ansicon -i causes hangs

[bilogic]

I'm on Windows 7 and used ansicon -i to install, but when I start cmd.exe, it hangs/gets stuck like shown in screenshot. Any idea why?

Thank you.

[adoxa]

Not offhand, as that's what I use without incident. You can uninstall by using the Run dialog to run cmd /d, then ansicon -u from there. Does just ansicon work? It looks like you're using something to change appearance, perhaps that's interfering? Try ansicon -l2 to get a log of the modules in %temp%\ansicon.log.

[bilogic]

Hi,

1. just ansicon works
2. logs

ANSICON (64-bit) v1.86 log (2) started 2018-11-09 13:28:05

ansicon (35348): CreateProcessW: <null>, C:\Windows\system32\cmd.exe
ansicon (35348): cmd (15924)
ansicon (35348):   64-bit console (base = 00000000_4A1E0000)

cmd (15924): hDllInstance = 00000000_5C880000
cmd (15924): Storing my imports
cmd (15924): Hooking cmd.exe
cmd (15924): Hooking ntdll.dll
cmd (15924): Hooking KERNELBASE.dll
cmd (15924): Hooking msvcrt.dll
cmd (15924): Hooking WINBRAND.dll
cmd (15924): Hooking USER32.dll
cmd (15924): Hooking GDI32.dll
cmd (15924): Hooking LPK.dll
cmd (15924): Hooking USP10.dll
cmd (15924): Hooking completed
cmd (15924): LoadLibraryA "gdi32.dll"
cmd (15924):   Hooking completed
cmd (15924): LoadLibraryW "C:\Windows\system32\IMM32.DLL"
cmd (15924):   Hooking IMM32.DLL
cmd (15924):   Hooking MSCTF.dll
cmd (15924):   Hooking completed

3. Is there a way to make the installed ansicon produce logs by default?

[adoxa]

1. Okay, that suggests it's particular to -p. Does ansicon -p directly in cmd also freeze? I'm slack to update, might be time to do so...

2. Looks normal.

3. ansicon -l2 -i.

[bilogic]

After uninstalling, I did a ansicon -l2 -i, followed by running cmd.exe, here is the log

ANSICON (64-bit) v1.86 log (2) started 2018-11-09 13:49:56

ansicon (45140): hDllInstance = 00000000_59A50000
ansicon (45140): Storing my imports
ansicon (45140): Hooking ansicon.exe
ansicon (45140): Hooking ntdll.dll
ansicon (45140): Hooking KERNELBASE.dll
ansicon (45140): Hooking msvcrt.dll
ansicon (45140): Hooking ADVAPI32.dll
ansicon (45140): Hooking sechost.dll
ansicon (45140): Hooking RPCRT4.dll
ansicon (45140): Hooking completed

still stuck with the same -p.

[adoxa]

That log doesn't look right, here's the start of mine.

ANSICON (64-bit) v1.86 log (2) started 2018-11-09 15:39:01

ansicon (7968): Parent = cmd.exe (6296)

cmd (6296): hDllInstance = 00000000_657B0000
cmd (6296): Storing my imports
cmd (6296): Hooking cmd.exe
...

So the initial install should have the parent line and be hooking into cmd.exe, not ansicon.exe.

And -i implies -p, so it seems to be working okay directly from the command line.

[bilogic]

The logs seems to be clearing itself each time, this is what I have now.

ANSICON (64-bit) v1.86 log (2) started 2018-11-09 14:12:27

ansicon (15664): Parent = cmd.exe (28252)
ansicon (15664):   ANSICON already loaded
ansicon (15664): Terminating
ansicon (15664): Unhooking ansicon.exe
ansicon (15664): Unhooking ntdll.dll
ansicon (15664): Unhooking KERNELBASE.dll
ansicon (15664): Unhooking msvcrt.dll
ansicon (15664): Unhooking ADVAPI32.dll
ansicon (15664): Unhooking sechost.dll
ansicon (15664): Unhooking RPCRT4.dll
ansicon (15664): Unhooking completed

[bilogic]

To answer your earlier question, ansicon -p directly in command line does not freeze.

