Boot Screens in XP SP2

There has been a significant amount of users who were having problems porting their boot screens to SP2. The purpose of this post is to state the problem and the workarounds.

Problem: Say you are using a program such as BootEditor. It allows you to compile most of the resources into the boot screen, move the progress bar to the desired location, and embed the colour palette. However, Service Pack 2 for Windows XP is released and when the boot screen is loaded after being compiled, the colours are screwed up.

Cause: When I previewed a SP2 boot screen compiled in BootEditor, I took a snapshot of the compiled boot screen as it loaded up on startup and compared it to the original. I noted that the first two colours have been bumped off (translated to black) and therefore, the rest of the palette has been shifted two spots towards the left. Yesterday, I checked the default NTOSKRNL.EXE file and the compiled NTOSKRNL.EXE file in UltraEdit and I noted that Microsoft programmed the boot screen palette does not start at the beginning of line 00075690h as BootEditor was programmed to read, but rather at the ninth hex couplet of line 00075680h (A line consists of 16 hex couplets). So, we understand now that BootEditor is only programmed to read the palette codes starting at the first hex couplet of a line.

Solution: Once you have made the graphics, converted them to indexes, and transferred the graphics to BootEditor to compile it for SP2; you will need a hex editor like UltraEdit. You load up the hex editor to open the SP2 boot screen file and look for the line that says 00075680h on the left. Go to the ninth hex couplet and start typing everything in order listed from lines 00075690h to 000756c0h. When you get to the last eight hex couplets of line 000756c0h after typing the 64 hex couplets, type the following:

01 00 00 00 FF FF FF FF

Save the changes and you are ready to test the boot screen.

If you decide to not use BootEditor to insert the images, note that when you load up the hex editor to type in the palette, the sequence is Blue Hex Value, Green Hex Value, Red Hex Value, 00 and NOT Red HV, Green HV, Blue HV, 00. And yes, the palette is typed in order from index 0 to 15.

Hope this helps for you all and I'll be doing some deeper boot screen hacking, which some of the info may interest you in the future.

Source Neowin