Thread by @yarden_shafir

Some people asked, so here's a guide for customizing your BSOD

Step 1: changing the background. Here I just followed this excellent guide by @depletionmode: .
Found the structure (first line). Add 0x18 to find the first structure, and in offset 0x28 in the second structure you'll find the background color. pagedout.institute/download/Paged…

The original color was this standard Insider Preview green. So I edited it to this purple.

Step 2: the text.
Disassemble BgpFwDisplayBugCheckScreen and find the first call to BcpDisplayCriticalString. The first argument points to a UNICODE_STRING that contains the emoji. This will be ":(" unless the code is MANUALLY_INITIATED_POWER_BUTTON_HOLD. Then the emoji is empty.

The pointer points to a hard-coded UNICODE_STRING that lived in the kernel's read-only data section. You can edit it with a debugger (unless HVCI is enabled). You can allocate a new buffer for your text. I'm lazy so I overwrote the existing buffer and the text that came after it

Now to trigger the BSOD.
Easiest way is to start a process and make it critical. You can do that with System Informer as admin -> right click on the process -> Miscellaneous -> Critical.
Once the process is critical, kill it.
This triggers a BSOD.

Congratulations! You have customized your BSOD!
The text color is technically customizable but seems hard-coded in the function, maybe someone will manage to find a way to modify it and document it :)