Windows 7: How to change boot animation in Windows 7

@thaimin
Have you tried changing "/TESTSIGNING" string inside winload.exe? For me (in x86 OS) it works just fine, I mean - with testsigning on, modified bootres.dll loads fine, and there's no watermark on desktop after boot.

[removed all that certificate / embedding stuff that is no longer necessary]


@joakim

How do you get the bootmgr.exe? All I can find is the bootmgr which seems to be compressed or something weird. Isn't the real bootmgr.exe on the 200MB 'hidden' partition?


@AlexYM

I did try adding test-signing to {bootmgr} and that worked great! I haven't tried your method of disabling test-signing yet. Although I am still hopeful there is a non-testsigning method.

BOOTMGR is usually located on the 100 Mb partition. It is build of 2 parts. The 16-bit stub and the exe attached at the end of the stub. BOOTMGR is compressed in someway unknown to me. What I know is you can use bootmgr.exe (the pxe version) and attach an older 16-bit stub (from vista sp0) that handles its larger size. However you will still need to reduce the size of the embedded xsl so that total size (including the stub) is below 512 Kb. This pxe version that now is able to local boot, is not compressed and is more easy to read.

When disassembling it, preferrably cut off the stub first.

Or just grab an older version of bootmgr that is not compressed at all (cannot vhd boot though).

Joakim

Actually, forget all that stupid stuff about certificates.

There is a MUCH easier way that I just tested and works!

This is still not 100% complete, but is getting there.

Find all instances of 68 70 08 00 00 in winload.exe (there are 3) and replace them with 68 40 08 00 00. Now bootres.dll doesn't need any signing at all! One of those is for bootres.dll, one is for bootres.dll.mui, and the third I am a bit unsure about...

Note 1: This is untested in 64-bit, but should be C7 44 24 40 70 08 00 00 to C7 44 24 40 30 08 00 00. There are only two (bootres.dll and bootres.dll.mui, but not the unsure one...)

Note 2: winload.exe still needs to be signed (and bootmgr testsigning needs to be enabled)! So run my program on winload after you do the edits so it gets re-signed and then run bcdedit /set {bootmgr} testsigning on

Note 3: I hope that unknown one doesn't hurt anything at the moment, but it doesn't seem to. I will work on clarifying which ones do what.

DO NOT DO THIS ON A LIVE SYSTEM AT THE MOMENT. It may totally f your system... (although it didn't for me, I just don't want to be responsible).

So this is awesome! No security holes (since it ONLY enables bootres.dll and bootres.dll.mui to be unsigned). However, it still requires testsigning for the bootmgr. So hopefully a trick like this works for bootmgr as well, and just letting winload.exe through (a bit bigger of a security hole...).

@thaimin
That is an awesome find, allowing insigned bootres.dll to load!
To allow the same for winload.exe, you can try instead of "bcdedit /set {bootmgr} testsigning on" another option:
bcdedit.exe /set nointegritychecks on
(it works solely for unsigned winload.exe, not for unsigned winload.exe.mui).
May be the third mentioned sequence of bytes in winload.exe is for it's own mui file?
And to allow unsigned bootmgr.exe.mui (in case we want to modify boot menu appearance and look) - apply the same to bootmgr store:
bcdedit.exe /set {bootmgr} nointegritychecks on

.

The unsure one is most likely the unloading of bootres.dll in case of graphics failure. To allow winload.exe.mui to be used unsigned I believe you need to switch the following (there is only one of them):
6A 30 58 53 0D 01 05 00 00 -> 6A 00 58 53 0D 01 05 00 00
I have not tested it at all, and it will be different on 64-bit, I believe:
83 E0 30 0D 01 05 00 00 -> 83 E0 00 0D 01 05 00 00

@AlemYM
So we can easily re-sign winload.exe and then use bcdedit /set {bootmgr} testsigning on. You get no test-signing warning as you pointed out earlier since {current} is not in testsigning mode.

However, as I have said a couple of times, I do not want to rely on testsigning at all. It cannot be setup pre-install.

Some more little hacks (untested)

So before I talked about how the copyright was fixed, well I found out that you can adjust it at least a little bit.

The easy ones:
Remember that the boot up screen is 1024 x 768 and 32bpp in Windows 7 (so you can use alpha for the foreground color).

