4

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures.

I thought one may check the belonging xref type. Yet, there are several different types possible: Code_Near_Jump Code_Far_Jump but also Data_Read (for indirect jumps). This approach looks complicated and not very reliable to me.

For call instructions, there is idaapi.is_call_insn(addr). Is there a similar thing for jumps?

langlauf.io
  • 1,560
  • 1
  • 19
  • 36

1 Answers1

4

For ideas look at https://github.com/trailofbits/mcsema/blob/master/tools/mcsema_disass/ida/get_cfg.py

Here's an example of how to get the mnemonic of the entrypoint opcode:

import idaapi
import idautils

ea = idaapi.get_screen_ea()  // Gets the entrypoint VA
idautils.DecodeInstruction(ea).get_canon_mnem() // e.g. push or jne

I'd used that technique recently, checked the example works. Essentially if you can get the VA of an instruction, then you can use DecodeInstruction or DecodePreviousInstruction in idautils.

Then you can use the consts that Trail of bits used e.g

COND_BRANCHES = [\
idaapi.NN_ja,\
idaapi.NN_jae,\
idaapi.NN_jb,
....

function docs here - https://www.hex-rays.com/products/ida/support/idapython_docs/

evandrix
  • 125
  • 1
  • 4
JoeKir
  • 149
  • 3
  • 2
    Did you try that on other platforms? I just tried it on MIPS and it did not work. If you look at the SDK, those constants seem pretty intel-specific. – tmr232 Jun 29 '15 at 15:53
  • I have not, however I think you are correct. See this reference for the supported ida processors https://www.hex-rays.com/products/ida/support/idadoc/618.shtml the constants that you need for MIPS are here https://www.hex-rays.com/products/ida/support/idapython_docs/ e.g.MIPS_null = 0 MIPS_add = 1 MIPS_addu = 2 – JoeKir Jul 16 '15 at 00:13
  • Sadly, it seems that the only way to do this is by detecting jump xrefs. I need to check, but I think it might be a problem when jumps are to non-existent addresses. Will update after checking. – tmr232 Jul 16 '15 at 19:23