[adoxa]

Try ansicon -l10 -i - that will append to the existing log.

[bilogic]

Hi,

Not sure why I missed this, but ansicon -l10 -i is appending to logs. Let me get back when I see something odd. Thank you.

[bilogic]

Hi,

I found ansicon in my taskmanager consuming 100% CPU load on one of my cores. I terminated it and one of my 4 am scheduled tasks began to run. The scheduled task starts a batch file.

However, there is no trace of ansicon being started at 4 am in the logs. I extracted the tail end of the logs from 8 pm the day before til end. Any ideas? Thank you.

logs.txt

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-18 20:06:30

ansicon (24904): Parent = cmd.exe (24600)

cmd (24600): hDllInstance = 00000000_6E440000
cmd (24600): Storing my imports
cmd (24600): Hooking cmd.exe
cmd (24600): Hooking ntdll.dll
cmd (24600): Hooking KERNELBASE.dll
cmd (24600): Hooking msvcrt.dll
cmd (24600): Hooking WINBRAND.dll
cmd (24600): Hooking USER32.dll
cmd (24600): Hooking GDI32.dll
cmd (24600): Hooking LPK.dll
cmd (24600): Hooking USP10.dll
cmd (24600): Hooking IMM32.DLL
cmd (24600): Hooking MSCTF.dll
cmd (24600): Hooking apphelp.dll
cmd (24600): Hooking completed
cmd (24600): Injection detected
cmd (24600):   Hooking completed

ansicon (24904): Terminating
ansicon (24904): Unhooking ansicon.exe
ansicon (24904): Unhooking ntdll.dll
ansicon (24904): Unhooking KERNELBASE.dll
ansicon (24904): Unhooking msvcrt.dll
ansicon (24904): Unhooking ADVAPI32.dll
ansicon (24904): Unhooking sechost.dll
ansicon (24904): Unhooking RPCRT4.dll
ansicon (24904): Unhooking completed

cmd (24600): CreateProcessW: "C:\WINDOWS\SYSTEM32\notepad.exe", notepad  testbac
kfill.bat
cmd (24600): notepad (21704)
cmd (24600):   64-bit GUI (base = 00000000_FF8B0000)
cmd (24600):   Ignoring
cmd (24600): Terminating
cmd (24600): Unhooking cmd.exe
cmd (24600): Unhooking ntdll.dll
cmd (24600): Unhooking KERNELBASE.dll
cmd (24600): Unhooking msvcrt.dll
cmd (24600): Unhooking WINBRAND.dll
cmd (24600): Unhooking USER32.dll
cmd (24600): Unhooking GDI32.dll
cmd (24600): Unhooking LPK.dll
cmd (24600): Unhooking USP10.dll
cmd (24600): Unhooking IMM32.DLL
cmd (24600): Unhooking MSCTF.dll
cmd (24600): Unhooking apphelp.dll
cmd (24600): Unhooking completed

ansicon (25964): hDllInstance = 00000000_6E440000
ansicon (25964): Storing my imports
ansicon (25964): Hooking ansicon.exe
ansicon (25964): Hooking ntdll.dll
ansicon (25964): Hooking KERNELBASE.dll
ansicon (25964): Hooking msvcrt.dll
ansicon (25964): Hooking ADVAPI32.dll
ansicon (25964): Hooking sechost.dll
ansicon (25964): Hooking RPCRT4.dll
ansicon (25964): Hooking completed

ansicon (27504): hDllInstance = 00000000_6E440000
ansicon (27504): Storing my imports
ansicon (27504): Hooking ansicon.exe
ansicon (27504): Hooking ntdll.dll
ansicon (27504): Hooking KERNELBASE.dll
ansicon (27504): Hooking msvcrt.dll
ansicon (27504): Hooking ADVAPI32.dll
ansicon (27504): Hooking sechost.dll
ansicon (27504): Hooking RPCRT4.dll
ansicon (27504): Hooking completed

