Actually, it's not SystemStarter either. Just before SystemStarter is launched, the WindowServer is started, and that's what draws the blue background as the lowest lowest window. It's what you see briefly if you kill the loginwindow or windowserver (thus restarting the windowserver), or logout, or what you see if you set the Finder's desktop picture window to transparent (or move it out the way - ah, playing with CoreGraphics Services is fun ). Since most of WindowServer is in CoreGraphics, you'll need to look in the CoreGraphics library. However, I suggest that NOBODY patches this library EVER using a theme with current theme technology.