I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 code) I cannot step into it:

enter image description here

Can someone show if it's possible to step into a kernel code?

PS. I'm running IDA Pro in a VM from my host Windows system.

  • 3
    you cannot step into kernel mode from usermode seamlessly if you have a pair (physc/vm , vm/vm , physc/physc ) set a breakpoint on the Actual System Call in kernel mode and step in to break the one in ntdll is just a stub that transfers the execution to kmode
    – blabb
    Nov 20, 2017 at 22:37
  • 1
    a kernel debugger may work I think @blabb
    – Igor Skochinsky
    Nov 22, 2017 at 14:19
  • 1
    stackoverflow.com/questions/42776503/… has some ideas and actually mentions IDA, and an answer from blabb :)
    – Igor Skochinsky
    Nov 22, 2017 at 14:23
  • @igor yes a kernel debugger connection needs a pair iiur op expects to do it in a single machine
    – blabb
    Nov 22, 2017 at 15:57
  • oh indeed, it won’t work on the same box.
    – Igor Skochinsky
    Nov 22, 2017 at 16:06

1 Answer 1


In order to step into syscall you must debug your machine from kernel mode debugger. https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf see Debugging the kernel with VMWare section. But be aware, that in kernel mode debugger you won't be able to debug your single process as it was in user mode. Kernel mode debugging is about debugging all the processes in the system. So you'll have to attach to the target process before you can do anything, and you'll need to learn how to set breakpoints, which will trigger only in your target process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.