Add files via upload

Updated the language in the Driver Signature section for clarity.

Engine/Properties/train_server.py

@@ -58,15 +58,14 @@ def analyze_schema(jsonl_path):
         for line in f:
             num_lines += 1
 
-            if not base_keys:
-                try:
-                    data = JSON_LOADS(line)
-                    base_data = data.get('Base')
-                    if base_data:
-                        base_keys.update(base_data.keys())
+            try:
+                data = JSON_LOADS(line)
+                base_data = data.get('Base')
+                if base_data:
+                    base_keys.update(base_data.keys())
 
-                except Exception:
-                    pass
+            except Exception:
+                pass
 
     base_schema = sorted([k for k in base_keys if k.lower().strip() not in EXCLUDE_FEATURES])
     dll_schema = [f"DllHash_{i:03d}" for i in range(DLL_HASH_DIM)]

Engine/Properties/train_user.py

@@ -58,15 +58,14 @@ def analyze_schema(jsonl_path):
         for line in f:
             num_lines += 1
 
-            if not base_keys:
-                try:
-                    data = JSON_LOADS(line)
-                    base_data = data.get('Base')
-                    if base_data:
-                        base_keys.update(base_data.keys())
+            try:
+                data = JSON_LOADS(line)
+                base_data = data.get('Base')
+                if base_data:
+                    base_keys.update(base_data.keys())
 
-                except Exception:
-                    pass
+            except Exception:
+                pass
 
     base_schema = sorted([k for k in base_keys if k.lower().strip() not in EXCLUDE_FEATURES])
     dll_schema = [f"DllHash_{i:03d}" for i in range(DLL_HASH_DIM)]

Interface/static/css/style.css

@@ -1,4 +1,4 @@
-* {
+* {
     box-sizing: border-box;
     margin: 0;
     padding: 0;
@@ -14,6 +14,7 @@
     --bg-hover: rgba(0, 0, 0, 0.05);
     --text-primary: rgb(29, 29, 31);
     --text-secondary: rgb(134, 134, 139);
+    --text-on-accent: rgb(255, 255, 255);
     --border-color: rgb(210, 210, 215);
     --accent-color: rgb(0, 122, 255);
     --accent-alpha: rgba(0, 122, 255, 0.1);
@@ -82,7 +83,7 @@ body {
 }
 
 .ctrl-btn:hover { background-color: var(--bg-hover); color: var(--text-primary); }
-#close_button:hover { background-color: #ff3b30; color: white; }
+#close_button:hover { background-color: #ff3b30; color: var(--text-on-accent); }
 
 .theme-svg {
     width: 16px;
@@ -258,7 +259,7 @@ body {
 
 .primary-btn {
     background-color: var(--accent-color);
-    color: white;
+    color: var(--text-on-accent);
     border: none;
     box-shadow: 0 2px 4px var(--accent-shadow);
 }
@@ -648,9 +649,38 @@ select.hidden + .custom-select-wrapper {
     transition: opacity 0.4s ease, visibility 0.4s ease;
 }
 
-#loading_overlay.fade-out {
-    opacity: 0;
-    visibility: hidden;
+#loading_overlay.fade-out {
+    opacity: 0;
+    visibility: hidden;
+}
+
+#loading_overlay.startup-error {
+    padding: 28px;
+    background-color: #f5f5f7;
+    color: #1d1d1f;
+}
+
+.startup-error-box {
+    max-width: 520px;
+    padding: 24px;
+    border: 1px solid rgba(0, 0, 0, 0.12);
+    border-radius: 8px;
+    background: #ffffff;
+    box-shadow: 0 16px 40px rgba(0, 0, 0, 0.12);
+}
+
+.startup-error-box h1 {
+    margin: 0 0 10px;
+    font-size: 18px;
+    font-weight: 700;
+}
+
+.startup-error-box p {
+    margin: 0;
+    font-size: 13px;
+    line-height: 1.6;
+    color: #515154;
+    word-break: break-word;
 }
 
 .spinner {

Interface/templates/index.html

@@ -6,7 +6,18 @@
     <title>PYAS Security</title>
     <link rel="stylesheet" href="/static/css/style.css">
     <script defer src="/static/js/i18n.js"></script>
-    <script defer src="/static/js/main.js"></script>
+    <script defer src="/static/js/main.js"></script>
+    <script>
+        window.addEventListener('DOMContentLoaded', function () {
+            window.setTimeout(function () {
+                var overlay = document.getElementById('loading_overlay');
+                if (overlay && !overlay.classList.contains('fade-out') && !overlay.classList.contains('startup-error')) {
+                    overlay.classList.add('startup-error');
+                    overlay.innerHTML = '<div class="startup-error-box"><h1>PYAS failed to open</h1><p>WebView2 initialization timed out. PYAS will retry automatically.</p></div>';
+                }
+            }, 20000);
+        });
+    </script>
 </head>
 <body>
     <div id="loading_overlay">
@@ -309,7 +320,7 @@
                         <div class="license-widget">
                             <textarea class="license-text" readonly>87owo Publicly Available Source Code License Agreement
 
-Last Updated: 2026-06-09
+Last Updated: 2026-07-18
 IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
 1. Definitions and Interpretation
@@ -361,6 +372,7 @@ IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE L
    - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
    - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
    - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+   - 7.6. Driver Signature: Certain kernel-mode drivers distributed with this software may be digitally signed using code signing methods that are not certified by Microsoft Windows Hardware Quality Labs (WHQL). By installing or using this software, you acknowledge this and decide for yourself whether to install and trust such drivers on your system.
 
 8. Warranty Disclaimer and Limitation of Liability
 

LICENSE.txt

@@ -1,6 +1,6 @@
 87owo Publicly Available Source Code License Agreement
 
-Last Updated: 2026-06-09
+Last Updated: 2026-07-18
 IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE LICENSE APPROVED BY THE OPEN SOURCE INITIATIVE (OSI). BY DOWNLOADING, ACCESSING, OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THESE TERMS.
 
 1. Definitions and Interpretation
@@ -52,6 +52,7 @@ IMPORTANT NOTICE: THIS LICENSE IS "SOURCE AVAILABLE" AND IS NOT AN OPEN SOURCE L
    - 7.3. Scope of Collected Extensions: Sample collection targets potential executable and system binary formats, which explicitly include, but are not limited to, files with the following extensions: `.exe`, `.dll`, `.sys`, `.ocx`, `.scr`, `.efi`, `.acm`, `.ax`, `.cpl`, `.drv`, `.com`, `.mui`, `.pyd`, `.wfx`, `.api`, `.awx`, `.rll`, and `.winmd`.
    - 7.4. Public Disclosure of Threat Intelligence: You explicitly acknowledge and agree that the metadata, behavioral reports, and threat intelligence data generated from the cloud analysis of submitted samples may be publicly disclosed, published, or shared with the cybersecurity community for collaborative defense purposes.
    - 7.5. Opt-Out Mechanism: Cloud-based telemetry and sample submission are fully optional. Users who do not wish to participate in sample collection or cloud-assisted analysis may disable the corresponding cloud services at any time via the toggle switches provided within the Software’s settings interface.
+   - 7.6. Driver Signature: Certain kernel-mode drivers distributed with this software may be digitally signed using code signing methods that are not certified by Microsoft Windows Hardware Quality Labs (WHQL). By installing or using this software, you acknowledge this and decide for yourself whether to install and trust such drivers on your system.
 
 8. Warranty Disclaimer and Limitation of Liability
 

PYAS_Inno.iss

@@ -1,6 +1,6 @@
 #define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
 #define AppName "PYAS"
-#define AppVersion "3.6.2.0"
+#define AppVersion "3.6.5.0"
 #define AppPublisher "PYAS Security"
 #define AppURL "https://github.com/87owo/PYAS"
 #define AppExeName "PYAS.exe"
@@ -55,13 +55,15 @@ Name: "slovenian"; MessagesFile: "SetupResources\Slovenian.isl"
 [Tasks]
 Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"
 Name: "autostart"; Description: "{cm:AutoStartTask}"; GroupDescription: "{cm:AdditionalIcons}"
-Name: "install_webview2"; Description: "{cm:InstallWebView2}"; GroupDescription: "{cm:Dependencies}"
-Name: "install_vcredist"; Description: "{cm:InstallVCRedist}"; GroupDescription: "{cm:Dependencies}"
 
 [Files]
-Source: "Payload\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "Redist\VC_redist.x64.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
-Source: "Redist\MicrosoftEdgeWebview2Setup.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion
+Source: "Redist\VC_redist.x64.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion; AfterInstall: EnsureVCRedist
+Source: "Redist\MicrosoftEdgeWebview2Setup.exe"; DestDir: "{tmp}\PYAS_Redist"; Flags: deleteafterinstall ignoreversion; AfterInstall: EnsureWebView2
+Source: "Payload\Engine\*"; DestDir: "{app}\Engine"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Payload\Interface\*"; DestDir: "{app}\Interface"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Payload\License\*"; DestDir: "{app}\License"; Flags: ignoreversion recursesubdirs createallsubdirs
+Source: "Payload\PYAS.exe"; DestDir: "{app}"; Flags: ignoreversion; AfterInstall: FinalizeDriverRemoval
+Source: "Payload\Plugins\*"; DestDir: "{app}\Plugins"; Flags: ignoreversion recursesubdirs createallsubdirs
 
 [Registry]
 Root: HKCU; Subkey: "Software\Classes\*\shell\PYAS_Scan"; Flags: uninsdeletekey dontcreatekey
@@ -76,9 +78,7 @@ Name: "{group}\{#AppName}"; Filename: "{app}\{#AppExeName}"
 Name: "{group}\Uninstall {#AppName}"; Filename: "{uninstallexe}"
 
 [Run]
-Filename: "{tmp}\PYAS_Redist\VC_redist.x64.exe"; Parameters: "/quiet /norestart"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingVCRuntime}"; Tasks: install_vcredist
-Filename: "{tmp}\PYAS_Redist\MicrosoftEdgeWebview2Setup.exe"; Parameters: "/silent /install"; Flags: waituntilterminated runhidden; StatusMsg: "{cm:InstallingWebView2Runtime}"; Tasks: install_webview2
-Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#StringChange(AppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent runascurrentuser
+Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#StringChange(AppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent runascurrentuser; Check: CanLaunchApp
 
