ansicon crashes

[rmroczk]

I have installed the ansicon 189 64 bit version of the exe and dll into a directory in the PATH on a Windows 2012 R2 server. After launching ansicon I attempt to execute a script that sends a color code as ESC[38;2;124m and ansicon crashes immediately when this code is sent to the terminal.

Problem signature:
Problem Event Name: APPCRASH
Application Name: cmd.exe
Application Version: 6.3.9600.17415
Application Timestamp: 545042b1
Fault Module Name: ANSI64.dll
Fault Module Version: 1.8.9.0
Fault Module Timestamp: 5cc6d028
Exception Code: c0000005
Exception Offset: 0000000000002887
OS Version: 6.3.9600.2.0.0.272.7
Locale ID: 1033
Additional Information 1: 5ac4
Additional Information 2: 5ac4c9413d60a0981fa3a71ecc42ba58
Additional Information 3: 656b
Additional Information 4: 656bf9c6e05fa6ed24a86ea10c6169ef

PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 45 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=2d07
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files

[adoxa]

According to the crash address it's not the sequence causing the crash, but injecting into a DLL. Here's a DLL that will catch and log it. Run the script with ansicon -l2 SCRIPT (you'll also explicitly need the program if it's not a batch, e.g. ansicon -l2 python script.py) and post %TEMP%\ansicon.log (or just tell me what's inaccessible).

[rmroczk]

The version of the DLL provided does not cause a crash however when I run the php script by passing it to ansicon as directed the color codes output by the script are neither visible on the terminal nor do have any visible effect. When I invoke ansicon without passing the script and launch the script inside the subshell the escape sequences appear on the terminal and do not result in any color changes on the terminal.

The attached log file is from the former script execution and the log snippet below is from the latter.
ansicon.log

ANSICON (64-bit) v1.89 log (2) started 2020-04-04 1:54:26

ansicon (5588): CreateProcessW: , C:\Windows\system32\cmd.exe
ansicon (5588): cmd (8820)
ansicon (5588): 64-bit console (base = 00007FF7_A6370000)

cmd (8820): hDllInstance = 00000000_74670000
cmd (8820): Storing my imports
cmd (8820): Hooking cmd.exe
cmd (8820): Hooking ntdll.dll
cmd (8820): Hooking KERNELBASE.dll
cmd (8820): Hooking SYSFER.DLL
cmd (8820): Hooking msvcrt.dll
cmd (8820): Hooking completed
cmd (8820): CreateProcessW: "D:\Automation\manageiiscert.php", manageiiscert.php -d2
cmd (8820): Failed (193)
cmd (8820): LoadLibraryExW "NTDLL.DLL"
cmd (8820): Hooking winbrand.dll
cmd (8820): Hooking cmdext.dll
cmd (8820): Hooking SHELL32.dll
cmd (8820): Hooking combase.dll
cmd (8820): Hooking USER32.dll
cmd (8820): Hooking SHLWAPI.dll
cmd (8820): Hooking GDI32.dll
cmd (8820): Hooking RPCRT4.dll
cmd (8820): Hooking SspiCli.dll
cmd (8820): Hooking sechost.dll
cmd (8820): Hooking IMM32.DLL
cmd (8820): Hooking MSCTF.dll
cmd (8820): Hooking SHCORE.dll
cmd (8820): Hooking uxtheme.dll
cmd (8820): Hooking ole32.dll
cmd (8820): Hooking kernel.appcore.dll
cmd (8820): Hooking CRYPTBASE.dll
cmd (8820): Hooking bcryptPrimitives.dll
cmd (8820): Hooking PROPSYS.dll
cmd (8820): Hooking OLEAUT32.dll
cmd (8820): Hooking ADVAPI32.dll
cmd (8820): Hooking clbcatq.dll
cmd (8820): Hooking profapi.dll
cmd (8820): Hooking CRYPTSP.dll
cmd (8820): Hooking rsaenh.dll
cmd (8820): Hooking bcrypt.dll
cmd (8820): Hooking Secur32.dll
cmd (8820): Hooking SETUPAPI.dll
cmd (8820): Hooking CFGMGR32.dll
cmd (8820): Hooking pcacli.dll
cmd (8820): Hooking MPR.dll
cmd (8820): Hooking apphelp.dll
cmd (8820): Hooking sfc_os.dll
cmd (8820): Hooking DEVRTL.dll
cmd (8820): Hooking completed

[adoxa]

The version of the DLL provided does not cause a crash

Nor does it show anything as inaccessible. Strange.

however when I run the php script by passing it to ansicon as directed the color codes output by the script are neither visible on the terminal nor do have any visible effect.

That could possibly be because there's a mistake in sequences.txt where I swapped 2 and 5 - 2 is the RGB value and expects three arguments, so your 38;2;124m sequence will correctly be ignored; you want 38;5;124m for the index.

When I invoke ansicon without passing the script and launch the script inside the subshell the escape sequences appear on the terminal and do not result in any color changes on the terminal.

cmd (8820): CreateProcessW: "D:\Automation\manageiiscert.php", manageiiscert.php -d2
cmd (8820): Failed (193)

That looks like ANSICON isn't picking up the script program (on 7 with Python I get another CreateProcessW for python.exe, but you don't have one for php.exe). That could be due to delayed imports not being hooked.

[rmroczk]

Weird, My script was originally sending the proper sequence of 38;5;124m but it had no effect and it was only after reading the sequence.txt that I changed it. I reverted this change and I'm now seeing colors with the new dll but only if I call the script as an argument to ansicon. Running the script inside the shell from ansicon is still just echoing the sequences to the terminal as is.

[adoxa]

Here's an update that fixes scripts run directly by cmd. It also moves the crash test to log level 64 (undocumented). Try without logging and see if it still crashes (it doesn't crash any 64-bit cmd running .js via cscript on 10.0.18362.175); if it does crash try -l66 and post the log.

[adoxa]

Have you tried this, @rmroczk?

[rmroczk]

sorry for not responding sooner. Yes the new DLL works without crashing from inside cmd. I meant to also let you know that the previous ansi.dll you provided also worked from inside cmd but not immediately, it took about 10-15 seconds or so before it started working. The new version I just tested appears to have fixed that hook delay. thanks much.

[adoxa]

Okay, couple of other tweaks to make then I'll put out a new release.