Customizing OneNote 16's Custom Pens

Microsoft’s OneNote is an incredibly useful tool for note organization, and with the advent of 2-in-1 devices, digital inking. I have personally been using the Android version with an active stylus and recently moved over to Windows, only to realize that the default pen colors and sizes are slightly different. For the sake of consistency between notes, I was interested in tweaking these settings to be reasonable similar across versions. Unfortunately, there did not appear to be any OneNote extensions or programs for accomplishing this easily.

This write-up describes the process of discovering where the values are persistently stored and how they can be conveniently modified.

Update (April 2018). OneNote 2016 has reached its end-of-life and is now succeeded by the UWP “OneNote for Windows 10.” While this new app still doesn’t allow for fine-tuned customization, it offers a wider selection of colors and is no longer as bad as it used to be. Regardless, OneNote 2016 can still be installed and customized by the tool at the bottom of this page.

Want to skip all of the technical mumbo jumbo? Jump to the pen customizer.

Finding the Values

In OneNote, these custom pens are listed under the heading “Favorite Pens,” right above the list of built-in pen styles. Considering this is Microsoft we’re dealing with, it’s likely we’ll be able to find these settings stored somewhere in the registry. Firing up procmon, we can begin probing the application and analyzing all of its registry queries. In this case, probing will be merely selecting different pens and adding a few of our own.

It doesn’t take long to see the ridiculous amount of traffic flowing every second. Since we’re only after key names, we can use procmon’s “Registry Summary” and identify anything that sticks out.

In particular, HKCU\Software\Microsoft\Office\16.0\OneNote\CustomPens piques my interest. After all, what else could that possibly refer to?

PS> $path = 'HKCU:\Software\Microsoft\Office\16.0\OneNote\CustomPens'; gp $path

PenZero      : {0, 0, 0, 0...}
PenOne       : {1, 0, 0, 0...}
PenTwo       : {2, 0, 0, 0...}
...

PS> gi $path | select -exp Property | %{"{0,-7} {1:X2}" -f $_, (gpv $path $_)}

PenZero 00 00 00 00 00 80 9E 00 20 10 88 40 20 10 88 40 00 00 00 00 04 00 00 00 00 00 00 00 0D 00 86 F2 86 69 1F 01 73 4A B1 96 F1 04 AC 76 2F 5B
PenOne  01 00 00 00 00 80 9E 00 20 10 88 40 20 10 88 40 00 00 00 00 08 E9 BB 21 00 00 00 00 1B 00 86 F2 86 69 1F 01 73 4A B1 96 F1 04 AC 76 2F 5B
PenTwo  02 00 00 00 00 80 9E 00 F9 7C BE 3F 20 10 08 41 7F 00 00 00 4D 00 41 00 01 00 00 00 1C 00 86 F2 86 69 1F 01 73 4A B1 96 F1 04 AC 76 2F 5B

Nice, it’s a binary format, a non-obvious one at that! To gather my bearings, I returned to probing and was hoping a few patterns would begin popping out as I changed and modified my pens. That was not the case. Whatever we’re looking at, it doesn’t react very much to modifying our pen styles.

Back to the drawing board, we scan over our “Registry Summary” once again and find another interesting key: HKCU\Software\Microsoft\Office\16.0\Common\FavoritePens. This has to be it, right? While CustomPens was rather convincing, FavoritePens is undeniable, especially considering the UI section was named exactly that.

PS> $path = 'HKCU:\Software\Microsoft\Office\16.0\Common\FavoritePens'; gp $path

Data         : {4, 0, 0, 0...}
...

PS> "{0:X2}" -f (gpv $path 'Data')
04 00 00 00 4C 4C 4C 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00 00 A0 D7 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00 00 B0 50 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00 FF 65 66 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00

And whaddaya know, more bytes to get bit-wise about. This time around, however, the values are a bit more sensible. The message begins with the number 4, correlating to the number of pens I have configured, followed by four similar looking blocks. Expectedly, this is all serialized in little endian format. Let’s break it down into equally sized blocks:

04 00 00 00
4C 4C 4C 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00
00 A0 D7 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00
00 B0 50 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00
FF 65 66 00 33 33 B3 3E 33 33 B3 3E 00 00 00 00 00 00 00 00

Some more background: all of my four pens are the same (smaller) size, and the RGB codes are as follows: #4c4c4c, #00a0d7, #00b050, and #ff6566. Looking at our first four bytes, it appears that colors are stored in 0xzzbbggrr format. No, that most significant byte isn’t an alpha value or anything relevant. Rather, this is most likely a COLORREF type: 0x00bbggrr.

Next up, there is a four-byte value representing pen size. In this case, they are all 0x3eb33333. Something fishy was definitely going on here, and it took me Googling a few of the numbers to realize what: we’re looking at floating- points, not decimals. After all, 0.35f is a lot more reasonable than 1051931443. For reference, here are the preset size options baked into OneNote, as floats and as their hexadecimal representation:

The values of size and type are strangely duplicated in between each other. Changing the duplicated versions doesn’t seem to have any effect either, and they can have entirely distinct values from their functional counterparts. This leaves us with a fleshed-out structure for the registry key:

int count;
struct {
    COLORREF color;
    float size;
    float size_dup;
    enum {
        PEN,
        HIGHLIGHTER
    } type_dup, type;
} pens[count];

Colors

Each OneNote version offers its own color palette, collected here for reference. Use a screen color picker to get the hex values.

Customizing FavoritePens

You can use this form below to generate your own custom set of pens; either change the registry value manually or run the created .reg file. Make sure to close OneNote before running the script, and don’t worry about any errors when reopening it. Doing this will erase all of your existing pens.

Enter the color as a hex value without the # and the size as a decimal number. Check the Colors section to find OneNote-specific colors.

...