Replacing the Windows XP Start Button Background - Patching Uxtheme.dll
(Page 5 of 6 )
So you’ve decided to get your hands dirty and take a leap into the world of hex editing. Great! Fasten your seat belt, follow along, and you should have no problem at all.
Microsoft’s Themes service is housed in the file uxtheme.dll located in your System32 directory. It is a Windows protected file. As always, when editing system files, you should make a backup in case of emergency. This file is changed depending on your PC’s service pack level so restoring from the Windows CD is not recommended.
This service is enabled by default so your first step is going to be stopping the service. Open the run dialog box and run services.msc to start the Services MMC snap-in.
Locate Themes in the service list. Right-click it and choose Properties… to open the Themes Properties dialog box. Click the Stop button to end the service. You should see your taskbar change to the plain looking taskbar from the Windows Classic theme.
What you are seeing is actually not the Windows Classic theme. Windows themes are based on HTML and CSS. By ending the service you are essentially seeing raw HTML without the CSS formatting.
Next, you’ll need to remove Windows File Protection for uxtheme.dll. Do this in the same fashion that we’ve used for Explorer.exe and luna.msstyles in this article series. Make sure that you remove all of the backups except the one that you created.
Now you can open uxtheme.dll in your hex editor. You’ll need to know what version you are running because each version requires a different edit. If you don’t know the service pack level of your system, you can find out in the System Properties dialog box.
In the table below you’ll find the different edits that need to be made. Each one has an offset listed. That is the memory address where the data string begins. The second column shows the data that needs to be replaced. The last column shows the data that it should be changed to.
No Service Packs Installed |
Offset | Original Data | Replacement Data |
0x0000B624 | 0F 8C 80 00 00 00 | 90 90 90 90 90 90 |
0x0000B6BB | 81 EC 80 00 00 00 56 57 | 33 F6 8B C6 C9 C2 08 00 |
0x0000B71E | 7C 38 | 90 90 |
Service Pack 1 |
Offset | Original Data | Replacement Data |
0x0000C3FF | 81 EC 80 00 00 00 56 57 | 33 F6 8B C6 C9 C2 08 00 |
Service Pack 2 |
Offset | Original Data | Replacement Data |
0x0001BB8C | 81 EC 88 00 00 00 A1 18 | 33 F6 8B C6 C9 C2 08 00 |
Once you've made all of the edits that you need to make, save the file. Choose yes if you are prompted about overwriting. At this point, you will most likely be notified about changing a protected Windows file. Choose Cancel when asked to insert your Windows CD.
Next: Replacing the graphic. >>
More BrainDump Articles
More By Nilpo/Developer Shed Staff Writer
/ 8 
