ANSICON provides ANSI escape sequences for Windows console programs. It
provides much the same functionality as ANSI.SYS does for MS-DOS.
- 32-bit: Windows 2000 Professional and later (it won't work with NT or 9X).
- 64-bit: AMD64 (it won't work with IA64).
ANSICON injects a DLL into a process, hooking its functions.
One of three methods is used to inject the DLL.
-
LoadLibraryviaCreateRemoteThreadfor a running process. -
LdrLoadDllviaCreateRemoteThreadfor a 64-bit .NET AnyCPU process. -
Adding the DLL directly to the import table, otherwise.
Hooking is achieved by modifying import addresses, or the return value of
GetProcAddress.
