2

I am using IDA pro to analyze an old nginx binary. I am getting following warnings which I have never seen before. Does anyone have an idea about these warnings?

IDA is analysing the input file...
You may start to explore the input file right now.
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'statfs64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used
failed to add structure type 'stat64': name is already used

I can send you nginx binary if required. And the binary is compiled using a custom version of llvm. I am using IDA Pro 7.5 and an IDAPython script.

1 Answer 1

2

This message shows that you, or a script you run, is trying to create a struct with a name that already exists.

Common IDAPython analysis scripts try to define known struct types found in the disassembled code by, for example, known function signatures/symbols.

This can be done by calling AddStrucEx function.

Scripts don't always check whether the struct is already defined before trying to add it - resulting in this error.

stat64 is a standard Linux structure and variables of that type are most likely used many times in the code.

2
  • do you know how to avoid this/ or is it fine if I just ignore it (without consequences)?
    – R4444
    Commented Nov 15, 2021 at 23:14
  • 1
    You can safely ignore these warnings. If you want a "cleaner" run, add a check to the script: Before calling AddStrucEx, do seomething like:struct_id = idc.GetStrucIdByName(name). If the struct does not exist, struct_id would be idc.BADADDR.
    – Yotamz
    Commented Nov 16, 2021 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.