 [CustomMessages]
 english.InstallingVCRuntime=Installing Microsoft Visual C++ Runtime...
@@ -100,97 +100,183 @@ english.InstallVCRedist=Install Microsoft Visual C++ Runtime
 chinesesimplified.InstallVCRedist=安装 Microsoft Visual C++ 运行库
 chinesetraditional.InstallVCRedist=安裝 Microsoft Visual C++ 執行庫
 english.LegacyVersionDetected=An older version of PYAS was detected. Please uninstall it manually before installing.
+english.QuitFailed=PYAS or its driver could not be stopped safely. Restart Windows and run Setup again.
+english.DependencyInstallFailed=Required Microsoft runtime installation failed. Setup cannot continue.
 chinesesimplified.LegacyVersionDetected=检测到存在旧版 PYAS。请先手动卸载旧版后，再运行本安装程序。
 chinesetraditional.LegacyVersionDetected=檢測到存在舊版 PYAS。請先手動卸載舊版後，再執行本安裝程式。
 
-[Code]
-var
-  TasksInitialized: Boolean;
-
-function IsWebView2Installed: Boolean;
-var
-  RegKeyPath: string;
-  Version: string;
-begin
-  RegKeyPath := 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';
-  Result := False;
-  if RegQueryStringValue(HKLM, 'SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
-    if Length(Version) > 0 then Result := True;
-  if not Result and RegQueryStringValue(HKCU, RegKeyPath, 'pv', Version) then
-    if Length(Version) > 0 then Result := True;
-  if not Result and RegQueryStringValue(HKLM, RegKeyPath, 'pv', Version) then
-    if Length(Version) > 0 then Result := True;
-end;
-
-function IsVCRedistInstalled: Boolean;
-var
-  Bld: Cardinal;
-begin
-  Result := False;
-  if RegQueryDWordValue(HKLM, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Bld', Bld) then
-    if Bld > 0 then Result := True;
-end;
-
-procedure CurPageChanged(CurPageID: Integer);
-var
-  I: Integer;
-  ItemText: string;
-begin
-  if (CurPageID = wpSelectTasks) and not TasksInitialized then
-  begin
-    TasksInitialized := True;
-    for I := 0 to WizardForm.TasksList.Items.Count - 1 do
-    begin
-      ItemText := WizardForm.TasksList.Items[I];
-      if Pos('Visual C++', ItemText) > 0 then
-        WizardForm.TasksList.Checked[I] := not IsVCRedistInstalled
-      else if Pos('WebView2', ItemText) > 0 then
-        WizardForm.TasksList.Checked[I] := not IsWebView2Installed;
-    end;
-  end;
-end;
-
-procedure QuitOldInstance(InstallPath: string);
-var
-  ResultCode: Integer;
-  ExePath: string;
-begin
-  ExePath := InstallPath + '\{#AppExeName}';
-  if FileExists(ExePath) then
-  begin
-    Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-    Sleep(500);
-    Exec(ExpandConstant('{sys}\taskkill.exe'), '/F /IM {#AppExeName} /T', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-  end;
-end;
-
-function InitializeSetup(): Boolean;
-var
-  OldInstallPath: string;
-  LegacyPath: string;
-begin
-  LegacyPath := ExpandConstant('{pf32}\{#AppName}');
-  if DirExists(LegacyPath) and FileExists(LegacyPath + '\{#AppExeName}') then
-  begin
-    MsgBox(CustomMessage('LegacyVersionDetected'), mbCriticalError, MB_OK);
-    Result := False;
-    Exit;
-  end;
-  if RegQueryStringValue(HKLM, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) or
-     RegQueryStringValue(HKCU, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) then
-  begin
-    QuitOldInstance(OldInstallPath);
-  end;
-  
-  Result := True;
-end;
-
-function InitializeUninstall(): Boolean;
-begin
-  QuitOldInstance(ExpandConstant('{app}'));
-  Result := True;
-end;
-
+[Code]
+var
+  DependencyRestartRequired: Boolean;
+  DependenciesReady: Boolean;
+
+function FindWindow(lpClassName: LongWord; lpWindowName: string): HWND;
+  external '[email protected] stdcall';
+
+function GetTickCount: Cardinal;
+  external '[email protected] stdcall';
+
+function IsValidRuntimeVersion(Version: string): Boolean;
+begin
+  Result := (Length(Trim(Version)) > 0) and (Trim(Version) <> '0.0.0.0');
+end;
+
+function IsWebView2Installed: Boolean;
+var
+  Version: string;
+begin
+  Result := False;
+  if RegQueryStringValue(HKLM, 'SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    Result := IsValidRuntimeVersion(Version);
+  if not Result and RegQueryStringValue(HKLM, 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    Result := IsValidRuntimeVersion(Version);
+  if not Result and RegQueryStringValue(HKCU, 'SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'pv', Version) then
+    Result := IsValidRuntimeVersion(Version);
+end;
+
+function IsVCRedistInstalled: Boolean;
+var
+  Installed: Cardinal;
+  Version: string;
+begin
+  Result := False;
+  if RegQueryDWordValue(HKLM64, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Installed', Installed) and (Installed = 1) then
+  begin
+    if RegQueryStringValue(HKLM64, 'SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64', 'Version', Version) then
+      Result := IsValidRuntimeVersion(Version)
+    else
+      Result := True;
+  end;
+end;
+
+function DependencyExitCodeSucceeded(ResultCode: Integer): Boolean;
+begin
+  Result := (ResultCode = 0) or (ResultCode = 1641) or (ResultCode = 3010);
+  if (ResultCode = 1641) or (ResultCode = 3010) then
+    DependencyRestartRequired := True;
+end;
+
+procedure EnsureVCRedist;
+var
+  ResultCode: Integer;
+  InstallerPath: string;
+begin
+  if IsVCRedistInstalled then Exit;
+  InstallerPath := ExpandConstant('{tmp}\PYAS_Redist\VC_redist.x64.exe');
+  WizardForm.StatusLabel.Caption := CustomMessage('InstallingVCRuntime');
+  if not Exec(InstallerPath, '/quiet /norestart', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) or
+     not DependencyExitCodeSucceeded(ResultCode) or not IsVCRedistInstalled then
+  begin
+    DependenciesReady := False;
+    RaiseException(CustomMessage('DependencyInstallFailed'));
+  end;
+end;
+
+procedure EnsureWebView2;
+var
+  ResultCode: Integer;
+  InstallerPath: string;
+begin
+  if IsWebView2Installed then Exit;
+  InstallerPath := ExpandConstant('{tmp}\PYAS_Redist\MicrosoftEdgeWebview2Setup.exe');
+  WizardForm.StatusLabel.Caption := CustomMessage('InstallingWebView2Runtime');
+  if not Exec(InstallerPath, '/silent /install', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) or
+     not DependencyExitCodeSucceeded(ResultCode) or not IsWebView2Installed then
+  begin
+    DependenciesReady := False;
+    RaiseException(CustomMessage('DependencyInstallFailed'));
+  end;
+end;
+
+function WaitForMainWindowToClose(TimeoutMs: Cardinal): Boolean;
+var
+  Deadline: Cardinal;
+begin
+  Deadline := GetTickCount + TimeoutMs;
+  repeat
+    if FindWindow(0, 'PYAS Security') = 0 then
+    begin
+      Result := True;
+      Exit;
+    end;
+    Sleep(100);
+  until GetTickCount >= Deadline;
+  Result := False;
+end;
+
+function QuitOldInstance(InstallPath: string): Boolean;
+var
+  ResultCode: Integer;
+  ExePath: string;
+begin
+  Result := True;
+  ExePath := InstallPath + '\{#AppExeName}';
+  if not FileExists(ExePath) then Exit;
+
+  if not Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) then
+  begin
+    Result := False;
+    Exit;
+  end;
+
+  Result := (ResultCode = 0) and WaitForMainWindowToClose(30000);
+end;
+
+procedure FinalizeDriverRemoval;
+var
+  ResultCode: Integer;
+  ExePath: string;
+begin
+  ExePath := ExpandConstant('{app}\{#AppExeName}');
+  if not Exec(ExePath, '-quit', '', SW_HIDE, ewWaitUntilTerminated, ResultCode) or (ResultCode <> 0) then
+    RaiseException(CustomMessage('QuitFailed'));
+end;
+
+function InitializeSetup(): Boolean;
+var
+  OldInstallPath: string;
+  LegacyPath: string;
+begin
+  DependencyRestartRequired := False;
+  DependenciesReady := True;
+  LegacyPath := ExpandConstant('{pf32}\{#AppName}');
+  if DirExists(LegacyPath) and FileExists(LegacyPath + '\{#AppExeName}') then
+  begin
+    MsgBox(CustomMessage('LegacyVersionDetected'), mbCriticalError, MB_OK);
+    Result := False;
+    Exit;
+  end;
+
+  if RegQueryStringValue(HKLM, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) or
+     RegQueryStringValue(HKCU, 'Software\Microsoft\Windows\CurrentVersion\Uninstall\' + ExpandConstant('{#AppId}') + '_is1', 'InstallLocation', OldInstallPath) then
+  begin
+    if not QuitOldInstance(OldInstallPath) then
+    begin
+      MsgBox(CustomMessage('QuitFailed'), mbCriticalError, MB_OK);
+      Result := False;
+      Exit;
+    end;
+  end;
+
+  Result := True;
+end;
+
+function InitializeUninstall(): Boolean;
+begin
+  Result := QuitOldInstance(ExpandConstant('{app}'));
+  if not Result then
+    MsgBox(CustomMessage('QuitFailed'), mbCriticalError, MB_OK);
+end;
+
+function CanLaunchApp: Boolean;
+begin
+  Result := DependenciesReady and not DependencyRestartRequired;
+end;
+
+function NeedRestart: Boolean;
+begin
+  Result := DependencyRestartRequired;
+end;
 procedure TryCreateStartupTask;
 var
   ResultCode: Integer;

