I am currently disassembling a binary that enters vm86 mode, so 32-bit binary in 16-bit mode. While IDA fails to do that correctly, I took the initiative to do it by myself.

Problem is, I very often stumble on two "0x00" opcodes that follow each other, and that wouldn't make any good instruction.
So here, I have the possibility to take the second zero and the following opcode, creating strange instructions, but that may work, or skip the two zeroes everytime (cf screenshot)

My question is, what is the correct way of disassembling here ? So that I don't make any bad instructions that would destruct my instructions flow

Here is an example (I tried to do something clear enough):


  • 1
    Could this just be constant data embedded in the code segment? Is there any control flow that causes this range to be executed? – Ben Voigt Oct 15 '15 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.