
+PYAS_WINDOW_TITLE = "PYAS Security"
+WM_COPYDATA = 0x004A
+SMTO_ABORTIFHUNG = 0x0002
+SMTO_ERRORONEXIT = 0x0020
+PYAS_SEND_MESSAGE_FLAGS = SMTO_ABORTIFHUNG | SMTO_ERRORONEXIT
+
 ####################################################################################################
 
 class _MainMixin:
@@ -31,48 +37,12 @@ class _MainMixin:
         self.init_windll()
 
         if not self.check_singleton("PYAS_Security_Mutex"):
-            hwnd = self.user32.FindWindowW(None, "PYAS Security")
-            if hwnd:
-                if "-quit" in self.args_pyas:
-                    try:
-                        cds = COPYDATASTRUCT()
-                        cds.dwData = 3
-                        cds.cbData = 0
-                        cds.lpData = None
-                        self.user32.SendMessageTimeoutW(hwnd, 0x004A, 0, ctypes.byref(cds), 0x0002, 3000, None)
+            if self.forward_to_existing_instance():
+                os._exit(0)
 
-                        time.sleep(0.5)
-                    except Exception:
-                        pass
-
-                elif "-scan" in self.args_pyas:
-                    try:
-                        idx = self.args_pyas.index("-scan")
-                        target = self.args_pyas[idx+1]
-                        cds = COPYDATASTRUCT()
-                        cds.dwData = 1
-                        encoded = target.encode('utf-8')
-                        cds.cbData = len(encoded) + 1
-
-                        buffer = ctypes.create_string_buffer(encoded)
-                        cds.lpData = ctypes.cast(buffer, ctypes.c_void_p)
-                        self.user32.SendMessageTimeoutW(hwnd, 0x004A, 0, ctypes.byref(cds), 0x0002, 3000, None)
-                        self.user32.SetForegroundWindow(hwnd)
-
-                    except Exception:
-                        pass
-                else:
-                    try:
-                        cds = COPYDATASTRUCT()
-                        cds.dwData = 2
-                        cds.cbData = 0
-                        cds.lpData = None
-                        self.user32.SendMessageTimeoutW(hwnd, 0x004A, 0, ctypes.byref(cds), 0x0002, 3000, None)
-                        self.user32.SetForegroundWindow(hwnd)
-
-                    except Exception:
-                        pass
-            os._exit(0)
+            self.h_recovery_mutex = self.kernel32.CreateMutexW(None, False, "PYAS_Security_Recovery_Mutex")
+            if ctypes.get_last_error() == 183:
+                os._exit(0)
 
         if "-quit" in self.args_pyas:
             os._exit(0)
@@ -81,6 +51,68 @@ class _MainMixin:
         self.load_config()
         self.load_logs()
 
+    def find_existing_window(self, timeout=2.0):
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            hwnd = self.user32.FindWindowW(None, PYAS_WINDOW_TITLE)
+            if hwnd:
+                return hwnd
+            time.sleep(0.05)
+        return None
+
+    def send_existing_window_message(self, hwnd, message_id, payload=None, timeout=1000):
+        if not hwnd:
+            return False
+
+        cds = COPYDATASTRUCT()
+        cds.dwData = message_id
+        buffer = None
+
+        if payload is not None:
+            encoded = str(payload).encode('utf-8')
+            buffer = ctypes.create_string_buffer(encoded + b'\x00')
+            cds.cbData = len(encoded) + 1
+            cds.lpData = ctypes.cast(buffer, ctypes.c_void_p)
+        else:
+            cds.cbData = 0
+            cds.lpData = None
+
+        try:
+            return bool(self.user32.SendMessageTimeoutW(hwnd, WM_COPYDATA, 0, ctypes.byref(cds), PYAS_SEND_MESSAGE_FLAGS, timeout, None))
+        except Exception:
+            return False
+
+    def forward_to_existing_instance(self):
+        hwnd = self.find_existing_window()
+        if not hwnd:
+            return False
+
+        if "-quit" in self.args_pyas or "-driver-unload" in self.args_pyas or "-driver-uninstall" in self.args_pyas:
+            return self.send_existing_window_message(hwnd, 3, timeout=1200)
+
+        if "-scan" in self.args_pyas:
+            try:
+                idx = self.args_pyas.index("-scan")
+                target = self.args_pyas[idx + 1]
+            except Exception:
+                return False
+
+            if self.send_existing_window_message(hwnd, 1, target, timeout=1200):
+                try:
+                    self.user32.SetForegroundWindow(hwnd)
+                except Exception:
+                    pass
+                return True
+            return False
+
+        if self.send_existing_window_message(hwnd, 2, timeout=1200):
+            try:
+                self.user32.SetForegroundWindow(hwnd)
+            except Exception:
+                pass
+            return True
+        return False
+
     def check_singleton(self, name):
         try:
             self.h_mutex = self.kernel32.CreateMutexW(None, False, name)
@@ -225,7 +257,9 @@ class _MainMixin:
         self.kernel32.ReadProcessMemory.restype = ctypes.wintypes.BOOL
         self.kernel32.ReadProcessMemory.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
         self.kernel32.QueryFullProcessImageNameW.restype = ctypes.wintypes.BOOL
-        self.kernel32.QueryFullProcessImageNameW.argtypes = [ctypes.wintypes.HANDLE, ctypes.wintypes.DWORD, ctypes.c_wchar_p, ctypes.POINTER(ctypes.wintypes.DWORD)]
+        self.kernel32.QueryFullProcessImageNameW.argtypes = [ctypes.wintypes.HANDLE, ctypes.wintypes.DWORD, ctypes.wintypes.LPWSTR, ctypes.POINTER(ctypes.wintypes.DWORD)]
+        self.kernel32.QueryDosDeviceW.restype = ctypes.wintypes.DWORD
+        self.kernel32.QueryDosDeviceW.argtypes = [ctypes.wintypes.LPCWSTR, ctypes.wintypes.LPWSTR, ctypes.wintypes.DWORD]
         self.kernel32.GetProcessIoCounters.argtypes = [ctypes.wintypes.HANDLE, ctypes.POINTER(IO_COUNTERS)]
         self.kernel32.GetProcessIoCounters.restype = ctypes.wintypes.BOOL
         self.kernel32.VirtualQueryEx.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_void_p, ctypes.POINTER(MEMORY_BASIC_INFORMATION), ctypes.c_size_t]
@@ -254,6 +288,8 @@ class _MainMixin:
         self.driver_listener_thread = None
         self.engine_initialized = False
         self.scan_running = False
+        self.scan_preparing = False
+        self.scan_stop_requested = False
         self.scan_finished = False
         self.virus_lock = {}
         self.virus_results = []
@@ -270,13 +306,14 @@ class _MainMixin:
         self.lock_driver_unload = threading.Lock()
         self.driver_unload_worker = None
         self.driver_unload_result = None
+        self.closing = False
         self.lock_update = threading.RLock()
         self.lock_proc = threading.RLock()
         self.lock_net = threading.RLock()
         self.lock_io = threading.RLock()
 
         self.pyas_default = {
-            "version": "3.6.2",
+            "version": "3.6.3",
             "api_host": "https://pyas-security.com/",
             "api_key": "fBRZxYS1UxykM-qzNOlKOEl63WILzlvgNMn6QfsG6FXCAAIktCrOPTAfY5_hEyuZ",
             "suffix": [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd", ".wfx", ".api", ".awx", ".rll", ".winmd"],
@@ -709,7 +746,7 @@ class _MainMixin:
             self._window.restore()
             self._window.show()
 
-            hwnd = self.user32.FindWindowW(None, "PYAS Security")
+            hwnd = self.user32.FindWindowW(None, PYAS_WINDOW_TITLE)
             if hwnd:
                 self.user32.SetForegroundWindow(hwnd)
 
@@ -722,7 +759,7 @@ class _MainMixin:
         if self._window:
             self._window.minimize()
         else:
-            hwnd = self.user32.FindWindowW(None, "PYAS Security")
+            hwnd = self.user32.FindWindowW(None, PYAS_WINDOW_TITLE)
             if hwnd:
                 self.user32.ShowWindow(hwnd, 6)
 
@@ -730,11 +767,48 @@ class _MainMixin:
         if self._window:
             self._window.hide()
 
