ZoRoNa's profileZoRoNaX' blogBlog Tools Help
    10/8/2006

    Windows Vista boot screen customization

    Until Windows Vista, one had to change the resources of ntoskrnl.exe to modify the boot screen. Modifying the ntoskrnl.exe executable is, of course, is very sensitive to human error which could render your Windows installation useless. With Windows Vista, the Windows loading process has been overhauled. For example, boot-time graphics were relocated, new native-mode boot-time applications added (winload.exe, winresume.exe) and all critical kernel components have received a digital signature. Because of the digital signatures, tampering with the kernel is no longer possible. Has the customization of the boot graphics come to an end? NO!
     
    Multilingual User Interface files
    With Windows Vista, Microsoft provides new functionalities in the Multilingual User Interface (MUI) area. This new functionality allows developers to separate localized resources (e.g. text strings) from language independent resources (e.g. bitmaps, icons, cursors). Typically, the separate .mui file contains the localized resources and the application executable contains the language independent resources. Just as with any .dll or .exe, a .mui file is just a normal Win32 portable executable (PE) stripped of executable code. On Windows Vista, the Win32 resource API functions have been modified to load resources from the .mui files automatically. Because the loading of resources happens independently of the application, it doesn't matter if the resource is located in the application executable or in a .mui file. The resource loading process can be seen as the following: First, the resources located in the applications executable are loaded into the memory. Afterwards, the system decides which .mui file to use (based on the language) and loads the resources from the .mui file on top of the previously loaded resources, replacing any resources that already exists! If a resource exists in a .mui file it will be loaded from the .mui file, but if a resource doesn't exist in a .mui file, the system loads it from the application executable resources if it exists there. But what does this MUI stuff has to do with boot screen customization? Everything!
     
    Boot screen customization
    Because .mui files don't have a digital signature, its resources can be modified without problems. So if one wants to replace a resource in a digitally signed executable, one can add the resource to the .mui file (or replace it in the .mui file if the resource exists there). That's exactly what we'll do to customize the Windows Vista boot screen, so grab your favorite Win32 resource editing tool and let's start! If you don't know which tool you need for this, you can download the excellent Resource Builder or the alternative Resource Hacker.
     
    Customization instructions
    First you have to create a working directory, let's say X:\bootscreen\, which is going to contain the modified winload.exe.mui file. Furthermore, I will assume that you have installed Windows Vista on your V: drive (of course you have to substitute these paths in this article with your own paths).
    1. Open V:\Windows\System32\Boot\winload.exe with your favorite Win32 resource editing tool, navigate to resource 1 in the RCData resource section and save its contents to X:\bootscreen\winload.wim (there is only one RCData resource).

      The extracted Windows Image (WIM) file contains the boot screen bitmaps. You can modify the winload.wim contents by using ImageX.

      NOTE: ImageX currently is only distributed with "Microsoft Solution Accelerator for Business Desktop Deployment (BDD) 2007 (Beta) for Microsoft Windows Vista". Because BDD 2007 is still in beta, you can only get ImageX if you are a member of the beta program.
    2. Mount the WIM image by creating a mount directory in the working directory (for example X:\bootscreen\mount\). Mount the WIM image with write access by executing:

      imagex /mountrw X:\bootscreen\winload.wim 1 X:\bootscreen\mount

      If ImageX successfully mounted the image, you will see two bitmap files in the X:\bootscreen\mount\ directory: osload800x600.bmp and osload1024x768.bmp . These two files are required and are used for the boot screen at 800x600 and 1024x786 resolutions respectively. You can replace these files with your own, as long as they are of bitmap type and have the above defined name and size.
    3. After editing the bitmaps, commit the changes to the WIM file by executing:

      imagex /unmount X:\bootscreen\mount /commit
    4. Now X:\bootscreen\winload.wim contains your custom images, copy V:\Windows\System32\Boot\en-US\winload.exe.mui to X:\bootscreen\winload.exe.mui and open it with your favorite Win32 resource editing tool.
    5. Create a new resource of the type RCDATA with name 1 and language 1033 (1033 stands for English-US) and import X:\bootscreen\winload.wim as the resource’s data. Save the file and exit your Win32 resource editing tool.

