Another Windows XP Hack

Ok. This is what happened to me. I was reading my friends blog, and he had talked about hacking the Windows XP Logon Screen. But his blog was written for Windows XP SP1a. So I'm spending some time, winging the blog. So after I figured out the differences in SP1a and SP2 I finally hacked the logon screen. So this is blog on how to hack it if your using Windows XP SP2. Now the version I used was Windows XP Pro SP2. Here's what you'll need.


What You Need

Windows XP SP2 preferably Professional that way your on the same page as me.
Resource Hacker(you can get it here
A boot disk(my friend claims he did it with a win98 floppy, but I couldn't do it. MS must of prevented people from using it in SP2. So I used BartPE you can get it here)
Some pics in a bitmap format.
And the most important thing you need is a fully functional brain.

Before I get started let me just say a few things. If you mess up this hack don't come crying to me. I'm simply telling you how to do it. I'm not making you do it. If you mess it up you did it, not me. And I suggest you backup all of your important data before trying to do this. This hack is perfectly legal unless you do it for profit.

Now that I've said all that lets get to business. Windows XP has many files in it. Many of these files are hidden or threaten you with a message saying something along the lines of "These are protect Operating System files. If you view the contents we will be very mad, you can destroy your computer) well it says all that except for them being very mad. And I've never had a problem by just viewing these files. Feel free to look at any file in Windows XP. Right now I want you to find the file logonui.exe. It is located in the C:\Windows\System32 directory. Once you find it copy it to another location.

Now open up Resource Hacker, and goto File > Open. A dialog box will pop up asking you what file you want to open, navigate to the directory that you saved the logonui.exe file in, and open it in ResHack. In doing this 4 files will appear inside of ResHack. These files are UIFILE, Bitmap, String Table, And version Info. The only one we will worry about is the Bitmap file.

The Bitmap file has several other files inside of it. All of which have names that are just numbers. You should see the file names like what I am about to mention down below.
List of Files
100
102
103
104
105
106
107
108
109
110
111
112
113
114
And then it goes to file
119
then
121
122
123
124
125
126
127

If you open up each file you will see some pics. And you will start to notice that these pics are bits and parts of the default logon screen. So what we are going to do here is open up the first file, it's name is 100 then click on the little lime named 1033(in SP1a the lime is 1022). And you will see the baby blue screen. Now don't ask me why, but this is just for the top left corner of the screen. Now right click on the lime and scroll down to replace resource, and click on it. Then another window pops up. Click the button that says "Open File With New Bitmap" then go to the directory that have you bitmaps in. Choose a bitmap, then click open. Then you should see the image change. But that doesn't mean anything to ResHack. To make it mean something you need to tell ResHack to change it, to do the click the button that says replace file.

So you do the same things with all the other files. After your down doing this then you go to File > Save. Then close ResHack.

Now take you boot disk and restart your computer into the boot disk. Niw that your using the boot disk you can replace logonui.exe. To do this the easy way open up the command prompt. Then if you saved your edited version of logonui.exe in the C drive. Then type C: and press ENTER
Now to see if your file is there type this
dir then press ENTER
You should see the file on the right of the prompt. If you see it your in the right place. If not find out where you put it then go there.
So I'm going to assume you see the file. If this is so then type this in the prompt.
copy logonui.exe C:\windows\system32 then press enter.
Now you can log off of the boot disk and start up windows and if you did everything right then you should see your custom boot screen.