PYAS_Protect.py

@@ -7,8 +7,35 @@ FLT_PORT_FLAG_SYNC_HANDLE = 0x00000001
 HRESULT_IO_PENDING = 0x800703E5
 ERROR_OPERATION_ABORTED = 995
 ERROR_NOT_FOUND = 1168
+ERROR_SHARING_VIOLATION = 32
+ERROR_LOCK_VIOLATION = 33
 WAIT_OBJECT_0 = 0
 WAIT_TIMEOUT = 258
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+GENERIC_READ = 0x80000000
+FILE_SHARE_READ = 0x00000001
+OPEN_EXISTING = 3
+FILE_ATTRIBUTE_NORMAL = 0x00000080
+FILE_SCAN_DEBOUNCE_SECONDS = 0.35
+FILE_SCAN_RETRY_SECONDS = 0.25
+FILE_LOCK_RETRY_SECONDS = 0.5
+PYAS_CONNECTION_MAGIC = 0x53415950
+PYAS_CONNECTION_VERSION = 1
+PROCESS_TERMINATE = 0x0001
+PROCESS_VM_READ = 0x0010
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_SUSPEND_RESUME = 0x0800
+PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+PYAS_PROCESS_SCAN_ACCESS = PROCESS_TERMINATE | PROCESS_VM_READ | PROCESS_QUERY_INFORMATION | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_LIMITED_INFORMATION
+PYAS_PROCESS_NETWORK_ACCESS = PROCESS_TERMINATE | PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION
+
+class PYAS_CONNECTION_CONTEXT(ctypes.Structure):
+    _fields_ = [
+        ("Size", ctypes.wintypes.ULONG),
+        ("Version", ctypes.wintypes.ULONG),
+        ("Magic", ctypes.wintypes.ULONG),
+        ("ProcessId", ctypes.wintypes.ULONG)
+    ]
 
 class OVERLAPPED(ctypes.Structure):
     _fields_ = [
@@ -77,75 +104,98 @@ class ProtectMixin:
 
 ####################################################################################################
 
-    def lock_file(self, target_path, lock, quiet=False):
+    def _try_lock_file(self, file_path):
+        fd = None
+        try:
+            fd = os.open(file_path, os.O_RDWR | os.O_BINARY)
+            try:
+                size = os.path.getsize(file_path)
+            except Exception:
+                size = 1
+
+            lock_size = size if size > 0 else 1
+            msvcrt.locking(fd, msvcrt.LK_NBRLCK, lock_size)
+            self.virus_lock[file_path] = (fd, lock_size)
+            return True, None
+        except Exception as e:
+            if fd is not None:
+                try:
+                    os.close(fd)
+                except Exception:
+                    pass
+            return False, e
+
+    def _queue_file_lock(self, file_path):
+        self._schedule_file_task("lock", file_path, self._retry_file_lock, FILE_LOCK_RETRY_SECONDS)
+
+    def _retry_file_lock(self, file_path):
+        if not os.path.isfile(file_path):
+            return
+
         with self.lock_file_ops:
-            if lock:
-                if not os.path.exists(target_path):
-                    return
+            if file_path in self.virus_lock:
+                return
+            success, _ = self._try_lock_file(file_path)
 
-                paths_to_lock = []
-                if os.path.isdir(target_path):
-                    for root, _, files in os.walk(target_path):
-                        for f in files:
-                            paths_to_lock.append(os.path.join(root, f))
-                else:
-                    paths_to_lock.append(target_path)
+        if not success:
+            self._queue_file_lock(file_path)
 
+    def lock_file(self, target_path, lock, quiet=False):
+        if lock:
+            if not os.path.exists(target_path):
+                return False
+
+            paths_to_lock = []
+            if os.path.isdir(target_path):
+                for root, _, files in os.walk(target_path):
+                    for file_name in files:
+                        paths_to_lock.append(os.path.join(root, file_name))
+            else:
+                paths_to_lock.append(target_path)
+
+            failed_locks = []
+            with self.lock_file_ops:
                 for file_path in paths_to_lock:
                     if file_path in self.virus_lock:
                         continue
 
-                    success = False
-                    last_error = None
-                    for _ in range(5):
-                        try:
-                            fd = os.open(file_path, os.O_RDWR | os.O_BINARY)
-                            try:
-                                try:
-                                    size = os.path.getsize(file_path)
-                                except Exception:
-                                    size = 1
+                    success, error = self._try_lock_file(file_path)
+                    if not success:
+                        failed_locks.append((file_path, error))
 
-                                lock_size = size if size > 0 else 1
-                                msvcrt.locking(fd, msvcrt.LK_NBRLCK, lock_size)
-                                self.virus_lock[file_path] = (fd, lock_size)
-                                success = True
-                                break
+            for file_path, error in failed_locks:
+                self._queue_file_lock(file_path)
+                if not quiet:
+                    self.write_log("INFO", "File Lock Deferred", source=file_path, detail=str(error))
 
-                            except Exception as e:
-                                os.close(fd)
-                                raise e
+            return not failed_locks
 
-                        except Exception as e:
-                            last_error = e
-                            time.sleep(0.1)
+        self._cancel_pending_file_tasks("lock", target_path)
+        with self.lock_file_ops:
+            target_norm = os.path.normcase(target_path)
+            target_dir = target_norm + os.sep
+            keys_to_unlock = []
 
-                    if not success and not quiet:
-                        self.write_log("WARN", "lock_file", source=file_path, detail=str(last_error), success=False)
-            else:
-                target_norm = os.path.normcase(target_path)
-                target_dir = target_norm + os.sep
-                keys_to_unlock = []
+            for locked_path in self.virus_lock:
+                locked_norm = os.path.normcase(locked_path)
+                if locked_norm == target_norm or locked_norm.startswith(target_dir):
+                    keys_to_unlock.append(locked_path)
 
-                for locked_path in self.virus_lock:
-                    locked_norm = os.path.normcase(locked_path)
-                    if locked_norm == target_norm or locked_norm.startswith(target_dir):
-                        keys_to_unlock.append(locked_path)
-
-                for file_path in keys_to_unlock:
-                    fd, lock_size = self.virus_lock[file_path]
+            for file_path in keys_to_unlock:
+                fd, lock_size = self.virus_lock[file_path]
+                try:
+                    msvcrt.locking(fd, msvcrt.LK_UNLCK, lock_size)
+                except Exception as e:
+                    if not quiet:
+                        self.write_log("WARN", "unlock_file", source=file_path, detail=str(e), success=False)
+                finally:
                     try:
-                        msvcrt.locking(fd, msvcrt.LK_UNLCK, lock_size)
-                    except Exception as e:
-                        if not quiet:
-                            self.write_log("WARN", "unlock_file", source=file_path, detail=str(e), success=False)
+                        os.close(fd)
+                    except Exception:
+                        pass
+                    del self.virus_lock[file_path]
 
-                    finally:
-                        try:
-                            os.close(fd)
-                        except Exception:
-                            pass
-                        del self.virus_lock[file_path]
+        return True
 
     def relock_file(self):
         while True:
@@ -448,7 +498,7 @@ class ProtectMixin:
                     self.exist_process = cur
 
                 for pid in new_pids:
-                    h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+                    h = self.kernel32.OpenProcess(PYAS_PROCESS_SCAN_ACCESS, False, pid)
                     if h:
                         with self.lock_config:
                             should_suspend = self.pyas_config.get("suspend_switch", True)
@@ -476,7 +526,7 @@ class ProtectMixin:
                 suspended = self.pyas_config.get("suspend_switch", True)
 
         if not h:
-            h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            h = self.kernel32.OpenProcess(PYAS_PROCESS_SCAN_ACCESS, False, pid)
             if not h:
                 return
 
@@ -578,7 +628,7 @@ class ProtectMixin:
                             raw_path = self.device_path_to_drive(raw_path)
 
                         file_path = self.norm_path(raw_path)
-                        if file_path and file_path not in scanned_paths:
+                        if file_path and file_path not in scanned_paths and self.path_system not in file_path:
 
                             scanned_paths.add(file_path)
                             file_path_lower = file_path.lower()
@@ -648,7 +698,7 @@ class ProtectMixin:
                                         suffix = self.pyas_config.get("suffix", [])
 
                                     if not ext_filter or os.path.splitext(file_path)[-1].lower() in suffix:
-                                        self.protect_pool.submit(self.handle_new_file, file_path)
+                                        self._queue_file_scan(file_path)
 
                         if notify.NextEntryOffset == 0:
                             break
@@ -666,33 +716,106 @@ class ProtectMixin:
                         pass
                     self.h_dir_file = None
 
+    def _cancel_pending_file_tasks(self, task_name=None, target_path=None):
+        target_norm = os.path.normcase(target_path) if target_path else None
+        target_dir = target_norm + os.sep if target_norm else None
+
+        with self.lock_file_ops:
+            task_keys = []
+            for task_key in self.file_task_timers:
+                name, path_key = task_key
+                if task_name and name != task_name:
+                    continue
+                if target_norm and path_key != target_norm and not path_key.startswith(target_dir):
+                    continue
+                task_keys.append(task_key)
+
+            timers = [self.file_task_timers.pop(task_key) for task_key in task_keys]
+            for task_key in task_keys:
+                self.file_task_generations.pop(task_key, None)
+
+        for timer in timers:
+            timer.cancel()
+
+    def _cancel_pending_file_scans(self):
+        self._cancel_pending_file_tasks("scan")
+
+    def _schedule_file_task(self, task_name, file_path, callback, delay):
+        task_key = (task_name, os.path.normcase(file_path))
+
+        with self.lock_file_ops:
+            previous_timer = self.file_task_timers.get(task_key)
+            if previous_timer:
+                previous_timer.cancel()
+
+            generation = self.file_task_generations.get(task_key, 0) + 1
+            timer = threading.Timer(delay, self._run_file_task, args=(task_key, file_path, generation, callback))
+            timer.daemon = True
+            self.file_task_timers[task_key] = timer
+            self.file_task_generations[task_key] = generation
+
+        timer.start()
+
+    def _run_file_task(self, task_key, file_path, generation, callback):
+        with self.lock_file_ops:
+            if self.file_task_generations.get(task_key) != generation:
+                return
+            if self.file_task_timers.get(task_key) is threading.current_thread():
+                self.file_task_timers.pop(task_key, None)
+
+        try:
+            callback(file_path)
+        finally:
+            with self.lock_file_ops:
+                if self.file_task_generations.get(task_key) == generation:
+                    self.file_task_timers.pop(task_key, None)
+                    self.file_task_generations.pop(task_key, None)
+
+    def _queue_file_scan(self, file_path, delay=FILE_SCAN_DEBOUNCE_SECONDS):
+        self._schedule_file_task("scan", file_path, self.handle_new_file, delay)
+
+    def _acquire_file_scan_gate(self, file_path):
+        ctypes.set_last_error(0)
+        handle = self.kernel32.CreateFileW(
+            file_path,
+            GENERIC_READ,
+            FILE_SHARE_READ,
+            None,
+            OPEN_EXISTING,
+            FILE_ATTRIBUTE_NORMAL,
+            None
+        )
+
+        if handle == INVALID_HANDLE_VALUE:
+            return None, ctypes.get_last_error()
+
+        return handle, 0
+
     def handle_new_file(self, file_path):
         try:
-            for _ in range(5):
-                try:
-                    fd = os.open(file_path, os.O_RDONLY | os.O_BINARY)
-                    os.close(fd)
+            with self.lock_config:
+                if not self.pyas_config.get("document_switch", False):
+                    return
 
