Geoff Chappell - Software Analyst
The Windows XP kernel ordinarily displays a logo and progress bar while booting. There exists a small industry—yes, with software actually for sale—concerned with changing this boot logo. Moreover, this personalisation is apparently so desirable that people are prepared to get it by editing the bitmap resources in the kernel, even to the point of working around particular locations within Microsoft’s images.
As it happens, nothing even nearly so drastic is needed for changing the boot logo in Windows XP. A simple reconfiguration that disables the ordinary boot logo is well-known from Microsoft’s documentation. Microsoft also provides, but seems not to document, a similarly simple reconfiguration for displaying an installable boot logo instead.
Prepare your boot logo as a file in the Windows Bitmap (BMP) format. It must be displayable using VGA graphics. This means specifically that the image can be no larger than 640 by 480 pixels and that the palette can have no more than (any) 16 colours. Download an example.
Save your logo file as BOOT.BMP in the Windows directory (typically C:\WINDOWS) of whichever Windows XP installation you want this boot logo to apply to.
In the [operating systems] section of your BOOT.INI file, find an entry that corresponds to that same Windows installation. To this entry (or perhaps to a copy of it, for safety, at least at the first attempt), add the options /bootlogo /noguiboot.
The (undocumented) /bootlogo option tells the NTLDR to display the installable boot logo. The (documented) /noguidboot option tells the NT kernel not to show the ordinary logo from the kernel’s resources—and, in combination with /bootlogo, to leave alone whatever already is displayed.
Be sure not to stray from VGA compatibility. The NTLDR does not check at all that the file conforms to one of the few suitable formats. The best consequence of installing an unsuitable BOOT.BMP is that the image is displayed unrecognisably. One case is known that is more serious: if the image has 4 bits per pixel and the bitmap data is not stored with the BMP format’s Run Length Encoding (RLE) compression, then if the image width exceeds 640 pixels, a programming error may cause the NTLDR to crash while trying to display the logo.
(The coding error is a buffer overflow. The 4 bits-per-pixel format for uncompressed bitmap data in the file does not correspond directly to what must be written to the 4 colour planes of video memory. For each colour plane in each whole row of the video image, the code extracts the video bits from the file data to an 80-byte buffer on the stack. This size suffices if the image width is no greater than 640 pixels, but none of the relevant code ever checks, and a wider image therefore corrupts some amount of whatever follows the buffer on the stack.)
This note is based on inspection of the NTLDR file from Windows XP Service Pack 1. However, perusal of other Windows versions for a revision of this article in 2007 has shown that the feature dates from at least the original Windows XP and continues at least until Windows Server 2003 Service Pack 1.
In the reworking of the boot-time executables in Windows Vista, the boot option that BCDEDIT presents as quietboot translates for all practical purposes to the combination of /bootlogo and /noguiboot (notwithstanding that Microsoft continues to document only the latter). However, the boot logo is no longer found so simply. It is still taken from a named file (see below for details), but the location is not so readily accessible, being a WIM file stored within WINLOAD.EXE as a data resource. A WIM file is a disk image, and the files within the file are easily enough worked with, e.g., to be replaced by a bitmap of your own, given the right tools. However, these tools are not supplied as standard with Windows, and there is anyway the complication that WINLOAD.EXE is a signed executable.
The bitmap file for the installable boot logo in Windows Vista must be named either “osload1024x768.bmp” or “osload800x600.bmp”, depending on the display resolution, and be in the root directory of the disk image. It is now allowed 1, 24 or 32 bits per pixel, and RLE compression is no longer supported.