Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
When I debug a .exe file on Windows with IDA, I do it step by step.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
By the way, when I'm looking at a specific address on the stack and move one step I'm loosing my view of the specific address, the stack view change to current sp.
How can I always look at a specific stack address without the view changing?
Thanks
Although those are too completely unrelated questions and should be asked separately, I'll answer both.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
No. You cannot. In order to move a step backwards IDA (or any other debugger for that matter) needs to store all previous register values, memory values and CPU state. This is not part of debugging functionality provided by most debuggers. There are a few instrumentation tools that allow for that, but they're overhead is rarely worth the effort / limitations for most debugging sessions. I often use Virtual Machines and save snapshots for that purpose instead.
when I'm looking at a specific address on the stack and move one step I'm loosing my view of the specific address, the stack view change to current sp.
How can I always look at a specific stack address without the view changing?
The stack view window follows the stack pointer by definition. However, it seems you're using the stack view for purposes that would better utilize the memory view/memory dump. The memory dump view (located just below the instructions/disassembly view in IDA by default) will show you a range of memory addresses and is freely browsable. You can create multiple memory views within IDA to view multiple address areas at any given time. The memory view will not show other addresses unless you've specifically changed the address using the UI.
