Remove branding from basic (Vista style) boot screen

The vista bootscreen is located in ntoskrnl.exe, bitmap 1, however, the colour palette is completely black (a leftover from XP which uses the same bootscreen code, in XP they made the colours all black due to a limitation I believe), so you will need to open it in Photoshop, go to Image, Mode, Color Table, and select "System (Windows)". Click OK and you'll see a vista boot screen with odd colours. Just replace the text with black, and there you go. I'm not sure if you have to change the palette back to all black though, but if I recall correctly, the bootloader should ignore the colour pallette and just use the one hardcoded into the bootloader itself.

DownhillDruid67 said:

The vista bootscreen is located in ntoskrnl.exe, bitmap 1, however, the colour palette is completely black (a leftover from XP which uses the same bootscreen code, in XP they made the colours all black due to a limitation I believe), so you will need to open it in Photoshop, go to Image, Mode, Color Table, and select "System (Windows)". Click OK and you'll see a vista boot screen with odd colours. Just replace the text with black, and there you go. I'm not sure if you have to change the palette back to all black though, but if I recall correctly, the bootloader should ignore the colour pallette and just use the one hardcoded into the bootloader itself.

Thanks for detailed explanation! I was able to follow your instructions but the boot screen remained the same. I tried saving the bitmap file with both the system (windows) palette as well as black but no dice. I'm opening ntoskrnl.exe with Resource Hacker and right clicking on bitmap 1 --> replace bitmap then choosing the edited bitmap. Initially I couldn't save the new file until I messed with the permissions and gave myself write access. I also tried deleting ntoskrnl.exe completely and the boot screen still appears which doesn't make sense to me. I am editing it in the System 32 directory.

DownhillDruid67 said:

Something is replacing your replaced ntoskrnl.exe with the original, or your system is using another ntoskrnl file other than the one you're finding.


DO NOT DELETE NTOSKRNL! ntoskrnl is the actual Windows NT Kernal itself. That file is pretty much most of Windows itself. It's really lucky that something is causing your system to either use another ntoskrnl file or something has put it back. Otherwise, your computer would have been toast.


I also recommending doing a backup before trying any of what I said (I should have mentioned that in my original post, sorry )

I'm using a virtual machine for testing, not worried if I mess anything up. Those were exactly my thoughts but I have no idea where this other ntoskrnl could be.

Yardley said:

I'm using a virtual machine for testing, not worried if I mess anything up. Those were exactly my thoughts but I have no idea where this other ntoskrnl could be.

Try looking in SysWOW64. (if your VM has this folder)