Making the Changes
The file that is going to be modified to create the new boot logo is ntoskrnl.exe that is located in C:\Windows\System32. The first step is to make a copy of ntoskrnl.exe and rename it ntoskrnl.bak. It's probably overkill, but I'd also make a couple of extra copies and store one on a floppy and another on a second hard drive or CD if you have those options.
Fire up the Resource Hacker program and open the ntoskrnl.exe file as shown in Fig. 01.
The left hand column contains a list of editable resources displayed in Explorer tree format. The Bitmap tree is the one we'll be concerned with for this procedure. Bitmaps 1, 7, and 9 are used for XP Home Edition and 1, 8, and 10 are used for XP Professional. This article deals with the Professional version so expand bitmap 1 as shown in Fig. 02. You may expect to see something interesting when you do so, but at this point all you'll see in the right pane is a black image. I'll explain why as we get further along in the process. For now, just click the Action menu and save the bitmap.
This article deals with the Professional version so expand bitmap 1 as shown in Fig. 02. You may expect to see something interesting when you do so, but at this point all you'll see in the right pane is a black image. I'll explain why as we get further along in the process. For now, just click the Action menu and save the bitmap to a folder you create somewhere on the system. Repeat the process for bitmaps 8 and 10. After the bitmaps have been saved it's time to edit them to create the new boot logo.
Editing the Bitmaps
Fire up Paintshop Pro and open all three of the bitmaps that were saved previously. I mentioned earlier that the images were all 'black', but this isn't entirely true. The images are actually there but they aren't visible until the proper palette of colors is installed in the graphics program. Creating a palette or .pal file isn't difficult, but to make it easier I've included it here for you to download in zip file format.
Once the palette file is downloaded and unzipped, click Colors > Load Palette, or use the Shift+O key combination if you prefer, as shown in Fig. 01. to open the Load Palette dialog box shown in Fig. 02.
Use the drop down Look in: list to navigate to where you saved the extracted 16 Color.pal file. Make note that after selecting the palette you must use the radio buttons at the bottom of the dialog box to select 'Maintain Indexes'. Repeat this process for all of the open bitmap files. The images should now be visible. If not, go back and try the process again being sure to follow the 'Maintain Indexes' instructions.
The three images should appear as shown below:
Now it's time for the fun part. Edit the bitmaps as you see fit. You can change one of the images or all of them, add or delete portions, and express your creativity. Once the changes are complete and you're satisfied with the new boot logo, save the edited images.
Integrate the New Bitmaps
With the editing of the bitmaps that comprise the boot logo complete, it's time to integrate them into the ntoskrnl.exe file. Once again, start Resource Hacker and open ntoskrnl.exe.
Click Action (Fig. 01) on the menu bar and select Replace Bitmap to open the Replace Bitmap window as shown in Fig. 02. This window is divided vertically into two sections. On the left you select the new bitmaps that were created in the editing phase. The right side displays the old bitmap image from the list at the bottom of the window.
Using the Open File With New Bitmap... button at top left, select the newly created bitmap to replace the old #1 bitmap. On the right side, select the number of the image to be replaced. In the example, this would also be #1. Click the Replace button. Repeat the same process for images 8 and 10, clicking Replace once the proper images have been selected. Click the Close button to return to Resource Hacker main window.
Once the bitmaps have all been replaced, click File > Save As (Fig. 03) and save the modified ntoskrnl.exe file to a folder on the system. Do not use the C:\Windows\System32 folder for this procedure in spite of the fact that's where the file will eventually end up in the next step.
Replace NTOSKRNL.EXE
It used to be that if you wanted to replace a system file it was a simple process of copying the new file over the top of the old version. Windows File Protection (WFP) changed all that in a big brother type effort to protect us from ourselves. Progress? I don't know, and won't get into that here, but here's how to replace the old ntoskrnl.exe with the modified version.
Restart the system and boot into Safe Mode by repeatedly tapping the F8 key right after the system starts to boot. If you miss the timing and the system boots normally into XP just restart and try again, tapping the F8 key a bit earlier than you did last time. Once you get started in Safe Mode, open Windows Explorer and overwrite the original ntoskrnl.exe file located in C:\Windows\System32 with the modified ntoskrnl.exe you created.
Important Note: Before you overwrite ntoskrnl.exe, compare the information of the new file against the old. The only thing that should be different between the two files is the size. In the example I've used here, the old ntoskrnl.exe file was 1936kb and the new file is 2072kb. The Date Modified on the file should not be changed. If it is, go back to the beginning and retrace all the steps to find out where the file was saved improperly.
That's it. Reboot the system normally and you should see it start with your new boot logo.