The harder ones:
The x position, height, and background color can be MAX 0xFF (255). I believe you should keep the height 0 to let it calculate the proper height.

Changing the width will be difficult. It grabs a global variable that has the current screen width stored in it. You can however change it to point to any address that has the value you want it in the file (but convert the address to a memory address).

Now if you set it so x+width or y+height goes off the screen it will fail to draw. If it fails to draw then it also will not draw the "Starting Windows" message from the message table (during osload-main or osload-graphics).

So if we just change the y-position to 0xFFFF (way off the screen) then we don't have to bother changing the copyright notice OR the message table. Just the XSL, and we can make it say whatever we want. The downside is the Starting Windows is nicer and larger text...

@thaimin
It would be great if you''ll manage to find where definitions are located for animation "film" - width/height (200pxl), position on screen, number of frames, etc...

I know I have been posting a lot, and posting really long messages, but please bear with me. I am trying to get all the thoughts out of my head and written somewhere.


I have performed some tests.

I tested the winload.exe.mui hack and it does make it so no signature was required for the MUI.

I tested the copyright message stuff. Moving copyright off screen does indeed make it not draw and forces "Starting Windows" to not draw as well. Changing the foreground color works (did not test alpha though). Changing the background color failed however (its possible that it is only changing the alpha and not red channel which doesn't work). I did not test width or x positioning (since you need to change width to change x and width would be complicated to change).

I also tested some other new things as well:

• Set copyright font size: C7 45 E4 0B 00 00 00 -> C7 45 E4 XX XX XX XX (currently 11 (0x0B))
• Move startup message vertically: C7 45 F4 0B 02 00 00 -> C7 45 F4 XX XX XX XX (currently 523 (0x20B))
• Set startup message font size: C7 43 24 12 00 00 00 -> C7 43 24 XX XX XX XX (currently 18 (0x12))
• The font for both of them can be replaced like so:
  • Find the font for your locale in winload.exe (it is a Unicode string)
    • zh-TW zh-CHT zh-HK zh-Hant: \fonts\msjh.ttf (Han (Traditional))
    • zh-CN zh-CHS zh-Hans: \fonts\msyh.ttf (Han (Simplified))
    • ko: \fonts\malgun.ttf (Korean)
    • ja: \fonts\meiryo.ttc (Japanese)
    • everyone else: \fonts\segoeui.ttf
  • Replace it with the desired font (if your font name is longer than the one already there you must rename you font, easy way is to copy it and rename it boot.ttf which is as short as the shortest one there)
  • Note: I do not think this will change the text-mode-ui text!

The background and foreground colors of the startup message are like the background color of the copyright message, so at the moment I cannot change them.

So, now that these two messages are so changeable, we can display 0, 1, or 2 messages with the following properties:

• Both messages:
  • Can move vertically
  • Can change font size
  • Fixed background color
  • Change the font (the changed font applies to both)
• Message 1 (utilizing original copyright message):
  • Text color can change
  • Limited to 23 characters
  • Must display if message 2 displays
• Message 2 (utilizing original startup message):
  • Fixed text color
  • Any number of characters long

@joakim
Since the MUI resources for winload.exe are loaded before the registry is loaded, there is no MUI cache involved (the MUI cache is in the registry). However, I am having problems settings the values in winload.exe. They don't show up. If I change winload.exe.mui however it does work (which is really easy now since it doesn't need a signature). My program is not MUI-aware so it could be that whatever program you have edits the right file automatically.


@AlexYM
I have been looking for how to move / resize / whatever the animation, however I have not had any luck so far. I am still looking though.


@everyone
There have been a lot of really important developments recently but I don't have the time to put them all into the program yet. You will have to wait just a bit to get a program. For my own reference, this is what needs to be added/changed:

• Change testsigning to only sign {bootmgr}
• Add the hacks that allow bootres.dll, bootres.dll.mui, and winload.exe.mui to load with no/invalid signatures
• Edit message table in winload.exe.mui instead of (or in addition to) winload.exe.
• Add options to:
  • Have 0, 1, or 2 messages
  • Move message vertically
  • Change message font
  • Change message font sizes
  • Change message 1 text color

Anything else you would want to change?

Would it be possible to increase/change the total amount of frames drawn for the animation and the amount of frames looped?
I tried using more than 105 frames but it just cut off the additional ones and looped the last few secods.