To start ResHacker, double-click its executable file. The ResHacker window opens. To open a resource file (I'm opening a copy of the logonui.exe file as an example), select the File menu and then select Open. The Open File Containing Resource dialog box opens. Locate the resource file you want to open and then click Open.
The resource file is opened in the ResHacker window. Figure A.1 shows a copy of the logonui.exe file open in the ResHacker window.
Figure A.1. A resource file open in ResHacker.
Note that on the left side of the ResHacker window a tree display is used to show the various parts of the resource file. You can click each of the elements in the tree to expand that element. For example, the String Table provides decompiled code and lists the various code lines of the resource. You can use this to do such things as change the messages that are displayed by a resource file as a user interacts with the file. When a user interacts with the logon screen, different messages appear depending on what the user does. More importantly, there is a folder in the tree called Bitmap. This controls the bitmaps that are used to render the logon screen you see.
If you expand the Bitmap folder, you are presented with a number of subfolders that hold individual resource filesin this case the individual bitmaps that make up the logon screen. If you expand one of the folders, you can then click its contents and view the bitmap it holds in the main ResHacker pane (see Figure A.2).
Figure A.2. Expand the folders in a resource file to view the contents.
In the case of Figure A.2, I have expanded the folder that holds the Windows logo bitmap that appears on the logon screen. I've also selected the bitmap. The bitmap is shown in the main ResHacker pane.
Now, let's say you want to replace this bitmap with another bitmap. You must click the Action menu and select Replace Bitmap. The Replace Bitmap window opens (see Figure A.3). You can replace the current bitmap with a bitmap (.bmp) file or extract a replacement bitmap from another resource file.
Figure A.3. Locate a replacement bitmap file.
Click the Open File with New Bitmap button and then locate the bitmap or resource file (.exe, .dll, or .res). Select the file and then click Open. If you are using a single bitmap file as a replacement, it appears in the lower window of the Replace Bitmap window. If you are extracting the bitmap from a resource file you opened, the available images in the resource file are listed in the upper-left pane of the Replace Bitmap window. Click the picture you want to use.
Next, click the Replace button. You are returned to the ResHacker window and the replacement graphic appears in the main pane of the ResHacker window (see Figure A.4). Be sure you save changes to the resource file you are hacking by clicking the File menu and selecting Save.
Figure A.4. The replacement picture appears in the ResHacker window.
If you really feel compelled to use ResHacker, you should read the resources related to ResHacker that are provided at http://www.neowin.net/. This website provides a primer on ResHacker and includes a forum where you can read posts and replies from other users of ResHacker.
If you want to use ResHacker as a way to give the logon screen a complete makeover, you would replace each of the graphics contained in the logonui.exe resource file. You would then save the file to the Windows\System32 folder. When you reboot, the modified logon screen would then appear.
Although the example in this appendix deals only with the changing of a bitmap file in a resource file (logonui.exe), you can use ResHacker to virtually rewrite a resource file. You can even hack resource files associated with applications. You can also use it to replace cursors, icons, and bitmaps that are found in the various resource files discussed in this book.
ResHacker really is the ultimate tool for reworking interface elements and other Windows resources. However, as I've mentioned before, you should mess with Windows resource files only if you are willing to take the riskand it is definitely a risk. But if you like playing around with file source code and like to see how individual resource files work, ResHacker can be a fun tool.
Your replacement bitmaps should be the same size as the bitmaps you are replacing in the resource file. To find the height and width of an image in a resource file, right-click the bitmap in the ResHacker window and then select Copy. You can then paste the image into your favorite image editing software to check out its size and other attributes. Be sure that the replacement has the same attributes (particularly the size and color palette, such as RGB) as the original.