Fellow RCEs:

I have been having this question for a long time (since I started working with NTICE). When we are able to load NTICE even after OS start (like for instance using "net start ntice" why isn't there a way to unload NTICE, such as say "net stop ntice". Is that because NTICE "messes" up your system so badly that only a reboot will unload the driver from the system?

I have been scavenging info. about PM debuggers but still no idea why this is not possible. If you guys think I'll get the answer after further "scavenging", feel free to ignore this one...

Signed,
-- FoxThree

My guess would be that NTICE messes with the IDT (and other things) and then other drivers might mess with them too so NTICE can't restore thr original IDT when it's unloaded the chose not to make it " stopable", since if you can't restore itr to it's current state but remove the NTICE stuff it would make the system unstable... ummm hope that made any sense... but in short i guess it's because NTICE messes up your system so badly...

If Softice is able to manage the IDT, GDT, Page tables, etc., then it IS in fact able to reverse things and put them back to the current state.

My opinion is that the NUMEGA and/or Compuware were just plain lazy.


Regards,

TGODD