From 2b6fec8a3185c720d97b015cecff1882f03fea87 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <wballenthin@hex-rays.com>
Date: Fri, 14 Aug 2026 13:05:28 +0100
Subject: [PATCH 1/2] add "check for NOPed API"

closes #1177
---
 .../vm-detection/check-for-noped-api.yml      | 17 +++++++++++++
 lib/is-nop-byte.yml                           | 24 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 anti-analysis/anti-vm/vm-detection/check-for-noped-api.yml
 create mode 100644 lib/is-nop-byte.yml

diff --git a/anti-analysis/anti-vm/vm-detection/check-for-noped-api.yml b/anti-analysis/anti-vm/vm-detection/check-for-noped-api.yml
new file mode 100644
index 000000000..641d66e48
--- /dev/null
+++ b/anti-analysis/anti-vm/vm-detection/check-for-noped-api.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: check for NOPed API
+    namespace: anti-analysis/anti-vm/vm-detection
+    authors:
+      - wballenthin@hex-rays.com
+    scopes:
+      static: function
+      dynamic: unsupported
+    references:
+      - https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/
+    examples:
+      - F3D8530A2B81D1871C2F96E064291AD0:0x140001699
+  features:
+    - and:
+      - api: GetProcAddress
+      - count(match(is NOP byte)): 3 or more
diff --git a/lib/is-nop-byte.yml b/lib/is-nop-byte.yml
new file mode 100644
index 000000000..4cc7015c6
--- /dev/null
+++ b/lib/is-nop-byte.yml
@@ -0,0 +1,24 @@
+rule:
+  meta:
+    name: is NOP byte
+    namespace: lib
+    authors:
+      - wballenthin@hex-rays.com
+    description: checks to see if the start of a buffer contains NOP (0x90) bytes
+    scopes:
+      static: instruction
+      dynamic: unsupported
+    examples:
+      - F3D8530A2B81D1871C2F96E064291AD0:0x1400016D9
+  features:
+    - and:
+      - or:
+        - arch: i386
+        - arch: amd64
+      - mnemonic: cmp
+      - or:
+        - operand[0].offset: 0x0
+        - operand[0].offset: 0x1
+        - operand[0].offset: 0x2
+        - operand[0].offset: 0x3
+      - operand[1].number: 0x90

From 30cc0ce6dab24283d2b05d3c824790ab29f6748b Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <wballenthin@hex-rays.com>
Date: Fri, 14 Aug 2026 14:38:56 +0100
Subject: [PATCH 2/2] is-nop-byte: add inline comments

---
 lib/is-nop-byte.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/is-nop-byte.yml b/lib/is-nop-byte.yml
index 4cc7015c6..ef0a8e402 100644
--- a/lib/is-nop-byte.yml
+++ b/lib/is-nop-byte.yml
@@ -18,7 +18,10 @@ rule:
       - mnemonic: cmp
       - or:
         - operand[0].offset: 0x0
+        # like: cmp     byte ptr [rax+1], 90h
         - operand[0].offset: 0x1
+        # like: cmp     byte ptr [rax+2], 90h
         - operand[0].offset: 0x2
+        # like: cmp     byte ptr [rax+3], 90h
         - operand[0].offset: 0x3
       - operand[1].number: 0x90