+    def destroy_window_with_timeout(self, window, timeout=1.0):
+        if not window:
+            return
+
+        done = threading.Event()
+
+        def destroy_window():
+            try:
+                window.destroy()
+            except Exception:
+                pass
+            finally:
+                done.set()
+
+        threading.Thread(target=destroy_window, daemon=True).start()
+        done.wait(timeout)
+
+    def flush_logs_now(self):
+        with self.lock_logs:
+            if not getattr(self, 'logs_dirty', False):
+                return
+
+            try:
+                os.makedirs(os.path.dirname(self.file_log), exist_ok=True)
+                with open(self.file_log, "w", encoding="utf-8") as f:
+                    json.dump(self.logs_data, f, indent=4, ensure_ascii=False)
+                self.logs_dirty = False
+            except Exception:
+                pass
+
     def close(self, *args, **kwargs):
+        if getattr(self, 'closing', False):
+            return True
+
+        self.closing = True
+
         with self.lock_config:
             driver_enabled = self.pyas_config.get("driver_switch", False)
 
-        if driver_enabled and not self.stop_system_driver():
+        driver_loaded = driver_enabled or self.check_system_driver()
+        if driver_loaded and not self.stop_system_driver():
+            self.closing = False
             self.write_log("WARN", "Driver Protection", detail="Controlled unload failed", success=False)
             if self._window:
                 try:
@@ -750,9 +824,11 @@ class _MainMixin:
                 pass
             self.tray_icon = None
 
-        if self._window:
+        window = self._window
+        self._window = None
+        if window:
             try:
-                self._window.hide()
+                window.hide()
             except Exception:
                 pass
 
@@ -793,24 +869,17 @@ class _MainMixin:
                         pass
                 self.suspended_procs.clear()
 
-        if hasattr(self, 'h_mutex') and self.h_mutex:
-            try:
-                self.kernel32.CloseHandle(self.h_mutex)
-            except Exception:
-                pass
-
-        if self._window:
-            self._window.destroy()
-
-        with self.lock_logs:
-            if getattr(self, 'logs_dirty', False):
+        for mutex_name in ('h_mutex', 'h_recovery_mutex'):
+            handle = getattr(self, mutex_name, None)
+            if handle:
                 try:
-                    os.makedirs(os.path.dirname(self.file_log), exist_ok=True)
-                    with open(self.file_log, "w", encoding="utf-8") as f:
-                        json.dump(self.logs_data, f, indent=4, ensure_ascii=False)
-
+                    self.kernel32.CloseHandle(handle)
                 except Exception:
                     pass
+                setattr(self, mutex_name, None)
+
+        self.flush_logs_now()
+        self.destroy_window_with_timeout(window)
         os._exit(0)
 
     def init_ui_ready(self):
@@ -1018,6 +1087,33 @@ def get_base_path():
 
     return os.path.dirname(os.path.abspath(__file__))
 
+
+def get_frontend_asset_errors():
+    base_path = get_base_path()
+    required_files = [
+        os.path.join("Interface", "templates", "index.html"),
+        os.path.join("Interface", "static", "css", "style.css"),
+        os.path.join("Interface", "static", "js", "i18n.js"),
+        os.path.join("Interface", "static", "js", "main.js"),
+    ]
+    errors = []
+
+    for rel_path in required_files:
+        abs_path = os.path.join(base_path, rel_path)
+        if not os.path.isfile(abs_path):
+            errors.append(f"Missing UI asset: {rel_path}")
+        elif os.path.getsize(abs_path) <= 0:
+            errors.append(f"Empty UI asset: {rel_path}")
+
+    return errors
+
+
+def show_startup_error(message):
+    try:
+        ctypes.windll.user32.MessageBoxW(None, message, PYAS_WINDOW_TITLE, 0x00000010)
+    except Exception:
+        pass
+
 ####################################################################################################
 
 class NoCacheRequestHandler(SimpleHTTPRequestHandler):
@@ -1041,7 +1137,14 @@ class WindowHook:
     def __init__(self, title, api_ref=None):
         self.title, self.api_ref = title, api_ref
         self.old_wndproc = None
-        self.WM_DPICHANGED, self.WM_NCHITTEST, self.WM_COPYDATA, self.HTCAPTION, self.GWLP_WNDPROC = 0x02E0, 0x0084, 0x004A, 2, -4
+        self.WM_DPICHANGED = 0x02E0
+        self.WM_NCHITTEST = 0x0084
+        self.WM_CLOSE = 0x0010
+        self.WM_COPYDATA = WM_COPYDATA
+        self.WM_SYSCOMMAND = 0x0112
+        self.SC_CLOSE = 0xF060
+        self.HTCAPTION = 2
+        self.GWLP_WNDPROC = -4
 
         class RECT(ctypes.Structure):
             _fields_ = [("left", ctypes.c_long), ("top", ctypes.c_long), ("right", ctypes.c_long), ("bottom", ctypes.c_long)]
@@ -1052,6 +1155,7 @@ class WindowHook:
         self.user32 = ctypes.windll.user32
         self.user32.FindWindowW.argtypes, self.user32.FindWindowW.restype = [ctypes.c_wchar_p, ctypes.c_wchar_p], ctypes.wintypes.HWND
         self.user32.CallWindowProcW.argtypes, self.user32.CallWindowProcW.restype = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_uint, ctypes.c_void_p, ctypes.c_void_p], ctypes.c_void_p
+        self.user32.DefWindowProcW.argtypes, self.user32.DefWindowProcW.restype = [ctypes.c_void_p, ctypes.c_uint, ctypes.c_void_p, ctypes.c_void_p], ctypes.c_void_p
 
         if ctypes.sizeof(ctypes.c_void_p) == 8:
             self.SetWindowLong, self.GetWindowLong = self.user32.SetWindowLongPtrW, self.user32.GetWindowLongPtrW
@@ -1063,6 +1167,9 @@ class WindowHook:
         self.new_wndproc_cb = self.WNDPROC(self.wndproc)
 
     def hook(self):
+        if self.old_wndproc:
+            return
+
         hwnd = self.user32.FindWindowW(None, self.title)
         if hwnd:
             self.old_wndproc = self.GetWindowLong(hwnd, self.GWLP_WNDPROC)
@@ -1071,38 +1178,40 @@ class WindowHook:
             try:
                 self.user32.ChangeWindowMessageFilterEx.argtypes = [ctypes.c_void_p, ctypes.c_uint, ctypes.c_uint, ctypes.c_void_p]
                 self.user32.ChangeWindowMessageFilterEx(hwnd, self.WM_COPYDATA, 1, None)
-
             except Exception:
                 pass
 
-    def wndproc(self, hwnd, msg, wparam, lparam):
-        if msg in [0x0010, 0x0002, 0x0012, 0x0212] or (msg == 0x0112 and (wparam & 0xFFF0) == 0xF060):
-            return 0
+    def call_default(self, hwnd, msg, wparam, lparam):
+        if self.old_wndproc:
+            return self.user32.CallWindowProcW(self.old_wndproc, hwnd, msg, wparam, lparam)
+        return self.user32.DefWindowProcW(hwnd, msg, wparam, lparam)
 
+    def wndproc(self, hwnd, msg, wparam, lparam):
         if msg == self.WM_COPYDATA:
             try:
                 cds = COPYDATASTRUCT.from_address(lparam)
                 if cds.dwData == 1:
                     path = ctypes.string_at(cds.lpData, cds.cbData).decode('utf-8').strip('\x00')
-
                     if self.api_ref:
-                        if self.api_ref._window:
-                            self.api_ref._window.restore();
-                            self.api_ref._window.show()
-
+                        threading.Thread(target=self.api_ref.restore_from_tray, daemon=True).start()
                         threading.Thread(target=self.api_ref.trigger_context_scan, args=(path,), daemon=True).start()
 
-                elif cds.dwData == 2 and self.api_ref and self.api_ref._window:
-                    self.api_ref._window.restore();
-                    self.api_ref._window.show()
+                elif cds.dwData == 2 and self.api_ref:
+                    threading.Thread(target=self.api_ref.restore_from_tray, daemon=True).start()
 
                 elif cds.dwData == 3 and self.api_ref:
-                    self.api_ref.close()
+                    threading.Thread(target=self.api_ref.close, daemon=True).start()
 
             except Exception:
                 pass
             return 1
 
+        if msg == self.WM_CLOSE or (msg == self.WM_SYSCOMMAND and (wparam & 0xFFF0) == self.SC_CLOSE):
+            if self.api_ref and not getattr(self.api_ref, 'closing', False):
+                threading.Thread(target=self.api_ref.hide_window, daemon=True).start()
+                return 0
+            return self.call_default(hwnd, msg, wparam, lparam)
+
         if msg == self.WM_NCHITTEST:
             x, y = lparam & 0xFFFF, (lparam >> 16) & 0xFFFF
             if x >= 32768:
@@ -1119,11 +1228,10 @@ class WindowHook:
             try:
                 rect = self.RECT.from_address(lparam)
                 self.user32.SetWindowPos(hwnd, None, rect.left, rect.top, rect.right - rect.left, rect.bottom - rect.top, 0x0004 | 0x0010 | 0x0020)
-
             except Exception:
                 pass
 
