I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ring0? (Which would mean that only code in ntdll would be executed by the system?) The word system seems to appear next to functions in user32 etc. Any help in correcting my misunderstanding would be very much appreciated. Thanks a bunch

1 Answer 1


It simply means that the location of the module is inside a “system” directory (c:\windows). For example kernel32.dll is a system module and your debuggee is usually a user module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.