IDA Pro: Platform-independent way to check if an instruction is a jump

Question

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures.

I thought one may check the belonging xref type. Yet, there are several different types possible: Code_Near_Jump Code_Far_Jump but also Data_Read (for indirect jumps). This approach looks complicated and not very reliable to me.

For call instructions, there is idaapi.is_call_insn(addr). Is there a similar thing for jumps?

Answer 1

For ideas look at https://github.com/trailofbits/mcsema/blob/master/tools/mcsema_disass/ida/get_cfg.py

Here's an example of how to get the mnemonic of the entrypoint opcode:

import idaapi
import idautils

ea = idaapi.get_screen_ea()  // Gets the entrypoint VA
idautils.DecodeInstruction(ea).get_canon_mnem() // e.g. push or jne

I'd used that technique recently, checked the example works. Essentially if you can get the VA of an instruction, then you can use DecodeInstruction or DecodePreviousInstruction in idautils.

Then you can use the consts that Trail of bits used e.g

COND_BRANCHES = [\
idaapi.NN_ja,\
idaapi.NN_jae,\
idaapi.NN_jb,
....

function docs here - https://www.hex-rays.com/products/ida/support/idapython_docs/