I would have thought that it just overwrites/swaps out the image on disk that Windows uses for the logon background - surely it's not more complicated than that? (Maybe Microsoft was kind enough to allow editing via some registry keys or something, but just changing the image on disk seems easier)