Sponsoring website: Emergency Boot Kit

Windows Power-User Series


Hacking Windows™ 95/98 NOTEPAD:
Removing the "Nag" Screen

( Also: How to make Notepad open Another Editor
instead of WordPad if a file is too large for Notepad! )


Note: The Notepad programs in Windows™ NT/2000/XP can open any size file! Obviously, many Win 95 and 98/98SE users become a bit upset with M$ upon learning that NT users have never had to deal with a nag screen in their NOTEPAD programs!


If you attempt to open a file with Notepad that is larger than about 64 kb, you'll see a pop-up window like this:


Well, duh!  is the first reaction of most people that have to deal with this. They went through the trouble of clicking on the filename to see its contents, so why wouldn't they still want to see them even if they had to use WordPad? Well, as it turns out, if you try to open an executable (program file) in WordPad, it refuses to do so! (One reason, I assume, MS added the warning.)

Most Power Users, however, not only know the size of files they want to open but whether or not they're executables too, so why should they have to bother with this "Nag screen" to see the contents of large text files? Furthermore, I'll also show you how to change the editor Notepad calls so you can open large executable files!   Follow my instructions here (or run one of the patch programs listed below) and you'll never have to hassle with this again!


What Needs to be Changed in Notepad


Program Operation

Buried deep inside the code of Notepad (a 32-bit Windows program) is an instruction which causes the " Error " window to pop-up on your screen. In Assembly language, this 32-bit instruction code would be:
Call DWORD ptr [00xxxxxx]   (where the six x's stand for an actual memory location that depends upon which version of Windows you are running; more about this later.)

Instead of running some code inside its own program though, Notepad uses another Windows program called, USER32.DLL, to pop-up the window known as 'MessageBoxA' and then USER32 passes some info back to Notepad telling it which one of the two buttons you pressed. After it checks the data you entered, Notepad either keeps the file from being opened and closes itself too (because you pressed 'No'), or passes info about the file you want opened to WordPad (beaus you pressed 'Yes'). Therefore, we need to do two things: make sure the Error window never pops-up again, and cause Notepad to always use WordPad (or some other editor ! ) when a file is too large for Notepad to open.

On my Windows 95 " B " machine (see TABLE below for other versions), the relevant lines of code (after being placed into memory ) are:

00402D61  FF1530744000     Call dword ptr [00407430]
00402D67  83F806           cmp eax, 00000006
00402D6A  0F85A9000000     jne 00402E19


The last instruction above causes program execution to jump to a section of code which shuts-down Notepad ( it only jumps there if you pressed the 'No' button). So, this hack is actually quite easy: We'll replace the first and third instructions above with some others that essentially do nothing.
[ Note: You can NOT simply delete instructions from a program that has already been compiled into code! If you do, one of the 'Jump instructions ' will cause execution to start at the wrong location in the code and that will very likely LOCK-UP your system; requiring a cold reboot!]

There are six bytes in each of the two instructions above which must be replaced. We could use a 90 hex ('No Operation' or NOP) for each byte, but a good hack should be a bit more elegant than that. So we'll replace them with strings of push and pop and inc and dec instructions instead (see the pics below).


( If you want to see what the patch strings look like in Assembly code, or if you want to see larger sections of the code produced by a sophisticated Debugger program for both Win 95 and 98/98SE, then click here for the code lines.)



Downloading the
Notepad Patch Programs

These Patches are One Way only -- You should make a Copy of the Original File so you can refer to it if necessary (Use 'Copy' and 'Paste' to create a 'Copy of...' file in the same folder; never change the name of the original NOTEPAD files directly!!!).

Operating System Notepad.exe Date/Time File Size (Bytes) Download
Windows 95 B (OSR2) 08-24-96 11:11a
(CRC = 015444c6)
34,304
NP9520.ZIP
(only 3.5 kb)

Windows 98 05-11-98 08:01p
(CRC = b4daaf81)
53,248 Use the Patch NP98SE.ZIP below...
Windows 98   (SE) 04-23-99 10:22p
(CRC = e55b4071)
53,248
NP98SE.ZIP
(only 3.5 kb)

Windows ME 06-08-00 05:00p
(CRC = ff7887ee)
53,248
Apparently _not_ necessary!


Windows ? ? ? ?



Making the changes to Notepad Yourself

If you want to hack Notepad manually, you'll need a Hex Editor. If you do not have one of your own (such as UltraEdit), you can read my review of a FREE Hex Editor here at The Starman's Realm: Frhed - Free Hex Editor. Or download 'Frhed' right now from its author at:

http://www.tu-darmstadt.de/~rkibria/ (opens in new window)

You should always make a backup copy of your original program. Either store a copy of NOTEPAD.EXE in a folder just for backup files, or keep a copy of the original program in the same folder using a different extension-name like .SAV for example. (You could open the C:\>Windows folder in an Explorer window, find Notepad.exe and right-click on it, choose "Copy" from the menu and then "Paste" it into the same folder. Since it already exists, Windows will rename your copy to "Copy of Notepad.exe" instead. Then you can rename this file to: NOTEPAD.SAV -- ready to use if anything should go wrong.)

Open Notepad.exe in your Hex Editor and go to the location listed in the TABLE below for your operating system. ( If it's NOT listed there, you can write to me using this online reply form.) If you opened Notepad in Frhed, you can use the menu " Edit --> Go To " (or just press CTRL + G ) to get a box like this:

( Check the TABLE below for your version of NOTEPAD and enter the hex digits listed under "Location (Hex)" -- prefixed with an ' x ' -- and Frhed will place the cursor on the first byte of the string of digits that need to be changed.)

