A bit of history: (aka an aging guy blabbering about)
In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's download center using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary and somewhat deprecated scripting language, this is not related to C however there is evident effort using a C-like syntax. It was commonly used in the past but IDAPython nearly replaced it completely. The only reason to see IDC now is for old code, that precedes IDAPython.
Since then, IDAPython was developed (originally as a plugin using the aforementioned SDK, and then adopted by hex-rays and made part of IDA). Up until the recent IDA 6.95, we only had a single module exposing all of IDA's C SDK in python. That module was
idc is implementing higher level functions that were migrated from IDC into IDAPython.
idautils implements some more high level functions, that weren't there before. those are rough divisions, and not entirely accurate. The important point here is that there was a single (long) python file exposing all SDK functions (that are exposed to python using SWIG).
In IDA 6.95 we still have that, but it was also the first version to include multiple
ida_* modules where are to replace the broad
idaapi is only included in 6.95 for backwards compatibility and should be expected to be dropped in IDA 7. Generally, the names of the modules (what follows the
ida_ prefix) are the names of the header files in which those functions are defined. For example,
ida_lines will expose functions defined in
- The IDA plugin SDK is a collection of C header files and binary libraries that allow a third party develop IDA plugins using the provided API. It can be downloaded from the download center and it's documentation is available here.
- While the C SDK is pretty well documented, the IDAPython not so much. I often find browsing the SDK useful when developing IDAPython plugins, as functions are usually exposed to python but not documented or described as well as they are in the SDK. basically most of the functions correspond and you'll find the same functions having the same name in both IDAPython and the SDK (as this is mostly automatically generated code by/for SWIG).
- First guess would be you're using an older version of IDA, where
ida_* modules don't yet exist. generally, using
idaapi instead of every other module will do just fine.
Developing for IDA:
A person interested in developing for IDA has three options:
- Writing C code using the IDA SDK and compiling it, having a
plw or a
p64 binary as output.
- Writing IDC code. This is a decent scripting language resembling a simplified C in syntax. output would be a text file. This was the scripting language of choice for IDA before IDAPython became popular and ownership was transferred to hexrays.
- Writing IDAPython code. This is mostly python using the additional modules available when running from within IDA, plus a simple IDA plugin interface required to register as a plugin.