Regarding the embedded LOGO in MS-DOS 7.x, I just found the following information online:
The cover of Windows 95 does not have a bitmap file in an independent file form, which is different from the processing of LOGOS.SYS by WIN.COM and the processing of LOGOW.SYS by USER.EXE. The author discovered during the analysis of the boot file IO.SYS that the startup cover logo of Windows 95 is embedded in the boot file IO.SYS and compressed by DBLSPACE, with an image data area length of 64KB. In the version of Windows 95 analyzed by the author, the image data occupies sectors 217-344 of IO.SYS (file length 223748B), and there are multiple "DS" identifiers inside the data, which are signs of DBLSPACE compressed files. Since DBLSPACE is a segmented checksum compressed file, even a change of one byte in this area will cause a large-scale damage to the image. In the above IO.SYS, the part of the image display execution code starts at the place marked with "DBLSBIN$\LOGO.SYS" and occupies sectors 110-112. Because the compressed file of DBLSPACE is very complex and segmented checked, we cannot customize the startup cover like modifying the combined file or recompiling part of the code of WIN.COM for Windows 3.1, but we can blank the display by setting Logo=0 in MSDOS.SYS. The settings of the configuration file MSDOS.SYS are already available in relevant documents, and Appendix 2 of this article briefly describes the configuration setting options.
In fact, the startup cover can also be customized. The author found during the analysis of IO.SYS that before IO.SYS displays the embedded cover internally, it tries to open a file named LOGO.SYS in the boot directory (using the DOS function call INT 21H, AH=3DH sub-function). If the opening fails (this file does not exist), it switches to display the embedded cover internally (when the opening fails in WIN.COM and USER.EXE, it does not display the graphic but replaces it with text to display relevant information). If the opening is successful, it does a file format check, and the required format is more stringent than the check conditions of WIN.COM for LOGOS.SYS.
The code for IO.SYS to check LOGO.SYS is as follows:
debug io.sys
-u de0e
12B9:DE0E 813C424D CMP WORD PTR ,4D42
12B9:DE12 0F DB 0F
12B9:DE13 854801 TEST CX,
12B9:DE16 83C60E ADD SI,+0E
-u de19
12B9:DE19 833C28 CMP WORD PTR ,+28
-u de20
12B9:DE20 837C0C01 CMP WORD PTR ,+01
-u de28
12B9:DE28 837C0E08 CMP WORD PTR ,+08
-u de30
12B9:DE30 817C044001CMP WORD PTR ,0140
-u de39
12B9:DE39 817C089001CMP WORD PTR ,0190
-u de42
12B9:DE42 837C1000 CMP WORD PTR ,+00
From the above code, we can immediately see that the opened file is a non-compressed bitmap file with a size of 320×400, 1 plane, and 256 colors. Therefore, a 256-color non-compressed bitmap file with a size of 320 pixels × 400 pixels can be formed using tools like Paintbrush, named LOGO.SYS, and placed in the boot directory. The required format of LOGO.SYS happens to be consistent with the formats of LOGOS.SYS and LOGOW.SYS. As a verification, renaming LOGOS.SYS or LOGOW.SYS to LOGO.SYS and placing it in the boot directory is fully feasible. If there is a file named LOGO.SYS in the boot directory but it does not pass all the above checks, it will be refused to be displayed and the embedded logo cover will not be displayed either.
IV. Removing the format check for LOGO.SYS and forming a dither-colored logo cover
The external cover image displayed by the above method is static, and there is a scrolling color bar below the image in IO.SYS. The method above can make the image colors change dithered. If the LOGO.SYS in the boot directory is removed, the embedded image in IO.SYS can also achieve "clouds flowing" over the entire picture, with strong movement. The dither coloring of the bitmap is processed by IO.SYS, and the relevant processing flags are embedded in the above judgment statement for LOGO.SYS. Therefore, modifying the relevant statements can be done. The method is: use PCTOOLS or other tools (DEBUG, etc.) to find the parts underlined below, and rewrite them all to the hexadecimal machine code 90 (nop, an empty instruction that does nothing). There are 60 bytes between the beginning and the end, and some code is not listed in the above disassembly.
debug io.sys
-d de00
12B9:DE00 00 93 BA 02 00 E8 D6 02 -0F 82 52 01 8B F2 81 3C ..........R....
12B9:DE10 42 4D 0F 85 48 01 83 C6 -0E 83 3C 28 0F 85 3E 01 BM..H.....