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-19 9:20:58

ansicon (27504): Parent = cmd.exe (26172)

cmd (26172): hDllInstance = 00000000_6E440000
cmd (26172): Storing my imports
cmd (26172): Hooking cmd.exe
cmd (26172): Hooking ntdll.dll
cmd (26172): Hooking KERNELBASE.dll
cmd (26172): Hooking msvcrt.dll
cmd (26172): Hooking WINBRAND.dll
cmd (26172): Hooking USER32.dll
cmd (26172): Hooking GDI32.dll
cmd (26172): Hooking LPK.dll
cmd (26172): Hooking USP10.dll
cmd (26172): Hooking IMM32.DLL
cmd (26172): Hooking MSCTF.dll
cmd (26172): Hooking apphelp.dll
cmd (26172): Hooking completed
cmd (26172): Injection detected
cmd (26172):   Hooking completed

ansicon (27504): Terminating
ansicon (27504): Unhooking ansicon.exe
ansicon (27504): Unhooking ntdll.dll
ansicon (27504): Unhooking KERNELBASE.dll
ansicon (27504): Unhooking msvcrt.dll
ansicon (27504): Unhooking ADVAPI32.dll
ansicon (27504): Unhooking sechost.dll
ansicon (27504): Unhooking RPCRT4.dll
ansicon (27504): Unhooking completed

cmd (26172): Terminating
cmd (26172): Unhooking cmd.exe
cmd (26172): Unhooking ntdll.dll
cmd (26172): Unhooking KERNELBASE.dll
cmd (26172): Unhooking msvcrt.dll
cmd (26172): Unhooking WINBRAND.dll
cmd (26172): Unhooking USER32.dll
cmd (26172): Unhooking GDI32.dll
cmd (26172): Unhooking LPK.dll
cmd (26172): Unhooking USP10.dll
cmd (26172): Unhooking IMM32.DLL
cmd (26172): Unhooking MSCTF.dll
cmd (26172): Unhooking apphelp.dll
cmd (26172): Unhooking completed

ansicon (26584): hDllInstance = 00000000_6E440000
ansicon (26584): Storing my imports
ansicon (26584): Hooking ansicon.exe
ansicon (26584): Hooking ntdll.dll
ansicon (26584): Hooking KERNELBASE.dll
ansicon (26584): Hooking msvcrt.dll
ansicon (26584): Hooking ADVAPI32.dll
ansicon (26584): Hooking sechost.dll
ansicon (26584): Hooking RPCRT4.dll
ansicon (26584): Hooking completed

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-19 9:21:10

ansicon (26584): Parent = cmd.exe (26988)

cmd (26988): hDllInstance = 00000000_6E440000
cmd (26988): Storing my imports
cmd (26988): Hooking cmd.exe
cmd (26988): Hooking ntdll.dll
cmd (26988): Hooking KERNELBASE.dll
cmd (26988): Hooking msvcrt.dll
cmd (26988): Hooking WINBRAND.dll
cmd (26988): Hooking USER32.dll
cmd (26988): Hooking GDI32.dll
cmd (26988): Hooking LPK.dll
cmd (26988): Hooking USP10.dll
cmd (26988): Hooking IMM32.DLL
cmd (26988): Hooking MSCTF.dll
cmd (26988): Hooking apphelp.dll
cmd (26988): Hooking completed
cmd (26988): Injection detected
cmd (26988):   Hooking completed

ansicon (26584): Terminating
ansicon (26584): Unhooking ansicon.exe
ansicon (26584): Unhooking ntdll.dll
ansicon (26584): Unhooking KERNELBASE.dll
ansicon (26584): Unhooking msvcrt.dll
ansicon (26584): Unhooking ADVAPI32.dll
ansicon (26584): Unhooking sechost.dll
ansicon (26584): Unhooking RPCRT4.dll
ansicon (26584): Unhooking completed

cmd (26988): Terminating
cmd (26988): Unhooking cmd.exe
cmd (26988): Unhooking ntdll.dll
cmd (26988): Unhooking KERNELBASE.dll
cmd (26988): Unhooking msvcrt.dll
cmd (26988): Unhooking WINBRAND.dll
cmd (26988): Unhooking USER32.dll
cmd (26988): Unhooking GDI32.dll
cmd (26988): Unhooking LPK.dll
cmd (26988): Unhooking USP10.dll
cmd (26988): Unhooking IMM32.DLL
cmd (26988): Unhooking MSCTF.dll
cmd (26988): Unhooking apphelp.dll
cmd (26988): Unhooking completed

