V2 Stealth Code for MinGW (Not working)

[Elmo]

I have been trying to get Maggotboy's V2 stealth code to work with the minGW gcc compiler--my thought was to introduce another compiler into the mix to increase our code diversity.

I don't have any success yet. I started with MisterSpock's LCC code, assuming it might be closer to GCC syntax than the MSVC++ version. With some changes I was able to compile and build using MinGW.

After that I got some errors (memory access violations) when testing it with iexplore.exe, then I made some more changes and the errors went away.

However, it appears to do absolutely nothing. I brought up DebugView and there are absolutely no messages being sent, I even tried some OutputDebugString statements into the very beginning of Dllmain (changed back from LibMain) and InstallHook, and even those didn't show up, so it appears to me that it isn't even beginning execution. I know Rundll32.exe is finding the dll, because if I misspell the dll name it complains.

I'm pretty sharp technically but I'm not a very experienced programmer so I don't know how much more headway I'll be able to make on my own, I've tried just about everything I can think of and find with searches. Unfortunately most of the minGW/gcc DLL examples I've found are very simplistic compared to this, for example I had to really dig to find out how do to a shared data segment.

I am developing and testing on W2K using minGW 2.0.0.3, and as recommended on the MinGW website I upgraded two packages:

binutils 2.13.90.20021006-2
w32api-2.1

I'm using Cygwin version 2.249.2.5 to make the development a bit more like Linux, but although Cygwin has its own compiler I set up the path to make sure I'm using the minGW bin executables (e.g., gcc, dllwrap), and I made sure I was using the minGW versions of the libraries that I linked to, so I'm hoping the Cygwin part is irrelevant to the end product.

I have attached 3 files:

mingwsniffer211.c
mingwsniffer211.def
Makefile

I'd really appreciate any help I can get making this work.

[EQDoze]

The problem is there is so little documentation on DLLTOOLS. As a result, most people can't figure out how to make it export the symbols, and make a "shared" segment.

[Elmo]

As far as I could tell, the code above was exporting the symbols--I know when I tried having it generate its own .DEF file it created the 3 functions (InstallHook, HookProc, ReleaseHook). Also, on some link attempts I got linker warnings that it was resolving "_InstallHook" by linking to "_InstallHook@16" (I think that's the number it used, and got similar messages for all 3 exported functions, so it would seem to me that the linker was finding them.

I have not yet tried generating the symbols directly from the finished .DLL file to see what that shows, I'll see if I can do that.

As far as the shared data segment goes, I did find some posts that indicated the syntax I used was correct, putting this:

__attribute__((section ("shared"), shared))

after each variable definition. This was confirmed in the GCC documentation here:

http://gcc.gnu.org/onlinedocs/gcc/Variable-Attributes.html

I don't know how to verify that the shared data segment is being created in the DLL, all I know is that it is compiling and linking with no errors, but it doesn't appear to do anything when I run it.

[MisterSpock]

Elmo,

If you have a disassembler (Like Win32DASM), you can take a look at the exported symbols from a DLL. You can also look at the sections created.