12B9:DE20 83 7C 0C 01 0F 85 36 01 -83 7C 0E 08 0F 85 2E 01 .|....6..|.....
12B9:DE30 81 7C 04 40 01 0F 85 25 -01 81 7C 08 90 01 0F 85 .|.@...%..|....
12B9:DE40 1C 01 83 7C 10 00 0F 85 -14 01 8B 44 24 1E 2E 8E ...|.......D$..
12B9:DE50 1E 3E 0F A2 D8 02 F6 D8 -04 FF A2 D9 02 84 E4 74 .>.............
12B9:DE60 06 A3 DA 02 A3 DC 02 1F -2E C6 06 F2 8E 00 16 07 ...............
12B9:DE70 83 EC 26 8B FC BD 5F 03 -E8 45 02 B9 00 80 E8 E9 ..&..._..E.....
After making the above changes to IO.SYS, any bitmap can be displayed. But since the display is adjusted according to the system display driver and the screen, it is better to keep the original settings in terms of scale. If changes are to be made, testing should be done first, and the result may be distorted, but it does not affect the display and operation. After the above changes, the embedded cover can dither and change colors when there is no external LOGO.SYS. If LOGOS.SYS or LOGOW.SYS is renamed to LOGO.SYS and placed in the boot directory, it can replace the internal cover and have changing colors. However, if these two bitmaps are edited or a new file is formed using Paintbrush, it generally cannot change colors, because the actual colors used in the file formed by Paintbrush are very few, and most of the bitmap color tables are empty. To form a new dither-colored logo, the following should be done:
1. Form a common 256-color bitmap using Paintbrush, etc.;
2. Make the formed bitmap have a complete 256-color index table, which can be obtained from the color index table of LOGOW.SYS or LOGOS.SYS, that is, copy the area from offset 36H to 436H of LOGOW.SYS or LOGOS.SYS to the same area of the new file. Note that do not change the first 0-36H bytes of the bitmap. Name the new file LOGO.SYS and place it in the boot directory.
V. Removing the format check for LOGOS.SYS and LOGOW.SYS by WIN.COM and USER.EXE
The method is similar to the above, and details are not described one by one here.
Since the boot file is very important, changes must be made on the copy. Now, DOS7 uses IFSHLP.SYS to handle file names up to 255B, and the storage of this file name is to change the directory entry attribute byte to 0FH, that is, the VFAT file name attribute (0FH) which is system (04) + hidden (02) + read-only (01) + volume label (08) = 0FH. And use multiple directory entry areas to store the long file name continuously. To prevent data loss, DOS7 shields the absolute disk write INT 26H. The EDIT function of PCTOOLS and other tools calls INT 26H to write to the disk. If changes are made on the hard disk, it will cause the system to deadlock and cancel the disk writing. There is no this problem on the floppy disk. Therefore, it is recommended to modify IO.SYS on the system floppy disk.
It is very easy to form the system floppy disk of DOS7. The disk initialized under DOS7 only needs to copy IO.SYS, MSDOS.SYS, and COMMAND.COM to boot Windows 95, because DOS7 has a more sophisticated BOOT boot area. The boot file IO.SYS can be stored discontinuously, does not occupy the starting cluster, and the file name entry is not the first directory entry.
Appendix: Bitmap file structure
Important fields in the bitmap file header involved in this article
Offset Length(Bytes) Identification information
00H 2 424DH i.e. "BM"
0EH 4 Bitmap information header size 28H=40 bytes
12H 4 Bitmap width in pixels 4001H=320 pixels
16H 4 Bitmap height in pixels 9001H=400 pixels
1AH 2 Number of planes of the bitmap target device 1
1CH 2 Bits per pixel of the bitmap array, can take values:
1: monochrome, 4: 16-color, 8: 256-color, 24: 16 million colors
1EH 4 Bitmap compression flag, can take values: 0: uncompressed, 1: run-length compressed 8-bit bitmap, 2: 4-bit compressed bitmap
Therefore, the bitmap LOGO.SYS read by IO.SYS in this article is a non-compressed, 1-plane, 256-color, 320-pixel wide, 400-pixel high bitmap.