ansicon (24260): hDllInstance = 00000000_6E440000
ansicon (24260): Storing my imports
ansicon (24260): Hooking ansicon.exe
ansicon (24260): Hooking ntdll.dll
ansicon (24260): Hooking KERNELBASE.dll
ansicon (24260): Hooking msvcrt.dll
ansicon (24260): Hooking ADVAPI32.dll
ansicon (24260): Hooking sechost.dll
ansicon (24260): Hooking RPCRT4.dll
ansicon (24260): Hooking completed

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-19 9:22:02

ansicon (24260): Parent = cmd.exe (23080)

cmd (23080): hDllInstance = 00000000_6E440000
cmd (23080): Storing my imports
cmd (23080): Hooking cmd.exe
cmd (23080): Hooking ntdll.dll
cmd (23080): Hooking KERNELBASE.dll
cmd (23080): Hooking msvcrt.dll
cmd (23080): Hooking WINBRAND.dll
cmd (23080): Hooking USER32.dll
cmd (23080): Hooking GDI32.dll
cmd (23080): Hooking LPK.dll
cmd (23080): Hooking USP10.dll
cmd (23080): Hooking IMM32.DLL
cmd (23080): Hooking MSCTF.dll
cmd (23080): Hooking apphelp.dll
cmd (23080): Hooking completed
cmd (23080): Injection detected
cmd (23080):   Hooking completed

ansicon (24260): Terminating
ansicon (24260): Unhooking ansicon.exe
ansicon (24260): Unhooking ntdll.dll
ansicon (24260): Unhooking KERNELBASE.dll
ansicon (24260): Unhooking msvcrt.dll
ansicon (24260): Unhooking ADVAPI32.dll
ansicon (24260): Unhooking sechost.dll
ansicon (24260): Unhooking RPCRT4.dll
ansicon (24260): Unhooking completed

cmd (23080): LoadLibraryExA "USER32.dll"
cmd (23080):   Hooking completed

[bilogic]

I just started a prompt session which was stuck, looking in taskmanager, I see with ansicon at 100% CPU load. The last entry in the logs are very similiar to the one in my post an hour ago, it has the LoadLibraryExA:

cmd (25272): LoadLibraryExA "USER32.dll"
cmd (25272):   Hooking completed

which is quite unlike the other entries. Any ideas? Thank you.

The full log entry as follows:

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-19 10:47:19

ansicon (13484): Parent = cmd.exe (25272)

cmd (25272): hDllInstance = 00000000_6E440000
cmd (25272): Storing my imports
cmd (25272): Hooking cmd.exe
cmd (25272): Hooking ntdll.dll
cmd (25272): Hooking KERNELBASE.dll
cmd (25272): Hooking msvcrt.dll
cmd (25272): Hooking WINBRAND.dll
cmd (25272): Hooking USER32.dll
cmd (25272): Hooking GDI32.dll
cmd (25272): Hooking LPK.dll
cmd (25272): Hooking USP10.dll
cmd (25272): Hooking IMM32.DLL
cmd (25272): Hooking MSCTF.dll
cmd (25272): Hooking apphelp.dll
cmd (25272): Hooking completed
cmd (25272): Injection detected
cmd (25272):   Hooking completed

ansicon (13484): Terminating
ansicon (13484): Unhooking ansicon.exe
ansicon (13484): Unhooking ntdll.dll
ansicon (13484): Unhooking KERNELBASE.dll
ansicon (13484): Unhooking msvcrt.dll
ansicon (13484): Unhooking ADVAPI32.dll
ansicon (13484): Unhooking sechost.dll
ansicon (13484): Unhooking RPCRT4.dll
ansicon (13484): Unhooking completed

cmd (25272): LoadLibraryExA "USER32.dll"
cmd (25272):   Hooking completed

[adoxa]