-                    size = os.path.getsize(file_path)
-                    if size > 0:
-                        break
-
-                except Exception:
-                    pass
-                time.sleep(0.1)
-            else:
+            gate_handle, error = self._acquire_file_scan_gate(file_path)
+            if not gate_handle:
+                if error in (ERROR_SHARING_VIOLATION, ERROR_LOCK_VIOLATION):
+                    self._queue_file_scan(file_path, FILE_SCAN_RETRY_SECONDS)
                 return
 
-            with self.lock_file_ops:
-                if file_path in self.virus_lock: return
+            try:
+                with self.lock_file_ops:
+                    if file_path in self.virus_lock:
+                        return
 
-            result = self.safe_scan_engine(file_path)
-            self.cloud_check(file_path)
-
-            if result:
-                if self.manage_named_list("quarantine", [file_path], action="add", lock_func=self.lock_file) > 0:
-                    self.write_log("BLOCK", "File Block", source=file_path, file_hash=self.calc_file_hash(file_path))
+                result = self.safe_scan_engine(file_path)
+                self.cloud_check(file_path)
 
+                if result:
+                    if self.manage_named_list("quarantine", [file_path], action="add", lock_func=self.lock_file) > 0:
+                        self.write_log("BLOCK", "File Block", source=file_path, file_hash=self.calc_file_hash(file_path))
+            finally:
+                self.kernel32.CloseHandle(gate_handle)
         except Exception:
             pass
 
@@ -726,7 +849,7 @@ class ProtectMixin:
     def handle_new_connection(self, key):
         pid, remote_addr, remote_port = key
         try:
-            h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            h = self.kernel32.OpenProcess(PYAS_PROCESS_NETWORK_ACCESS, False, pid)
             if not h:
                 return
 
@@ -940,6 +1063,46 @@ class ProtectMixin:
                 self.advapi32.CloseServiceHandle(service)
             self.advapi32.CloseServiceHandle(scm)
 
+    def _get_driver_client_image_path(self):
+        buffer = ctypes.create_unicode_buffer(32768)
+        size = ctypes.wintypes.DWORD(len(buffer))
+        if not self.kernel32.QueryFullProcessImageNameW(
+            self.kernel32.GetCurrentProcess(),
+            0,
+            buffer,
+            ctypes.byref(size)
+        ):
+            return None
+
+        image_path = os.path.abspath(buffer.value)
+        drive, tail = os.path.splitdrive(image_path)
+        if not drive or not tail:
+            return None
+
+        device_buffer = ctypes.create_unicode_buffer(32768)
+        if not self.kernel32.QueryDosDeviceW(drive, device_buffer, len(device_buffer)):
+            return None
+
+        return device_buffer.value.rstrip("\\") + tail
+
+    def _configure_driver_identity(self):
+        image_path = self._get_driver_client_image_path()
+        if not image_path:
+            return False, ctypes.get_last_error() or 1
+
+        try:
+            access = winreg.KEY_SET_VALUE | getattr(winreg, "KEY_WOW64_64KEY", 0)
+            with winreg.CreateKeyEx(
+                winreg.HKEY_LOCAL_MACHINE,
+                r"SYSTEM\CurrentControlSet\Services\PYAS_Driver",
+                0,
+                access
+            ) as key:
+                winreg.SetValueEx(key, "ClientImagePath", 0, winreg.REG_SZ, image_path)
+            return True, 0
+        except OSError as e:
+            return False, int(getattr(e, "winerror", 0) or 1)
+
     def _ensure_driver_service(self):
         desired_service_access = 0x0002 | 0x0004 | 0x0010 | 0x00010000
         dependencies = ctypes.create_unicode_buffer("FltMgr\0\0")
@@ -1024,36 +1187,59 @@ class ProtectMixin:
                 self.advapi32.CloseServiceHandle(service)
             self.advapi32.CloseServiceHandle(scm)
 
-    def _delete_driver_service(self):
-        scm = self.advapi32.OpenSCManagerW(None, None, 0x0001)
-        if not scm:
-            return False, ctypes.get_last_error()
+    def uninstall_system_driver(self):
+        if not self.stop_system_driver():
+            return False, 1051
+        return self._delete_driver_service()
 
-        service = None
-        try:
-            service = self.advapi32.OpenServiceW(scm, "PYAS_Driver", 0x0004 | 0x00010000)
-            if not service:
-                error = ctypes.get_last_error()
-                return (True, 0) if error in (1060, 1072) else (False, error)
+    def _delete_driver_service(self, timeout=15.0):
+        deadline = time.monotonic() + timeout
+        last_error = 0
+        delete_requested = False
 
-            state, error = self._query_service_state_handle(service)
-            if error:
-                return False, error
-            if state in (2, 3, 4):
-                return False, 1051
+        while time.monotonic() < deadline:
+            scm = self.advapi32.OpenSCManagerW(None, None, 0x0001)
+            if not scm:
+                return False, ctypes.get_last_error()
 
-            ctypes.set_last_error(0)
-            if self.advapi32.DeleteService(service):
-                return True, 0
+            service = None
+            try:
+                ctypes.set_last_error(0)
+                service = self.advapi32.OpenServiceW(scm, "PYAS_Driver", 0x0004 | 0x00010000)
+                if not service:
+                    last_error = ctypes.get_last_error()
+                    if last_error == 1060:
+                        return True, 0
+                    if last_error != 1072:
+                        return False, last_error
+                else:
+                    state, status_error = self._query_service_state_handle(service)
+                    if status_error:
+                        return False, status_error
 
-            error = ctypes.get_last_error()
-            if error in (1060, 1072):
-                return True, 0
-            return False, error
-        finally:
-            if service:
-                self.advapi32.CloseServiceHandle(service)
-            self.advapi32.CloseServiceHandle(scm)
+                    if state not in (2, 3, 4) and not delete_requested:
+                        ctypes.set_last_error(0)
+                        if self.advapi32.DeleteService(service):
+                            delete_requested = True
+                            last_error = 1072
+                        else:
+                            last_error = ctypes.get_last_error()
+                            if last_error == 1060:
+                                return True, 0
+                            if last_error == 1072:
+                                delete_requested = True
+                            else:
+                                return False, last_error
+                    elif state in (2, 3, 4):
+                        last_error = 1051
+            finally:
+                if service:
+                    self.advapi32.CloseServiceHandle(service)
+                self.advapi32.CloseServiceHandle(scm)
+
+            time.sleep(0.1)
+
+        return False, last_error or 1072
 
     def install_system_driver(self):
         try:
@@ -1062,6 +1248,11 @@ class ProtectMixin:
                 self.write_log("WARN", "Driver Service", detail=f"CreateServiceW/ChangeServiceConfigW failed: 0x{service_error & 0xFFFFFFFF:08X}", success=False)
                 return False
 
+            configured, identity_error = self._configure_driver_identity()
+            if not configured:
+                self.write_log("WARN", "Driver Identity", detail=f"ClientImagePath configuration failed: 0x{identity_error & 0xFFFFFFFF:08X}", success=False)
+                return False
+
             self._reg_write(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\PYAS_Driver\Instances", "DefaultInstance", winreg.REG_SZ, "PYAS Instance")
             self._reg_write(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\PYAS_Driver\Instances\PYAS Instance", "Altitude", winreg.REG_SZ, "320000")
             self._reg_write(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\PYAS_Driver\Instances\PYAS Instance", "Flags", winreg.REG_DWORD, 0)
@@ -1120,12 +1311,18 @@ class ProtectMixin:
             return None
 
     def _connect_driver_port(self, asynchronous=False):
+        context = PYAS_CONNECTION_CONTEXT()
+        context.Size = ctypes.sizeof(context)
+        context.Version = PYAS_CONNECTION_VERSION
+        context.Magic = PYAS_CONNECTION_MAGIC
+        context.ProcessId = os.getpid()
+
         temp_port = ctypes.wintypes.HANDLE()
         status = self.fltlib.FilterConnectCommunicationPort(
             "\\PYAS_Output_Pipe",
             0 if asynchronous else FLT_PORT_FLAG_SYNC_HANDLE,
-            None,
-            0,
+            ctypes.byref(context),
+            ctypes.sizeof(context),
             None,
             ctypes.byref(temp_port)
         )
@@ -1526,8 +1723,12 @@ class ProtectMixin:
                     self._resume_driver_listener()
 
     def check_system_driver(self):
-        state = self._query_driver_service_state()
-        return state in (2, 3, 4)
+        runtime_state = self._query_driver_state()
+        if runtime_state in (1, 2, 3, 4):
+            return True
+
+        service_state = self._query_driver_service_state()
+        return service_state in (2, 3, 4)
 
     def clear_driver_rules(self):
         with self.lock_driver:

PYAS_Scanner.py

@@ -159,25 +159,92 @@ class ScannerMixin:
 
 ####################################################################################################
 
-    def start_scan(self, targets):
-        with self.lock_virus:
-            if getattr(self, 'scan_running', False):
-                return
+    def _scan_result_messages(self, count=None, scanned=None, elapsed=None):
+        if count is None or scanned is None or elapsed is None:
+            with self.lock_virus:
+                count = len(getattr(self, 'virus_results', [])) if count is None else count
+                scanned = getattr(self, 'scan_count', 0) if scanned is None else scanned
+                scan_start = getattr(self, 'scan_start', time.time())
+                elapsed = int(time.time() - scan_start) if elapsed is None else elapsed
 