Download PAL file here
The file that is going to be modified to create the new boot logo is ntoskrnl.exe that is located in C:\Windows\System32. The first step is to make a copy of ntoskrnl.exe and rename it ntoskrnl.bak. It's probably overkill, but I'd also make a couple of extra copies and store one on a floppy and another on a second hard drive or CD if you have those options.
Fire up the Resource Hacker program and open the ntoskrnl.exe file as shown in Fig. 01.
The left hand column contains a list of editable resources displayed in Explorer tree format. The Bitmap tree is the one we'll be concerned with for this procedure. Bitmaps 1, 7, and 9 are used for XP Home Edition and 1, 8, and 10 are used for XP Professional. This article deals with the Professional version so expand bitmap 1 as shown in Fig. 02. You may expect to see something interesting when you do so, but at this point all you'll see in the right pane is a black image. I'll explain why as we get further along in the process. For now, just click the Action menu and save the bitmap.
This article deals with the Professional version so expand bitmap 1 as shown in Fig. 02. You may expect to see something interesting when you do so, but at this point all you'll see in the right pane is a black image. I'll explain why as we get further along in the process. For now, just click the Action menu and save the bitmap to a folder you create somewhere on the system. Repeat the process for bitmaps 8 and 10. After the bitmaps have been saved it's time to edit them to create the new boot logo.
Editing the Bitmaps
Fire up Paintshop Pro and open all three of the bitmaps that were saved previously. I mentioned earlier that the images were all 'black', but this isn't entirely true. The images are actually there but they aren't visible until the proper palette of colors is installed in the graphics program. Creating a palette or .pal file isn't difficult, but to make it easier I've included it here for you to download in zip file format.
Once the palette file is downloaded and unzipped, click Colors > Load Palette, or use the Shift+O key combination if you prefer, as shown in Fig. 01. to open the Load Palette dialog box shown in Fig. 02.
Use the drop down Look in: list to navigate to where you saved the extracted 16 Color.pal file. Make note that after selecting the palette you must use the radio buttons at the bottom of the dialog box to select 'Maintain Indexes'. Repeat this process for all of the open bitmap files. The images should now be visible. If not, go back and try the process again being sure to follow the 'Maintain Indexes' instructions.
The three images should appear as shown below:
Now it's time for the fun part. Edit the bitmaps as you see fit. You can change one of the images or all of them, add or delete portions, and express your creativity. Once the changes are complete and you're satisfied with the new boot logo, save the edited images.
Integrate the New Bitmaps
With the editing of the bitmaps that comprise the boot logo complete, it's time to integrate them into the ntoskrnl.exe file. Once again, start Resource Hacker and open ntoskrnl.exe.
Click Action (Fig. 01) on the menu bar and select Replace Bitmap to open the Replace Bitmap window as shown in Fig. 02. This window is divided vertically into two sections. On the left you select the new bitmaps that were created in the editing phase. The right side displays the old bitmap image from the list at the bottom of the window.
Using the Open File With New Bitmap... button at top left, select the newly created bitmap to replace the old #1 bitmap. On the right side, select the number of the image to be replaced. In the example, this would also be #1. Click the Replace button. Repeat the same process for images 8 and 10, clicking Replace once the proper images have been selected. Click the Close button to return to Resource Hacker main window.
Once the bitmaps have all been replaced, click File > Save As (Fig. 03) and save the modified ntoskrnl.exe file to a folder on the system. Do not use the C:\Windows\System32 folder for this procedure in spite of the fact that's where the file will eventually end up in the next step.
Replace NTOSKRNL.EXE
It used to be that if you wanted to replace a system file it was a simple process of copying the new file over the top of the old version. Windows File Protection (WFP) changed all that in a big brother type effort to protect us from ourselves. Progress? I don't know, and won't get into that here, but here's how to replace the old ntoskrnl.exe with the modified version.
Restart the system and boot into Safe Mode by repeatedly tapping the F8 key right after the system starts to boot. If you miss the timing and the system boots normally into XP just restart and try again, tapping the F8 key a bit earlier than you did last time. Once you get started in Safe Mode, open Windows Explorer and overwrite the original ntoskrnl.exe file located in C:\Windows\System32 with the modified ntoskrnl.exe you created.
Important Note: Before you overwrite ntoskrnl.exe, compare the information of the new file against the old. The only thing that should be different between the two files is the size. In the example I've used here, the old ntoskrnl.exe file was 1936kb and the new file is 2072kb. The Date Modified on the file should not be changed. If it is, go back to the beginning and retrace all the steps to find out where the file was saved improperly.
That's it. Reboot the system normally and you should see it start with your new boot logo.
Download PAL file here
