This is from a w2knews post, long winded but it does work:
In order to modify the W2K startup logo you have to be aware of a few things
up front:
The logo is a 16 color (not bit) bitmap that is 640 by 480 in size. It is
built into the ntoskrnl.exe.
W2k file protection will not let you just modify this file and place it in
the system32 directory, it will be overwritten shortly thereafter with the
original.
Knowing this you'll need a tool to pull apart the ntoskrnl.exe and replace
the bitmap. I'm using a tool called "Resource Hacker". This is available
here:
http://rpi.net.au/~ajohnson/resourcehacker
It's a fairly simple program, just extract the files to a directory and run
the exe. Once it's open, do a "File/Open" and select your ntoskrnl.exe. This
is located in X:\winnt\sytem32.
You'll get 3 main folders, Bitmap is the one we want to work with. If you
are on W2k Pro, it's under the directory "1" and is called "1033". If you
run W2k Server, it's under "4" and is also called "1033". You'll see the
current boot time logo.
Now you can do "Action/Replace Bitmap". Select the bitmap you have created
to replace the old bitmap. Or, you could export the bitmap, modify it, then
import it back in. It is very important that you do not deviate from 640x480
w/ 16 colors. Here is a nice gallery of already created images that could be
downloaded and quickly converted to 16 color bmps:
http://www.littlewhitedog.com/reviews_other_00025.asp
In the Replace Bitmap browser once you have selected the new bitmap you'll
need to select the bitmap number in the bottom right that you wish to
replace. "1" for Pro and "4" for Server (or Adv Server).
Now you need to do a "File/Save As" and save the file somewhere on your
drive. Do *NOT* save it in the same directory or it will be quickly snarfed
up by Windows File Protection.
For the next step we'll need a tool that can open .CAB files as well as
create them. I used WinAce: http://www.winace.com
Now you'll need to open the latest service pack .cab file that you have in
your system. This file is located in X:\winnt\driver cache\i386 and will be
called something like SP1.cab or SP2.cab. Extract the contents of the most
current one to a directory. Now take your modified ntoskrnl.exe and drop it
in that directory, it will overwrite the existing one.
Re-compress the all the files back into a .CAB and overwrite the original
SP1.cab or SP2.cab (Back up the original first just in case). Then drop your
modified ntoskrnl.exe into X:\winnt\system32\dllcache and X:\winnt\system32,
in that order. This way Windows file protection has nowhere to get the
original ntoskrnl.exe and leaves well enough alone. At this point, you can
reboot.
You hose your system, it's not my fault... I've done it about 20 times on
different systems and haven't had a problem yet. Special thanks to
www.littlewhitedog.com and their forums for supplying much of the
information in this report.
Greg Kras MCP+I MCSE
Sunbelt Software Technical Services Manager
Regards,
Lee Jolley
-----Original Message-----
From: Steve Kelsay [mailto:[EMAIL PROTECTED]]
Sent: 06 September 2001 16:49
To: NT System Admin Issues
Subject: Repair files location?
Where are the system files stored that are replaced during the repair
process?
I need to replace the NTOSKRNL.EXE file after editing the bootup logo
bitmap, and don;t want the original to return. I presume if I replace the
repair copy and the system32 copy, it will be ok?
(Some Managers just think I have all the tie in the world!)
Steve Kelsay
Network Administration Group
South Carolina Department of Revenue
301 Gervais Street
Columbia, SC 29201
(803) 898-5522
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
_____________________________________________________________________
This message has been checked for all known viruses by Star Internet
delivered through the MessageLabs Virus Scanning Service. For further
information visit http://www.star.net.uk/stats.asp or alternatively call
Star Internet for details on the Virus Scanning Service.
**********************************************************************
This email transmission is confidential and intended for the
addressee only. It may contain privileged and confidential
information. If you are not the person or organisation to
whom it is addressed, you must not copy, distribute, or take
any action in reliance upon it. If you have received this
message in error, please notify the
[EMAIL PROTECTED] and return it.
Carillion PLC Registered in England No. 3782379
Registered Office:
Birch Street Wolverhampton WV1 4HY
**********************************************************************
_____________________________________________________________________
This message has been checked for all known viruses by Star Internet
delivered through the MessageLabs Virus Scanning Service. For further
information visit http://www.star.net.uk/stats.asp or alternatively call
Star Internet for details on the Virus Scanning Service.
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