+        return {
+            "traditional_switch": f"發現 {count} 個病毒，掃描 {scanned} 個檔案，耗時 {elapsed} 秒",
+            "simplified_switch": f"发现 {count} 个病毒，扫描 {scanned} 个文件，耗时 {elapsed} 秒",
+            "english_switch": f"Found {count} viruses, scanned {scanned} files, time {elapsed}s",
+            "japanese_switch": f"{count} 個のウイルスを発見し、{scanned} 個のファイルをスキャンしました（所要時間 {elapsed} 秒）",
+            "korean_switch": f"바이러스 {count}개 발견, 파일 {scanned}개 검사, 소요 시간 {elapsed}초",
+            "french_switch": f"{count} virus trouvés, {scanned} fichiers analysés, temps {elapsed}s",
+            "spanish_switch": f"Se encontraron {count} virus, {scanned} archivos escaneados, tiempo {elapsed}s",
+            "hindi_switch": f"{count} वायरस मिले, {scanned} फ़ाइलें स्कैन की गईं, समय {elapsed}s",
+            "arabic_switch": f"تم العثور على {count} فيروسات، تم فحص {scanned} ملفات، الوقت {elapsed} ثانية",
+            "russian_switch": f"Найдено {count} вирусов, проверено {scanned} файлов, время {elapsed}с",
+            "slovenian_switch": f"Najdenih {count} virusov, skeniranih {scanned} datotek, čas {elapsed}s"
+        }
+
+    def _is_scan_cancel_requested(self):
+        with self.lock_virus:
+            return getattr(self, 'scan_stop_requested', False)
+
+    def _finish_scan_cancelled(self, messages=None):
+        with self.lock_virus:
+            count = len(getattr(self, 'virus_results', []))
+            scanned = getattr(self, 'scan_count', 0)
+            scan_start = getattr(self, 'scan_start', time.time())
+            elapsed = int(time.time() - scan_start)
+            self.scan_running = False
+            self.scan_preparing = False
+            self.scan_finished = True
+            self.scan_stop_requested = False
+
+        messages = messages or self._scan_result_messages(count, scanned, elapsed)
+
+        if self._window:
+            js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
+            self.ui_queue.put(js_cmd)
+
+        return False
+
+    def _begin_scan_preparation(self):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False) or getattr(self, 'scan_preparing', False):
+                return False
+
+            self.scan_preparing = True
+            self.scan_stop_requested = False
+            self.scan_finished = False
+            self.virus_results = []
+            self.scan_count = 0
+            self.scan_start = time.time()
+            return True
+
+    def start_scan(self, targets, from_preparing=False):
+        with self.lock_virus:
+            if getattr(self, 'scan_running', False) or (getattr(self, 'scan_preparing', False) and not from_preparing):
+                return False
+
+            if getattr(self, 'scan_stop_requested', False):
+                self.scan_running = False
+                self.scan_preparing = False
+                self.scan_finished = True
+                return False
+
+            self.scan_preparing = False
             self.scan_running = True
             self.scan_finished = False
+            self.scan_stop_requested = False
             self.virus_results = []
             self.scan_count = 0
             self.scan_start = time.time()
 
         self.scan_pool.submit(self.scan_worker, targets)
+        return True
 
     def scan_worker(self, targets):
         last_update = 0.0
         try:
             for file_path, is_explicit in self.yield_files(targets):
                 with self.lock_virus:
-                    if not self.scan_running:
+                    if not self.scan_running or getattr(self, 'scan_stop_requested', False):
                         break
 
                 norm_path = self.norm_path(file_path)
@@ -203,6 +270,8 @@ class ScannerMixin:
                         continue
 
                     with self.lock_virus:
+                        if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                            break
                         self.scan_count += 1
 
                     with self.lock_config:
@@ -213,6 +282,10 @@ class ScannerMixin:
                         continue
 
                     result = self.safe_scan_engine(norm_path)
+                    with self.lock_virus:
+                        if not self.scan_running or getattr(self, 'scan_stop_requested', False):
+                            break
+
                     if result:
                         with self.lock_virus:
                             self.virus_results.append(norm_path)
@@ -233,116 +306,178 @@ class ScannerMixin:
 
         finally:
             with self.lock_virus:
+                cancelled = getattr(self, 'scan_stop_requested', False)
                 self.scan_running = False
+                self.scan_preparing = False
                 self.scan_finished = True
+                self.scan_stop_requested = False
                 count, scanned, elapsed = len(self.virus_results), self.scan_count, int(time.time() - self.scan_start)
 
-            messages = {
-                "traditional_switch": f"發現 {count} 個病毒，掃描 {scanned} 個檔案，耗時 {elapsed} 秒",
-                "simplified_switch": f"发现 {count} 个病毒，扫描 {scanned} 个文件，耗时 {elapsed} 秒",
-                "english_switch": f"Found {count} viruses, scanned {scanned} files, time {elapsed}s",
-                "japanese_switch": f"{count} 個のウイルスを発見し、{scanned} 個のファイルをスキャンしました（所要時間 {elapsed} 秒）",
-                "korean_switch": f"바이러스 {count}개 발견, 파일 {scanned}개 검사, 소요 시간 {elapsed}초",
-                "french_switch": f"{count} virus trouvés, {scanned} fichiers analysés, temps {elapsed}s",
-                "spanish_switch": f"Se encontraron {count} virus, {scanned} archivos escaneados, tiempo {elapsed}s",
-                "hindi_switch": f"{count} वायरस मिले, {scanned} फ़ाइलें स्कैन की गईं, समय {elapsed}s",
-                "arabic_switch": f"تم العثور على {count} فيروسات، تم فحص {scanned} ملفات، الوقت {elapsed} ثانية",
-                "russian_switch": f"Найдено {count} вирусов, проверено {scanned} файлов, время {elapsed}с",
-                "slovenian_switch": f"Najdenih {count} virusov, skeniranih {scanned} datotek, čas {elapsed}s"
-            }
+            messages = self._scan_result_messages(count, scanned, elapsed)
+            log_detail = f"Found {count} viruses, scanned {scanned} files, time {elapsed}s"
+
             if self._window:
                 js_cmd = f"if(window.finishScan) window.finishScan({json.dumps(messages)}, {count});"
                 self.ui_queue.put(js_cmd)
 
-            self.write_log("INFO", "Scan Completed", detail=f"Found {count} viruses, scanned {scanned} files, time {elapsed}s")
+            self.write_log("INFO", "Scan Completed", detail=log_detail)
 
 ####################################################################################################
 
     def stop_scan(self):
-        with self.lock_virus: self.scan_running = False
+        with self.lock_virus:
+            active = getattr(self, 'scan_running', False) or getattr(self, 'scan_preparing', False)
+            if active:
+                self.scan_stop_requested = True
+                self.scan_running = False
+            return active
 
     def trigger_scan(self, method):
-        messages = {
-            "traditional_switch": "已取消掃描",
-            "simplified_switch": "已取消扫描", "english_switch":
-            "Scan cancelled", "japanese_switch": "スキャンがキャンセルされました",
-            "korean_switch": "스캔이 취소되었습니다",
-            "french_switch": "Analyse annulée",
-            "spanish_switch": "Escaneo cancelado",
-            "hindi_switch": "स्कैन रद्द कर दिया गया",
-            "arabic_switch": "تم إلغاء الفحص",
-            "russian_switch": "Сканирование отменено",
-            "slovenian_switch": "Skeniranje preklicano"
-        }
         targets = []
 
-        if method == "smart":
-            for folder in ["Desktop", "Downloads", "AppData"]:
-                fp = os.path.join(self.path_user, folder)
-                if os.path.exists(fp):
-                    targets.append(fp)
+        if not self._begin_scan_preparation():
+            return False
 
-            if os.path.exists(self.path_config):
-                targets.append(self.path_config)
+        try:
+            if method == "smart":
+                for folder in ["Desktop", "Downloads", "AppData"]:
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
 
-            buf = ctypes.create_unicode_buffer(1024)
-            max_address = 0x7FFFFFFFFFFF if ctypes.sizeof(ctypes.c_void_p) == 8 else 0x7FFFFFFF
-            system_dir = self.path_system.lower()
+                    fp = os.path.join(self.path_user, folder)
+                    if os.path.exists(fp):
+                        targets.append(fp)
 
-            for proc in self.get_process_list():
-                if proc["path"] and proc["path"] != "None": 
-                    targets.append(proc["path"])
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
 
-                pid = proc["pid"]
-                if pid <= 4:
-                    continue
+                if os.path.exists(self.path_config):
+                    targets.append(self.path_config)
 
-                h_process = self.kernel32.OpenProcess(0x1000, False, pid)
-                if h_process:
-                    try:
-                        address = 0
-                        mbi = MEMORY_BASIC_INFORMATION()
-                        while address < max_address and self.kernel32.VirtualQueryEx(h_process, ctypes.c_void_p(address), ctypes.byref(mbi), ctypes.sizeof(mbi)):
-                            if mbi.State == 0x1000 and mbi.Type == 0x1000000:
-                                if self.psapi.GetMappedFileNameW(h_process, ctypes.c_void_p(address), buf, 1024):
-                                    raw_path = buf.value
-                                    if raw_path.startswith("\\"):
-                                        raw_path = self.device_path_to_drive(raw_path)
+                buf = ctypes.create_unicode_buffer(1024)
+                max_address = 0x7FFFFFFFFFFF if ctypes.sizeof(ctypes.c_void_p) == 8 else 0x7FFFFFFF
+                system_dir = self.path_system.lower()
 
-                                    file_path = self.norm_path(raw_path)
-                                    if file_path and not file_path.lower().startswith(system_dir):
-                                        targets.append(file_path)
+                for proc in self.get_process_list():
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
 
-                            if mbi.RegionSize == 0:
-                                break
-                            address += mbi.RegionSize
-                    finally:
-                        self.kernel32.CloseHandle(h_process)
+                    if proc["path"] and proc["path"] != "None": 
+                        targets.append(proc["path"])
 
-            self.start_scan(list(set(targets)))
+                    pid = proc["pid"]
+                    if pid <= 4:
+                        continue
 