-        return self.user32.CallWindowProcW(self.old_wndproc, hwnd, msg, wparam, lparam) if self.old_wndproc else self.user32.DefWindowProcW(hwnd, msg, wparam, lparam)
+        return self.call_default(hwnd, msg, wparam, lparam)
 
 ####################################################################################################
 
@@ -1139,11 +1247,34 @@ def start_api(port_container, ready_event):
         ready_event.set()
 
 if __name__ == "__main__":
+    if "-driver-unload" in sys.argv or "-driver-uninstall" in sys.argv:
+        controller = WindowAPI()
+        success = controller.stop_system_driver()
+        if "-driver-uninstall" in sys.argv:
+            deleted, delete_error = False, 0
+            for _ in range(20):
+                deleted, delete_error = controller._delete_driver_service()
+                if deleted:
+                    break
+                if delete_error not in (1051, 1072):
+                    break
+                time.sleep(0.25)
+            if not deleted:
+                controller.write_log("WARN", "Driver Service", detail=f"DeleteService failed: 0x{delete_error & 0xFFFFFFFF:08X}", success=False)
+            success = (success or not controller.check_system_driver()) and deleted
+        controller.flush_logs_now()
+        os._exit(0 if success or not controller.check_system_driver() else 2)
+
     hide_on_start = "-h" in sys.argv or "-hide" in sys.argv
     init_width, init_height = 980, 670
 
     os.environ["WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS"] = "--proxy-bypass-list=127.0.0.1,localhost"
 
+    frontend_errors = get_frontend_asset_errors()
+    if frontend_errors:
+        show_startup_error("PYAS UI files are incomplete.\n\n" + "\n".join(frontend_errors))
+        os._exit(4)
+
     port_container = []
     server_ready = threading.Event()
     api_thread = threading.Thread(target=start_api, args=(port_container, server_ready), daemon=True)
@@ -1157,22 +1288,43 @@ if __name__ == "__main__":
     user32 = ctypes.windll.user32
     pos_x, pos_y = (user32.GetSystemMetrics(0) - init_width) // 2, (user32.GetSystemMetrics(1) - init_height) // 2
 
+    startup_url = f"http://127.0.0.1:{port_container[0]}/"
     window = webview.create_window(
-        title="PYAS Security", url=f"http://127.0.0.1:{port_container[0]}/", width=init_width, height=init_height, x=pos_x, y=pos_y,
+        title=PYAS_WINDOW_TITLE, url=startup_url, width=init_width, height=init_height, x=pos_x, y=pos_y,
         frameless=True, easy_drag=False, js_api=js_api, background_color='#e0e0e0', hidden=hide_on_start)
 
     if platform.system() == "Windows":
-        window_hook = WindowHook("PYAS Security", js_api)
+        window_hook = WindowHook(PYAS_WINDOW_TITLE, js_api)
         window.events.shown += window_hook.hook
 
     js_api.set_window(window)
     js_api.show_tray()
 
+    webview_ready_event = threading.Event()
+
+    def mark_webview_ready():
+        webview_ready_event.set()
+
     def bind_dnd():
+        mark_webview_ready()
         try:
             window.dom.document.events.drop += DOMEventHandler(js_api.on_drop, True, True)
         except Exception:
             pass
 
+    def webview_startup_watchdog():
+        if not hide_on_start and not webview_ready_event.wait(60.0):
+            try:
+                webbrowser.open(startup_url)
+            except Exception:
+                pass
+            show_startup_error("PYAS WebView did not finish loading. The app was opened in your default browser as a fallback.")
+            try:
+                js_api.flush_logs_now()
+            except Exception:
+                pass
+            os._exit(3)
+
     window.events.loaded += bind_dnd
+    threading.Thread(target=webview_startup_watchdog, daemon=True).start()
     webview.start()

PYAS_Inno.iss

@@ -1,6 +1,6 @@
 #define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
 #define AppName "PYAS"
-#define AppVersion "3.6.2.0"
+#define AppVersion "3.6.3.0"
 #define AppPublisher "PYAS Security"
 #define AppURL "https://github.com/87owo/PYAS"
 #define AppExeName "PYAS.exe"

PYAS_Protect.py

@@ -9,6 +9,23 @@ ERROR_OPERATION_ABORTED = 995
 ERROR_NOT_FOUND = 1168
 WAIT_OBJECT_0 = 0
 WAIT_TIMEOUT = 258
+PYAS_CONNECTION_MAGIC = 0x53415950
+PYAS_CONNECTION_VERSION = 1
+PROCESS_TERMINATE = 0x0001
+PROCESS_VM_READ = 0x0010
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_SUSPEND_RESUME = 0x0800
+PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+PYAS_PROCESS_SCAN_ACCESS = PROCESS_TERMINATE | PROCESS_VM_READ | PROCESS_QUERY_INFORMATION | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_LIMITED_INFORMATION
+PYAS_PROCESS_NETWORK_ACCESS = PROCESS_TERMINATE | PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION
+
+class PYAS_CONNECTION_CONTEXT(ctypes.Structure):
+    _fields_ = [
+        ("Size", ctypes.wintypes.ULONG),
+        ("Version", ctypes.wintypes.ULONG),
+        ("Magic", ctypes.wintypes.ULONG),
+        ("ProcessId", ctypes.wintypes.ULONG)
+    ]
 
 class OVERLAPPED(ctypes.Structure):
     _fields_ = [
@@ -448,7 +465,7 @@ class ProtectMixin:
                     self.exist_process = cur
 
                 for pid in new_pids:
-                    h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+                    h = self.kernel32.OpenProcess(PYAS_PROCESS_SCAN_ACCESS, False, pid)
                     if h:
                         with self.lock_config:
                             should_suspend = self.pyas_config.get("suspend_switch", True)
@@ -476,7 +493,7 @@ class ProtectMixin:
                 suspended = self.pyas_config.get("suspend_switch", True)
 
         if not h:
-            h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            h = self.kernel32.OpenProcess(PYAS_PROCESS_SCAN_ACCESS, False, pid)
             if not h:
                 return
 
@@ -578,7 +595,7 @@ class ProtectMixin:
                             raw_path = self.device_path_to_drive(raw_path)
 
                         file_path = self.norm_path(raw_path)
-                        if file_path and file_path not in scanned_paths:
+                        if file_path and file_path not in scanned_paths and self.path_system not in file_path:
 
                             scanned_paths.add(file_path)
                             file_path_lower = file_path.lower()
@@ -726,7 +743,7 @@ class ProtectMixin:
     def handle_new_connection(self, key):
         pid, remote_addr, remote_port = key
         try:
-            h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            h = self.kernel32.OpenProcess(PYAS_PROCESS_NETWORK_ACCESS, False, pid)
             if not h:
                 return
 
@@ -940,6 +957,46 @@ class ProtectMixin:
                 self.advapi32.CloseServiceHandle(service)
             self.advapi32.CloseServiceHandle(scm)
 
