How Do I Modify The W2K Startup Logo?

Originally published in:

             W2Knews[tm] Electronic Newsletter

            Vol. 6, #59 – Aug 6, 2001 – Issue #294

Published by sunbelt-software.com since 1996 – ISSN: 1527-3407


How Do I Modify The W2K Startup Logo?
Tired of gazing at that boring W2K-logo when booting? Here’s a way

to change that to your company logo or other even more fun things.

This is also at the same time a tutorial about the W2K file protection

system. When I saw that one of our Techs had done this, I asked him

to write it up so here you go:
In order to modify the W2K startup logo you have to be aware of a

few things up front:
#1.  The logo is a 16 color (not bit) bitmap that is 640 by 480 in

size.  It is built into the ntoskrnl.exe.
#2.  W2k file protection will *not* let you just modify this file

and place it in the system32 directory, it will be overwritten

shortly thereafter with the original.
Knowing this you’ll need a tool to pull apart the ntoskrnl.exe and

replace the bitmap.  I’m using a tool called “Resource Hacker”.

This is available here:
http://rpi.net.au/~ajohnson/resourcehacker/
It’s a fairly simple program, just extract the files to a directory

and run the exe.  Once it’s open, do a “File/Open” and select your

ntoskrnl.exe.  This is located in X:\winnt\sytem32.
You’ll get 3 main folders, Bitmap is the one we want to work with.

If you are on W2k Pro, it’s under the directory “1” and is called

“1033”.  If you run W2k Server, it’s under “4” and is also called

“1033”. You’ll see the current boot time logo.
Now you can do “Action/Replace Bitmap”. Select the bitmap you have

created to replace the old bitmap. Or, you could export the bitmap,

modify it, then import it back in.  It is very important that you

do not deviate from 640×480 w/ 16 colors.   Here is a nice gallery

of already created images that could be downloaded and quickly

converted to 16 color bmps:
http://www.littlewhitedog.com/reviews_other_00025.asp
In the Replace Bitmap browser once you have selected the new bitmap

you’ll need to select the bitmap number in the bottom right that

you wish to replace.  “1” for Pro and “4” for Server (or Adv Server).
Now you need to do a “File/Save As” and save the file somewhere on

your drive.  Do *NOT* save it in the same directory or it will be

quickly snarfed up by Windows File Protection.
For the next step we’ll need a tool that can open .CAB files as

well as create them.  I used WinAce:
www.winace.com 
Now you’ll need to open the latest service pack .cab file that you

have in your system.  This file is located in X:\winnt\driver cache\i386

and will be called something like SP1.cab or SP2.cab. Extract the

contents of the most current one to a directory.  Now take your

modified ntoskrnl.exe and drop it in that directory, it will

overwrite the existing one.
Re-compress the all the files back into a .CAB and overwrite the

original SP1.cab or SP2.cab (Back up the original first just in case).

Then drop your modified ntoskrnl.exe into X:\winnt\system32\dllcache

and X:\winnt\system32, in that order.  This way Windows file protection

has nowhere to get the original ntoskrnl.exe and leaves well enough

alone. At this point, you can reboot.
You hose your system, it’s not my fault…  I’ve done it about 20 times

on different systems and haven’t had a problem yet. Special thanks to

www.littlewhitedog.com and their forums for supplying much of the

information in this report.
Greg Kras   MCP+I  MCSE

Sunbelt Software Technical Services Manager