You can try this function that I wrote which worked just fine in some quick tests I did. You might need to implement more code to handle edge cases, but in general it should work.
The function was written with the following generic assumptions (which isn't always true):
- A Branch\Jump instruction has at least one local reference
- A Conditional Branch would have the flow continued to the next instruction in True/False cases.
And here's the code which is commented where I think it'd be helpful:
from idaapi import *
from idc import *
def check_conditional(func_ea, addr):
# Get: function's base address, suspicious branch/jmp address
# Returns: a strings which says whether the address is a Conditional Branch, Unconditional Branch or neither
f_start = get_func(func_ea).startEA
f_end = FindFuncEnd(f_start)
# Get local function's references made from the instruction
refs = CodeRefsFrom(addr, 0)
refs = set(filter(lambda x: x>=f_start and x<=f_end, refs))
# Add a reference to the next instruction if the flow continues to it
next_head = NextHead(addr, f_end)
# refs holds the referenced address so you can use them later
return "Conditional Branch"
return "Unconditional Branch"
return "Not JMP/Branch at all"