5

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK API wrapper: <some_module>.

I have a few specific questions about the documentation and IDAPython:

  1. What is this IDA plugin SDK? Is it the C like API available in IDC?
  2. Do the higher level API allow access to all the lower level functionalities?
  3. What can't I seem to load lower level modules? (When I try to import ida_lines, IDA says ImportError: No module named ida_lines)
8

A bit of history: (aka an aging guy blabbering about)

In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's download center using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary and somewhat deprecated scripting language, this is not related to C however there is evident effort using a C-like syntax. It was commonly used in the past but IDAPython nearly replaced it completely. The only reason to see IDC now is for old code, that precedes IDAPython.

Since then, IDAPython was developed (originally as a plugin using the aforementioned SDK, and then adopted by hex-rays and made part of IDA). Up until the recent IDA 6.95, we only had a single module exposing all of IDA's C SDK in python. That module was idaapi. idc is implementing higher level functions that were migrated from IDC into IDAPython. idautils implements some more high level functions, that weren't there before. those are rough divisions, and not entirely accurate. The important point here is that there was a single (long) python file exposing all SDK functions (that are exposed to python using SWIG).

In IDA 6.95 we still have that, but it was also the first version to include multiple ida_* modules where are to replace the broad idaapi. idaapi is only included in 6.95 for backwards compatibility and should be expected to be dropped in IDA 7. Generally, the names of the modules (what follows the ida_ prefix) are the names of the header files in which those functions are defined. For example, ida_lines will expose functions defined in lines.h.

Actual answers:

  1. The IDA plugin SDK is a collection of C header files and binary libraries that allow a third party develop IDA plugins using the provided API. It can be downloaded from the download center and it's documentation is available here.
  2. While the C SDK is pretty well documented, the IDAPython not so much. I often find browsing the SDK useful when developing IDAPython plugins, as functions are usually exposed to python but not documented or described as well as they are in the SDK. basically most of the functions correspond and you'll find the same functions having the same name in both IDAPython and the SDK (as this is mostly automatically generated code by/for SWIG).
  3. First guess would be you're using an older version of IDA, where ida_* modules don't yet exist. generally, using idaapi instead of every other module will do just fine.

Developing for IDA:

A person interested in developing for IDA has three options:

  • Writing C code using the IDA SDK and compiling it, having a plw or a p64 binary as output.
  • Writing IDC code. This is a decent scripting language resembling a simplified C in syntax. output would be a text file. This was the scripting language of choice for IDA before IDAPython became popular and ownership was transferred to hexrays.
  • Writing IDAPython code. This is mostly python using the additional modules available when running from within IDA, plus a simple IDA plugin interface required to register as a plugin.
  • "idc is implementing higher level functions that were migrated from IDC into IDAPython" - what is IDC in (CAPITAL) here? Can you please edit your original answer to make it clearer? – Holmes.Sherlock Jan 17 '17 at 22:41
  • Can plugins be written in both C and Python? – Holmes.Sherlock Jan 17 '17 at 22:48
  • 1
    (Edited) See 2nd half of first paragraph for what's IDC. Yes, you can develop IDA plugins in C. Plugin developers seem to prefer python over C however. – NirIzr Jan 17 '17 at 22:51
  • Is IDC different from IDA's C-based SDK? I'm asking because the documentation says IDC to be 'C-like' (which is different from the language being 'C' itself). Could IDC be used for writing plugins? In that case, one can theoretically write a plugin in either of the three languages: IDC, IDA C-based SDK, IDAPython. Please update your answer above. It's already so precise, clean and to-the-point that I just want it to be better for future readers. – Holmes.Sherlock Jan 17 '17 at 23:01
  • 1
    See additional edit. – NirIzr Jan 17 '17 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.