New kernel offset positions?

[Power350]

here is where the pallete is at in the NEW kernel (ie. with ryanvm's pack)

74f87 = pallete

it must be an updated version but the offsett values are different.

I will post the rest if I find them. Does anyone else know?

[NoX1911]

Its not too hard to find them with a hex editor...

The original tutorial is here: XPbootcolors

ntoskrnl.exe 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)

Palette:

74f88

Progress Bar:

32026

346B0

3473C

320A4

34732

[Zasurus]

They have done it again! RyanVM's New pack 2.0.1 uses ntoskrnl.exe v5.1.2600.2765

Anyone know where the progress bar location is in this one? Or an easy way to find it?

Thanks

Zas

[keytotime]

Use the bootscreen editof found on unattended.msfn.org

[Zasurus]

I managed to get hold of version 0.9.93 of boot editor and that can make exe files still and just changed the location of the progress bar a bit then compaired the original file with the new one and here are the locations for version 5.1.2600.2765

Progress Bar:

TOP:

3205eH

346f0H

3477cH

Bottom:

320dcH

34772H

[Power350]

well...I managed to finally find all the positions...yes it is easy to find them with a hex editor...one bit of info that you need though is all the possitions will be in the 3xxxx range of offsets...no one has seemed to mention that yet. anyhoo here are all the offsets to 5.1.2600.2765...

ntoskrnl.exe (THX ZASURUS)

PALLET = 75108

PRGBAR TOP = 3205E - 346F0 - 3477C

PRGBAR BOTTOM = 320DC - 34772

ntkrnlmp.exe

PALLET = 78808

PRGBAR TOP = 32D6F - 34592 - 345AC

PRGBAR BOTTOM = 32DED - 345A2