So just replacing bitmap while keeping same layout is just boring. What about putting Beta boot screen into retail?
cross post from betaarchive:
I think I found the position that sets progress bar and scrolling bar:
NTOSKRNL.EXE 5.0.2195.7376, CHT, 1,691,648 bytes
File Date: Thursday, 18 February, 2010, 20:17:26
SHA256: 86356E3BB6DB3E873AE8C881358233F5CD142EC2CEDF34D7B007B427CE085394
.text:0041D14A loc_41D14A: ; CODE XREF: sub_41CFF6+14Aj
.text:0041D14A push 1B5h
.text:0041D14F push 112h
.text:0041D154 call sub_41CDAC
.text:0041D159 push offset loc_41D1F4
.text:0041D15E mov dword_476070, 1A0h
.text:0041D168 mov dword_47606C, esi
.text:0041D16E mov dword_476000, 280h
.text:0041D178 mov dword_475F40, 0Ah
.text:0041D182 call InbvInstallDisplayStringFilter
Y = 0x1B5=437, X = 0x112=274 is progress bar starting location
Y= dword_476070 = 0x1A0 = 416
X = dword_47606C = esi = 0
W = dword_476000 = 0x280 = 640
H = dword_475F40 = 0x0A = 10
is scrolling bar location.
but there is difficulty on setting dword_47606C, since "mov dword_47606C, esi" is 4-bytes shorter than others.
--
so hacking around it is working!
(VA)0x41d14a:
68 b5 01 00 00 push 0x1b5
e9 6d 29 04 00 jmp 0x45fac1
be a0 00 00 00 mov esi, 0xa0 /* it is 0x41D154 here */
(VA)0x45fac1:
68 21 01 00 00 push 0x121
e8 e1 d2 fb ff call 0x41CDAC
e9 84 d6 fb ff jmp 0x41D154
that splits call to sub_41CDAC into half, pushing X value goes to 15-bytes spaces at 0x45FAC1, call 0x41CDAC can jumps back to 0x41D154 for making a space to set ESI.
Thanks http://shell-storm.org/online/Online-Assembler-and-Disassembler/ for a flexible-enough online assembler.