Hacking the Windows XP Start Button Text

We’re going to begin very simply by changing the start button text.  You’re going to be editing some core Windows files.  These are binary files and can’t be edited using a standard text editor.

In order to make these changes, you’re going to need a resource editor.  A resource editor is a program that allows you to open compiled binary files such as exes and dlls and edit their resources.  Resources include things like text strings (for dialog boxes) and the bitmap images used for icons and dialogs.

It’s probably a good idea to print out this article so that you can follow along.  Once we get started, you won’t be able to have your browser open.

There are many resource editors available including XN Resource Editor and Resource Builder, but I think the easiest one to use is an “oldie but goodie” from circa 2000, Resource Hacker.

Resource Hacker has a very simple interface and very simple menus that make it extremely simple to use for beginners and very quick for experts.  It also doesn’t require any installation.  Just download the zip and extract it with your favorite zip program.

Once you have Resource Hacker, go ahead and download the component pack I’ve put together.  It contains all of the example graphics I’ve used as well as a WSH script you can use to save time later in this article.

Now is also a good time to close any unnecessary programs and disable any antivirus programs.  You need to make sure that Explorer.exe is not in use by any other programs; antivirus software sometimes protects it with real-time scanning.

You have everything you need; now you’re ready to rock!

Before you begin editing any operating systems files, always remember the first rule of computing:  Back up!

I’ve taken the time to add a lot of pictures to this article so that you can see exactly what I’m doing.  In an effort to keep them in the highest detail possible, I have not cropped any of them.  You can click on any of the shrunken images to see them full size.

You’re going to want to back up all of the files we’ll be working with.  While we’ll only be editing one we will be deleting several others.  You can back them all up very quickly by running the UnprotectExplorer.vbs file included in my component pack.  Not only will it back up all necessary files for you, but it will also take care of the next step as well—unprotecting Explorer.exe.

If you prefer to do your backup manually, just follow along.  If you ran the script, you can jump to the next section and begin “Editing the start button.”

We’re going to be editing Explorer.exe which is the executable used as the Windows shell.  This is the file that manages your taskbar and start menu along with some other things.

In My Computer, open up your Windows directory (the directory where Windows was installed). In most cases this is in C:\Windows but it may also be C:\Winnt on Windows 2000 upgrades.  Find the file named Explorer.exe and make a copy of it in the same directory.  Name your copy something like Explorer.backup.exe.

If you’re running Service Pack 1 or 2, navigate into the ServicePackFiles directory and do the same.  This time, however, you’re going to delete the original.  This is a backup file used by Windows to replace a damaged Explorer.exe file in your Windows directory.  Since we’re going to be editing it and changing its file size, Windows is going to think it’s been corrupted.

Go back up a level and perform the same process again in the LastGood folder if it exists.  Again, make sure to delete the original.  This is the folder where Windows stores backup files that are used when you boot using the Last Known Good Configuration option.

In case you’re worried about not being able to use the Last Known Good Configuration, don’t be.  After making our changes, a successful reboot will add our hacked version of Explorer.exe to the LastGood directory making it once again available for future use.

Navigate back up to the Windows directory and then into System32.  Find a directory named dllcache and perform the same operation again, both backing up and deleting the original.  This is the backup folder used by Windows File Protection.

Take a breath, you’re almost there.  Now that we’ve eliminated all of the backup files that Windows would use to undo our changes, we need tell it to stop monitoring the file for changes.  This will prevent Windows from nagging us about an incorrect file version once we reboot.

To do that, you’ll need to navigate back into the System32 directory and then into the Restore directory.  Here we’re going to edit a file called filelist.xml.  This is a hidden file.  You may need to enable viewing of hidden files and folders in order to see it.

You can do that by choosing Folder Options from the Tools menu.  In the Folder Options dialog box, select the View tab.  In the Advanced Settings box, scroll down until you see Hidden files and folders.  Select the radio button labeled Show hidden files and folders and then click Apply and OK to save the changes.

You should now see the file grayed out.  Right-click it and choose Properties…  On the General tab, remove the checkmark next to Read-only to remove the file’s read-only attribute.

