Competitive Types

Question

I have the following lines discovered in a piece of code (using IDA PRO) :

 ...
 ...
 push 44h
 pop edi
 push edi        ; size_t
 xor esi, esi
 lea eax, [ebp+StartupInfo]
 push esi        ; int 
 push eax        ; void *
 call _memset
 ...
 ...

When I saw the line lea eax, [ebp+StartupInfo] I thought, okay eax is a pointer to the structure STARTUPINFO. With int esi = 0 or NULL (see the line xor esi, esi) and with size_t edi = 44h and by calling memset, they must fill the first 44 bytes of STARTUPINFO (that would be the elements cb, lpReserved,....,wShowWindow).

But the line push eax ; void *

irritates me. How can eax has the type Startupinfo and void at the same time?

After that, I found out that the first parameter of memset()-function must have the type void. And so, the question mark in my mind is now bigger...

Answer 1

IDA knows that the prototype for the _memset function is _memset(void *, int, size_t), so it's showing you that the value of eax in push eax is for the void * parameter.

However, later on in this function, a pointer to the StartupInfo structure is likely passed to CreateProcess, which is why IDA named it as such.

How can eax has the type Startupinfo and void at the same time?

eax is just a register that holds a value, which in your disassembly above is the address of the StartupInfo structure. Types are high-level concepts, so when handled by _memset, the value of eax is interpreted as a void *, and when it's handled by CreateProcess, it's interpreted as a pointer to a STARTUPINFO structure.