      If you have a non English-US version of Windows Vista, your language code may be different. You can find a list of language codes here.
    6. Copy X:\bootscreen\winload.exe.mui back to V:\Windows\System32\Boot\en-US\winload.exe.mui and you're done!
    Text customization instructions
    Changing the text in the boot screen is also possible. XML editing experience is required and assumed below.
    1. Open X:\bootscreen\winload.exe.mui with your favorite Win32 resource editing tool and navigate to resource OSLOADER.XSL in the 23 resource section and save its contents to X:\bootscreen\osloader.xsl.
    2. To change the Starting Windows Vista text, navigate to the osload-status template and change the text of the value attribute in the update element.
    3. To change the position of the Starting Windows Vista text, navigate to the osload-graphics template and change the value of the height and width attributes of the textarea element in front of the textarea with a name attribute of status.
    10/5/2006

    Object Store types

    Recently, Inky presented me a list of Object Store types (Object Store is the functionality that stores your messenger content [display pictures, emoticons, etc] on your computer) and asked me if I could fill in the blanks. Because I worked the last couple months on a tool that can enumerate all the installed content (the import and export functionality is currently on the to-do list) I was able the complete most of the list. After a small research, I was able to complete the whole list.
     
    Value Name Comments
     1 Avatar Unknown, but already present since the beginning (MSN Messenger 6.0).  
     2 Custom Emoticons
     3 User Tile Static display pictures.
     4 Shared File Unknown, but already present since the beginning (MSN Messenger 6.0).
     5 Backgrounds Static backgrounds.
     6 History
     7 Deluxe Display Pictures Dynamic display pictures.
     8 Winks3 Winks.
     9 Map File A map file contains a list of items in the store.
     10 Dynamic Backgrounds Dynamic backgrounds.
     11 Voice Clip
     12 Plug-In State Saved state of Add-ins.
     13 Roaming Objects For example, your roaming display picture.
     14 Location Information about your locations (City, Country, etc).
     
    If you list it per Messenger version, you get the following list.
     
    MSN Messenger 6.0
    • Avatar
    • Custom Emoticons
    • User Tile
    • Shared File
    • Backgrounds
    MSN Messenger 6.1
    Nothing new has been added in this version.
     
    MSN Messenger 6.2
    • History
    MSN Messenger 7.0
    • Deluxe Display Pictures
    • Winks3
    • Map File
    MSN Messenger 7.5
    • Dynamic Backgrounds
    • Voice Clip
    Windows Live Messenger 8.0
    • Plug-In State
    Windows Live Messenger 8.1
    • Roaming Objects
    • Location

    Unified User Notification (UUN)

    Unified User Notification (UUN) was introduced together with Unified Buddy Notification (UBN) in MSNP13, to give clients the ability to exchange data with another without setting up a Switchboard session first. Although MSNP13 isn't the latest version of the protocol, the real purpose of the commands has come to the light with the introduction of Windows Live Messenger 8.1. If you send a UUN command to a buddy via your Notification Server, his or her client will receive it as a UBN command from the Notification Server.
     
    When sending a UUN command to the server, 4 parameters are needed: a transaction identifier, the receiving buddy's e-mail address, the type of the data being send and the payload length. The type parameter can have the following values:
    • 1 - Data for the Shared Folders sharing engine (in particular for the Synchronization Negotiation Manager).
    • 2 - Not yet observed, so still unknown.
    • 3 - MSNSLP data for starting a P2P session (in particular for starting a direct connection).
    The differences between UUN and UBN are that the UBN command doesn't have a TrId parameter and that the parameter containing the e-mail address is the e-mail address of the sender.
     
    Sending UUN - Abstract
    Client: UUN <TrId> <receivers e-mail address> <type> <payload length>\r\n<payload data>
    Server: UUN <TrId> OK\r\n
     
    Sending UUN - Example
    Client: UUN 10 buddy_b@live.com 1 78\r\n<SNM opcode="SNM" csid="{054F3A1E-229C-453a-8AAA-5530DEC402BB}" priority="0"/>
    Server: UUN 10 OK\r\n
     
     
    Receiving UBN - Abstract
    Server: UBN <senders e-mail address> <type> <payload length>\r\n<payload data>
     
    Receiving UBN - Example
    Server: UBN buddy_a@live.com 1 78\r\n<SNM opcode="SNM" csid="{054F3A1E-229C-453a-8AAA-5530DEC402BB}" priority="0"/>