1

I have the following lines discovered in a piece of code (using IDA PRO) :

 ...
 ...
 push 44h
 pop edi
 push edi        ; size_t
 xor esi, esi
 lea eax, [ebp+StartupInfo]
 push esi        ; int 
 push eax        ; void *
 call _memset
 ...
 ...

When I saw the line lea eax, [ebp+StartupInfo] I thought, okay eax is a pointer to the structure STARTUPINFO. With int esi = 0 or NULL (see the line xor esi, esi) and with size_t edi = 44h and by calling memset, they must fill the first 44 bytes of STARTUPINFO (that would be the elements cb, lpReserved,....,wShowWindow).

But the line push eax ; void *

irritates me. How can eax has the type Startupinfo and void at the same time?

After that, I found out that the first parameter of memset()-function must have the type void. And so, the question mark in my mind is now bigger...

1
  • 1
    its the memset declaration, parameter is a size_to_memset (size_t), value to fill with (int), memory address (void*) and the void*, StartupInfo etc are all just high level concepts.. at the end of the day the chip doesnt care what it is, its just a number..
    – evlncrn8
    Sep 19, 2014 at 17:06

1 Answer 1

3

IDA knows that the prototype for the _memset function is _memset(void *, int, size_t), so it's showing you that the value of eax in push eax is for the void * parameter.

However, later on in this function, a pointer to the StartupInfo structure is likely passed to CreateProcess, which is why IDA named it as such.

How can eax has the type Startupinfo and void at the same time?

eax is just a register that holds a value, which in your disassembly above is the address of the StartupInfo structure. Types are high-level concepts, so when handled by _memset, the value of eax is interpreted as a void *, and when it's handled by CreateProcess, it's interpreted as a pointer to a STARTUPINFO structure.

1
  • thanks for your answer. The part " the value of eax is interpreted as a void *, and when it's handled by CreateProcess, it's interpreted as a pointer to a STARTUPINFO structure." was completely new for me. Thx! Sep 20, 2014 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.