[DennyMK]

I was looking for a tool for making bootscreen background, trying to add my background in bootscreen (NTOSKRNL.exe), and finally with a help of my friend @wolfcall (who is also a member here) we found how to make original background like in MS NTOSKRNL.exe file (BMP 1 and BMP 4 as most important for Windows XP Professional).
Unlike some people I know from forums, I want to share my effort with YOU.
I was trying to edit that background with 16 colours 4 bit palette in Photoshop, but everytime failed.
I tried with Windows "Paint" and I succeed but I needed to make painting (dot by dot) manually and at the end I had working background but visible in ResHack or PE Explorer or other editing tools unlike MS's non-visible with mentioned tools.
Last night I found that using TuneUp Utilities can make the original like MS's background without much effort
In the folowing tutorial, I'll try to explain the step-by-step how to make the bootscreen like you desire.



01. Download and install "TuneUP Utilities 2009"
02. Start the program and select "Customize Windows"
03. From a "TuneUP Styler" menu, select "Change boot screen"



04. You can see now the Windows default boot screen (active) (ntoskrnl.exe). We are ready to make our own background
05. Click on "New Screen" and by clicking "Open image" select your favourite (background) BMP or JPG image





06. At "Customize progress bar" select the position of border (if you don't want to change the position leave it default) and the colour of the moving stripe









07. "Save boot screen" with the name you want





08. Select the boot screen you just made (selected by default) and click install



09. Now open the folder C:\WINDOWS\system32 and search for file named "TUKernel.exe" and copy it to the desktop
10. Return to folder C:\WINDOWS\system32 and search for file named "ntoskrnl.exe" and rename it to something else (Old.exe for example) and cut/paste it to desktop
11. Rename the TUKernel.exe file to ntoskrnl.exe and paste in into C:\WINDOWS\system32 folder
12. Return to TuneUP Utilities, set the Windows default boot screen as active and delete the new maden (by you) boot screen
13. Reboot and delete the "Old.exe" file from desktop after reboot

For those who want to use TuneUP Utilities and don't want to waste their time, consider step 9 to 13 unessential.
For those who want to "practice" go to the step 13
This method is tested on Windows XP Professional SP3 with ntoskrnl.exe 5657 version and will work for desktops and laptops. It will also work with 5512 version unless you update.
P.S.: TuneUP Utilities uses the original ntoskrnl.exe and modify the file with your background image and create it's own file named "TUKernel".

Here is a link of boot screen (step-by-step illustration jpg's included) I made it from my favourite Panther pic:

File Size: 3.85 MB

MD5: 081B4319936F03DCE9084CEA27D152DA

This post has been edited by DennyMK: 22 December 2008 - 05:28 PM

[Sponsor]

[LordWarlock]

Replacing ntoskrnl.exe is a bad practice, use the boot.ini /KERNEL= switch instead. Also, for multiprocessor machines the boot screen is not ntoskrnl.exe, but ntkrnlmp.exe, if you have a single processor and more than 3GB of RAM it's ntkrnlpa.exe and for MP with more than 3GB it's ntkrpamp.exe, so if you really need to replace the file, first check which you have to replace.

Now for the boot.ini part, it's simple:
This is how a standard boot.ini looks like:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINXP
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut

This is how you have to modify it to change you bootscreen:

[boot loader]
timeout=3
default=multi(0)disk(0)rdisk(0)partition(1)\WINXP
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional (MOD)" /fastdetect /NoExecute=OptOut /Kernel=bootmod.exe
multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional (BACKUP)" /fastdetect /NoExecute=OptOut

Simply copy the OS line to another line (as a backup), change the description to your liking (but use only ASCII characters), add a /Kernel=xxxx.exe switch, where xxxx.exe is the name of your modified kernel, be careful, it has to be a short name (max 8+3). Also change the timeout value to some short interval, don't change it to 0, so that you can simply switch back to the original kernel in case of problems. Now copy your modified kernel to system32 and give it the same name you specified after /Kernel=. This is safer than a direct overwrite and it's actually the same way TuneUp does this.

[DennyMK]

Thanks @LordWarlock I'm aware about your post, but this is my first Topic and I wanted to be more simple and useable for begginers. Between, you explained that for me

This post has been edited by DennyMK: 21 December 2008 - 07:53 PM

[johnhc]

DennyMK, I tried to modify my NTOSKRNL.exe with a resource editor and when I rebooted, the new boot screen flashed for a few seconds, looking like the good quality image I used. Then the screen went black and the new boot image reappeared, but this time the color was wrong and the quality was poor. I then DL the trial version of TuneUp and used it with the same image and it looks great. I open the TUKernel.exe with the resource editor and the bit maps are not altered. I then did a new install (format) of my ISO (on VMware Server). After the install, I copied the TUKernel.exe into the System32 folder and changed the boot.ini as LordWarlock suggested and it looked great. In this case TuneUp is not installed and any files left around are gone. I also opened NTOSKRNL.exe, that TuneUp had altered, with my resource editor and could find no changes. I am really curious how the image is placed in TUKernel.exe and what changes are made to NTOSKRNL.exe. Do you have any ideas to share with me? I am running XP x64. Does your 32 bit TUKernel.exe appear to have had its bit maps altered by TuneUp? Thanks to you and LordWarlock for teaching me some more about Windows. Enjoy, John.

[DennyMK]

johnhc, on Dec 27 2008, 03:22 PM, said:

• ... I also opened NTOSKRNL.exe, that TuneUp had altered, with my resource editor and could find no changes.

• I am really curious how the image is placed in TUKernel.exe and what changes are made to NTOSKRNL.exe.

Do you have any ideas to share with me? I am running XP x64. Does your 32 bit TUKernel.exe appear to have had its bit maps altered by TuneUp? Thanks to you and LordWarlock for teaching me some more about Windows. Enjoy, John.

Hi johnhc,
First I want to wish you a Happy New Year and to the rest of the MSFN Members .
Answer to both questions:

TuneUp DOES NOT change NTOSKRNL.exe. It copy the NTOSKRNL and rename the copy to TUKernel.exe . That's the reason you couldn't find any changes to NTOSKRNL.exe. So no changes to the original NTOSKRNL.exe. and that's why I suggested to replace the original NTOSKRNL.exe .
It's also safe that way I've described, but LordWarlock's suggestion is even better, because Microsoft releases too many hotfixes recently, which may alter the modified NTOSKRNL.exe.
And how the image placed in TUKernel.exe? I guess TuneUP Utilities has their own 16colours palette with 4 bit colour depth, editor, integrated.

I hope I help you ,

P.S.: Ask again if I missed something.
And yes I want to share my experience

[johnhc]

DennyMK, thanks for your reply. I think TuneUp did modify NTOSKRNL.exe, because it was about 15 kB larger than the original. Have you looked at your TUKernel.exe with a resource editor and if so, could you see that the bit maps images were altered? You might also look at your NTOSKRNL.exe before and after running TuneUp.
Thanks again, John.