+    def _get_driver_client_image_path(self):
+        buffer = ctypes.create_unicode_buffer(32768)
+        size = ctypes.wintypes.DWORD(len(buffer))
+        if not self.kernel32.QueryFullProcessImageNameW(
+            self.kernel32.GetCurrentProcess(),
+            0,
+            buffer,
+            ctypes.byref(size)
+        ):
+            return None
+
+        image_path = os.path.abspath(buffer.value)
+        drive, tail = os.path.splitdrive(image_path)
+        if not drive or not tail:
+            return None
+
+        device_buffer = ctypes.create_unicode_buffer(32768)
+        if not self.kernel32.QueryDosDeviceW(drive, device_buffer, len(device_buffer)):
+            return None
+
+        return device_buffer.value.rstrip("\\") + tail
+
+    def _configure_driver_identity(self):
+        image_path = self._get_driver_client_image_path()
+        if not image_path:
+            return False, ctypes.get_last_error() or 1
+
+        try:
+            access = winreg.KEY_SET_VALUE | getattr(winreg, "KEY_WOW64_64KEY", 0)
+            with winreg.CreateKeyEx(
+                winreg.HKEY_LOCAL_MACHINE,
+                r"SYSTEM\CurrentControlSet\Services\PYAS_Driver",
+                0,
+                access
+            ) as key:
+                winreg.SetValueEx(key, "ClientImagePath", 0, winreg.REG_SZ, image_path)
+            return True, 0
+        except OSError as e:
+            return False, int(getattr(e, "winerror", 0) or 1)
+
     def _ensure_driver_service(self):
         desired_service_access = 0x0002 | 0x0004 | 0x0010 | 0x00010000
         dependencies = ctypes.create_unicode_buffer("FltMgr\0\0")
@@ -1062,6 +1119,11 @@ class ProtectMixin:
                 self.write_log("WARN", "Driver Service", detail=f"CreateServiceW/ChangeServiceConfigW failed: 0x{service_error & 0xFFFFFFFF:08X}", success=False)
                 return False
 
+            configured, identity_error = self._configure_driver_identity()
+            if not configured:
+                self.write_log("WARN", "Driver Identity", detail=f"ClientImagePath configuration failed: 0x{identity_error & 0xFFFFFFFF:08X}", success=False)
+                return False
+
             self._reg_write(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\PYAS_Driver\Instances", "DefaultInstance", winreg.REG_SZ, "PYAS Instance")
             self._reg_write(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\PYAS_Driver\Instances\PYAS Instance", "Altitude", winreg.REG_SZ, "320000")
             self._reg_write(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\PYAS_Driver\Instances\PYAS Instance", "Flags", winreg.REG_DWORD, 0)
@@ -1120,12 +1182,18 @@ class ProtectMixin:
             return None
 
     def _connect_driver_port(self, asynchronous=False):
+        context = PYAS_CONNECTION_CONTEXT()
+        context.Size = ctypes.sizeof(context)
+        context.Version = PYAS_CONNECTION_VERSION
+        context.Magic = PYAS_CONNECTION_MAGIC
+        context.ProcessId = os.getpid()
+
         temp_port = ctypes.wintypes.HANDLE()
         status = self.fltlib.FilterConnectCommunicationPort(
             "\\PYAS_Output_Pipe",
             0 if asynchronous else FLT_PORT_FLAG_SYNC_HANDLE,
-            None,
-            0,
+            ctypes.byref(context),
+            ctypes.sizeof(context),
             None,
             ctypes.byref(temp_port)
         )
@@ -1526,8 +1594,12 @@ class ProtectMixin:
                     self._resume_driver_listener()
 
     def check_system_driver(self):
-        state = self._query_driver_service_state()
-        return state in (2, 3, 4)
+        runtime_state = self._query_driver_state()
+        if runtime_state in (1, 2, 3, 4):
+            return True
+
+        service_state = self._query_driver_service_state()
+        return service_state in (2, 3, 4)
 
     def clear_driver_rules(self):
         with self.lock_driver:

PYAS_Scanner.py

@@ -159,25 +159,92 @@ class ScannerMixin:
 
 ####################################################################################################
 
-    def start_scan(self, targets):
-        with self.lock_virus:
-            if getattr(self, 'scan_running', False):
-                return
+    def _scan_result_messages(self, count=None, scanned=None, elapsed=None):
+        if count is None or scanned is None or elapsed is None:
+            with self.lock_virus:
+                count = len(getattr(self, 'virus_results', [])) if count is None else count
+                scanned = getattr(self, 'scan_count', 0) if scanned is None else scanned
+                scan_start = getattr(self, 'scan_start', time.time())
+                elapsed = int(time.time() - scan_start) if elapsed is None else elapsed
 
+        return {
+            "traditional_switch": f"發現 {count} 個病毒，掃描 {scanned} 個檔案，耗時 {elapsed} 秒",
+            "simplified_switch": f"发现 {count} 个病毒，扫描 {scanned} 个文件，耗时 {elapsed} 秒",
+            "english_switch": f"Found {count} viruses, scanned {scanned} files, time {elapsed}s",
+            "japanese_switch": f"{count} 個のウイルスを発見し、{scanned} 個のファイルをスキャンしました（所要時間 {elapsed} 秒）",
+            "korean_switch": f"바이러스 {count}개 발견, 파일 {scanned}개 검사, 소요 시간 {elapsed}초",
+            "french_switch": f"{count} virus trouvés, {scanned} fichiers analysés, temps {elapsed}s",
+            "spanish_switch": f"Se encontraron {count} virus, {scanned} archivos escaneados, tiempo {elapsed}s",
+            "hindi_switch": f"{count} वायरस मिले, {scanned} फ़ाइलें स्कैन की गईं, समय {elapsed}s",
+            "arabic_switch": f"تم العثور على {count} فيروسات، تم فحص {scanned} ملفات، الوقت {elapsed} ثانية",
+            "russian_switch": f"Найдено {count} вирусов, проверено {scanned} файлов, время {elapsed}с",
+            "slovenian_switch": f"Najdenih {count} virusov, skeniranih {scanned} datotek, čas {elapsed}s"
+        }
+
+    def _is_scan_cancel_requested(self):
+        with self.lock_virus:
+            return getattr(self, 'scan_stop_requested', False)
+
+    def _finish_scan_cancelled(self, messages=None):
+        with self.lock_virus:
+            count = len(getattr(self, 'virus_results', []))
+            scanned = getattr(self, 'scan_count', 0)
+            scan_start = getattr(self, 'scan_start', time.time())
+            elapsed = int(time.time() - scan_start)
+            self.scan_running = False
+            self.scan_preparing = False
+            self.scan_finished = True
+            self.scan_stop_requested = False
+
+        messages = messages or self._scan_result_messages(count, scanned, elapsed)
+
+        if self._window:
+            js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
+            self.ui_queue.put(js_cmd)
+
+        return False
+
+    def _begin_scan_preparation(self):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False) or getattr(self, 'scan_preparing', False):
+                return False
+
+            self.scan_preparing = True
+            self.scan_stop_requested = False
+            self.scan_finished = False
+            self.virus_results = []
+            self.scan_count = 0
+            self.scan_start = time.time()
+            return True
+
+    def start_scan(self, targets, from_preparing=False):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False) or (getattr(self, 'scan_preparing', False) and not from_preparing):
+                return False
+
+            if getattr(self, 'scan_stop_requested', False):
+                self.scan_running = False
+                self.scan_preparing = False
+                self.scan_finished = True
+                return False
+
+            self.scan_preparing = False
             self.scan_running = True
             self.scan_finished = False
+            self.scan_stop_requested = False
             self.virus_results = []
             self.scan_count = 0
             self.scan_start = time.time()
 
         self.scan_pool.submit(self.scan_worker, targets)
+        return True
 
     def scan_worker(self, targets):
         last_update = 0.0
         try:
             for file_path, is_explicit in self.yield_files(targets):
                 with self.lock_virus:
-                    if not self.scan_running:
+                    if not self.scan_running or getattr(self, 'scan_stop_requested', False):
                         break
 
                 norm_path = self.norm_path(file_path)
@@ -203,6 +270,8 @@ class ScannerMixin:
                         continue
 
                     with self.lock_virus:
+                        if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                            break
                         self.scan_count += 1
 
                     with self.lock_config:
@@ -213,6 +282,10 @@ class ScannerMixin:
                         continue
 
                     result = self.safe_scan_engine(norm_path)
+                    with self.lock_virus:
+                        if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                            break
+
                     if result:
                         with self.lock_virus:
                             self.virus_results.append(norm_path)
@@ -233,113 +306,134 @@ class ScannerMixin:
 
         finally:
             with self.lock_virus:
+                cancelled = getattr(self, 'scan_stop_requested', False)
                 self.scan_running = False
+                self.scan_preparing = False
                 self.scan_finished = True
+                self.scan_stop_requested = False
                 count, scanned, elapsed = len(self.virus_results), self.scan_count, int(time.time() - self.scan_start)
 
