Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 

Sign in to follow this  

Editing Win2000 Startup Screen

Recommended Posts

Posted (edited)

So just replacing bitmap while keeping same layout is just boring. What about putting Beta boot screen into retail?


cross post from betaarchive:

I think I found the position that sets progress bar and scrolling bar:

NTOSKRNL.EXE 5.0.2195.7376, CHT, 1,691,648 bytes
File Date: Thursday, 18 February, 2010, 20:17:26
SHA256: 86356E3BB6DB3E873AE8C881358233F5CD142EC2CEDF34D7B007B427CE085394

.text:0041D14A loc_41D14A:                             ; CODE XREF: sub_41CFF6+14Aj
.text:0041D14A                 push    1B5h
.text:0041D14F                 push    112h
.text:0041D154                 call    sub_41CDAC
.text:0041D159                 push    offset loc_41D1F4
.text:0041D15E                 mov     dword_476070, 1A0h
.text:0041D168                 mov     dword_47606C, esi
.text:0041D16E                 mov     dword_476000, 280h
.text:0041D178                 mov     dword_475F40, 0Ah
.text:0041D182                 call    InbvInstallDisplayStringFilter

Y = 0x1B5=437, X = 0x112=274 is progress bar starting location

Y= dword_476070 = 0x1A0 = 416
X = dword_47606C = esi = 0
W = dword_476000 = 0x280 = 640
H = dword_475F40 = 0x0A = 10

is scrolling bar location.

but there is difficulty on setting dword_47606C, since "mov dword_47606C, esi" is 4-bytes shorter than others.


so hacking around it is working!

68 b5 01 00 00 push 0x1b5
e9 6d 29 04 00 jmp 0x45fac1
be a0 00 00 00 mov esi, 0xa0 /* it is 0x41D154 here */

68 21 01 00 00 push 0x121
e8 e1 d2 fb ff call 0x41CDAC
e9 84 d6 fb ff jmp 0x41D154

that splits call to sub_41CDAC into half, pushing X value goes to 15-bytes spaces at 0x45FAC1, call 0x41CDAC can jumps back to 0x41D154 for making a space to set ESI.

Thanks http://shell-storm.org/online/Online-Assembler-and-Disassembler/ for a flexible-enough online assembler.

Edited by roytam1
  • Like 5

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.