Oh, it's ansicon that's getting stuck in a loop. Here's a 64-bit exe with some additional logging (line numbers, as I don't really know where to look). As there doesn't seem to be a problem with hooking, reinstall with -l9 to reduce log size. So the new log should look something like this:

ansicon (848): hDllInstance = 00AC0000
ansicon (848): [line 304]
ansicon (848): [line 310]
ansicon (848): [line 317]
ansicon (848): [line 323]
ansicon (848): [line 329]
ansicon (848): [line 348]
ansicon (848): [line 377]

========================================================================

ANSICON (32-bit) v1.88 log (9) started 2019-04-19 16:31:23

ansicon (848): [line 407]
ansicon (848): [line 411]
ansicon (848): Parent = cmd.exe (8036)

[bilogic]

Ok,

1. Downloaded and replaced.
2. Executed ansicon.exe -i -l9

Will update again. Thank you.

[bilogic]

I opened and closed my cmd several times to induce a hang, Once it hung, I took the last 2 entries of the log.

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-19 15:24:42

ansicon (1392): [line 407]
ansicon (1392): [line 411]
ansicon (1392): Parent = cmd.exe (24688)

cmd (24688): hDllInstance = 00000000_6E440000
cmd (24688): Storing my imports
cmd (24688): Hooking cmd.exe
cmd (24688): Hooking ntdll.dll
cmd (24688): Hooking KERNELBASE.dll
cmd (24688): Hooking msvcrt.dll
cmd (24688): Hooking WINBRAND.dll
cmd (24688): Hooking USER32.dll
cmd (24688): Hooking GDI32.dll
cmd (24688): Hooking LPK.dll
cmd (24688): Hooking USP10.dll
cmd (24688): Hooking IMM32.DLL
cmd (24688): Hooking MSCTF.dll
cmd (24688): Hooking apphelp.dll
cmd (24688): Hooking completed
cmd (24688): Injection detected
cmd (24688):   Hooking completed

ansicon (1392): [line 435]
ansicon (1392): Terminating
ansicon (1392): Unhooking ansicon.exe
ansicon (1392): Unhooking ntdll.dll
ansicon (1392): Unhooking KERNELBASE.dll
ansicon (1392): Unhooking msvcrt.dll
ansicon (1392): Unhooking ADVAPI32.dll
ansicon (1392): Unhooking sechost.dll
ansicon (1392): Unhooking RPCRT4.dll
ansicon (1392): Unhooking completed

cmd (24688): Terminating
cmd (24688): Unhooking cmd.exe
cmd (24688): Unhooking ntdll.dll
cmd (24688): Unhooking KERNELBASE.dll
cmd (24688): Unhooking msvcrt.dll
cmd (24688): Unhooking WINBRAND.dll
cmd (24688): Unhooking USER32.dll
cmd (24688): Unhooking GDI32.dll
cmd (24688): Unhooking LPK.dll
cmd (24688): Unhooking USP10.dll
cmd (24688): Unhooking IMM32.DLL
cmd (24688): Unhooking MSCTF.dll
cmd (24688): Unhooking apphelp.dll
cmd (24688): Unhooking completed

ansicon (14488): hDllInstance = 00000000_6E440000
ansicon (14488): Storing my imports
ansicon (14488): Hooking ansicon.exe
ansicon (14488): Hooking ntdll.dll
ansicon (14488): Hooking KERNELBASE.dll
ansicon (14488): Hooking msvcrt.dll
ansicon (14488): Hooking ADVAPI32.dll
ansicon (14488): Hooking sechost.dll
ansicon (14488): Hooking RPCRT4.dll
ansicon (14488): Hooking completed
ansicon (14488): [line 304]
ansicon (14488): [line 310]
ansicon (14488): [line 317]
ansicon (14488): [line 323]
ansicon (14488): [line 329]
ansicon (14488): [line 348]
ansicon (14488): [line 377]

