IDA Pro:未知警告

逆向工程 艾达 蟒蛇
2021-06-23 18:30:25

我正在使用 IDA pro 来分析旧的 nginx 二进制文件。我收到了以前从未见过的警告。有没有人知道这些警告?

IDA is analysing the input file...
You may start to explore the input file right now.
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used

如果需要,我可以向您发送 nginx 二进制文件。二进制文件是使用自定义版本的 llvm 编译的。我正在使用 IDA Pro 7.5 和一个 IDAPython 脚本。

1个回答

此消息表明您或您运行的脚本正在尝试使用已存在的名称创建结构。

常见的 IDAPython 分析脚本试图通过例如已知的函数签名/符号来定义在反汇编代码中发现的已知结构类型。

这可以通过调用AddStrucEx函数来完成

脚本在尝试添加之前并不总是检查结构是否已经定义 - 导致此错误。

stat64 是标准的 Linux 结构,并且该类型的变量很可能在代码中多次使用。