-        elif method == "file":
-            targets = self.select_files()
-            if targets:
-                self.start_scan(targets)
+                    h_process = self.kernel32.OpenProcess(0x1000, False, pid)
+                    if h_process:
+                        try:
+                            address = 0
+                            mbi = MEMORY_BASIC_INFORMATION()
+                            while address < max_address and not self._is_scan_cancel_requested() and self.kernel32.VirtualQueryEx(h_process, ctypes.c_void_p(address), ctypes.byref(mbi), ctypes.sizeof(mbi)):
+                                if mbi.State == 0x1000 and mbi.Type == 0x1000000:
+                                    if self.psapi.GetMappedFileNameW(h_process, ctypes.c_void_p(address), buf, 1024):
+                                        raw_path = buf.value
+                                        if raw_path.startswith("\\"):
+                                            raw_path = self.device_path_to_drive(raw_path)
 
-            elif self._window:
-                self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, 0);")
+                                        file_path = self.norm_path(raw_path)
+                                        if file_path and not file_path.lower().startswith(system_dir):
+                                            targets.append(file_path)
 
-        elif method == "path":
-            targets = self.select_folder()
-            if targets:
-                self.start_scan(targets)
+                                if mbi.RegionSize == 0:
+                                    break
+                                address += mbi.RegionSize
+                        finally:
+                            self.kernel32.CloseHandle(h_process)
 
-            elif self._window:
-                self._window.evaluate_js(f"if(window.finishScan) window.finishScan({json.dumps(messages)}, 0);")
+                    if self._is_scan_cancel_requested():
+                        return self._finish_scan_cancelled()
 
-        elif method == "full":
-            targets = [f"{chr(d)}:/" for d in range(65, 91) if os.path.exists(f"{chr(d)}:/")]
-            self.start_scan(targets)
+                if not self.start_scan(list(set(targets)), from_preparing=True):
+                    return self._finish_scan_cancelled()
+
+                return True
+
+            elif method == "file":
+                targets = self.select_files()
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if targets:
+                    if not self.start_scan(targets, from_preparing=True):
+                        return self._finish_scan_cancelled()
+                    return True
+
+                return self._finish_scan_cancelled()
+
+            elif method == "path":
+                targets = self.select_folder()
+                if self._is_scan_cancel_requested():
+                    return self._finish_scan_cancelled()
+
+                if targets:
+                    if not self.start_scan(targets, from_preparing=True):
+                        return self._finish_scan_cancelled()
+                    return True
+
+                return self._finish_scan_cancelled()
+
+            elif method == "full":
+                targets = [f"{chr(d)}:/" for d in range(65, 91) if os.path.exists(f"{chr(d)}:/")]
+                if self._is_scan_cancel_requested() or not self.start_scan(targets, from_preparing=True):
+                    return self._finish_scan_cancelled()
+                return True
+
+            return self._finish_scan_cancelled()
+
+        except Exception as e:
+            self.write_log("WARN", "trigger_scan", detail=str(e), success=False)
+            return self._finish_scan_cancelled()
 
 ####################################################################################################
 
+    def _queue_virus_delete(self, file_path):
+        self._schedule_file_task("delete", file_path, self._retry_virus_delete, 0.5)
+
+    def _retry_virus_delete(self, file_path):
+        file_hash = self.calc_file_hash(file_path)
+        try:
+            with self.lock_file_ops:
+                if file_path in self.virus_lock:
+                    self.lock_file(file_path, False)
+
+            target_key = os.path.normcase(self.norm_path(file_path, must_exist=False) or file_path)
+            for proc in self.get_process_list():
+                proc_path = proc.get("path")
+                if not proc_path or proc_path == "None":
+                    continue
+                proc_key = os.path.normcase(self.norm_path(proc_path, must_exist=False) or proc_path)
+                if proc_key == target_key:
+                    self.kill_process(proc["pid"])
+
+            try:
+                os.chmod(file_path, stat.S_IWRITE)
+            except Exception:
+                pass
+            os.remove(file_path)
+        except FileNotFoundError:
+            pass
+        except Exception as e:
+            self.lock_file(file_path, True, quiet=True)
+            self._queue_virus_delete(file_path)
+            self.write_log("INFO", "Virus Delete Deferred", source=file_path, detail=str(e))
+            return
+
+        self.remove_list_items("quarantine", [file_path])
+        with self.lock_virus:
+            target_key = os.path.normcase(self.norm_path(file_path, must_exist=False) or file_path)
+            self.virus_results = [
+                result for result in self.virus_results
+                if os.path.normcase(self.norm_path(result, must_exist=False) or result) != target_key
+            ]
+        self.write_log("INFO", "Virus Delete", source=file_path, file_hash=file_hash, operate=True, success=True)
+
     def solve_scan(self, file_paths):
         deleted_paths = []
         proc_map = {}
@@ -383,23 +518,19 @@ class ScannerMixin:
                     except Exception:
                         pass
 
-                    delete_success = False
-                    for _ in range(5):
-                        try:
-                            os.remove(path)
-                            delete_success = True
-                            break
-
-                        except Exception:
-                            time.sleep(0.1)
-
-                    if not delete_success:
+                    file_hash = self.calc_file_hash(path)
+                    try:
                         os.remove(path)
+                    except Exception as e:
+                        self.lock_file(path, True, quiet=True)
+                        self._queue_virus_delete(path)
+                        self.write_log("INFO", "Virus Delete Deferred", source=path, detail=str(e))
+                        continue
 
                     self.remove_list_items("quarantine", [path])
-                    deleted_paths.append(raw_path) 
+                    deleted_paths.append(raw_path)
                     deleted_set.add(path)
-                    self.write_log("INFO", "Virus Delete", source=path, file_hash=self.calc_file_hash(path), operate=True, success=True)
+                    self.write_log("INFO", "Virus Delete", source=path, file_hash=file_hash, operate=True, success=True)
 
                 except Exception as e:
                     self.lock_file(path, True)

PYAS_Tools.py

@@ -4,6 +4,11 @@ import ctypes, ctypes.wintypes
 
 from concurrent.futures import ThreadPoolExecutor
 
+PROCESS_TERMINATE = 0x0001
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+PYAS_PROCESS_TERMINATE_ACCESS = PROCESS_TERMINATE | PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION
+
 ####################################################################################################
 
 class PROCESSENTRY32W(ctypes.Structure):
@@ -657,7 +662,7 @@ class ToolsMixin:
 
     def kill_process(self, pid, expected_path=None):
         try:
-            h = self.kernel32.OpenProcess(0x1F0FFF, False, pid)
+            h = self.kernel32.OpenProcess(PYAS_PROCESS_TERMINATE_ACCESS, False, pid)
             if h:
                 try:
                     file_path = self.norm_path(self.get_process_file(h))

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.6.2.0',
+version='3.6.7.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Filter/DriverCommon.h

@@ -8,7 +8,9 @@
 constexpr auto PYAS_PORT_NAME = L"\\PYAS_Output_Pipe";
 constexpr auto MAX_PATH_LEN = 1024;
 constexpr auto PYAS_POOL_TAG = 'SAYP';
-constexpr auto PYAS_OB_ALTITUDE = L"320000.4101";
+constexpr auto PYAS_OB_ALTITUDE = L"320000.4101";
+constexpr auto PYAS_CONNECTION_MAGIC = 0x53415950;
+constexpr auto PYAS_CONNECTION_VERSION = 1;
 
 #ifndef PROCESS_TERMINATE
 #define PROCESS_TERMINATE                  (0x0001)
@@ -130,7 +132,14 @@ typedef enum _PYAS_COMMAND {
 typedef struct _PYAS_USER_MESSAGE {
     ULONG Command;
     WCHAR Path[MAX_PATH_LEN];
-} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+} PYAS_USER_MESSAGE, * PPYAS_USER_MESSAGE;
+
+typedef struct _PYAS_CONNECTION_CONTEXT {
+    ULONG Size;
+    ULONG Version;
+    ULONG Magic;
+    ULONG ProcessId;
+} PYAS_CONNECTION_CONTEXT, * PPYAS_CONNECTION_CONTEXT;
 
 typedef struct _DRIVER_DATA {
     PDRIVER_OBJECT DriverObject;
@@ -150,7 +159,9 @@ typedef struct _DRIVER_DATA {
     volatile LONG ClientCloseActive;
     EX_RUNDOWN_REF PortRundown;
     KEVENT CleanupCompleteEvent;
-    PVOID ObRegistrationHandle;
+    PVOID ObRegistrationHandle;
+    UNICODE_STRING ClientImagePath;
+    WCHAR ClientImagePathBuffer[MAX_PATH_LEN];
 } DRIVER_DATA, * PDRIVER_DATA;
 
 typedef struct _RULE_NODE {

Plugins/Filter/DriverEntry.cpp

@@ -49,6 +49,99 @@ static NTSTATUS SelectFailure(NTSTATUS CurrentStatus, NTSTATUS CandidateStatus)
     return CandidateStatus;
 }
 
