[Q] Older Windows (NT) support?

[roytam1]

I wonder if it is possible to hook child program even if there is no autohook support?

[adoxa]

Sorry, I'm not sure what you're asking.

[roytam1]

readme stated that ansicon supports win2000 or later, and I wonder if we can reduce functionality to make it work in older winNT?

[adoxa]

Had a quick look and it seems CreateRemoteThread requires "Windows NT Workstation", but everything else I looked at also supported 9X. I'm pretty sure I had a reason for making 2k the minimum, but not sure why now (I thought it was the virtual memory stuff, but that seems okay). (I don't think there's any need for 9X support anyway, as the DOS drivers work, there.)

[roytam1]

older windows NT (for example, NT 3.51) has no CreateToolhelp32Snapshot/Module32First/Module32Next etc., and I wonder if we can still work without these and just hook child's stdin/stderr/stdout to provide something ansi.sys alike functionality.

[adoxa]

You could ignore the parent process (primarily used to hook into the current cmd), but it's also used to hook all the other modules of a process, meaning without them it would only hook the child's own directly-used functions, not anything else (e.g. msvcrt.dll). You could probably emulate toolhelp via the VirtualQuery functions (look at get_ntdll), but I'm certainly not bothered to support that far back.

[roytam1]

hmm, in NT 3.1 there is even no VirtualAllocEx and VirtualFreeEx so it will be impossible to hot-patching child code.
I just wonder if only process child's stdout/stderr/stdin on such system? (K95 seems to work in NT 3.1 in such manner, albeit slow)

[adoxa]

Since it needs to allocate memory in the child process for the new import table I don't see how. I guess some binaries might be able to do it in-place, but that's fragile. Is child | ansicon an option?

[roytam1]

Is child | ansicon an option?

I just don't know if cmd's pipe will pass stderr to ansicon or not, and K95 -C "pipe another-command" seems to create its own input and output pipes and setup child STARTUPINFO's hStdInput, hStdOutput and hStdError to newly created pipes and run it with defined STARTUPINFO.

so it could be ansicon child to startup child with pipes created by ansicon?

[adoxa]

child 2>&1 | ansicon (assuming that type of redirection wasn't added later), although it's not quite the same thing (that's why I created ErrOut, but it has the same injection issues).

Yeah, that should work. I'm still not going to do it, though.