Can I remove the fade effect between the login screen and the desktop?

Butters · 05 May 2014

GameX said:

Hi Butters,

Sorry for bumping the thread, I can't seem to be able to send a Private Message - how did you managed to decompile user32.dll and get access to these functions, possibly in Hexadecimal? I would like to attempt this as well.
Maybe you can just send me your own file to make it easier, I'm curious on how this is done which such files - I've hacked system resources, but never attempted these types of modifications before.

Thank you

Hello there. Sorry, it turns out I have PMs disabled for some reason. I'll fix that.

Anyway, let me explain things a bit. The file user32.dll doesn't actually need to be modified. At all. A simpler way to go about this would be to modify winlogon.exe to load the function SwitchDesktop instead of SwitchDesktopWithFade from user32.dll when switching between the login screen and the user desktop. I am actually having a bit of trouble doing this, and since it is such a small thing (that I don't actually NEED to have done) I haven't been trying to figure it out lately. It might still be something I'd like to mess around with in the future when I get the time. You MIGHT be able to do it by hex editing winlogon.exe, But you really do need to know what you're doing. Unfortunately I don't have time to try it myself, but if you do figure it out, feel free to post it here.

GameX · 17 May 2014

Hello there. Sorry, it turns out I have PMs disabled for some reason. I'll fix that.

Anyway, let me explain things a bit. The file user32.dll doesn't actually need to be modified. At all. A simpler way to go about this would be to modify winlogon.exe to load the function SwitchDesktop instead of SwitchDesktopWithFade from user32.dll when switching between the login screen and the user desktop. I am actually having a bit of trouble doing this, and since it is such a small thing (that I don't actually NEED to have done) I haven't been trying to figure it out lately. It might still be something I'd like to mess around with in the future when I get the time. You MIGHT be able to do it by hex editing winlogon.exe, But you really do need to know what you're doing. Unfortunately I don't have time to try it myself, but if you do figure it out, feel free to post it here.

Oh, hello!

Thank you for explaining that, I got the idea, that was helpful.
Could you point me to how you've gain access to the SwitchDesktop function?

I was actually asking, you managed somehow to decompile the EXE, and you realised the functions SwitchDesktop and SwitchDekstopWithFade were present in the code - may I know which tools you've used, please?

I understand that you've not succeeded with replacing the functions, I would at least be interested in have the right softwares to open this program and check it out. I assume the code will all be presented in hexadecimal?

If that's too long to explain the process or refer me to the software you've used to open it, don't bother.

EDIT: Found it:
dl.dropboxusercontent.com/u/67605655/hexedit.png

Did you used an hexadecimal editor as well, or something else?

Thanks!

Butters · 18 May 2014

Hello again, GameX. Sorry to get back to you so late, but that's awesome that you managed to find it. Thanks for posting. To answer your question, I was using a hex editor, but it didn't seem to find the SwitchDesktopWithFade function for some reason. But after using HexEdit (the editor you used) I can verify that changing the function to SwitchDesktop does in fact work (and is actually pretty easy to do). For anyone else who would like to do this, here's how:

1.) Make a backup of the original winlogn.exe. I cannot stress how important this step is. If you don't and something goes wrong, you will regret it.
2.) Copy winlogon.exe from C:\Windows\system32 to any working directory.
3.) Open it with a hex editor, and search for the following hex:
57 69 74 68 46 61 64 65

3.) Replace it with this:
00 00 00 00 00 00 00 00

4.) Save winlogon.exe
5.) Take ownership of winlogon.exe in system32, and rename it to something like delme.exe (you can rename it to anything really, it will be deleted. You can also rename it to something like winlogon.exe.backup and just use that as your backup file)
6.) Copy your modified winlogon.exe to the system32 folder.
7.) Restart your computer.

This will work with Windows Vista and Windows 7. Doing this will actually load your desktop a lot faster when you log on. Once you're all done, you can delete the renamed winlogon.exe file as well, just keep the backup of the original.

GameX · 28 May 2014

Hello,

Sorry for the delay - for some reason, I can't get this to work.

Here's my winlogon.exe file, I've triple-checked it, replaced the strings with 00 like you said, and that still fails.
Never seemed like "Take Ownership" worked much for me, but I just copied the file in system32 and deleted the older... No problem, but not working.

Also tried replacing the file directly in Linux, still not working. Not sure what's wrong with my file.. I use Windows 7 Professional x64.

https://dl.dropboxusercontent.com/u/...5/winlogon.exe

Originally, I attempted to delete the "WithFade" part (Delete, not replace it with 0 ), then I got a BlueScreen when LogonUI loaded. XD Had to restore a backup...

Thank you for your help!

Butters · 30 May 2014

Huh, that's odd. I did look at your winlogon.exe file, and for some reason it's smaller than the one I have. Did you make any other modifications to it? Also, are you able to boot your computer with it, and if so it still has the fade effect? Replace nothing but the "WithFade" part of the hex. I'm running the exact same version of Windows as you, so I can't imagine why it won't work. Just so you can test it, I'll post up my winlogon.exe file so you can test it. Just be sure you are running Windows 7 x64.

GameX · 30 May 2014

Oh man, that worked !!

I don't know why your file was much larger than mine, but I just directly replaced yours after a backup. That did the trick!

Don't understand, I did replaced the "WithFade" with enough 0, but it still fade. No error, but still fade.
I check the hexadecimal of that file...

I suppose you changed your login background as well? I will do this, put the same login background as my desktop background, so the login will "look" much more fluid. Of course, it's just an illusion.

A little unrelated, did you knew that Apple does this on iOS ? Since they take fluidity too seriously on iOS, when the iOS app load, they first load just a static image, to give the illusion of a fast loading, and to avoid to see a black screen instead.

