Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: How to change boot animation in Windows 7

12 Jan 2012   #841
thaimin

Windows 7 Pro 64 / 7 Pro 64 / 7 Home Prem 64
 
 

Yes, LZNT1 is #2 and is still around (NTFS still uses it among other things).

To load these functions I just use the header file at the end of this post (I stripped comments, but close enough) along with the "load_rtl_compression" function called from main. You can then use the functions normally even though they are dynamically loaded.

Code:
static bool load_rtl_compression()
{
#ifdef _WIN64 // compiling for win-64
	HMODULE ntdll = LoadLibraryW(L"ntdll-8-64.dll");
#else
	HMODULE ntdll = LoadLibraryW(L"ntdll-8-32.dll");
#endif
	return LOAD_FUNC(RtlDecompressBufferEx, ntdll) != NULL && LOAD_FUNC(RtlCompressBuffer, ntdll) != NULL && LOAD_FUNC(RtlGetCompressionWorkSpaceSize, ntdll) != NULL;
}
-----------------------------------

Code:
#pragma once

////////// NT compression functions from ntdll.dll //////////

#include <windows.h>

///// Dynamic Function Loading /////
#define FUNC(r, n, ...) typedef r (__stdcall* FUNC_##n)(__VA_ARGS__); FUNC_##n n = NULL;
#define LOAD_FUNC(func, hmod) (func = (FUNC_##func)GetProcAddress(hmod, #func))


///// From <ntdef.h> /////
typedef __success(return >= 0) LONG NTSTATUS;


///// From <ntstatus.h> /////
#define STATUS_SUCCESS                   ((NTSTATUS)0x00000000L) // ntsubauth
#ifndef STATUS_INVALID_PARAMETER
#define STATUS_INVALID_PARAMETER         ((NTSTATUS)0xC000000DL) // winnt
#endif
#define STATUS_BUFFER_TOO_SMALL          ((NTSTATUS)0xC0000023L)
#define STATUS_NOT_SUPPORTED             ((NTSTATUS)0xC00000BBL)
#define STATUS_BUFFER_ALL_ZEROS          ((NTSTATUS)0x00000117L)
#define STATUS_BAD_COMPRESSION_BUFFER    ((NTSTATUS)0xC0000242L)
#define STATUS_UNSUPPORTED_COMPRESSION   ((NTSTATUS)0xC000025FL)


///// From <ntifs.h> /////
#define COMPRESSION_FORMAT_NONE          (0x0000)   // winnt
#define COMPRESSION_FORMAT_DEFAULT       (0x0001)   // winnt
#define COMPRESSION_FORMAT_LZNT1         (0x0002)   // winnt
#define COMPRESSION_FORMAT_XPRESS        (0x0003)   // added in Windows 8
#define COMPRESSION_FORMAT_XPRESS_HUFF   (0x0004)   // added in Windows 8

#define COMPRESSION_ENGINE_STANDARD      (0x0000)   // winnt
#define COMPRESSION_ENGINE_MAXIMUM       (0x0100)   // winnt
#define COMPRESSION_ENGINE_HIBER         (0x0200)   // winnt

FUNC(NTSYSAPI NTSTATUS, RtlGetCompressionWorkSpaceSize,
	__in USHORT CompressionFormatAndEngine, __out PULONG CompressBufferWorkSpaceSize, __out PULONG CompressFragmentWorkSpaceSize);
FUNC(NTSYSAPI NTSTATUS, RtlCompressBuffer,
	__in USHORT CompressionFormatAndEngine,
	__in_bcount(UncompressedBufferSize) PUCHAR UncompressedBuffer, __in ULONG UncompressedBufferSize,
	__out_bcount_part(CompressedBufferSize, *FinalCompressedSize) PUCHAR CompressedBuffer, __in ULONG CompressedBufferSize,
	__in ULONG UncompressedChunkSize, __out PULONG FinalCompressedSize, __in PVOID WorkSpace);
FUNC(__drv_maxIRQL(APC_LEVEL) NTSYSAPI NTSTATUS, RtlDecompressBuffer,
	__in USHORT CompressionFormat,
	__out_bcount_part(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer, __in ULONG UncompressedBufferSize,
	__in_bcount(CompressedBufferSize) PUCHAR CompressedBuffer, __in ULONG CompressedBufferSize,
	__out PULONG FinalUncompressedSize);
FUNC(__drv_maxIRQL(APC_LEVEL) NTSYSAPI NTSTATUS, RtlDecompressBufferEx, // added in Windows 8
	__in USHORT CompressionFormat,
	__out_bcount_part(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer, __in ULONG UncompressedBufferSize,
	__in_bcount(CompressedBufferSize) PUCHAR CompressedBuffer, __in ULONG CompressedBufferSize,
	__out PULONG FinalUncompressedSize, __in PVOID WorkSpace);
FUNC(__drv_maxIRQL(APC_LEVEL) NTSYSAPI NTSTATUS, RtlDecompressFragment,
	__in USHORT CompressionFormat,
	__out_bcount_part(UncompressedFragmentSize, *FinalUncompressedSize) PUCHAR UncompressedFragment, __in ULONG UncompressedFragmentSize,
	__in_bcount(CompressedBufferSize) PUCHAR CompressedBuffer, __in ULONG CompressedBufferSize,
	__in_range(<, CompressedBufferSize) ULONG FragmentOffset, __out PULONG FinalUncompressedSize, __in PVOID WorkSpace );



My System SpecsSystem Spec
.
12 Jan 2012   #842
joakim

ubuntu
 
 

Ok I don't have time until tomorrow to look into this but 2 questions;

1. What are you using RtlDecompressFragment for?
2. Have you verified on both x86 and x64, or just x64? (my failure is on x86)
My System SpecsSystem Spec
12 Jan 2012   #843
thaimin

Windows 7 Pro 64 / 7 Pro 64 / 7 Home Prem 64
 
 

1. Not using it, mostly copy-paste at that point.
2. Actually, I am testing with 32-bit DLL right now, have never even compiled my project for x64. But as I said Xpress Huffman decompression always fails with STATUS_BAD_COMPRESSION_BUFFER even if sending the results from RtlCompressBuffer straight to RtlDceompressBufferEx. Maybe this is different on x64.
My System SpecsSystem Spec
.