The cover of Windows 95 does not have a bitmap file in an independent file form, which is different from the processing of LOGOS.SYS by WIN.COM and the processing of LOGOW.SYS by USER.EXE. The author discovered during the analysis of the boot file IO.SYS that the startup cover logo of Windows 95 is embedded in the boot file IO.SYS and compressed by DBLSPACE, with an image data area length of 64KB. In the version of Windows 95 analyzed by the author, the image data occupies sectors 217-344 of IO.SYS (file length 223748B), and there are multiple "DS" identifiers inside the data, which are signs of DBLSPACE compressed files. Since DBLSPACE is a segmented checksum compressed file, even a change of one byte in this area will cause a large-scale damage to the image. In the above IO.SYS, the part of the image display execution code starts at the place marked with "DBLSBIN$\LOGO.SYS" and occupies sectors 110-112. Because the compressed file of DBLSPACE is very complex and segmented checked, we cannot customize the startup cover like modifying the combined file or recompiling part of the code of WIN.COM for Windows 3.1, but we can blank the display by setting Logo=0 in MSDOS.SYS. The settings of the configuration file MSDOS.SYS are already available in relevant documents, and Appendix 2 of this article briefly describes the configuration setting options.
In fact, the startup cover can also be customized. The author found during the analysis of IO.SYS that before IO.SYS displays the embedded cover internally, it tries to open a file named LOGO.SYS in the boot directory (using the DOS function call INT 21H, AH=3DH sub-function). If the opening fails (this file does not exist), it switches to display the embedded cover internally (when the opening fails in WIN.COM and USER.EXE, it does not display the graphic but replaces it with text to display relevant information). If the opening is successful, it does a file format check, and the required format is more stringent than the check conditions of WIN.COM for LOGOS.SYS.
The code for IO.SYS to check LOGO.SYS is as follows:
debug io.sys
-u de0e
12B9:DE0E 813C424D CMP WORD PTR ,4D42
12B9:DE12 0F DB 0F
12B9:DE13 854801 TEST CX,
12B9:DE16 83C60E ADD SI,+0E
-u de19
12B9:DE19 833C28 CMP WORD PTR ,+28
-u de20
12B9:DE20 837C0C01 CMP WORD PTR ,+01
-u de28
12B9:DE28 837C0E08 CMP WORD PTR ,+08
-u de30
12B9:DE30 817C044001CMP WORD PTR ,0140
-u de39
12B9:DE39 817C089001CMP WORD PTR ,0190
-u de42
12B9:DE42 837C1000 CMP WORD PTR ,+00
From the above code, we can immediately see that the opened file is a non-compressed bitmap file with a size of 320×400, 1 plane, and 256 colors. Therefore, a 256-color non-compressed bitmap file with a size of 320 pixels × 400 pixels can be formed using tools like Paintbrush, named LOGO.SYS, and placed in the boot directory. The required format of LOGO.SYS happens to be consistent with the formats of LOGOS.SYS and LOGOW.SYS. As a verification, renaming LOGOS.SYS or LOGOW.SYS to LOGO.SYS and placing it in the boot directory is fully feasible. If there is a file named LOGO.SYS in the boot directory but it does not pass all the above checks, it will be refused to be displayed and the embedded logo cover will not be displayed either.
IV. Removing the format check for LOGO.SYS and forming a dither-colored logo cover
The external cover image displayed by the above method is static, and there is a scrolling color bar below the image in IO.SYS. The method above can make the image colors change dithered. If the LOGO.SYS in the boot directory is removed, the embedded image in IO.SYS can also achieve "clouds flowing" over the entire picture, with strong movement. The dither coloring of the bitmap is processed by IO.SYS, and the relevant processing flags are embedded in the above judgment statement for LOGO.SYS. Therefore, modifying the relevant statements can be done. The method is: use PCTOOLS or other tools (DEBUG, etc.) to find the parts underlined below, and rewrite them all to the hexadecimal machine code 90 (nop, an empty instruction that does nothing). There are 60 bytes between the beginning and the end, and some code is not listed in the above disassembly.
debug io.sys
-d de00
12B9:DE00 00 93 BA 02 00 E8 D6 02 -0F 82 52 01 8B F2 81 3C ..........R....
12B9:DE10 42 4D 0F 85 48 01 83 C6 -0E 83 3C 28 0F 85 3E 01 BM..H.....
12B9:DE20 83 7C 0C 01 0F 85 36 01 -83 7C 0E 08 0F 85 2E 01 .|....6..|.....
12B9:DE30 81 7C 04 40 01 0F 85 25 -01 81 7C 08 90 01 0F 85 .|.@...%..|....
