Resolved Editing the NTOSKRNL file?

Hi all,

I'm trying to edit the NTOSKRNL.EXE file with Resource Hacker. The problem I have is that when I rename the file, a new one is automatically added.

I tried: Safe Mode, turning off System Restore "” yet it always replaces itself; sometimes with "ntoskrnl-original.exe ".

How do I rename the file without it automatically replacing itself so I can hack it?

 

Hi jpChris,

Are you by any chance trying to change your bootscreen?

First of all, doing it directly will fail almost all of the time.
you need to copy the file ,then edit it and replace the old one with your new concoction
BTW,you can't rename ntoskrnl.exe and expect it to run.You can edit it,
but the replacement has to have the same name.
If you can't replace it on a running system ,try it with the help of a Live CD.

Windows file protection will not allow it,so you may have to turn that off too.
Also Windows Updates may revert it to the original file.

You can try this (old thread) Customizing the XP boot logo
http://articles.techrepublic.com.com/5100-22_11-5169193.html

Easier way is to use LogonUI Boot Randomizer
http://userxp.belchfire.net/indexlbr.htm

You can also try the Boot Editor on this page http://userxp.belchfire.net/

Of course ,if that's not what you had in mind,maybe let us know what you want to do

Pete.

 

Hi Pete,

Exactly! I've used BootSkin in the past, but with my new MoBo's drivers it won't play nice.

Here's what I've tried (other than renaming the file): Copied NTOSKRNL to the DeskTop; edited the file in Resource Hacker and changed the bootscreen .bmp to the one I made with BootSkin; saved the changes and copy\pasted it into the Win\Sys32 folder. (I did a search and found NTOSKRNL in "Driver Cache\i386, Service Pack Files\i386, System32\dllcache; all dated 2004-05. Also, I found duplicates of those files in: Driver.cab; SP1.cab; SP2.cab; Service Pack Files\SP2.cab. Those files are from 2001, 2002, and 2004.)

Anyway, after I copied the edited file and pasted into the Sys32 folder, a new file was created immediately called ntoskrnl-original.exe, and I can't get past this.

As far as turning off Windows File Protection, doesn't turning it back on (after the bootscreen change) replace the edited file?

 

Hi jpChris,

Yes you're on the right track.
You used Bootskin from Stardock ,right?
Did you try the one from UserXP (belchfire)? from the link I gave you?

No it won't ,since the change happened while it was off.
But an easier way is to do it in SafeMode .
Here's another link describing it (you know most of it)
http://www.jakeludington.com/windows_xp/20060219_change_xp_boot_screen.html
As you can see the BIOS branding screen can also be changed if the file allows access.

My preference for doing stuff like this is from a Live XP CD.(so I'm working outside the OS)
I strongly recommend to back up any files you're going to change or delete.
Also create a Live CD like a rescue CD .There are numerous versions of it.

EG, Hiren's Boot CD,ERD Commander, UBCD4Win, LiveXP from Bootland ,http://winbuilder.net/download.php?view.35, LiveXP is at the top - other projects are on this page as well.
Great for doing repairs or just run from it even if your harddrive is hosed.

Pete.

 

Hi DiggerP,

I apologize for not responding before now. I'm perma-set to "Instant E-mail Notification" but this one didn't come through.

Anyway, thanks for the links; lots of good stuff. When I get back on the other machine I'll give it a go and let you know how it worked.

 

Hi jpChris,

No problem.My settings are the same and the same thing has happened to me.
Also with other email being marked as spam.Trusted email will all of a sudden be marked as spam by my ISP or email client. No apparent difference in the mail itself.
Must be a change in the ISP's filters or something.
Anyway have fun with your tweaking

Pete.

 

Hi Digger,

I got it sussed out. I moved my drive to a new MoBo — easier than I thought — and it was when I installed the new drivers that the "problem" happened.

So, I did it again (and again, and again) until I narrowed it down to two drivers that, for some reason, messed with the bootscreen. Win XP has some SATA drivers and they worked for my rig. And, since I didn't install all the drivers, my bootscreen stayed!!!

Anyway, on a scale of 1 to 10, this rates a - (minus) 3,682. I mean after all, the bootscreen is only up for about 5 to 10 seconds, but it became a "thing" with me.

Thanks, again, Pete, for the links.

 

Hi jpChris,
No problem.Actually it had a different slant to it than I originally thought.
I guess you were lucky with the MoBo - did you just move the drive without re-installing XP? I've done the same and it seems to work if the MoBos are of the same family.
I may be wrong ,but I didn't think XP had any built-in SATA drivers.
Anyway ,you got'er done
As for the bootscreen ,I usually don't bother changing that since it's so short.
Besides that, most of it is taken up with the OS selector screen - got about 5 different
OS's to choose from or just let it go to default.

Yeah,try those LiveXP CDs - there's a whole bunch out there.
Have run those for a week or more while waiting for parts (hard drives) and some problems to be solved.Lots of stuff runs almost as normal.
Just looking at it, most people wouldn't know that you're running off a CD and all of it runs in RAM.Files can be saved to USB flashdrive if the drivers are on the CD.

Pete.

 

The new MoBo is totally different from the old (chipset, BIOS, SATA, PCI-E, Memory, etc.). The only thing that's the same is the CPU "family ". The new one is dual-core, overclockable, and a GHz bigger.

As far as the "move ", I followed MS's guidelines and it went without a hitch — that's why I did it so many times trying to find the glitch. A few minor things had to be reset, but no big deal.