NtSystemDebugControl

Prototype

NTSTATUS NtSystemDebugControl(
  SYSDBG_COMMAND Command,
  PVOID          InputBuffer,
  ULONG          InputBufferLength,
  PVOID          OutputBuffer,
  ULONG          OutputBufferLength,
  PULONG         ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 D0 01 00 00      mov eax, 0x1D0
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtSystemDebugControl is a multiplexer for debugger-style kernel operations. The Command enum (SYSDBG_COMMAND / SysDbgCommand) selects between virtual/physical memory read and write, control-space access, MSR reads, profiler control, breakpoint installation, triage-dump retrieval and several legacy commands. *Crucially*, on free / retail builds Microsoft has progressively restricted the truly powerful commands: SysDbgReadVirtual, SysDbgWriteVirtual, SysDbgReadPhysical and SysDbgWritePhysical return STATUS_NOT_IMPLEMENTED unless the system is running a debug (checked) kernel or has been booted with the `/DEBUG` kernel-debugger enabled. On a normal Win10/Win11 desktop those bytes are inert. The caller also requires SeDebugPrivilege.

Common malware usage

Historically — Windows XP and early Vista — NtSystemDebugControl with SysDbgReadVirtual/WriteVirtual was a clean userland-to-kernel R/W primitive that several rootkits abused. Rustock and the BlackEnergy 2 kernel driver are commonly cited examples; numerous research PoCs from the same era used it for SSDT patching and kernel structure tampering. Since Vista x64 + PatchGuard + the free-build restriction this avenue is essentially closed on modern systems. Modern malware does not abuse NtSystemDebugControl for kernel R/W — the path is shut. Indirect uses persist: SysDbgGetTriageDump can be invoked by anti-analysis code to detect the presence of a kernel debugger or running profiler.

Detection opportunities

On a modern system, *any* successful call to NtSystemDebugControl from a non-debugger process is suspicious. ETW Microsoft-Windows-Kernel-Audit-API-Calls covers privileged debugger surface, and SeDebugPrivilege usage shows up in security auditing (Event ID 4673). EDR-side, hook ntdll!NtSystemDebugControl, decode the command, and treat SysDbgReadVirtual / SysDbgWriteVirtual / SysDbgReadControlSpace / SysDbgReadMsr as high-confidence indicators regardless of return status. Calls that return STATUS_NOT_IMPLEMENTED are themselves a probing signal worth logging.

Direct syscall examples

; Direct syscall stub for NtSystemDebugControl (SSN 0x1D0 on Win11 24H2 / Server 2025)
NtSystemDebugControl PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 1D0h         ; SSN for win11-24h2
    syscall
    ret
NtSystemDebugControl ENDP

// Read N bytes from a kernel virtual address.
// On a stock Win10/Win11 system this returns STATUS_NOT_IMPLEMENTED.
// Only works against a checked kernel or with the system booted /DEBUG.
typedef enum _SYSDBG_COMMAND {
    SysDbgReadVirtual           = 8,
    SysDbgWriteVirtual          = 9,
    SysDbgReadPhysical          = 10,
    SysDbgWritePhysical         = 11,
    SysDbgReadControlSpace      = 12,
    SysDbgGetTriageDump         = 29,
} SYSDBG_COMMAND;

typedef struct _SYSDBG_VIRTUAL {
    PVOID  Address;
    PVOID  Buffer;
    ULONG  Request;
} SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL;

// caller must have SeDebugPrivilege enabled
BYTE buf[16] = { 0 };
SYSDBG_VIRTUAL in = {
    .Address = (PVOID)0xfffff80000000000ULL,  // some kernel VA
    .Buffer  = buf,
    .Request = sizeof(buf),
};
ULONG returned = 0;
NTSTATUS s = NtSystemDebugControl(SysDbgReadVirtual,
                                  &in, sizeof(in),
                                  NULL, 0,
                                  &returned);
// On a free build: s == STATUS_NOT_IMPLEMENTED (0xC0000002).

// Cargo: windows-sys = "0.59"
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_system_debug_control_stub() {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x1D0",   // Win11 24H2; resolve dynamically for other builds
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1014Rootkitmitre ↗
• T1622Debugger Evasionmitre ↗
• T1106Native APImitre ↗