-            messages = {
-                "traditional_switch": f"發現 {count} 個病毒，掃描 {scanned} 個檔案，耗時 {elapsed} 秒",
-                "simplified_switch": f"发现 {count} 个病毒，扫描 {scanned} 个文件，耗时 {elapsed} 秒",
-                "english_switch": f"Found {count} viruses, scanned {scanned} files, time {elapsed}s",
-                "japanese_switch": f"{count} 個のウイルスを発見し、{scanned} 個のファイルをスキャンしました（所要時間 {elapsed} 秒）",
-                "korean_switch": f"바이러스 {count}개 발견, 파일 {scanned}개 검사, 소요 시간 {elapsed}초",
-                "french_switch": f"{count} virus trouvés, {scanned} fichiers analysés, temps {elapsed}s",
-                "spanish_switch": f"Se encontraron {count} virus, {scanned} archivos escaneados, tiempo {elapsed}s",
-                "hindi_switch": f"{count} वायरस मिले, {scanned} फ़ाइलें स्कैन की गईं, समय {elapsed}s",
-                "arabic_switch": f"تم العثور على {count} فيروسات، تم فحص {scanned} ملفات، الوقت {elapsed} ثانية",
-                "russian_switch": f"Найдено {count} вирусов, проверено {scanned} файлов, время {elapsed}с",
-                "slovenian_switch": f"Najdenih {count} virusov, skeniranih {scanned} datotek, čas {elapsed}s"
-            }
+            messages = self._scan_result_messages(count, scanned, elapsed)
+            log_detail = f"Found {count} viruses, scanned {scanned} files, time {elapsed}s"
+
             if self._window:
                 js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
                 self.ui_queue.put(js_cmd)
 
-            self.write_log("INFO", "Scan Completed", detail=f"Found {count} viruses, scanned {scanned} files, time {elapsed}s")
+            self.write_log("INFO", "Scan Completed", detail=log_detail)
 
 ####################################################################################################
 
     def stop_scan(self):
-        with self.lock_virus: self.scan_running = False
+        with self.lock_virus:
+            active = getattr(self, 'scan_running', False) or getattr(self, 'scan_preparing', False)
+            if active:
+                self.scan_stop_requested = True
+                self.scan_running = False
+            return active
 
     def trigger_scan(self, method):
-        messages = {
-            "traditional_switch": "已取消掃描",
-            "simplified_switch": "已取消扫描", "english_switch":
-            "Scan cancelled", "japanese_switch": "スキャンがキャンセルされました",
-            "korean_switch": "스캔이 취소되었습니다",
-            "french_switch": "Analyse annulée",
-            "spanish_switch": "Escaneo cancelado",
-            "hindi_switch": "स्कैन रद्द कर दिया गया",
-            "arabic_switch": "تم إلغاء الفحص",
-            "russian_switch": "Сканирование отменено",
-            "slovenian_switch": "Skeniranje preklicano"
-        }
         targets = []
 
-        if method == "smart":
-            for folder in ["Desktop", "Downloads", "AppData"]:
-                fp = os.path.join(self.path_user, folder)
-                if os.path.exists(fp):
-                    targets.append(fp)
+        if not self._begin_scan_preparation():
+            return False
 
-            if os.path.exists(self.path_config):
-                targets.append(self.path_config)
+        try:
+            if method == "smart":
+                for folder in ["Desktop", "Downloads", "AppData"]:
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
 
-            buf = ctypes.create_unicode_buffer(1024)
-            max_address = 0x7FFFFFFFFFFF if ctypes.sizeof(ctypes.c_void_p) == 8 else 0x7FFFFFFF
-            system_dir = self.path_system.lower()
+                    fp = os.path.join(self.path_user, folder)
+                    if os.path.exists(fp):
+                        targets.append(fp)
 
-            for proc in self.get_process_list():
-                if proc["path"] and proc["path"] != "None": 
-                    targets.append(proc["path"])
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
 
-                pid = proc["pid"]
-                if pid <= 4:
-                    continue
+                if os.path.exists(self.path_config):
+                    targets.append(self.path_config)
 
-                h_process = self.kernel32.OpenProcess(0x1000, False, pid)
-                if h_process:
-                    try:
-                        address = 0
-                        mbi = MEMORY_BASIC_INFORMATION()
-                        while address < max_address and self.kernel32.VirtualQueryEx(h_process, ctypes.c_void_p(address), ctypes.byref(mbi), ctypes.sizeof(mbi)):
-                            if mbi.State == 0x1000 and mbi.Type == 0x1000000:
-                                if self.psapi.GetMappedFileNameW(h_process, ctypes.c_void_p(address), buf, 1024):
-                                    raw_path = buf.value
-                                    if raw_path.startswith("\\"):
-                                        raw_path = self.device_path_to_drive(raw_path)
+                buf = ctypes.create_unicode_buffer(1024)
+                max_address = 0x7FFFFFFFFFFF if ctypes.sizeof(ctypes.c_void_p) == 8 else 0x7FFFFFFF
+                system_dir = self.path_system.lower()
 
-                                    file_path = self.norm_path(raw_path)
-                                    if file_path and not file_path.lower().startswith(system_dir):
-                                        targets.append(file_path)
+                for proc in self.get_process_list():
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
 
-                            if mbi.RegionSize == 0:
-                                break
-                            address += mbi.RegionSize
-                    finally:
-                        self.kernel32.CloseHandle(h_process)
+                    if proc["path"] and proc["path"] != "None": 
+                        targets.append(proc["path"])
 
-            self.start_scan(list(set(targets)))
+                    pid = proc["pid"]
+                    if pid <= 4:
+                        continue
 
-        elif method == "file":
-            targets = self.select_files()
-            if targets:
-                self.start_scan(targets)
+                    h_process = self.kernel32.OpenProcess(0x1000, False, pid)
+                    if h_process:
+                        try:
+                            address = 0
+                            mbi = MEMORY_BASIC_INFORMATION()
+                            while address < max_address and not self._is_scan_cancel_requested() and self.kernel32.VirtualQueryEx(h_process, ctypes.c_void_p(address), ctypes.byref(mbi), ctypes.sizeof(mbi)):
+                                if mbi.State == 0x1000 and mbi.Type == 0x1000000:
+                                    if self.psapi.GetMappedFileNameW(h_process, ctypes.c_void_p(address), buf, 1024):
+                                        raw_path = buf.value
+                                        if raw_path.startswith("\\"):
+                                            raw_path = self.device_path_to_drive(raw_path)
 
-            elif self._window:
-                self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, 0);")
+                                        file_path = self.norm_path(raw_path)
+                                        if file_path and not file_path.lower().startswith(system_dir):
+                                            targets.append(file_path)
 
-        elif method == "path":
-            targets = self.select_folder()
-            if targets:
-                self.start_scan(targets)
+                                if mbi.RegionSize == 0:
+                                    break
+                                address += mbi.RegionSize
+                        finally:
+                            self.kernel32.CloseHandle(h_process)
 
-            elif self._window:
-                self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, 0);")
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
 
-        elif method == "full":
-            targets = [f"{chr(d)}:/" for d in range(65, 91) if os.path.exists(f"{chr(d)}:/")]
-            self.start_scan(targets)
+                if not self.start_scan(list(set(targets)), from_preparing=True):
+                    return self._finish_scan_cancelled()
+
+                return True
+
+            elif method == "file":
+                targets = self.select_files()
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if targets:
+                    if not self.start_scan(targets, from_preparing=True):
+                        return self._finish_scan_cancelled()
+                    return True
+
+                return self._finish_scan_cancelled()
+
+            elif method == "path":
+                targets = self.select_folder()
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if targets:
+                    if not self.start_scan(targets, from_preparing=True):
+                        return self._finish_scan_cancelled()
+                    return True
+
+                return self._finish_scan_cancelled()
+
+            elif method == "full":
+                targets = [f"{chr(d)}:/" for d in range(65, 91) if os.path.exists(f"{chr(d)}:/")]
+                if self._is_scan_cancel_requested() or not self.start_scan(targets, from_preparing=True):
+                    return self._finish_scan_cancelled()
+                return True
+
+            return self._finish_scan_cancelled()
+
+        except Exception as e:
+            self.write_log("WARN", "trigger_scan", detail=str(e), success=False)
+            return self._finish_scan_cancelled()
 
 ####################################################################################################
 

