From what I know, NTLDR is first stage bootstrap code (to load the kernel), with osloader.exe appended to the end of it as a second stage loader (since the kernel is loaded and executes this bit) to continue loading Windows.
So practically, you could probably just chop off the bit before the PE/MZ header of osloader.exe.
Just open up NTLDR in your favourite hex editor, search for "MZ" and delete everything before that. If you like, you can send me your file and I'll do it for you.
PE Explorer says: "Error! This is not EXE file!". What program can I use for this modification?
Tilka wrote:
Just open up NTLDR in your favourite hex editor, search for "MZ" and delete everything before that. If you like, you can send me your file and I'll do it for you.
PE Explorer wouldn't edit it anyway, since it's a 16-Bit executable (right?), and PE Explorer only supports 32-Bit PEs.
No, I think it's a 32-bit exe. I was using Resource Hacker and it "worked". Meaning I was able to modify it, but when I restarted the computer I got a nice error message saying "NTLDR is corrupt. The system cannot boot." After that I just didn't dare to do anything with NTLDR again Note: Windows 2000 apparently uses a different format
EDIT: Of course, NTLDR itself is 16-bit but osloader.exe is 32-bit.
Users browsing this forum: No registered users and 3 guests
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum
All views expressed in these forums are those of the author and do not necessarily represent the views of the BetaArchive site owner.