What does NTSTATUS 0x4000001E (STATUS_WX86_SINGLE_STEP) mean?

 
Previous Next
STATUS_WX86_CONTINUE STATUS_WX86_BREAKPOINT

STATUS_WX86_SINGLE_STEP

Microsoft debugger source recognizes this WX86 code as a distinct exception filter

STATUS_WX86_SINGLE_STEP is an informational exception code from the Win32 x86 emulation subsystem. Microsoft's DbgShell source explicitly defines 0x4000001E as STATUS_WX86_SINGLE_STEP and assigns it a dedicated debugger filter name, separate from ordinary STATUS_SINGLE_STEP. That is concrete evidence that debugging tools need to preserve the WX86 code rather than normalize it prematurely to the native processor exception.

Windows debugger documentation explains the general single-step/breakpoint flow: first-chance notification lets the debugger inspect or handle the event before frame-based handlers, and debugger exception settings can break, defer to second chance, notify, or ignore an exception. Those docs describe Windows debugging generally; they do not publish the private x86-emulator transition that raises this WX86 status. Therefore the useful diagnosis is at the emulated thread/debugger boundary, not an invented emulator implementation detail.

Capture the exception code without lossy conversion, thread context, instruction address in the x86 guest view, debugger first/second-chance state, and the action passed when continuing the debug event. Compare with STATUS_WX86_BREAKPOINT: both are recognized separately by Microsoft debugger code. If a debugger handles native single-step but ignores WX86 single-step, stepping can appear to hang or run past the expected boundary even though the emulation subsystem generated a distinct event.

What to inspect

  • Preserve the raw WX86 exception code and emulated x86 instruction context.
  • Check debugger filter settings and first/second-chance handling for the WX86 code.
  • Compare continuation behavior with native STATUS_SINGLE_STEP without merging the two codes.

References


Looking for a different code? Search another status or error code.