d7a2be9964
Processes on Windows 10 that return rather than call `ExitProcess` may have a 30 second delay before terminating. This seems due to the console creating a thread. Detect a detached primary thread and explicitly call `ExitProcess`.
ANSICON 
ANSICON provides ANSI escape sequences for Windows console programs. It
provides much the same functionality as ANSI.SYS does for MS-DOS.
Requirements
- 32-bit: Windows 2000 Professional and later (it won't work with NT or 9X).
- 64-bit: AMD64 (it won't work with IA64).
How it Works
ANSICON injects a DLL into a process, hooking its functions.
Injection
One of three methods is used to inject the DLL.
-
LoadLibraryviaCreateRemoteThreadfor a running process. -
LdrLoadDllviaCreateRemoteThreadfor a 64-bit .NET AnyCPU process. -
Adding the DLL directly to the import table, otherwise.
Hooking
Hooking is achieved by modifying import addresses, or the return value of
GetProcAddress.