Herb Chong commented: > you assume you can recognize a Jump instruction.
And that there are any bytes left over in the address space to stick the new code into. (Of the two, recognizing the JMP instructions is the more easily solvable. How many different embedded controllers are in common use these days? ID the controller and look it up, or try different interpretations of the code until you find one that starts making sense.) -- Glenn