NTSTATUS 0x80000004 (STATUS_SINGLE_STEP): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The processor completed a trace step or triggered a debug-register condition.

Previous	Next
STATUS_BREAKPOINT	STATUS_BUFFER_OVERFLOW

STATUS_SINGLE_STEP

A processor debug condition completed one execution step

A single-step exception can be produced by the processor trace flag, by hardware breakpoints in the debug registers, or by debugger machinery that temporarily enables stepping to move past a breakpoint. It is therefore a control event rather than evidence that the instruction itself failed.

Unexpected occurrences often come from stale debug-register state, anti-debugging code, instrumentation, or a handler that restored EFlags/RFlags incorrectly. Examine the complete thread context, especially the trap flag and DR0–DR7, before changing application logic. A debugger receives first-chance notification and may intentionally consume the event; only an unhandled or repeatedly re-raised event is normally visible as an application failure.

What to inspect

Record the trap flag and hardware debug-register values from the exception context.
Check whether the preceding breakpoint handler intentionally requested one step.
Identify injected instrumentation or security software modifying thread contexts.
Do not classify the stepped instruction as faulty without another exception.

References

Looking for a different code? Search another status or error code.