13 Jan 2012   #844
joakim

ubuntu
 
 

I have been testing the 64-bit version of 6.2.8102.0 now, and this STATUS_BAD_COMPRESSION_BUFFER is driving me nuts!! I get kind of expected return codes though when putting invalid and unsuported stuff there, so it's funny that we get the same error considering we are testing on 2 completely different programming language and code. Maybe it simply does not work (like protogon). I have tried so many variations of data types that I don't know what more to try..

Btw I guess you missed a "c" in the status code below (0xc0000117L);
Code:
#define STATUS_BUFFER_ALL_ZEROS          ((NTSTATUS)0x00000117L)
My System SpecsSystem Spec
13 Jan 2012   #845
thaimin

Windows 7 Pro 64 / 7 Pro 64 / 7 Home Prem 64
 
 

My guess is that the Xpress Huffman decompressor simply is broken right now. In the coming weeks I should have mine finished.

And no, I did not miss the C, it is a success code (see 2.3.1 NTSTATUS values). Basically it says, yes, it worked, but just so you know, your input was all zeroes. Only RtlCompressBuffer returns this, not RtlDecompressBuffer(Ex).
My System SpecsSystem Spec
13 Jan 2012   #846
joakim

ubuntu
 
 

For whatever it means, if I revert to using RtlDecompressBuffer;

- If CompressionFormat = 3 Then NTSTATUS = STATUS_BAD_COMPRESSION_BUFFER
- If CompressionFormat = 4 Then NTSTATUS = STATUS_GENERIC_NOT_MAPPED

Too tired to continue now..

(btw tried on x64 ver 7989)
My System SpecsSystem Spec
13 Jan 2012   #847
thaimin

Windows 7 Pro 64 / 7 Pro 64 / 7 Home Prem 64
 
 

RtlDecompressBuffer is equivalent to RtlDecompressBufferEx with WorkSpace = NULL. LZNT1 and Xpress (LZ) do not need a decompression work-space, so it can be NULL. Xpress Huffman needs a decompression work-space so RtlDecompressBufferEx is the only choice.

Also, Windows 8 bootmgr uses Xpress Huffman and NOT Xpress (LZ). These are different algorithms. Xpress (LZ) is LZSS while Xpress Huffman is Huffman-encoded LZ77.
My System SpecsSystem Spec
14 Jan 2012   #848
joakim

ubuntu
 
 

Here a nice pdf document that was released less than a month ago; [MS-XCA]: Xpress Compression Algorithm with detailed explanation of the algorithms. A bit heavy to digest on the first glance, but will read it later on.
My System SpecsSystem Spec
14 Jan 2012   #849
thaimin

Windows 7 Pro 64 / 7 Pro 64 / 7 Home Prem 64
 
 

I link to that from the post I mentioned earlier about Microsoft Compression Formats. I used it as a starting point for my Xpress (LZ) compressor/decompressor, but I actually already had a working Xpress Huffman compressor/decompressor when I found it (although I will look at it for those since mine is slow).
My System SpecsSystem Spec
27 Jan 2012   #850
RBCC

Windows 7 Ultimate
 
 

@Thaimin "How about working on a unattended installation or Reverse Integration? John"
I haven't figured this out yet either. Are you getting close? Can you help me with something? What security measures are there in winload.exe, ntoskrnl.exe can you point to a website that describes these ? John
My System SpecsSystem Spec
Reply

 How to change boot animation in Windows 7




Thread Tools




Similar help and support threads
Thread Forum
How di I change boot animation and text?
Hey! So I have been wanting to change my boot/startup logo from the default windows logo with "starting windows" and Microsoft text. So after many google attempts i have stumbled upon an application, BootUpdater. This program supposedly can easily change the windows animations and is exactly...
Customization
How do I change windows7 boot animation when resolution 800X600
Hello , I already know change windows7 boot animation need access bootres.dll and winload.exe.mui. But if resolution below 1024X768 it seem different. Can anybody teach me which file need be change, Thank you a lot! Ps. I know my English is terrible , I hope it can be understood.
Customization
Boot screen Animation Change?
I don't know if this one can be done. I know how to turn off the ding sound it makes when my computer boots up but does anyone know how to change the boot screen animation? I would like to put one of my own animations on there instead of the windows logo popping up from 4 little lights.
Customization
Windows 7 Home premium 64bit won't boot, just plays boot animation
My Windows 7 has stopped booting after a restart, the system would just endlessly play the boot animation and not boot properly... system restore won't work, startup repair won't work, chdsk and sfc won't work. I have yet to try and see whether a Registry fix works. Windows loads the WRE VERY...
BSOD Help and Support
How to change the boot screen animation?
Has anyone figured out how to change the boot animation? John
Customization


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 13:59.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App