Yet another way to stop WinICE/SoftICE (in 9x)

Source: Anti Crack

Hiya puppies, since SI uses software interrupts 1 to get control back after
an opcode, and 3 for breakpoints. You can make SI useless by patching its
code which is appearently writable(!).

but erh, saddly this isn't true for nt/2k :( (at least, win2k isn't big very
big friends with the SIDT instruction)

Pretty easy: find int1 & int3 after you have the IDT, and then patching the
code pointed by them to an iretd (0cfh) if you are friendly (no crash), or
some other code (like a nop) and saying bye to SI.

IMHO its better to use iretd, and replacing the original code back on the
end of your code, so SI still works, and, you code is less suspicious
because there are pretty much SI'ers in the world. i guess :)

Well, look for your self, tasm this code, popup SI, bpint3, run & trace...

Oh, and, don't forget the possiblity of BPM while defending, see my other
article.