Solved x64 resource editor that edits x64 system files, such as ntoskrnl.exe

[puraki]

I have been trying to modify Win7 64-bit ntoskrnl.exe, but every time I do it, my computer starts up with Automatic Repair.

First, I enabled the Windows Vista boot screen in Windows 7: [Fun Tip] Enable Windows Vista Boot Screen in Windows 7 - AskVG

Second, I got the Windows logo of the ntoskrnl.exe file from a Windows Embedded POSReady 2009 Eval ISO: https://www.microsoft.com/en-us/download/details.aspx?id=11196

Third, I opened Resource Hacker Resource Hacker and replaced Bitmap > 5 > 1033 with my Windows logo from WEP2009.

Fourth, I booted from a WinPE USB flash drive, made a backup copy of my ntoskrnl.exe file, and copied my modified ntoskrnl.exe to system32.

Afterward, Win7 was booting into Automatic Repair.

I also noticed that the modified ntoskrnl.exe and SysWOW64's ntoskrnl.exe was smaller than the original 64-bit ntoskrnl.exe.

I tried XN Resource Editor, Resource Tuner, ResEdit, Restorator, and Explorer Suite. They kept corrupting ntoskrnl.exe and Win7 continued booting into Automatic Repair.

Is there any 64-bit resource editor that successfully edits 64-bit system files, like ntoskrnl.exe?

 

[Alejandro85]

I don't think it's a matter of corruption. I've used at least Resource Hacker to edit system 64 bits dlls and it's certainly capable of doing so.

The thing is probably messing with a signed file. Modifying the contents of such a file will make the digital signature invalid, as it wouldn't match the contents of the original signed file (that's the primary reason to sign a file, prevent corruption). As the kernel is loaded early in the boot process, and the bootloader verifies the signature, it detects a modified kernel and aborts the boot to prevent damage, suggesting startup repair to fix the affected files.

No editor can modify such files without breaking the digital signature, as it depends on the file contents. It would require re-signing the kernel with the new contents, and for that it would require to have the Microsoft private key, which is obviously MS-only.

 

[Berton]

Another issue with altering files such as ntoskrnl.exe is that the original programmer/publisher will consider it as 'reverse engineering' and one would run afoul of the licensing of the program.
Ntoskrnl.exeIf - Wikipedia, the free encyclopedia

If wanting to customize or experiment with an Operating System it'd be best to get an Open Source OS such as a version of Linux.

 

[puraki]

Solution

Thanks, Alejandro85!

I found the solution:

First, I ran Command Prompt as an administrator and typed in "bcdedit -set TESTSIGNING ON" to enable test mode.

Second, I used Resource Tuner to edit the boot screen.

Third, I got Driver Signature Enforcement Overrider: Driver Signature Enforcement Overrider Downloads and signed my modified ntoskrnl.exe with the test signature.

Fourth, I booted from the WinPE 4 USB flash drive and replaced the old ntoskrnl.exe with my modified one.

My boot screen appeared on startup!