How is IDAPython API structured?

Question

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK API wrapper: <some_module>.

I have a few specific questions about the documentation and IDAPython:

1. What is this IDA plugin SDK? Is it the C like API available in IDC?
2. Do the higher level API allow access to all the lower level functionalities?
3. What can't I seem to load lower level modules? (When I try to import ida_lines, IDA says ImportError: No module named ida_lines)

Answer 1

A bit of history: (aka an aging guy blabbering about)

In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's download center using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary and somewhat deprecated scripting language, this is not related to C however there is evident effort using a C-like syntax. It was commonly used in the past but IDAPython nearly replaced it completely. The only reason to see IDC now is for old code, that precedes IDAPython.

Since then, IDAPython was developed (originally as a plugin using the aforementioned SDK, and then adopted by hex-rays and made part of IDA). Up until the recent IDA 6.95, we only had a single module exposing all of IDA's C SDK in python. That module was idaapi. idc is implementing higher level functions that were migrated from IDC into IDAPython. idautils implements some more high level functions, that weren't there before. those are rough divisions, and not entirely accurate. The important point here is that there was a single (long) python file exposing all SDK functions (that are exposed to python using SWIG).

In IDA 6.95 we still have that, but it was also the first version to include multiple ida_* modules where are to replace the broad idaapi. idaapi is only included in 6.95 for backwards compatibility and should be expected to be dropped in IDA 7. Generally, the names of the modules (what follows the ida_ prefix) are the names of the header files in which those functions are defined. For example, ida_lines will expose functions defined in lines.h.

Actual answers:

1. The IDA plugin SDK is a collection of C header files and binary libraries that allow a third party develop IDA plugins using the provided API. It can be downloaded from the download center and it's documentation is available here.
2. While the C SDK is pretty well documented, the IDAPython not so much. I often find browsing the SDK useful when developing IDAPython plugins, as functions are usually exposed to python but not documented or described as well as they are in the SDK. basically most of the functions correspond and you'll find the same functions having the same name in both IDAPython and the SDK (as this is mostly automatically generated code by/for SWIG).
3. First guess would be you're using an older version of IDA, where ida_* modules don't yet exist. generally, using idaapi instead of every other module will do just fine.

Developing for IDA:

A person interested in developing for IDA has three options:

• Writing C code using the IDA SDK and compiling it, having a plw or a p64 binary as output.
• Writing IDC code. This is a decent scripting language resembling a simplified C in syntax. output would be a text file. This was the scripting language of choice for IDA before IDAPython became popular and ownership was transferred to hexrays.
• Writing IDAPython code. This is mostly python using the additional modules available when running from within IDA, plus a simple IDA plugin interface required to register as a plugin.