+static NTSTATUS LoadClientIdentityFromRegistry(PUNICODE_STRING RegistryPath) {
+    if (!RegistryPath || !RegistryPath->Buffer || !GlobalData.ClientImagePath.Buffer) return STATUS_INVALID_PARAMETER;
+
+    UNICODE_STRING ValueName = RTL_CONSTANT_STRING(L"ClientImagePath");
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    InitializeObjectAttributes(&ObjectAttributes, RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+    HANDLE KeyHandle = NULL;
+    NTSTATUS Status = ZwOpenKey(&KeyHandle, KEY_READ, &ObjectAttributes);
+    if (!NT_SUCCESS(Status)) return Status;
+
+    ULONG ResultLength = 0;
+    Status = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, NULL, 0, &ResultLength);
+    if (Status != STATUS_BUFFER_TOO_SMALL && Status != STATUS_BUFFER_OVERFLOW) {
+        ZwClose(KeyHandle);
+        return Status;
+    }
+
+    if (ResultLength == 0 || ResultLength > FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) + GlobalData.ClientImagePath.MaximumLength) {
+        ZwClose(KeyHandle);
+        return STATUS_NAME_TOO_LONG;
+    }
+
+    PKEY_VALUE_PARTIAL_INFORMATION Information = (PKEY_VALUE_PARTIAL_INFORMATION)PyasAllocate(ResultLength);
+    if (!Information) {
+        ZwClose(KeyHandle);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    Status = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, Information, ResultLength, &ResultLength);
+    ZwClose(KeyHandle);
+
+    if (NT_SUCCESS(Status)) {
+        if ((Information->Type != REG_SZ && Information->Type != REG_EXPAND_SZ) ||
+            Information->DataLength < sizeof(WCHAR) ||
+            (Information->DataLength % sizeof(WCHAR)) != 0 ||
+            Information->DataLength > GlobalData.ClientImagePath.MaximumLength - sizeof(WCHAR)) {
+            Status = STATUS_INVALID_PARAMETER;
+        }
+        else {
+            RtlZeroMemory(GlobalData.ClientImagePath.Buffer, GlobalData.ClientImagePath.MaximumLength);
+            RtlCopyMemory(GlobalData.ClientImagePath.Buffer, Information->Data, Information->DataLength);
+
+            USHORT CharacterCount = (USHORT)(Information->DataLength / sizeof(WCHAR));
+            while (CharacterCount > 0 && GlobalData.ClientImagePath.Buffer[CharacterCount - 1] == L'\0') {
+                CharacterCount--;
+            }
+
+            if (CharacterCount == 0) {
+                Status = STATUS_INVALID_PARAMETER;
+            }
+            else {
+                GlobalData.ClientImagePath.Buffer[CharacterCount] = L'\0';
+                GlobalData.ClientImagePath.Length = CharacterCount * sizeof(WCHAR);
+                Status = STATUS_SUCCESS;
+            }
+        }
+    }
+
+    PyasFree(Information);
+    return Status;
+}
+
+static BOOLEAN IsAuthorizedClientConnection(PVOID ConnectionContext, ULONG SizeOfContext) {
+    if (!ConnectionContext || SizeOfContext < sizeof(PYAS_CONNECTION_CONTEXT)) return FALSE;
+    if (!GlobalData.ClientImagePath.Buffer || GlobalData.ClientImagePath.Length == 0) return FALSE;
+    if (KeGetCurrentIrql() != PASSIVE_LEVEL) return FALSE;
+
+    PYAS_CONNECTION_CONTEXT Context = { 0 };
+    __try {
+        RtlCopyMemory(&Context, ConnectionContext, sizeof(Context));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER) {
+        return FALSE;
+    }
+
+    if (Context.Size < sizeof(PYAS_CONNECTION_CONTEXT)) return FALSE;
+    if (Context.Version != PYAS_CONNECTION_VERSION) return FALSE;
+    if (Context.Magic != PYAS_CONNECTION_MAGIC) return FALSE;
+    if (Context.ProcessId != (ULONG)(ULONG_PTR)PsGetCurrentProcessId()) return FALSE;
+
+    PUNICODE_STRING ImagePath = NULL;
+    NTSTATUS Status = SeLocateProcessImageName(PsGetCurrentProcess(), &ImagePath);
+    if (!NT_SUCCESS(Status) || !ImagePath || !ImagePath->Buffer) {
+        if (ImagePath) ExFreePool(ImagePath);
+        return FALSE;
+    }
+
+    BOOLEAN Authorized = RtlEqualUnicodeString(ImagePath, &GlobalData.ClientImagePath, TRUE);
+    ExFreePool(ImagePath);
+    return Authorized;
+}
+
 static NTSTATUS UnregisterRuntimeCallbacksPass(BOOLEAN WaitWithoutTimeout) {
     NTSTATUS Status = STATUS_SUCCESS;
 
@@ -434,10 +527,9 @@ static NTSTATUS PortConnect(
     PVOID* ConnectionPortCookie
 ) {
     UNREFERENCED_PARAMETER(ServerPortCookie);
-    UNREFERENCED_PARAMETER(ConnectionContext);
-    UNREFERENCED_PARAMETER(SizeOfContext);
 
     if (!ConnectionPortCookie) return STATUS_INVALID_PARAMETER;
+    if (!IsAuthorizedClientConnection(ConnectionContext, SizeOfContext)) return STATUS_ACCESS_DENIED;
     *ConnectionPortCookie = NULL;
 
     if (InterlockedCompareExchange(&GlobalData.PortStopping, 0, 0) != 0) {
@@ -544,6 +636,8 @@ extern "C" NTSTATUS DriverEntry(
 ) {
     RtlZeroMemory(&GlobalData, sizeof(GlobalData));
     GlobalData.DriverObject = DriverObject;
+    GlobalData.ClientImagePath.Buffer = GlobalData.ClientImagePathBuffer;
+    GlobalData.ClientImagePath.MaximumLength = sizeof(GlobalData.ClientImagePathBuffer);
     KeInitializeSpinLock(&GlobalData.PortMutex);
     KeInitializeSpinLock(&GlobalData.TrackerMutex);
     KeInitializeSpinLock(&GlobalData.PidLock);
@@ -567,6 +661,9 @@ extern "C" NTSTATUS DriverEntry(
     Status = LoadRulesFromDisk(RegistryPath);
     if (!NT_SUCCESS(Status)) goto Failure;
 
+    Status = LoadClientIdentityFromRegistry(RegistryPath);
+    if (!NT_SUCCESS(Status)) goto Failure;
+
     Status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle);
     if (!NT_SUCCESS(Status)) goto Failure;
 