========================================================================

ANSICON (64-bit) v1.88 log (10) started 2019-04-19 15:24:45

ansicon (14488): [line 407]
ansicon (14488): [line 411]
ansicon (14488): Parent = cmd.exe (26072)

cmd (26072): hDllInstance = 00000000_6E440000
cmd (26072): Storing my imports
cmd (26072): Hooking cmd.exe
cmd (26072): Hooking ntdll.dll
cmd (26072): Hooking KERNELBASE.dll
cmd (26072): Hooking msvcrt.dll
cmd (26072): Hooking WINBRAND.dll
cmd (26072): Hooking USER32.dll
cmd (26072): Hooking GDI32.dll
cmd (26072): Hooking LPK.dll
cmd (26072): Hooking USP10.dll
cmd (26072): Hooking IMM32.DLL
cmd (26072): Hooking MSCTF.dll
cmd (26072): Hooking apphelp.dll
cmd (26072): Hooking completed
cmd (26072): Injection detected
cmd (26072):   Hooking completed

ansicon (14488): [line 435]
ansicon (14488): Terminating
ansicon (14488): Unhooking ansicon.exe
ansicon (14488): Unhooking ntdll.dll
ansicon (14488): Unhooking KERNELBASE.dll
ansicon (14488): Unhooking msvcrt.dll
ansicon (14488): Unhooking ADVAPI32.dll
ansicon (14488): Unhooking sechost.dll
ansicon (14488): Unhooking RPCRT4.dll
ansicon (14488): Unhooking completed

cmd (26072): Terminating
cmd (26072): Unhooking cmd.exe
cmd (26072): Unhooking ntdll.dll
cmd (26072): Unhooking KERNELBASE.dll
cmd (26072): Unhooking msvcrt.dll
cmd (26072): Unhooking WINBRAND.dll
cmd (26072): Unhooking USER32.dll
cmd (26072): Unhooking GDI32.dll
cmd (26072): Unhooking LPK.dll
cmd (26072): Unhooking USP10.dll
cmd (26072): Unhooking IMM32.DLL
cmd (26072): Unhooking MSCTF.dll
cmd (26072): Unhooking apphelp.dll
cmd (26072): Unhooking completed

ansicon (6220): hDllInstance = 00000000_6E440000
ansicon (6220): Storing my imports
ansicon (6220): Hooking ansicon.exe
ansicon (6220): Hooking ntdll.dll
ansicon (6220): Hooking KERNELBASE.dll
ansicon (6220): Hooking msvcrt.dll
ansicon (6220): Hooking ADVAPI32.dll
ansicon (6220): Hooking sechost.dll
ansicon (6220): Hooking RPCRT4.dll
ansicon (6220): Hooking completed

[bilogic]

It appears that ansicon -i -l9 does not log all activities. I'm going back to ansicon -i -l10

[adoxa]

Okay, that looks like the DLL is not returning to ansicon, so here's a DLL with line numbers. Order matters, so it's -l9 -i.

[bilogic]

Caught it!

========================================================================

ANSICON (64-bit) v1.88 log (9) started 2019-04-19 23:58:03

ansicon (21320): [line 407]
ansicon (21320): [line 411]
ansicon (21320): Parent = cmd.exe (13020)

cmd (13020): hDllInstance = 00000000_73F10000
cmd (13020): [ANSIDLL line 4133]
cmd (13020): [ANSIDLL line 4136]
cmd (13020): [ANSIDLL line 4140]
cmd (13020): [ANSIDLL line 4144]
cmd (13020): [ANSIDLL line 4146]
cmd (13020): [ANSIDLL line 4150]
cmd (13020): [ANSIDLL line 4154]
cmd (13020): [ANSIDLL line 4157]

ansicon (21320): [line 435]
ansicon (21320): Terminating

cmd (13020): Terminating

ansicon (2156): hDllInstance = 00000000_73F10000
ansicon (2156): [ANSIDLL line 4133]

[adoxa]

I think you might have a full 32-bit window handle, which causes my custom printf replacement to fail. Here's another DLL which does it properly. Verify this works and I'll release 1.89.

[bilogic]

Ok, I replaced it and opened like 50 times, no stucks, but it is a unreliable test. I suggest we give it 3 days or so, if there are no incidents I think we can assume it's resolved. Thank you so much!

[bilogic]

Thanks alot! No more hangs til date.