Fun idea: replacing the newer BSOD with the older one

[AS95678]

Here's a fun idea: replacing the newer BSOD introduced in Windows 8 with the older BSOD style used in Windows XP-7. Where is the BSOD and its resources stored? Is there anything that's been cut from newer versions of the BSOD that will have to be hacked in?

[Vova23]

ntoskrnl.exe

[Zv45Beta]

The only resources that are stored in ntoskrnl.exe are hibernation, "It's now safe to turn off your computer", and some black bitmaps that were used for the XP bootscreen.



It looks like the sad face from the Win10 BSOD is hardcoded: I'm not sure of its format in the file (probably some kind of a BMP file...)

The strings like "Your PC ran into a problem..." are actually hardcoded and are not found in Resource Hacker.

[3155ffGd]

I've been under the impression the sad face in Windows 8/10 is simply a plain-text ":(", and thus it should also be found as a string within the file. But as with the rest of the text, it would be hardcoded and not found as a resource viewable with Resource Hacker.

[Zv45Beta]

I've been under the impression the sad face in Windows 8/10 is simply a plain-text ":(", and thus it should also be found as a string within the file. But as with the rest of the text, it would be hardcoded and not found as a resource viewable with Resource Hacker.

I did find bytes that may actually be the sad face that is printed on the screen (and it's all in the Segoe font, including the text with the error, so it makes sense)

[AS95678]

Hmm, where's the color of the BSOD stored and how did older versions of the Blue Screen dump the text on the screen and how does it differ from newer versions?

[Zv45Beta]

Hmm, where's the color of the BSOD stored and how did older versions of the Blue Screen dump the text on the screen and how does it differ from newer versions?

You'd have to disassemble ntoskrnl.exe to find the exact procedure/operation used for color filling of the BSOD. (haven't tried it with Win32Dasm yet, I'll have a look tomorrow)

I think older versions did a fallback to 640x480 16-color mode (in case the native driver goes berzerk) and that the text was bitmapped. I'm not sure about that either, but I'll try to compare NT5 and NT6 with a disassembler and with a hex editor.

[XaddaGamer]

I don't think about more this older BSOD from Windows XP, Vista and 7.