Operating System Notepad.exe Date/Time File Size (Bytes) Location (Hex)
Windows 95 B (OSR2) 08-24-96 11:11a 34,304 02161
Before: ff 15 30 74 40 00       0216a: 0f 85 a9 00 00 00
After : 52 5a 53 5b 56 5e       0216a: 42 4a 43 4b 46 4e

Windows 98 05-11-98 08:01p 53,248 033b1
Before: ff 15 a8 64 40 00       033ba: 0f 85 a7 00 00 00
After : 52 5a 53 5b 56 5e       033ba: 42 4a 43 4b 46 4e

Note: Although the file above and the one below appear to be the same, about 130 of the bytes have different contents. The only way to know for sure if two files are exactly the same is to use a file comparison program (at a DOS prompt enter: fc /b file1 file2 ) or by comparing the MD5 sums of each file.

Windows 98   (SE) 04-23-99 10:22p 53,248 033b1
Before: ff 15 a8 64 40 00       033ba: 0f 85 a7 00 00 00
After : 52 5a 53 5b 56 5e       033ba: 42 4a 43 4b 46 4e

Windows ? ? ? ?
           
After : 52 5a 53 5b 56 5e           ?: 42 4a 43 4b 46 4e
If your version of Windows isn't listed above, I'd appreciate your help in adding its Notepad.exe data to this table! You can send me an e-mail using this online reply form (opens in a new window).



Editing Notepad.exe in Frhed







How to Change the Editor that
Notepad sends Large Files to


Using The GUN or PFE32
(or any other editor) instead of WordPad for opening >64kb Files


NOTE: For this to work correctly, you must place the Editor that you want to use in your C:\WINDOWS folder and its filename must NOT have any non-DOS characteristics! For example, if you wanted to use an editor named 'MyEditProg.exe' you must first rename it to a DOS filename such as 'MYEDITOR.EXE' which is displayed as 'Myeditor.exe' in Explorer. If the filename was 'MyEditor.exe' (less than or equal to 8 characters plus 3 for the extension; yet having a mixed-case) I would still rename it to 'MYEDITOR.EXE' anyway to make sure it's accepted as a DOS filename. THEN: You must enter the new filename (as shown in the procedure below) into NOTEPAD using all lower-case characters. So, our example would appear as:   m y e d i t o r . e x e   inside of the Notepad's program file. ( I assume there's a routine in WINDOWS which swaps the case of these characters; it simply doesn't work if you try using the same case as the executable.)

Open Notepad.exe in your Hex Editor and hunt for the Unicode string ( in hex ):   0b 00 77 00 6f 00 72 00 64 00 70 00 61 00   If you are using Frhed, you can enter the following string into the " Edit --> Find " box like this:

(OK, to save new users a little time...   Just copy the following text off the screen:
<bh:0b><bh:00>w<bh:00>o<bh:00>r<bh:00>d<bh:00>p<bh:00>a<bh:00>
Or, swipe your cursor across any string of zeros in Frhed and you'll get a bunch of <bh:00> tags in the Find box when you open it.) This short string will be found only once in the program and should allow you to find this one: "0b 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 00" (or: "
0b 00 w 00 o 00 r 00 p 00 a 00 d 00 . 00 e 00 x 00 e 00").

On my Win 95B machine ( OSR2 or   Version 4.00.1111 ), this string (starting with the 0b 00) begins at hex location 06c72 as seen in the following pic (see the TABLE below for the '..w.o.r.d.p.a.d...e.x.e.' string locations in other versions):

The hex byte 0b at the beginning of our string tells Windows how many of the following Unicode characters are used in the filename of the program Notepad passes the file info to! So, here's an example of how you can change the filename of "wordpad.exe" to something with only 9 characters instead of 11 by changing the 0b to 09 (and then, of course, by also changing the first 9 characters of the filename; in this example we 'lucked out' and only need to change the first 8 characters since an 'e' remains the same: from "w o r d p a d . "   to   "p f e 3 2 . e x " ).
For The Gun, I decided to rename that program simply to GUN.EXE on my system, so I changed what I'll refer to as the control byte, 0b, to 07 (and then changed only the first 7 characters of wordpad.exe from "w o r d p a d " to "g u n . e x e " ).

Since only the first 9 unicode characters (18 bytes) are used ( pfe32.exe ), it doesn't really matter what you do with the last 2 characters (4 bytes) of the original 11 unicode characters. You can simply leave them as they are (as in the pic above).

    Location of Control Byte (0b) and Filename String:

           Notepad Version          Begins at (Hex)
     ---------------------------   -----------------
     Win 95 B  (08-24-96 11:11a)         06c72
     Win 98    (05-11-98 08:01p)         0b0b6
     Win 98 SE (04-23-99 10:22p)         0b0b6
     Win ME    (06-08-00 05:00p)         0afde

Don't forget to rename a copy of the editor you choose in the WINDOWS folder.

Posted: July 16, 2000 (Revised: December 21, 2000.
A few 'typo' errors corrected: 7 April 2003.)


DISCLAIMER

Microsoft is a registered trademark, and the Microsoft Windows logos and screens are trademarks of Microsoft. The phrases "Windows 95," "Windows 98," "Windows NT," etc. may also be trademarks of Microsoft. All other logos or trademarks are owned or are property of their respective owner or owners.

Although I do try to help those in need when time permits, I am not responsible for any damage which may be caused by any software or information that you view or download from this web site, nor for any information obtained from or regarding the personal descriptions or opinions of others on pages that may be accessible from this page.


The Starman's Windows
Power-User Series
Page

The Starman's Free Tools
for Windows™ Page