Glossary
Single-Stepping
Executing one instruction at a time in a debugger to observe the exact effect of each operation on registers and memory.
Single-stepping (also called step-into or trace) is the debugger mode that executes exactly one instruction before pausing again. On x86 this is implemented by setting the Trap Flag (TF) in RFLAGS, causing the CPU to generate a SINGLE_STEP exception after each instruction. It is the most precise way to trace through unfamiliar code, observe how registers change, and watch for anti-analysis tricks. Step-over is a related mode that treats a CALL instruction as a single unit rather than descending into the called function. Overuse of single-stepping through long loops is tedious; analysts prefer breakpoints to skip to points of interest.