Compiling OSSEC with MinGW:ΒΆ

OSSEC’s Windows agent is compiled using MinGW

It has always been a pain to generate snapshots for Windows because it required me to open up my Windows VM (slow), push the code there, compile, etc. Well, until this week when I started to play with MinGW cross-compilation feature to completely build an Windows agent from Linux.

How it works? First, you need to install MinGW and nsis (to build the installer). For OpenSSL support, an OpenSSL MinGW package will also be necessary.

After that, download the source and generate the Windows package directory (replace 2.6 with the latest version or download the latest source here):

Note

On some systems, the command md5, sha1, or wget may not exist. Try md5sum, sha1sum or lynx respectively instead.

Warning

wget may not be able to pull files from the OSSEC site. Use the -U flag to add a UserAgent, or obtain the checksum file by some other manner.

# wget -U ossec http://www.ossec.net/files/ossec-hids-2.8.1.tar.gz
# wget -U ossec http://www.ossec.net/files/ossec-hids-2.8.1-checksum.txt
# cat ossec-hids-2.8.1-checksum.txt
MD5(ossec-hids-2.8.1.tar.gz)= c2ffd25180f760e366ab16eeb82ae382
SHA1(ossec-hids-2.8.1.tar.gz)= 0ecf1df09558dc8bb4b6f65e1fb2ca7a7df9817c
# md5sum ossec-hids-2.8.1.tar.gz
MD5(ossec-hids-2.8.1.tar.gz)= c2ffd25180f760e366ab16eeb82ae382
# sha1sum ossec-hids-2.8.1.tar.gz
SHA1(ossec-hids-2.8.1.tar.gz)= 0ecf1df09558dc8bb4b6f65e1fb2ca7a7df9817c

And generate the Windows package directory:

# cd ossec-hids-2.8.1/src/win32
# ./gen-win.sh

Now, you will have the win-pkg directory under src. Just go there and run make.sh. Your Windows agent package should be created in a few minutes:

Note

The make.sh script may require modification depending on the Linux distribution used.

# cd ../win-pkg
# sh ./make.sh

You will see the following in the screen:

Making windows agent
rootcheck/win-common.c: In function "__os_winreg_querykey":
rootcheck/win-common.c:279: warning: pointer targets in passing argument 7 of "RegEnumValueA" differ in signedness
win-registry.c: In function "os_winreg_querykey":
...

Output: "ossec-win32-agent.exe"
Install: 7 pages (448 bytes), 3 sections (3144 bytes), 379 instructions (10612 bytes), 247 strings (42580 bytes), 1 language table (346 bytes).
Uninstall: 5 pages (320 bytes),
1 section (1048 bytes), 301 instructions (8428 bytes), 166 strings (2646 bytes), 1 language table (290 bytes).
Datablock optimizer saved 8371 bytes (~0.7%).

Which means that your agent executable ossec-win32-agent.exe has been created properly.