PYAS_Tools.py

@@ -4,6 +4,11 @@ import ctypes, ctypes.wintypes
 
 from concurrent.futures import ThreadPoolExecutor
 
+PROCESS_TERMINATE = 0x0001
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+PYAS_PROCESS_TERMINATE_ACCESS = PROCESS_TERMINATE | PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION
+
 ####################################################################################################
 
 class PROCESSENTRY32W(ctypes.Structure):
@@ -657,7 +662,7 @@ class ToolsMixin:
 
     def kill_process(self, pid, expected_path=None):
         try:
-            h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            h = self.kernel32.OpenProcess(PYAS_PROCESS_TERMINATE_ACCESS, False, pid)
             if h:
                 try:
                     file_path = self.norm_path(self.get_process_file(h))

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.6.2.0',
+version='3.6.3.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -8,7 +8,9 @@
 constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
 constexpr auto MAX_PATH_LEN = 1024;
 constexpr auto PYAS_POOL_TAG = 'SAYP';
-constexpr auto PYAS_OB_ALTITUDE = L"320000.4101";
+constexpr auto PYAS_OB_ALTITUDE = L"320000.4101";
+constexpr auto PYAS_CONNECTION_MAGIC = 0x53415950;
+constexpr auto PYAS_CONNECTION_VERSION = 1;
 
 #ifndef PROCESS_TERMINATE
 #define PROCESS_TERMINATE                  (0x0001)
@@ -130,7 +132,14 @@ typedef enum _PYAS_COMMAND {
 typedef struct _PYAS_USER_MESSAGE {
     ULONG Command;
     WCHAR Path[MAX_PATH_LEN];
-} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+
+typedef struct _PYAS_CONNECTION_CONTEXT {
+    ULONG Size;
+    ULONG Version;
+    ULONG Magic;
+    ULONG ProcessId;
+} PYAS_CONNECTION_CONTEXT, * PPYAS_CONNECTION_CONTEXT;
 
 typedef struct _DRIVER_DATA {
     PDRIVER_OBJECT DriverObject;
@@ -150,7 +159,9 @@ typedef struct _DRIVER_DATA {
     volatile LONG ClientCloseActive;
     EX_RUNDOWN_REF PortRundown;
     KEVENT CleanupCompleteEvent;
-    PVOID ObRegistrationHandle;
+    PVOID ObRegistrationHandle;
+    UNICODE_STRING ClientImagePath;
+    WCHAR ClientImagePathBuffer[MAX_PATH_LEN];
 } DRIVER_DATA, * PDRIVER_DATA;
 
 typedef struct _RULE_NODE {

Plugins/Filter/DriverEntry.cpp

@@ -49,6 +49,99 @@ static NTSTATUS SelectFailure(NTSTATUS CurrentStatus, NTSTATUS CandidateStatus)
     return CandidateStatus;
 }
 
+static NTSTATUS LoadClientIdentityFromRegistry(PUNICODE_STRING RegistryPath) {
+    if (!RegistryPath || !RegistryPath->Buffer || !GlobalData.ClientImagePath.Buffer) return STATUS_INVALID_PARAMETER;
+
+    UNICODE_STRING ValueName = RTL_CONSTANT_STRING(L"ClientImagePath");
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(&ObjectAttributes, RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+    HANDLE KeyHandle = NULL;
+    NTSTATUS Status = ZwOpenKey(&KeyHandle, KEY_READ, &ObjectAttributes);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    ULONG ResultLength = 0;
+    Status = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, NULL, 0, &ResultLength);
+    if (Status != STATUS_BUFFER_TOO_SMALL && Status != STATUS_BUFFER_OVERFLOW) {
+        ZwClose(KeyHandle);
+        return Status;
+    }
+
+    if (ResultLength == 0 || ResultLength > FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) + GlobalData.ClientImagePath.MaximumLength) {
+        ZwClose(KeyHandle);
+        return STATUS_NAME_TOO_LONG;
+    }
+
+    PKEY_VALUE_PARTIAL_INFORMATION Information = (PKEY_VALUE_PARTIAL_INFORMATION)PyasAllocate(ResultLength);
+    if (!Information) {
+        ZwClose(KeyHandle);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    Status = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, Information, ResultLength, &ResultLength);
+    ZwClose(KeyHandle);
+
+    if (NT_SUCCESS(Status)) {
+        if ((Information->Type != REG_SZ && Information->Type != REG_EXPAND_SZ) ||
+            Information->DataLength < sizeof(WCHAR) ||
+            (Information->DataLength % sizeof(WCHAR)) != 0 ||
+            Information->DataLength > GlobalData.ClientImagePath.MaximumLength - sizeof(WCHAR)) {
+            Status = STATUS_INVALID_PARAMETER;
+        }
+        else {
+            RtlZeroMemory(GlobalData.ClientImagePath.Buffer, GlobalData.ClientImagePath.MaximumLength);
+            RtlCopyMemory(GlobalData.ClientImagePath.Buffer, Information->Data, Information->DataLength);
+
+            USHORT CharacterCount = (USHORT)(Information->DataLength / sizeof(WCHAR));
+            while (CharacterCount > 0 && GlobalData.ClientImagePath.Buffer[CharacterCount - 1] == L'\0') {
+                CharacterCount--;
+            }
+
+            if (CharacterCount == 0) {
+                Status = STATUS_INVALID_PARAMETER;
+            }
+            else {
+                GlobalData.ClientImagePath.Buffer[CharacterCount] = L'\0';
+                GlobalData.ClientImagePath.Length = CharacterCount * sizeof(WCHAR);
+                Status = STATUS_SUCCESS;
+            }
+        }
+    }
+
+    PyasFree(Information);
+    return Status;
+}
+
+static BOOLEAN IsAuthorizedClientConnection(PVOID ConnectionContext, ULONG SizeOfContext) {
+    if (!ConnectionContext || SizeOfContext < sizeof(PYAS_CONNECTION_CONTEXT)) return FALSE;
+    if (!GlobalData.ClientImagePath.Buffer || GlobalData.ClientImagePath.Length == 0) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    PYAS_CONNECTION_CONTEXT Context = { 0 };
+    __try {
+        RtlCopyMemory(&Context, ConnectionContext, sizeof(Context));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        return FALSE;
+    }
+
+    if (Context.Size < sizeof(PYAS_CONNECTION_CONTEXT)) return FALSE;
+    if (Context.Version != PYAS_CONNECTION_VERSION) return FALSE;
+    if (Context.Magic != PYAS_CONNECTION_MAGIC) return FALSE;
+    if (Context.ProcessId != (ULONG)(ULONG_PTR)PsGetCurrentProcessId()) return FALSE;
+
+    PUNICODE_STRING ImagePath = NULL;
+    NTSTATUS Status = SeLocateProcessImageName(PsGetCurrentProcess(), &ImagePath);
+    if (!NT_SUCCESS(Status) || !ImagePath || !ImagePath->Buffer) {
+        if (ImagePath) ExFreePool(ImagePath);
+        return FALSE;
+    }
+
+    BOOLEAN Authorized = RtlEqualUnicodeString(ImagePath, &GlobalData.ClientImagePath, TRUE);
+    ExFreePool(ImagePath);
+    return Authorized;
+}
+
 static NTSTATUS UnregisterRuntimeCallbacksPass(BOOLEAN WaitWithoutTimeout) {
     NTSTATUS Status = STATUS_SUCCESS;
 
@@ -434,10 +527,9 @@ static NTSTATUS PortConnect(
     PVOID* ConnectionPortCookie
 ) {
     UNREFERENCED_PARAMETER(ServerPortCookie);
-    UNREFERENCED_PARAMETER(ConnectionContext);
-    UNREFERENCED_PARAMETER(SizeOfContext);
 
     if (!ConnectionPortCookie) return STATUS_INVALID_PARAMETER;
+    if (!IsAuthorizedClientConnection(ConnectionContext, SizeOfContext)) return STATUS_ACCESS_DENIED;
     *ConnectionPortCookie = NULL;
 
     if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
@@ -544,6 +636,8 @@ extern "C" NTSTATUS DriverEntry(
 ) {
     RtlZeroMemory(&GlobalData, sizeof(GlobalData));
     GlobalData.DriverObject = DriverObject;
+    GlobalData.ClientImagePath.Buffer = GlobalData.ClientImagePathBuffer;
+    GlobalData.ClientImagePath.MaximumLength = sizeof(GlobalData.ClientImagePathBuffer);
     KeInitializeSpinLock(&GlobalData.PortMutex);
     KeInitializeSpinLock(&GlobalData.TrackerMutex);
     KeInitializeSpinLock(&GlobalData.PidLock);
@@ -567,6 +661,9 @@ extern "C" NTSTATUS DriverEntry(
     Status = LoadRulesFromDisk(RegistryPath);
     if (!NT_SUCCESS(Status)) goto Failure;
 