Thank you very much!

Will share this hack with friends..

Excellent find !

EDIT: Actually, I do see a black flash that last for like half-a-second or even shorter. I've replaced the login background with the same desktop picture, and it's an illusion, but it's faster, for sure! That's really cool!
That's a lot oh hassle for this, but I like it as well.

I can also confirm that I did not saw any black flash in a Virtual Machine, without the fade.

EDIT: Well....
It did worked, until I rebooted, and got a BlueScreen when Winlogon was supposed to load. When I got into Windows command prompt, I noticed my Winlogon.exe was not there anymore, so I had to restore my original backup.

I suspect this is because the file is not the same, so Windows would reject it...?
Or most probably, the Take Ownership tweak, that I never seems to get to work.

EDIT 2 : Tried again, used a different Take Ownership file... No problem "so far". Akwards.
Do you have a very quick black flash, or nothing at all?
I do have a quick flash, but on a virtual machine, I tested, and see no flash at all.

Butters · 31 May 2014

Actually I wanted to do this for pretty much the same reason as you did (I generally like having as little visual effects as possible, and of course it loads your desktop much quicker) so I'm glad we managed to figure it out. And yes, I did change my login background.

Now as for that black flash, I am getting that too, and although while it's a little bit annoying, I can live with it for now. I MIGHT have an idea as to why that happens though, but I could be dead wrong, and I wouldn't know how to remove it. I have done some other experimenting with the login screen, and I was wondering what it would look like with no background at all. And I don't mean just changing the background to a solid color, I wanted to see what would happen if it had no file to be loaded as the background. So I used Resource Hacker to delete the default background images from imageres.dll to see what would happen. I thought I would get Windows Server 2008's greenish-blue background, but instead I got solid black. At this point I thought it was drawing the default background color from the registry, so I tried changing that in the following keys:
HKEY_USERS\.Default\Control Panel\Colors > Background

and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon > Background

But that didn't seem to change anything. One note though:
If you delete the "winlogon > Background" data and change the "Control Panel\Colors > Background" to any RGB value (other than a black color) that said color will flash on the screen as soon as you boot up your computer for a couple of seconds, but it will quickly change to black as soon as the login screen to loads. I think winlogon.exe draws a solid black color over the default background color, but like I said, I couldn't begin to tell you how to remove it. Maybe some other winlogon.exe function?

GameX · 31 May 2014

I can tell, by your writing, that you're way better than me at this (And I thought I customized much, already);

Do you have access to a PC that load SwitchDesktop natively, with a basic video driver? I can't figure out why it work seemlesly in a virtual machine; my guess is that it's a limitation with the driver, the display...

Or it could be that the extra 0s we added to wipe the "WithFade" part, gives an extra... calculation time, which would display a black flash. Maybe deleting a few 0s, and keeping only 6 digits (00 f7 01, next to the original SwitchDesktopWithFade, or 00 0b 03, next to "SwitchDesktop). But I'm not even convinced by this myself - I did programming for a while, and I know that calculation stay blazing fast, I seriously doubt 6 digits does this.
If we would attempt to delete a few 0s, my guess is that we would get a BSOD.

I have no idea how this code work, but note that SwitchDesktop is right before "UnlockWindowsStation", while "SwitchDesktopWithFade" is even before that. Which might explain the delay..? As I said, no idea how this code work, doubt Windows would read it simply in a linear way.

Sorry, don't have much clue - I should find out how to display the fade effect in VMware (So that SwitchDesktopWithFade gets loaded instead), hack the SwitchDesktopWithFade function like we did, and see if the black flash is still there. That might give an idea on if it's related to the display driver or not.

I think that's an interesting way to find out more about this. But don't know how to get the fade effect in VMware yet. :/

Butters · 31 May 2014

I don't have access to a PC with a basic video driver (well, I do but it has Windows XP on it) but I can always test in a VM. Anyways deleting 0s is not a good idea, as yes, it will result in a bluescreen or a system crash of sorts, as winlogon.exe will no longer be a valid win32 file. Anyways, if the black overlay thing were to be removed somehow, the Windows Desktop background color (in HKEY_USERS\.Default\Control Panel\Desktop > Background) would likely be visible instead. Of course you would probably need to reshack imageres.dll and delete the background(s) in there if you want the login screen to use a solid color. And I don't know if a desktop wallpaper would work (in HKEY_Users\.Default\Control Panel\Desktop > Wallpaper) or if a login screen background would work. In any case, Windows does load color settings before the desktop is loaded (while still on the login screen) so the transition would probably look like something similar to using the GINA (classic) login screen in Windows XP/Windows 2000 (just without the window prompt of course). Also, I'm not sure how LogonUI.exe will interact with all this, since that is what loads the background (I'm not sure if it will create its own black overlay). But I think I should mention that if you start explorer.exe on the login screen, the desktop background color is visible (or whatever wallpaper you have set will be visible). I might start looking into more winlogon functions, and do some research on them.

Also, I meant to mention this on my last post, but that's interesting about iOS. I really haven't really messed around with it (at all) but that kind of reminds me of how Windows will take a screenshot of the Desktop with a UAC prompt (except that's more for effect, not for the illusion of faster loading).

GameX · 31 May 2014

I have access to a cheap Desktop, which I use for experimenting, and I could install Windows 7 on it, with a basic video driver.
The problem is that it has no DVD drive, and cannot boot from USB. I also don't have an external DVD drive.

I could try to install Windows 7 from CD-RW, but I'm not sure where to start...
At least, I could verify if I do see the black flash on this PC. :/