View topic - NTLDR Extraction!!! Very Urgent!

Daniel1981

Hello
How do I extract the files inside NTLDR??!?!
I tried to find an answer all over the internet without any sucess...

RentedMule · **Post subject:** **Posted:** Fri Nov 21, 2008 9:52 pm

From what I know, NTLDR is first stage bootstrap code (to load the kernel), with osloader.exe appended to the end of it as a second stage loader (since the kernel is loaded and executes this bit) to continue loading Windows.

So practically, you could probably just chop off the bit before the PE/MZ header of osloader.exe.

Why is something like this so urgent?

Daniel1981 · **Post subject:** **Posted:** Fri Nov 21, 2008 10:20 pm

Because I dont know how to do that. I dont understand how to do that.

Frozenport · **Post subject:** **Posted:** Fri Nov 21, 2008 10:26 pm

Are you referring to Boot.ini?

Tilka · **Post subject:** **Posted:** Sat Nov 22, 2008 2:55 am

Just open up NTLDR in your favourite hex editor, search for "MZ" and delete everything before that. If you like, you can send me your file and I'll do it for you.

Daniel1981 · **Post subject:** **Posted:** Sat Nov 22, 2008 8:36 am

PE Explorer says: "Error! This is not EXE file!".
What program can I use for this modification?

KenOath · **Post subject:** **Posted:** Sat Nov 22, 2008 12:34 pm

Daniel1981 wrote:

PE Explorer says: "Error! This is not EXE file!".
What program can I use for this modification?

Tilka wrote:

Just open up NTLDR in your favourite hex editor, search for "MZ" and delete everything before that. If you like, you can send me your file and I'll do it for you.

hounsell · **Post subject:** **Posted:** Sat Nov 22, 2008 12:52 pm

PE Explorer wouldn't edit it anyway, since it's a 16-Bit executable (right?), and PE Explorer only supports 32-Bit PEs.

Tilka · **Post subject:** **Posted:** Sat Nov 22, 2008 1:01 pm

hounsell wrote:

PE Explorer wouldn't edit it anyway, since it's a 16-Bit executable (right?), and PE Explorer only supports 32-Bit PEs.

No, I think it's a 32-bit exe. I was using Resource Hacker and it "worked". Meaning I was able to modify it, but when I restarted the computer I got a nice error message saying "NTLDR is corrupt. The system cannot boot." After that I just didn't dare to do anything with NTLDR again :oops:

Note: Windows 2000 apparently uses a different format :^)

EDIT: Of course, NTLDR itself is 16-bit but osloader.exe is 32-bit.

Kenneth · **Post subject:** **Posted:** Sat Nov 22, 2008 11:37 pm

Quote:

EDIT: Of course, NTLDR itself is 16-bit but osloader.exe is 32-bit

.
It's actually Startup.com+Osloader.exe.

Quote:

Note: Windows 2000 apparently uses a different format

No it doesn't, they just did not specify the MZ in the app.

davehc · **Post subject:** **Posted:** Sun Nov 23, 2008 6:44 am

Hi Daniel. You may be getting confused with the high tech answers. Why do you want to do that. What's the problem.

HubmaN · **Post subject:** **Posted:** Fri Nov 28, 2008 7:13 pm

davehc wrote:

Hi Daniel. You may be getting confused with the high tech answers. Why do you want to do that. What's the problem.

This is the Customisation forum, why not?

Daniel1981 · **Post subject:** **Posted:** Fri Nov 28, 2008 8:05 pm

Correct, I want to customize my NTLDR. Can someone help me?

logicaL · **Post subject:** **Posted:** Sat Nov 29, 2008 7:04 am

Daniel1981 wrote:

Correct, I want to customize my NTLDR. Can someone help me?

Customize how?

Put up a new Bootscreen? (There are easier ways)
Change/Add/Remove something to the bootlist? (There are easier ways)
Something Else?

Kenneth · **Post subject:** **Posted:** Sat Nov 29, 2008 7:08 am

If you want to customise strings, look at the topic I made about NTLDR customisation below.

NTLDR Extraction!!! Very Urgent!

Who is online