+    Status = LoadClientIdentityFromRegistry(RegistryPath);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
     Status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
     if (!NT_SUCCESS(Status)) goto Failure;
 

Plugins/Rules/Rules_Driver_P1.json

@@ -1,16 +1,29 @@
 {
     "DynamicRules": [
         {
-            "Name": "Process_Protect_Antivirus_Command",
+            "Name": "Self_Antivirus_Protect_Command",
             "Code": 1001,
             "Kill": false,
             "Category": "Process",
             "Initiator": [
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
                 "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wsl.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\bash.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\regsvr32.exe",
             ],
             "InitiatorExclude": [
                 "*\\PYAS.exe",
@@ -18,6 +31,14 @@
             "CommandLine": [
                 "*taskkill*PYAS.exe*",
                 "*taskkill*msedgewebview2.exe*",
+                "*Stop-Process*PYAS*",
+                "*Stop-Process*msedgewebview2*",
+                "*Get-Process*PYAS*Stop-Process*",
+                "*Get-Process*msedgewebview2*Stop-Process*",
+                "*wmic*PYAS.exe*call terminate*",
+                "*wmic*PYAS.exe*delete*",
+                "*wmic*msedgewebview2.exe*call terminate*",
+                "*wmic*msedgewebview2.exe*delete*",
             ],
             "Operations": [
                 "Execute",
@@ -28,27 +49,30 @@
                 "*\\powershell.exe",
                 "*\\pwsh.exe",
                 "*\\wmic.exe",
-                "*\\net.exe",
-                "*\\net1.exe",
             ],
             "Priority": 110,
             "FileOpenNameAvailable": true,
             "SubsystemProcess": false,
         },
         {
-            "Name": "Process_Protect_PYAS_Handle",
+            "Name": "Self_Antivirus_Protect_Handle",
             "Code": 1002,
             "Kill": false,
             "Category": "Process",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
+                "*\\PYAS_Setup.exe",
+                "*\\unins000.exe",
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
             ],
             "Target": [
                 "*\\PYAS.exe",
@@ -81,7 +105,244 @@
             ]
         },
         {
-            "Name": "File_Protect_Antivirus",
+            "Name": "Attack_Command_Block_EFI_Mount",
+            "Code": 1003,
+            "Kill": false,
+            "Category": "Process",
+            "Target": [
+                "*\\mountvol.exe",
+            ],
+            "CommandLine": [
+                "*mountvol* /S*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 170,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Attack_Command_Block_Destructive_Cmd_Delete",
+            "Code": 1004,
+            "Kill": true,
+            "Category": "Process",
+            "Target": [
+                "*\\cmd.exe",
+            ],
+            "CommandLine": [
+                "*rd /s /q C:\\*",
+                "*rmdir /s /q C:\\*",
+                "*del X:\\* /s /f /q*",
+                "*rd /s /q X:\\EFI*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 190,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Attack_Command_Block_Forced_OOBE_Sysprep",
+            "Code": 1005,
+            "Kill": false,
+            "Category": "Process",
+            "Target": [
+                "*\\sysprep.exe",
+            ],
+            "CommandLine": [
+                "*sysprep* /oobe*",
+                "*sysprep*/oobe*",
+                "* /oobe* /reboot*",
+                "* /generalize* /oobe*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 185,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Process_Protect_UserWritable_SystemName_Dll_Load",
+            "Code": 1006,
+            "Kill": false,
+            "Category": "Process",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\dllhost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\msiexec.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\spoolsv.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\regsvr32.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\*.dll",
+            ],
+            "Operations": [
+                "ImageLoad",
+            ],
+            "Priority": 160,
+        },
+        {
+            "Name": "Memory_Protect_Critical_Process_CreateRemoteThread",
+            "Code": 1007,
+            "Kill": false,
+            "Category": "Memory",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
+            ],
+            "Operations": [
+                "WriteMemory",
+                "VmOperation",
+                "CreateThread",
+            ],
+            "OperationMatch": "All",
+            "MinimumRiskScore": 90,
+            "HandleTypes": [
+                "Create",
+                "Duplicate",
+            ],
+            "ObjectTypes": [
+                "Process",
+            ],
+            "Priority": 175,
+        },
+        {
+            "Name": "Memory_Protect_Critical_Process_ThreadHijack",
+            "Code": 1008,
+            "Kill": false,
+            "Category": "Memory",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
+            ],
+            "Operations": [
+                "WriteMemory",
+                "VmOperation",
+                "SetThreadContext",
+            ],
+            "OperationMatch": "All",
+            "MinimumRiskScore": 90,
+            "HandleTypes": [
+                "Create",
+                "Duplicate",
+            ],
+            "ObjectTypes": [
+                "Process",
+            ],
+            "Priority": 175,
+        },
+        {
+            "Name": "Memory_Protect_Service_Process_CreateRemoteThread",
+            "Code": 1009,
+            "Kill": false,
+            "Category": "Memory",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
+            ],
+            "Operations": [
+                "WriteMemory",
+                "VmOperation",
+                "CreateThread",
+            ],
+            "OperationMatch": "All",
+            "MinimumRiskScore": 90,
+            "HandleTypes": [
+                "Create",
+                "Duplicate",
+            ],
+            "ObjectTypes": [
+                "Process",
+            ],
+            "Priority": 170,
+        },
+        {
+            "Name": "Memory_Protect_Service_Process_ThreadHijack",
+            "Code": 1010,
+            "Kill": false,
+            "Category": "Memory",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
+            ],
+            "Operations": [
+                "WriteMemory",
+                "VmOperation",
+                "SetThreadContext",
+            ],
+            "OperationMatch": "All",
+            "MinimumRiskScore": 90,
+            "HandleTypes": [
+                "Create",
+                "Duplicate",
+            ],
+            "ObjectTypes": [
+                "Process",
+            ],
+            "Priority": 170,
+        },
+        {
+            "Name": "Self_Antivirus_Protect_File",
             "Code": 2001,
             "Kill": false,
             "Category": "File",
@@ -90,8 +351,10 @@
                 "*\\PYAS_Setup.exe",
                 "*\\unins000.exe",
                 "*\\notepad*.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
             ],
             "Target": [
                 "*\\PYAS.exe",
@@ -109,7 +372,7 @@
                 "*\\Interface\\static\\img\\*.ico",
                 "*\\Interface\\static\\js\\*.js",
                 "*\\Interface\\templates\\*.html",
-                "*\\Plugins\\Filter\\PYAS_Driver.sys",
+                "*\\Plugins\\Filter\\*.sys",
                 "*\\Plugins\\Rules\\*.json",
             ],
             "Operations": [
@@ -118,7 +381,7 @@
             ]
         },
         {
-            "Name": "File_Protect_System",
+            "Name": "System_Boot_Protect_File",
             "Code": 2002,
             "Kill": true,
             "Category": "File",
@@ -132,6 +395,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
+                "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
             ],
             "Target": [
                 "\\Device\\HarddiskVolume*\\bootmgr",
@@ -147,9 +411,9 @@
             ]
         },
         {
-            "Name": "File_Protect_System_Exploit",
+            "Name": "Illegal_Characters_Protect_File",
             "Code": 2003,
-            "Kill": true,
+            "Kill": false,
             "Category": "File",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
@@ -179,17 +443,23 @@
             ]
         },
         {
-            "Name": "File_Protect_System_Ransom",
+            "Name": "System_Ransom_Protect_File",
             "Code": 2004,
             "Kill": true,
             "Category": "File",
             "Initiator": [
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
                 "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
             ],
             "Target": [
                 "\\Device\\HarddiskVolume*\\Windows\\*",
@@ -210,7 +480,7 @@
             "TimeWindow": 3000,
         },
         {
-            "Name": "File_Protect_Ransom",
+            "Name": "User_Ransom_Protect_File",
             "Code": 2005,
             "Kill": true,
             "Category": "File",
@@ -249,6 +519,7 @@
                 "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
                 "*\\bin\\*\\codex.exe",
                 "*\\bin\\codex.exe",
+                "*\\Weixin\\Weixin.exe",
             ],
             "Target": [
                 "\\Device\\HarddiskVolume*\\Users\\*",
@@ -265,6 +536,14 @@
