Windows Security Logging and Other Esoterica

thoughts from the Windows auditing team

I always wondered who Björn was...

I always wondered who Björn was...

  • Comments 1

OK here's something I just remembered today.  I may be the last person who remembers this so it's important that I record this somewhere.

In the RTM bits of Windows NT 4.0, for the German language release only, someone snuck in a string resource into the auditing message file.  I'm guessing that it was one of our localization engineers, but I don't know- I was over in the support side of things at the time.  I stumbled across the message one day while looking at source code.

Here's Björn's momentous message:  "Björn grüßt den rest der welt".  Basically Björn says hi to everyone.  He's a friendly guy.

This is string resource zero in the message table resource- it's not a code resource, it's properly formed and it's not used by the code anywhere.  You would not know it exists unless you slog through source code (like me) or use a hex editor or string dumper to analyze binaries AND happen to be so bored that you pull out an NT 4.0 RTM German CD and examine msaudite.dll.  NT4 RTM CD's are pretty rare, btw, because we replaced them with slipstream SP1 CD's very shortly after release.

If I remember correctly somebody else came along in a later service pack and changed Björn's name to their own (maybe it was Ulli?  I can't remember and I'm too lazy to find the source- it requires a lot of effort to dig that far back).  I do remember that shortly thereafter there was a huge Easter Egg crackdown here at Microsoft probably brought to a head by the Excel 97 Flight Simulator.  Björn's message of goodwill to mankind was erased forever. 

I did a search using the Officially Santioned Search Engine and the other one too; evidently the internet has forgotten Björn's message.  But I still remember, Björn.

Anyway I thought you might like this bit of arcana.  If you are bored, have a hex editor and a German NT4 CD, knock yourself out...

Comments
Leave a Comment
  • Please add 2 and 8 and type the answer here:
  • Post