12B9:DE40 1C 01 83 7C 10 00 0F 85 -14 01 8B 44 24 1E 2E 8E ...|.......D$..
12B9:DE50 1E 3E 0F A2 D8 02 F6 D8 -04 FF A2 D9 02 84 E4 74 .>.............
12B9:DE60 06 A3 DA 02 A3 DC 02 1F -2E C6 06 F2 8E 00 16 07 ...............
12B9:DE70 83 EC 26 8B FC BD 5F 03 -E8 45 02 B9 00 80 E8 E9 ..&..._..E.....
After making the above changes to IO.SYS, any bitmap can be displayed. But since the display is adjusted according to the system display driver and the screen, it is better to keep the original settings in terms of scale. If changes are to be made, testing should be done first, and the result may be distorted, but it does not affect the display and operation. After the above changes, the embedded cover can dither and change colors when there is no external LOGO.SYS. If LOGOS.SYS or LOGOW.SYS is renamed to LOGO.SYS and placed in the boot directory, it can replace the internal cover and have changing colors. However, if these two bitmaps are edited or a new file is formed using Paintbrush, it generally cannot change colors, because the actual colors used in the file formed by Paintbrush are very few, and most of the bitmap color tables are empty. To form a new dither-colored logo, the following should be done:
1. Form a common 256-color bitmap using Paintbrush, etc.;
2. Make the formed bitmap have a complete 256-color index table, which can be obtained from the color index table of LOGOW.SYS or LOGOS.SYS, that is, copy the area from offset 36H to 436H of LOGOW.SYS or LOGOS.SYS to the same area of the new file. Note that do not change the first 0-36H bytes of the bitmap. Name the new file LOGO.SYS and place it in the boot directory.
V. Removing the format check for LOGOS.SYS and LOGOW.SYS by WIN.COM and USER.EXE
The method is similar to the above, and details are not described one by one here.
Since the boot file is very important, changes must be made on the copy. Now, DOS7 uses IFSHLP.SYS to handle file names up to 255B, and the storage of this file name is to change the directory entry attribute byte to 0FH, that is, the VFAT file name attribute (0FH) which is system (04) + hidden (02) + read-only (01) + volume label (08) = 0FH. And use multiple directory entry areas to store the long file name continuously. To prevent data loss, DOS7 shields the absolute disk write INT 26H. The EDIT function of PCTOOLS and other tools calls INT 26H to write to the disk. If changes are made on the hard disk, it will cause the system to deadlock and cancel the disk writing. There is no this problem on the floppy disk. Therefore, it is recommended to modify IO.SYS on the system floppy disk.
It is very easy to form the system floppy disk of DOS7. The disk initialized under DOS7 only needs to copy IO.SYS, MSDOS.SYS, and COMMAND.COM to boot Windows 95, because DOS7 has a more sophisticated BOOT boot area. The boot file IO.SYS can be stored discontinuously, does not occupy the starting cluster, and the file name entry is not the first directory entry.
Appendix: Bitmap file structure
Important fields in the bitmap file header involved in this article
Offset Length(Bytes) Identification information
00H 2 424DH i.e. "BM"
0EH 4 Bitmap information header size 28H=40 bytes
12H 4 Bitmap width in pixels 4001H=320 pixels
16H 4 Bitmap height in pixels 9001H=400 pixels
1AH 2 Number of planes of the bitmap target device 1
1CH 2 Bits per pixel of the bitmap array, can take values:
1: monochrome, 4: 16-color, 8: 256-color, 24: 16 million colors
1EH 4 Bitmap compression flag, can take values: 0: uncompressed, 1: run-length compressed 8-bit bitmap, 2: 4-bit compressed bitmap
Therefore, the bitmap LOGO.SYS read by IO.SYS in this article is a non-compressed, 1-plane, 256-color, 320-pixel wide, 400-pixel high bitmap.
Wengier - 新DOS时代
欢迎大家来到我的“新DOS时代”网站,里面有各类DOS软件和资料,地址:
http://wendos.mycool.net/
E-Mail & MSN: wengierwu AT hotmail.com (最近比较忙,有事请联系DOSroot和雨露,谢谢!)

欢迎大家来到我的“新DOS时代”网站,里面有各类DOS软件和资料,地址:
http://wendos.mycool.net/
E-Mail & MSN: wengierwu AT hotmail.com (最近比较忙,有事请联系DOSroot和雨露,谢谢!)