Now make a copy of the file as we’ve done before.  Right-click the file and open it using Notepad or some other simple text editor.  Near the top of the file you’ll find an <EXCLUDE> section.  Insert a line above the one containing “<REC>%windir%\system.ini</REC>” and add the following line in the exact same format.

<REC>%windir%\Explorer.exe</REC>

Save your changes and then reapply the read-only attribute by replacing the checkmark in the File Properties dialog box.  You’ve now removed file protection for Explorer.exe.  Although protection isn’t officially disabled until you reboot, you'll want to see the nag screens to know that your changes were applied successfully.

Once we’re all finished up you’ll want to reboot to get your system up and running properly again.  While it is uncommon, you may experience some slight system instability until you do.

Now we’re ready to do the dirty work.  At this point, Explorer.exe should be unprotected and all other programs should be closed.  For all intents and purposes you should be staring at your desktop with its original Start button.

Go ahead and start Resource Hacker from the folder where you unzipped it.  You can close the folder window now if you want.

With Resource Hacker open, we need to end the Explorer.exe process.  We’re not going to be able to edit the file while it’s running.  If you try, you’ll just get the classic “this file is in use” error.

To do this, press Ctrl + Alt + Del to open the Task Manager.  Typing taskmgr in the Run dialog also works nicely.  Select the Processes tab.  Find and select the explorer.exe process.  Clicking the Image Name heading to sort the listing may make this a little easier.

With the explorer.exe process selected, click the End Process button.  You should see your taskbar disappear.  You can close the Task Manager window.

Now you need Resource Hacker.  If it was minimized when explorer.exe was closed, you can bring it back by holding down the Alt key and pressing Tab repeatedly until it’s selected.  Releasing the Alt button will bring Resource Hacker back in to focus.

In Resource Hacker, select Open… from the File menu.  Navigate to the Windows directory and open Explorer.exe.

In the left pane you should see a tree listing containing all of the resources in the executable.  Expand the String Table listing and then the entry named 37.  Next, select the listing for your installed language.  There’s usually only one option here anyway.  In my case it’s 1033, that the code for en-us (US English).

Now you should see a sort of script in the right pane.  In the line beginning with 578, you should see start in quotation marks.  Change this to whatever you would like your start button to display.  Mine looks like this:

578,   "Developer Shed"

Once you’re satisfied with your changes, click the Compile Script button above the right pane.  This will edit the resource, but will not yet commit changes to Explorer.exe.  You can repeat this process again if you change your mind before saving.

Now go back to the left pane and select heading 38.  Make the same changes for line 595.  Again make sure to click the Compile Script button.

Now head up to the File menu and Save your changes.  You'll see two notification boxes letting you know that a system file has been changed.  Click Cancel to the first and Yes to the second.  That’s all there is to it.  You now you need to start the explorer.exe process again.  You can do this from the Task Manager.  Press Ctrl + Alt + Del to open it again.

From the Task Manager’s File menu, select New Task (Run…) to open the Run dialog box.  Type in explorer.exe and click OK.  After a few seconds, you should see your taskbar reappear with all of your icons and your newly designed Start button.

See?  That wasn’t so hard, was it?  Take a look at my Start button in the graphic below.  If you ever want to revert the changes, just follow the process again or rename the explorer.exe backup file that we created in the Windows directory.  Make sure that you end the explorer.exe process or you won’t be able to replace your hacked version with the original.

You can use this process for editing most of the text strings you’ll see in the Windows environment.   A good many of the default error messages and dialog boxes are strewn throughout Explorer.exe.  But here's a little word of caution: making too many changes can cause it not to work at all.  Always make sure that you keep that original backup.

In an emergency, you can always extract the original Explorer.exe file from your original Windows installation disc or the recovery disc provided by your PC manufacturer.

I hope you had as much fun as I did.  Be sure to stick around for part 2 of this series when I show you step-by-step how to create and replace your start button’s graphic icon.  I’ll also be revealing a nice secret that you won’t find anywhere else on the Internet.  Don’t miss it!  Until next time…