2014-07-01 22:56:13 +02:00
|
|
|
# ANSICON [](https://github.com/adoxa/ansicon/releases)
|
|
|
|
|
2017-11-30 21:22:10 +10:00
|
|
|
ANSICON provides ANSI escape sequences for Windows console programs. It
|
2014-07-01 22:56:13 +02:00
|
|
|
provides much the same functionality as `ANSI.SYS` does for MS-DOS.
|
|
|
|
|
2025-01-21 16:30:05 +08:00
|
|
|
`source git`:[https://github.com/adoxa/ansicon](https://github.com/adoxa/ansicon)
|
|
|
|
|
2014-07-01 22:56:13 +02:00
|
|
|
## Requirements
|
|
|
|
|
2017-07-25 18:18:34 +10:00
|
|
|
* 32-bit: Windows 2000 Professional and later (it won't work with NT or 9X).
|
|
|
|
* 64-bit: AMD64 (it won't work with IA64).
|
2017-12-23 22:04:44 +10:00
|
|
|
|
|
|
|
## How it Works
|
|
|
|
|
|
|
|
ANSICON *injects* a DLL into a process, *hooking* its functions.
|
|
|
|
|
|
|
|
### Injection
|
|
|
|
|
|
|
|
One of three methods is used to inject the DLL.
|
|
|
|
|
|
|
|
* `LoadLibrary` via `CreateRemoteThread` for a running process.
|
|
|
|
|
|
|
|
* `LdrLoadDll` via `CreateRemoteThread` for a 64-bit .NET AnyCPU process.
|
|
|
|
|
|
|
|
* Adding the DLL directly to the import table, otherwise.
|
|
|
|
|
|
|
|
### Hooking
|
|
|
|
|
|
|
|
Hooking is achieved by modifying import addresses, or the return value of
|
|
|
|
`GetProcAddress`.
|