Windows Power-User Series

Hacking Windows™ 95/98 NOTEPAD:
Removing the "Nag" Screen

( Also: How to make Notepad open Another Editor
instead of WordPad if a file is too large for Notepad! )

If you attempt to open a file with Notepad that is larger than about 64 kb, you'll see a pop-up window like this:

What Needs to be Changed in Notepad

Buried deep inside the code of Notepad (a 32-bit Windows program) is an instruction which causes the " Error " window to pop-up on your screen. In Assembly language, this 32-bit instruction code would be:
Call DWORD ptr [00xxxxxx]   (where the six x's stand for an actual memory location that depends upon which version of Windows you are running; more about this later.)

Instead of running some code inside its own program though, Notepad uses another Windows program called, USER32.DLL, to pop-up the window known as 'MessageBoxA' and then USER32 passes some info back to Notepad telling it which one of the two buttons you pressed. After it checks the data you entered, Notepad either keeps the file from being opened and closes itself too (because you pressed 'No'), or passes info about the file you want opened to WordPad (beaus you pressed 'Yes'). Therefore, we need to do two things: make sure the Error window never pops-up again, and cause Notepad to always use WordPad (or some other editor ! ) when a file is too large for Notepad to open.

On my Windows 95 " B " machine (see TABLE below for other versions), the relevant lines of code (after being placed into memory ) are:

00402D61  FF1530744000     Call dword ptr [00407430]
00402D67  83F806           cmp eax, 00000006
00402D6A  0F85A9000000     jne 00402E19

The last instruction above causes program execution to jump to a section of code which shuts-down Notepad ( it only jumps there if you pressed the 'No' button). So, this hack is actually quite easy: We'll replace the first and third instructions above with some others that essentially do nothing.
[ Note: You can NOT simply delete instructions from a program that has already been compiled into code! If you do, one of the 'Jump instructions ' will cause execution to start at the wrong location in the code and that will very likely LOCK-UP your system; requiring a cold reboot!]

There are six bytes in each of the two instructions above which must be replaced. We could use a 90 hex ('No Operation' or NOP) for each byte, but a good hack should be a bit more elegant than that. So we'll replace them with strings of push and pop and inc and dec instructions instead (see the pics below).

( If you want to see what the patch strings look like in Assembly code, or if you want to see larger sections of the code produced by a sophisticated Debugger program for both Win 95 and 98/98SE, then click here for the code lines.)

Downloading the
Notepad Patch Programs

These Patches are One Way only -- You should make a Copy of the Original File so you can refer to it if necessary (Use 'Copy' and 'Paste' to create a 'Copy of...' file in the same folder; never change the name of the original NOTEPAD files directly!!!).

If you want to hack Notepad manually, you'll need a Hex Editor. If you do not have one of your own (such as UltraEdit), you can read my review of a FREE Hex Editor here at The Starman's Realm: Frhed - Free Hex Editor. Or download 'Frhed' right now from its author at:

http://www.tu-darmstadt.de/~rkibria/ (opens in new window)

You should always make a backup copy of your original program. Either store a copy of NOTEPAD.EXE in a folder just for backup files, or keep a copy of the original program in the same folder using a different extension-name like .SAV for example. (You could open the C:\>Windows folder in an Explorer window, find Notepad.exe and right-click on it, choose "Copy" from the menu and then "Paste" it into the same folder. Since it already exists, Windows will rename your copy to "Copy of Notepad.exe" instead. Then you can rename this file to: NOTEPAD.SAV -- ready to use if anything should go wrong.)

Open Notepad.exe in your Hex Editor and go to the location listed in the TABLE below for your operating system. ( If it's NOT listed there, you can write to me using this online reply form.) If you opened Notepad in Frhed, you can use the menu " Edit --> Go To " (or just press CTRL + G ) to get a box like this:

( Check the TABLE below for your version of NOTEPAD and enter the hex digits listed under "Location (Hex)" -- prefixed with an ' x ' -- and Frhed will place the cursor on the first byte of the string of digits that need to be changed.)

Editing Notepad.exe in Frhed

How to Change the Editor that
Notepad sends Large Files to

NOTE: For this to work correctly, you must place the Editor that you want to use in your C:\WINDOWS folder and its filename must NOT have any non-DOS characteristics! For example, if you wanted to use an editor named 'MyEditProg.exe' you must first rename it to a DOS filename such as 'MYEDITOR.EXE' which is displayed as 'Myeditor.exe' in Explorer. If the filename was 'MyEditor.exe' (less than or equal to 8 characters plus 3 for the extension; yet having a mixed-case) I would still rename it to 'MYEDITOR.EXE' anyway to make sure it's accepted as a DOS filename. THEN: You must enter the new filename (as shown in the procedure below) into NOTEPAD using all lower-case characters. So, our example would appear as:   m y e d i t o r . e x e   inside of the Notepad's program file. ( I assume there's a routine in WINDOWS which swaps the case of these characters; it simply doesn't work if you try using the same case as the executable.)

Open Notepad.exe in your Hex Editor and hunt for the Unicode string ( in hex ):   0b 00 77 00 6f 00 72 00 64 00 70 00 61 00   If you are using Frhed, you can enter the following string into the " Edit --> Find " box like this:

On my Win 95B machine ( OSR2 or   Version 4.00.1111 ), this string (starting with the 0b 00) begins at hex location 06c72 as seen in the following pic (see the TABLE below for the '..w.o.r.d.p.a.d...e.x.e.' string locations in other versions):

The hex byte 0b at the beginning of our string tells Windows how many of the following Unicode characters are used in the filename of the program Notepad passes the file info to! So, here's an example of how you can change the filename of "wordpad.exe" to something with only 9 characters instead of 11 by changing the 0b to 09 (and then, of course, by also changing the first 9 characters of the filename; in this example we 'lucked out' and only need to change the first 8 characters since an 'e' remains the same: from "w o r d p a d . "   to   "p f e 3 2 . e x " ).
For The Gun, I decided to rename that program simply to GUN.EXE on my system, so I changed what I'll refer to as the control byte, 0b, to 07 (and then changed only the first 7 characters of wordpad.exe from "w o r d p a d " to "g u n . e x e " ).

Since only the first 9 unicode characters (18 bytes) are used ( pfe32.exe ), it doesn't really matter what you do with the last 2 characters (4 bytes) of the original 11 unicode characters. You can simply leave them as they are (as in the pic above).

    Location of Control Byte (0b) and Filename String:

           Notepad Version          Begins at (Hex)
     ---------------------------   -----------------
     Win 95 B  (08-24-96 11:11a)         06c72
     Win 98    (05-11-98 08:01p)         0b0b6
     Win 98 SE (04-23-99 10:22p)         0b0b6
     Win ME    (06-08-00 05:00p)         0afde

Don't forget to rename a copy of the editor you choose in the WINDOWS folder.

Posted: July 16, 2000 (Revised: December 21, 2000.
A few 'typo' errors corrected: 7 April 2003.)

Microsoft is a registered trademark, and the Microsoft Windows logos and screens are trademarks of Microsoft. The phrases "Windows 95," "Windows 98," "Windows NT," etc. may also be trademarks of Microsoft. All other logos or trademarks are owned or are property of their respective owner or owners.

Although I do try to help those in need when time permits, I am not responsible for any damage which may be caused by any software or information that you view or download from this web site, nor for any information obtained from or regarding the personal descriptions or opinions of others on pages that may be accessible from this page.