Anyone could teach (show) me how to create a valid NTICE.INC for the
NTICE 4.3.1 B1722 with the old INC's of the id6026 (old).
I haven't done scripting with IDA ! Is it possible or do i have make it
by hand ?

Hi

I think this script by Toteu is what you want:

http://www.woodmann.com/forum/attachment.php?attachmentid=479

in thread
http://www.woodmann.com/forum/showthread.php?t=3982

Well have to make it by hand coz to many differences
Thanks

Hey,

I wrote a script some time ago, to aid me in adding support for an unsupported version of softice.
The script loads an .inc and names the addresses based on it's contents.
So, you need a version of ntice.sys that's currently supported, run the script against this,
then try locate the same addresses in your disassembly of the unsupported ntice.sys and name them accordingly.
You could reduce your workload by checking which names are actually used by icedump, since they're not all used.
Once you have the disassembly named, you can either construct a new .inc manually, or by using a script that dumps user changes.

Good luck
(The script is attached to this post)