ChaosProtector 2.8.0: CLion and MinGW-w64 Support

MinGW-w64 Is Now a First-Class Windows Toolchain

ChaosProtector 2.8.0 adds production support for native Windows applications and DLLs built with CLion and MinGW-w64, alongside the existing Microsoft Visual C++ workflow.

MinGW produces standard PE files, but its symbols, thread-local storage, exception metadata, and runtime relocations differ from MSVC in important ways. Treating both toolchains identically can hide private C++ functions from the selector or produce a protected executable that fails before main().

Version 2.8.0 handles those differences throughout the protection pipeline. It supports PE32 (x86) MinGW-w64 DWARF2 builds and PE32+ (x64) MinGW-w64 SEH builds, for both executables and DLLs.

Function Discovery from COFF and MAP Symbols

Unstripped MinGW binaries usually retain an embedded COFF symbol table. ChaosProtector now reads it automatically, discovers private functions, and demangles GNU C++ names before displaying them in the GUI or CLI.

No PDB conversion is required. Open the binary normally and select functions by their readable C++ names.

If your release pipeline strips the executable, generate a GNU linker MAP file with the same basename as the PE:

g++ -O2 app.cpp -Wl,-Map,myapp.map -o myapp.exe

Keep myapp.exe and myapp.map in the same directory while opening or protecting the binary. ChaosProtector loads the sidecar automatically. This also works with MAP output produced by common CLion/CMake MinGW configurations.

You can inspect the discovered function list from a script:

ChaosProtectorGui.exe --console myapp.exe --list-functions-json

Then virtualize selected functions by name:

ChaosProtectorGui.exe --console myapp.exe --vm `
  -s "ValidateLicense" -s "ProcessPayment" `
  --strings --imports --integrity

TLS-Safe Import Protection

MinGW's C and C++ runtimes use TLS callbacks before the program entry point to initialize runtime state, static TLS, constructors, and thread_local data.

Import protection therefore cannot wait until main() to restore the Import Address Table. ChaosProtector 2.8.0 installs a TLS-first resolver that runs before the original MinGW CRT callbacks, then preserves and invokes the original callback chain in order.

The protected image retains the original TLS template, index, zero-fill requirements, callback metadata, and required base relocations. Import resolution supports both name and ordinal imports on x86 and x64.

GCC Exception and Unwind Safety

Exception handling is one area where a protector must be conservative. Moving a function behind a VM frame without preserving its compiler-specific unwind contract can turn a valid throw into a process crash.

ChaosProtector now parses MinGW DWARF and x64 unwind metadata, emits valid unwind information for generated x64 VM and import stubs, and classifies compiler language handlers before virtualization.

When the original GCC semantics can be preserved, the function remains selectable. When they cannot be proven safe—such as an x86 call that may unwind across a virtualized frame—the function is still shown with its name and RVA, but virtualization is disabled with a clear reason.

This is intentional fail-closed behavior: an unsupported function is skipped instead of silently producing a broken protected executable. Other safe functions in the same binary remain available for protection.

MinGW Runtime Pseudo-Relocations

MinGW auto-imports may use runtime pseudo-relocation tables in addition to the standard PE base relocation directory. Rewriting a function that overlaps one of those targets can invalidate the runtime fixup.

Version 2.8.0 recognizes MinGW pseudo-relocation v1 and v2 records. Functions containing an unsafe target remain visible but are excluded from layout-changing virtualization or obfuscation.

Supported Configurations

The MinGW compatibility suite covers:

• MinGW-w64 x86 DWARF2 and x64 SEH executables
• Executables and DLLs with dynamic or static runtime linkage
• Unstripped COFF symbols and stripped builds with same-basename MAP files
• Private and exported C++ functions with GNU name demangling
• TLS callbacks, constructors, static TLS, and thread_local data
• Name and ordinal imports, with import protection plus integrity checking
• C++ exception propagation on supported x64 paths
• x86 calling conventions including cdecl, stdcall, fastcall, thiscall, varargs, structure returns, and x87 returns

The release passed the complete MinGW regression suite in both Release and Debug configurations.

Upgrading

Existing MSVC projects do not need configuration changes. CLion and MinGW-w64 users can open their normal .exe or .dll directly. For stripped outputs, add the same-basename MAP linker option shown above.

Download ChaosProtector 2.8.0 from the dashboard, inspect the detected functions, and test the protected output before shipping it—just as you would with any post-build binary transformation.