Low level WinNT debugger

Originally Posted by _kin_

SoftICE has check to prevent debugging itself.

Also, as I know SoftICE change system IDT and "virtualize" it - in debugger you see system IDT, but real IDT is hidden by SoftICE.

Ahh...now I see

So is virtualising the IDT a function provided within the Kernel API, or is it some hack that SoftICE comes up with. I haven't come across any documentations on that.

In fact, when I posted a similar question on the Microsoft MSDN list, try to directly handle certain interrupts in a driver, I was told that it couldn't be done, and that it had to go through the IoConnectInterrupt().

Thanks