Plugins/Rules/Rules_Driver_P1.json

@@ -1,16 +1,29 @@
 {
     "DynamicRules": [
         {
-            "Name": "Process_Protect_Antivirus_Command",
+            "Name": "Self_Antivirus_Protect_Command",
             "Code": 1001,
             "Kill": false,
             "Category": "Process",
             "Initiator": [
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
                 "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\wsl.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\bash.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\regsvr32.exe",
             ],
             "InitiatorExclude": [
                 "*\\PYAS.exe",
@@ -18,6 +31,14 @@
             "CommandLine": [
                 "*taskkill*PYAS.exe*",
                 "*taskkill*msedgewebview2.exe*",
+                "*Stop-Process*PYAS*",
+                "*Stop-Process*msedgewebview2*",
+                "*Get-Process*PYAS*Stop-Process*",
+                "*Get-Process*msedgewebview2*Stop-Process*",
+                "*wmic*PYAS.exe*call terminate*",
+                "*wmic*PYAS.exe*delete*",
+                "*wmic*msedgewebview2.exe*call terminate*",
+                "*wmic*msedgewebview2.exe*delete*",
             ],
             "Operations": [
                 "Execute",
@@ -28,27 +49,33 @@
                 "*\\powershell.exe",
                 "*\\pwsh.exe",
                 "*\\wmic.exe",
-                "*\\net.exe",
-                "*\\net1.exe",
             ],
             "Priority": 110,
             "FileOpenNameAvailable": true,
             "SubsystemProcess": false,
         },
         {
-            "Name": "Process_Protect_PYAS_Handle",
+            "Name": "Self_Antivirus_Protect_Handle",
             "Code": 1002,
             "Kill": false,
             "Category": "Process",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\sogoupdf\\pdfpopcl.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\games\\Arknights Game\\Arknights.exe",
+                "*\\games\\EndField Game\\EndField.exe",
+                "*\\cm\\FeverGames\\*\\FeverGamesInstaller.exe",
             ],
             "Target": [
                 "*\\PYAS.exe",
@@ -81,17 +108,108 @@
             ]
         },
         {
-            "Name": "File_Protect_Antivirus",
+            "Name": "Attack_Command_Block_EFI_Mount",
+            "Code": 1003,
+            "Kill": false,
+            "Category": "Process",
+            "Target": [
+                "*\\mountvol.exe",
+            ],
+            "CommandLine": [
+                "*mountvol* /S*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 170,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Attack_Command_Block_Destructive_Cmd_Delete",
+            "Code": 1004,
+            "Kill": true,
+            "Category": "Process",
+            "Target": [
+                "*\\cmd.exe",
+            ],
+            "CommandLine": [
+                "*rd /s /q C:\\*",
+                "*rmdir /s /q C:\\*",
+                "*del X:\\* /s /f /q*",
+                "*rd /s /q X:\\EFI*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 190,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Attack_Command_Block_Forced_OOBE_Sysprep",
+            "Code": 1005,
+            "Kill": false,
+            "Category": "Process",
+            "Target": [
+                "*\\sysprep.exe",
+            ],
+            "CommandLine": [
+                "*sysprep* /oobe*",
+                "*sysprep*/oobe*",
+                "* /oobe* /reboot*",
+                "* /generalize* /oobe*",
+            ],
+            "Operations": [
+                "Execute",
+            ],
+            "Priority": 185,
+            "FileOpenNameAvailable": true,
+        },
+        {
+            "Name": "Process_Protect_UserWritable_SystemName_Dll_Load",
+            "Code": 1006,
+            "Kill": false,
+            "Category": "Process",
+            "Initiator": [
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\dllhost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\msiexec.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\spoolsv.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\regsvr32.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\rundll32.exe",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\regsvr32.exe",
+            ],
+            "Target": [
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\*.dll",
+                "\\Device\\HarddiskVolume*\\ProgramData\\*\\*.dll",
+            ],
+            "Operations": [
+                "ImageLoad",
+            ],
+            "Priority": 160,
+        },
+        {
+            "Name": "Self_Antivirus_Protect_File",
             "Code": 2001,
             "Kill": false,
             "Category": "File",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
-                "*\\PYAS_Setup.exe",
-                "*\\unins000.exe",
                 "*\\notepad*.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
             ],
             "Target": [
                 "*\\PYAS.exe",
@@ -109,7 +227,7 @@
                 "*\\Interface\\static\\img\\*.ico",
                 "*\\Interface\\static\\js\\*.js",
                 "*\\Interface\\templates\\*.html",
-                "*\\Plugins\\Filter\\PYAS_Driver.sys",
+                "*\\Plugins\\Filter\\*.sys",
                 "*\\Plugins\\Rules\\*.json",
             ],
             "Operations": [
@@ -118,7 +236,7 @@
             ]
         },
         {
-            "Name": "File_Protect_System",
+            "Name": "System_Boot_Protect_File",
             "Code": 2002,
             "Kill": true,
             "Category": "File",
@@ -132,6 +250,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
+                "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
             ],
             "Target": [
                 "\\Device\\HarddiskVolume*\\bootmgr",
@@ -147,9 +266,9 @@
             ]
         },
         {
-            "Name": "File_Protect_System_Exploit",
+            "Name": "Illegal_Characters_Protect_File",
             "Code": 2003,
-            "Kill": true,
+            "Kill": false,
             "Category": "File",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
@@ -179,17 +298,23 @@
             ]
         },
         {
-            "Name": "File_Protect_System_Ransom",
+            "Name": "System_Ransom_Protect_File",
             "Code": 2004,
             "Kill": true,
             "Category": "File",
             "Initiator": [
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
                 "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
             ],
             "Target": [
                 "\\Device\\HarddiskVolume*\\Windows\\*",
@@ -210,7 +335,7 @@
             "TimeWindow": 3000,
         },
         {
-            "Name": "File_Protect_Ransom",
+            "Name": "User_Ransom_Protect_File",
             "Code": 2005,
             "Kill": true,
             "Category": "File",
@@ -249,6 +374,7 @@
                 "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
                 "*\\bin\\*\\codex.exe",
                 "*\\bin\\codex.exe",
+                "*\\Weixin\\Weixin.exe",
             ],
             "Target": [
                 "\\Device\\HarddiskVolume*\\Users\\*",
@@ -265,9 +391,19 @@
                 "\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
                 "\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
                 "\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.cache\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.aws\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.codex\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.designer\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.idlerc\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.keras\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.matplotlib\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\.ssh\\*",
                 "*\\ventoy\\Boot\\*",
                 "*\\AdminRegionConfig.*",
                 "*\\nt_qq\\nt_*\\*",
+                "*\\nt_qq\\global\\nt_*\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Documents\\Tencent Files\\*",
             ],
             "Extensions": [
                 ".zip",
@@ -300,22 +436,17 @@
                 ".mov",
                 ".wmv",
                 ".mkv",
-                ".apk",
-                ".jar",
-                ".class",
-                ".db",
-                ".sqlite",
             ],
             "Operations": [
                 "Write",
                 "Delete",
                 "Rename",
             ],
-            "Threshold": 5,
+            "Threshold": 10,
             "TimeWindow": 3000,
         },
         {
-            "Name": "Device_Protect_Disk_Wiper",
+            "Name": "System_Boot_Protect_Disk_Wiper",
             "Code": 2006,
             "Kill": false,
             "Category": "Device",
@@ -334,9 +465,9 @@
             ]
         },
         {
-            "Name": "Registry_Protect_System",
+            "Name": "Registry_Protect_System_Suspicious",
             "Code": 3001,
-            "Kill": true,
+            "Kill": false,
             "Category": "Registry",
             "InitiatorExclude": [
                 "\\Device\\HarddiskVolume*\\Windows\\*",
@@ -344,55 +475,109 @@
                 "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
                 "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
                 "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Google\\Chrome\\Application\\chrome.exe",
-                "*\\Microsoft\\Edge\\Application\\msedge.exe",
-                "*\\Mozilla Firefox\\firefox.exe",
-                "*\\Thorium\\Application\\thorium.exe",
-                "*\\Sources\\SetupHost.exe",
-                "*\\Work\\*\\DismHost.exe",
-                "*\\Steam\\steam.exe",
-                "*\\steam\\*\\steam.exe",
-                "*\\Steam\\steamapps\\common\\*",
-                "*\\Battle.net\\*\\Battle.net.exe",
-                "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
-                "*\\PC4399_WPFLauncher.exe",
-                "*\\Neverness To Everness\\NTELauncher.exe",
-                "*\\ThunderEv.exe",
-                "*\\ThunderStart.exe",
-                "*\\bin\\APlayer.exe",
-                "*\\bilibili\\bilibili.exe",
-                "*\\KuGou.exe",
-                "*\\XLGame.exe",
-                "*\\XLLiveUD.exe",
                 "*\\hrkill-*.exe",
                 "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
                 "*\\360Safe.exe",
                 "*\\PYAS.exe",
-                "*\\WPS Office\\ksolaunch.exe",
-                "*\\WPS Office\\*\\wps.exe",
-                "*\\WPS Office\\*\\*.exe",
-                "*\\Application\\AndrowsLauncher.exe",
-                "*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
-                "*\\bin\\*\\codex.exe",
-                "*\\bin\\codex.exe",
             ],
             "Target": [
-                "\\REGISTRY\\MACHINE\\BCD00000000",
-                "\\REGISTRY\\MACHINE\\BCD00000000\\*",
-                "*\\Classes\\.exe",
-                "*\\Classes\\.bat",
-                "*\\Classes\\.cmd",
-                "*\\Classes\\.com",
-                "*\\Classes\\exefile\\*",
-                "*\\Classes\\batfile\\*",
-                "*\\Classes\\cmdfile\\*",
-                "*\\Classes\\comfile\\*",
                 "*\\mouclass",
                 "*\\kbdclass",
                 "*\\DisableAntiSpyware",
                 "*\\DisableWindowsUpdateAccess",
+                "*\\NoWindowsUpdate",
+                "*\\AutoAdminLogon",
+                "*\\DefaultUserName",
+                "*\\DefaultPassword",
+                "*\\AltDefaultUserName",
+                "*\\AltDefaultPassword",
+                "*\\AutoReboot",
+                "*\\DisableAutomaticRestartOnFailure",
+                "*\\SystemBiosVersion",
+                "*\\ClearRecentDocsOnExit",
+                "*\\HideClock",
+                "*\\HideFastUserSwitching",
+                "*\\ShutdownWithoutLogon",
+                "*\\DisableCAD",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 130,
+        },
+        {
+            "Name": "Registry_Protect_Open_With_Suspicious",
+            "Code": 3002,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\Program Files\\*",
+                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "*\\Classes\\.exe",
+                "*\\Classes\\.com",
+                "*\\Classes\\.bat",
+                "*\\Classes\\.cmd",
+                "*\\Classes\\exefile\\*",
+                "*\\Classes\\comfile\\*",
+                "*\\Classes\\batfile\\*",
+                "*\\Classes\\cmdfile\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 150,
+        },
+        {
+            "Name": "Registry_Protect_BCD_Suspicious",
+            "Code": 3003,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\BCD00000000",
+                "\\REGISTRY\\MACHINE\\BCD00000000\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 140,
+        },
+        {
+            "Name": "Registry_Protect_System_Critical",
+            "Code": 3004,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
                 "*\\EnableLUA",
                 "*\\ConsentPromptBehaviorAdmin",
+                "*\\ConsentPromptBehaviorUser",
+                "*\\EnableSecureUIAPaths",
+                "*\\BootExecute",
+                "*\\SubSystems",
+                "*\\FirmwareBootDevice",
+                "*\\BootDriverFlags",
+                "*\\SystemStartOptions",
+                "*\\Userinit",
+                "*\\UIHost",
                 "*\\NoControlPanel",
                 "*\\NoDrives",
                 "*\\NoFileMenu",
@@ -407,7 +592,6 @@
                 "*\\NoFolderOptions",
                 "*\\RestrictRun",
                 "*\\NoViewContextMenu",
-                "*\\HideClock",
                 "*\\NoStartMenuMyGames",
                 "*\\NoStartMenuMyMusic",
                 "*\\DisableCMD",
@@ -426,7 +610,6 @@
                 "*\\NoActiveDesktop",
                 "*\\NoSetActiveDesktop",
                 "*\\NoRecentDocsMenu",
-                "*\\NoWindowsUpdate",
                 "*\\NoChangeStartMenu",
                 "*\\NoFavoritesMenu",
                 "*\\NoRecentDocsHistory",
@@ -436,44 +619,90 @@
                 "*\\NoManageMyComputerVerb",
                 "*\\NoRealMode",
                 "*\\NoRun",
-                "*\\ClearRecentDocsOnExit",
                 "*\\NoActiveDesktopChanges",
                 "*\\NoStartMenuNetworkPlaces",
                 "*\\NoLockScreen",
-                "*\\HideFastUserSwitching",
-                "*\\ConsentPromptBehaviorUser",
-                "*\\EnableSecureUIAPaths",
                 "*\\NoSRM",
                 "*\\NoInteractiveServices",
-                "*\\ShutdownWithoutLogon",
-                "*\\AutoAdminLogon",
-                "*\\BootExecute",
-                "*\\SubSystems",
-                "*\\FirmwareBootDevice",
-                "*\\BootDriverFlags",
-                "*\\SystemStartOptions",
-                "*\\DisableAutomaticRestartOnFailure",
-                "*\\SystemBiosVersion",
                 "*\\NoTheme",
-                "*\\SystemSetupInProgress",
-                "*\\SetupType",
-                "*\\AutoReboot",
-                "*\\Userinit",
-                "*\\UIHost",
-                "*\\Debugger",
-                "*\\DefaultUserName",
-                "*\\DefaultPassword",
-                "*\\AltDefaultUserName",
-                "*\\AltDefaultPassword",
-                "*\\DisableCAD",
-                "*\\LegalNoticeCaption",
-                "*\\LegalNoticeText",
             ],
             "Operations": [
                 "Write",
                 "Delete",
                 "Create",
-            ]
-        }
+            ],
+            "Priority": 180,
+        },
+        {
+            "Name": "Registry_Protect_SafeMode_Autostart",
+            "Code": 3005,
+            "Kill": true,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
+                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\360Safe.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Minimal\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Network\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 170,
+        },
+        {
+            "Name": "Registry_Protect_OOBE_Reset",
+            "Code": 3006,
+            "Kill": false,
+            "Category": "Registry",
+            "InitiatorExclude": [
+                "*\\Sources\\SetupHost.exe",
+                "*\\Work\\*\\DismHost.exe",
+                "*\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+                "*\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe",
+                "*\\Windows\\System32\\MoUsoCoreWorker.exe",
+                "*\\Windows\\System32\\Sysprep\\sysprep.exe",
+                "*\\Windows\\System32\\oobe\\*",
+                "*\\Windows\\System32\\svchost.exe",
+                "*\\Windows\\explorer.exe",
+                "*\\PYAS.exe",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupType",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\CmdLine",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\AuditInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\MiniSetupInProgress",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupPhase",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\SysprepStatus\\*",
+                "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\ChildCompletion\\*",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE\\*",
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\*",
+            ],
+            "TargetExclude": [
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\TelemetryCorrelation",
+            ],
+            "Operations": [
+                "Write",
+                "Delete",
+                "Create",
+            ],
+            "Priority": 175,
+        },
     ]
-}
+}