How 87owo/pyas works
PYAS is a Windows endpoint security application: users initiate scans or manage protection through its desktop interface, and the app coordinates local detection, optional cloud analysis, and response. Its documented detection stages include policy checks, metadata and hashing, signature verification, YARA, PE/ML classification, verdict aggregation, and remediation. Real-time user-mode monitoring and a kernel driver provide a separate protection branch. The README documents additional tools and online analysis; sampled source excerpts are partial, so uncertain internal call wiring is omitted.
Main entry points: PYAS_Engine.py Detection engine · PYAS.py App orchestration · PYAS_Scanner.py Scan scheduling · index.html WebView interface
Components 17
Desktop application
- WebView interface
Interface/templates/index.html - UI interactions
Interface/static/js/main.js - App orchestration
PYAS.py - System utilities
PYAS_Tools.py
Detection pipeline
- Scan scheduling
PYAS_Scanner.py - Detection engine
PYAS_Engine.py - YARA signatures
Engine/Heuristic - PE feature extraction
Engine/Properties/scanner.py - ONNX inference
Engine/Properties/predict_onnx.py - Scan response
PYAS_Scanner.py - Cloud analysis client
PYAS_Engine.py
Endpoint protection
- Live protection
PYAS_Protect.py - Kernel filter
Plugins/Filter/DriverEntry.cpp - Driver rules
Plugins/Filter/ProtectRules.cpp
Cloud and research
- Online analysis
PYAS_Cloud.py - Model training
Engine/Properties/train_server.py
Other components
- User
Connections 16
- User → WebView interface: uses
- UI interactions → App orchestration: invokes API
- WebView interface → UI interactions: loads
- App orchestration → Scan scheduling: coordinates scans
- App orchestration → Live protection: coordinates protection
- App orchestration → System utilities: exposes tools
- Scan scheduling → Detection engine: scans targets
- Detection engine → YARA signatures: matches rules
- Detection engine → PE feature extraction: extracts features
- PE feature extraction → ONNX inference: provides features
- Detection engine → Scan response: returns verdict
- Scan scheduling → Scan response: remediates findings
- Live protection → Kernel filter: communicates
- Kernel filter → Driver rules: evaluates rules
- Detection engine → Cloud analysis client: requests analysis
- Cloud analysis client → Online analysis: submits samples