IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

Question

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my script imports look somehow like this:

import ida_funcs
import ida_kernwin
import ida_lines
import ida_nalt
import ida_name
import ida_segment
import ida_struct
import idaapi
import idautils
import idc
from ida_bytes import *
from PyQt5 import QtCore, QtGui, QtWidgets

I've only just now realized that the idaapi module imports all the single modules. For example, I can define an action handler as

class MyHandler(ida_kernwin.action_handler_t):

but also as

class MyHandler(idaapi.action_handler_t):

So far, I was always trying to find the module the members originate from, and replace idaapi with the original module name where possible. But then I found BADADDR to originate from an ida_idaapi module, and the name feels so ridiculous, I wondered if I've been doing the right thing all along. The source and documentation on it is quite empty.

• Is it recommended to use idaapi instead of the single modules? Why does idaapi exist?

Then, on the other hand, there is idc, which seems to provide IDC like functions, even with C style name casing. If I recall correctly, I read that the usage of this module is deprecated and only meant for quickly porting IDC scripts; the documentation prominently states

This file is subject to change without any notice.
Future versions of IDA may use other definitions.

• Should I use ida_* / idaapi methods instead and, if possible, ignore idc completely?

Answer 1

Short answer is that both idaapi and idc modules should be avoided if possible.

The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a future version of IDA (probably with little to no warning ahead of time). You should strongly prefer the ida_ prefixed modules.

In older versions of IDA, a single module exposed all IDA functionality (that was idaapi), with a few modules implementing utility functions (in idautils) and IDC-translations to ease migration from IDC to IDAPython (in idc).

With IDA 6.95, IDA's python SDK was divided into multiple modules and idaapi was left to avoid breaking all existing code that relies on the idaapi module.

Since the idc module has been part of IDA for a long while (since IDAPython started), I think it'll remain part of IDA for longer than idaapi, so if you have to pick whether to use idc or idaapi (and cannot use the specific ida_* modules, for some obscure reason), I suggest you prefer idc over idaapi.

It's also important to note that idaapi has nearly no content on itself, and you'll see that nowadays idaapi.py is mostly composed of importing the other modules into it's namespace. This is also wrong for several reasons (accidental namespace overshadowing, longer load times by loading unnecessary code) and was part of the reason the namespace was split.

The ida_idaapi module, however, is part of the new interface and should be used whenever needed. This is where general definitions that have no other reasonable module are made.

Protip: When I want to convert an idaapi usage to an ida_* usage, I simply import the object at hand and print it's help, which will list where is this object actually defined.

P.S. Although not really a duplicate, this is somewhat related to How is IDAPython API structured?