| Previous | Next |
| STATUS_UNABLE_TO_DELETE_SECTION | STATUS_ILLEGAL_INSTRUCTION |
STATUS_INVALID_SYSTEM_SERVICE
This status belongs to the native system-service boundary
STATUS_INVALID_SYSTEM_SERVICE is different from an ordinary API returning STATUS_INVALID_PARAMETER. It indicates failure at the system-service selection boundary: the requested native service is not valid for the running environment. The status is therefore especially significant in crash dumps, compatibility layers, instrumentation, emulators, and software that constructs low-level system calls itself.
Windows documents native system services through paired NtXxx and ZwXxx routines. In kernel mode those prefixes can change how parameters are interpreted because the service observes the caller's previous mode differently, even though the underlying kernel service is related. Code should use the documented routine and its published prototype rather than infer a service contract from a numeric dispatch value or from another Windows build.
When this status appears, capture the faulting instruction and stack, the exact service wrapper or stub, the OS architecture and build, and whether a hook or compatibility layer modified the call path. If the code is a driver, verify that it calls the documented Nt/Zw routine appropriate for its context. Retrying the same invalid service selection is not useful; the diagnostic target is the call boundary and how the service was selected.
What to inspect
- Inspect the calling stub or wrapper and the target Windows architecture/build.
- Check whether instrumentation, emulation, or a compatibility layer rewrote the native-call path.
- Use the documented Nt/Zw routine and prototype instead of a privately assumed numeric service entry.
References
- Microsoft: Using Nt and Zw versions of native system services
- Microsoft: NtXxx routines
- Microsoft: NtOpenProcess
- Microsoft: What does the Zw prefix mean?
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.