What happens is that we overwrite the "zero page" (which contains the interrupt table; including the IRQ vectors). Anything interrupt related (including the IRQ0 timer executed (normally) 18.2Hz) will make the processor jump to ffff:ffff, which doesn't contain any sensible code. Windows 9x is unable to recover from this.
Another related way to annoy Windows it to open debug, in the same fashion, and tell it to jump to address F000:FFF0. This contains the reboot call, which annoys the hell out of Windows, and sometimes even crashes it, to boot.
Log in or register to write something here or to contact authors.