Editing Win2000 Startup Screen

[roytam1]

So just replacing bitmap while keeping same layout is just boring. What about putting Beta boot screen into retail?

cross post from betaarchive:

I think I found the position that sets progress bar and scrolling bar:

NTOSKRNL.EXE 5.0.2195.7376, CHT, 1,691,648 bytes
File Date: Thursday, 18 February, 2010, 20:17:26
SHA256: 86356E3BB6DB3E873AE8C881358233F5CD142EC2CEDF34D7B007B427CE085394

.text:0041D14A loc_41D14A:                             ; CODE XREF: sub_41CFF6+14Aj
.text:0041D14A                 push    1B5h
.text:0041D14F                 push    112h
.text:0041D154                 call    sub_41CDAC
.text:0041D159                 push    offset loc_41D1F4
.text:0041D15E                 mov     dword_476070, 1A0h
.text:0041D168                 mov     dword_47606C, esi
.text:0041D16E                 mov     dword_476000, 280h
.text:0041D178                 mov     dword_475F40, 0Ah
.text:0041D182                 call    InbvInstallDisplayStringFilter

Y = 0x1B5=437, X = 0x112=274 is progress bar starting location

Y= dword_476070 = 0x1A0 = 416
X = dword_47606C = esi = 0
W = dword_476000 = 0x280 = 640
H = dword_475F40 = 0x0A = 10

is scrolling bar location.

but there is difficulty on setting dword_47606C, since "mov dword_47606C, esi" is 4-bytes shorter than others.

--

so hacking around it is working!
 

(VA)0x41d14a:
68 b5 01 00 00 push 0x1b5
e9 6d 29 04 00 jmp 0x45fac1
be a0 00 00 00 mov esi, 0xa0 /* it is 0x41D154 here */

(VA)0x45fac1:
68 21 01 00 00 push 0x121
e8 e1 d2 fb ff call 0x41CDAC
e9 84 d6 fb ff jmp 0x41D154

that splits call to sub_41CDAC into half, pushing X value goes to 15-bytes spaces at 0x45FAC1, call 0x41CDAC can jumps back to 0x41D154 for making a space to set ESI.

Thanks http://shell-storm.org/online/Online-Assembler-and-Disassembler/ for a flexible-enough online assembler.

Edited July 25, 2018 by roytam1

[slayer1994]

Wow, I still prefer the original one, though

[roytam1]

* updated first post for the code.