                 "\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
                 "\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
                 "\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.cache\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.aws\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.codex\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.designer\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.idlerc\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.keras\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.matplotlib\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.ssh\\*",
                 "*\\ventoy\\Boot\\*",
                 "*\\AdminRegionConfig.*",
                 "*\\nt_qq\\nt_*\\*",
@@ -300,11 +579,6 @@
                 ".mov",
                 ".wmv",
                 ".mkv",
-                ".apk",
-                ".jar",
-                ".class",
-                ".db",
-                ".sqlite",
             ],
             "Operations": [
                 "Write",
@@ -315,7 +589,7 @@
             "TimeWindow": 3000,
         },
         {
-            "Name": "Device_Protect_Disk_Wiper",
+            "Name": "System_Boot_Protect_Disk_Wiper",
             "Code": 2006,
             "Kill": false,
             "Category": "Device",
@@ -334,9 +608,9 @@
             ]
         },
         {
-            "Name": "Registry_Protect_System",
+            "Name": "Registry_Protect_System_Suspicious",
             "Code": 3001,
-            "Kill": true,
+            "Kill": false,
             "Category": "Registry",
             "InitiatorExclude": [
                 "\\Device\\HarddiskVolume*\\Windows\\*",
@@ -344,55 +618,112 @@
                 "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
                 "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
                 "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Google\\Chrome\\Application\\chrome.exe",
-                "*\\Microsoft\\Edge\\Application\\msedge.exe",
-                "*\\Mozilla Firefox\\firefox.exe",
-                "*\\Thorium\\Application\\thorium.exe",
-                "*\\Sources\\SetupHost.exe",
-                "*\\Work\\*\\DismHost.exe",
-                "*\\Steam\\steam.exe",
-                "*\\steam\\*\\steam.exe",
-                "*\\Steam\\steamapps\\common\\*",
-                "*\\Battle.net\\*\\Battle.net.exe",
-                "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
-                "*\\PC4399_WPFLauncher.exe",
-                "*\\Neverness To Everness\\NTELauncher.exe",
-                "*\\ThunderEv.exe",
-                "*\\ThunderStart.exe",
-                "*\\bin\\APlayer.exe",
-                "*\\bilibili\\bilibili.exe",
-                "*\\KuGou.exe",
-                "*\\XLGame.exe",
-                "*\\XLLiveUD.exe",
                 "*\\hrkill-*.exe",
                 "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
                 "*\\360Safe.exe",
                 "*\\PYAS.exe",
-                "*\\WPS Office\\ksolaunch.exe",
-                "*\\WPS Office\\*\\wps.exe",
-                "*\\WPS Office\\*\\*.exe",
-                "*\\Application\\AndrowsLauncher.exe",
-                "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
-                "*\\bin\\*\\codex.exe",
-                "*\\bin\\codex.exe",
             ],
             "Target": [
-                "\\REGISTRY\\MACHINE\\BCD00000000",
-                "\\REGISTRY\\MACHINE\\BCD00000000\\*",
-                "*\\Classes\\.exe",
-                "*\\Classes\\.bat",
-                "*\\Classes\\.cmd",
-                "*\\Classes\\.com",
-                "*\\Classes\\exefile\\*",
-                "*\\Classes\\batfile\\*",
-                "*\\Classes\\cmdfile\\*",
-                "*\\Classes\\comfile\\*",
                 "*\\mouclass",
                 "*\\kbdclass",
                 "*\\DisableAntiSpyware",
                 "*\\DisableWindowsUpdateAccess",
+                "*\\NoWindowsUpdate",
+                "*\\AutoAdminLogon",
+                "*\\DefaultUserName",
+                "*\\DefaultPassword",
+                "*\\AltDefaultUserName",
+                "*\\AltDefaultPassword",
+                "*\\LegalNoticeCaption",
+                "*\\LegalNoticeText",
+                "*\\AutoReboot",
+                "*\\DisableAutomaticRestartOnFailure",
+                "*\\SystemBiosVersion",
+                "*\\ClearRecentDocsOnExit",
+                "*\\HideClock",
+                "*\\HideFastUserSwitching",
+                "*\\ShutdownWithoutLogon",
+                "*\\DisableCAD",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 130,
+        },
+        {
+            "Name": "Registry_Protect_Open_With_Suspicious",
+            "Code": 3002,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\Classes\\.exe",
+                "*\\Classes\\.com",
+                "*\\Classes\\.bat",
+                "*\\Classes\\.cmd",
+                "*\\Classes\\exefile\\*",
+                "*\\Classes\\comfile\\*",
+                "*\\Classes\\batfile\\*",
+                "*\\Classes\\cmdfile\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 150,
+        },
+        {
+            "Name": "Registry_Protect_BCD_Suspicious",
+            "Code": 3003,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\BCD00000000",
+                "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 140,
+        },
+        {
+            "Name": "Registry_Protect_System_Critical",
+            "Code": 3004,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
                 "*\\EnableLUA",
                 "*\\ConsentPromptBehaviorAdmin",
+                "*\\ConsentPromptBehaviorUser",
+                "*\\EnableSecureUIAPaths",
+                "*\\BootExecute",
+                "*\\SubSystems",
+                "*\\FirmwareBootDevice",
+                "*\\BootDriverFlags",
+                "*\\SystemStartOptions",
+                "*\\Userinit",
+                "*\\UIHost",
+                "*\\Debugger",
                 "*\\NoControlPanel",
                 "*\\NoDrives",
                 "*\\NoFileMenu",
@@ -407,7 +738,6 @@
                 "*\\NoFolderOptions",
                 "*\\RestrictRun",
                 "*\\NoViewContextMenu",
-                "*\\HideClock",
                 "*\\NoStartMenuMyGames",
                 "*\\NoStartMenuMyMusic",
                 "*\\DisableCMD",
@@ -426,7 +756,6 @@
                 "*\\NoActiveDesktop",
                 "*\\NoSetActiveDesktop",
                 "*\\NoRecentDocsMenu",
-                "*\\NoWindowsUpdate",
                 "*\\NoChangeStartMenu",
                 "*\\NoFavoritesMenu",
                 "*\\NoRecentDocsHistory",
@@ -436,44 +765,109 @@
                 "*\\NoManageMyComputerVerb",
                 "*\\NoRealMode",
                 "*\\NoRun",
-                "*\\ClearRecentDocsOnExit",
                 "*\\NoActiveDesktopChanges",
                 "*\\NoStartMenuNetworkPlaces",
                 "*\\NoLockScreen",
-                "*\\HideFastUserSwitching",
-                "*\\ConsentPromptBehaviorUser",
-                "*\\EnableSecureUIAPaths",
                 "*\\NoSRM",
                 "*\\NoInteractiveServices",
-                "*\\ShutdownWithoutLogon",
-                "*\\AutoAdminLogon",
-                "*\\BootExecute",
-                "*\\SubSystems",
-                "*\\FirmwareBootDevice",
-                "*\\BootDriverFlags",
-                "*\\SystemStartOptions",
-                "*\\DisableAutomaticRestartOnFailure",
-                "*\\SystemBiosVersion",
                 "*\\NoTheme",
-                "*\\SystemSetupInProgress",
-                "*\\SetupType",
-                "*\\AutoReboot",
-                "*\\Userinit",
-                "*\\UIHost",
-                "*\\Debugger",
-                "*\\DefaultUserName",
-                "*\\DefaultPassword",
-                "*\\AltDefaultUserName",
-                "*\\AltDefaultPassword",
-                "*\\DisableCAD",
-                "*\\LegalNoticeCaption",
-                "*\\LegalNoticeText",
             ],
             "Operations": [
                 "Write",
                 "Delete",
                 "Create",
-            ]
-        }
+            ],
+            "Priority": 180,
+        },
+        {
+            "Name": "Registry_Protect_SafeMode_Autostart",
+            "Code": 3005,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Minimal\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Network\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 170,
+        },
+        {
+            "Name": "Registry_Protect_Pending_File_Rename",
+            "Code": 3006,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations2",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 140,
+        },
+        {
+            "Name": "Registry_Protect_OOBE_Reset",
+            "Code": 3007,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Windows\\System32\\Sysprep\\sysprep.exe",
+                "*\\Windows\\System32\\oobe\\*",
+                "*\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupType",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\CmdLine",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\AuditInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\MiniSetupInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupPhase",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\SysprepStatus\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\ChildCompletion\\*",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE\\*",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 175,
+        },
     ]
 }