You know, when disassembling a Z80 binary, you'll often get nonsense like this:
LBFF9: CP 00h RET NZ RRA JP NZ,LC000 LC000: LD DE,0C136h
When in fact that should be:
DB 0FEh DW 0C000h DW 0C21Fh DW 0C000h LC000: LD DE,0C136h
In the first version, the first 7 bytes of a Basic bload file are interpreted as instructions. Just by chance, these "instructions" don't overlap the real enty point, so that LD DE,0C136h is decoded right. Of course we know that the 7 first bytes of a bload binary are always data, so they are easy to skip, but often there are data bytes later on that make the disassembly a mess.
I was wondering, why disassemblers don't track how the program is executed, so they would know which addresses are code? You'd just specify the entry point.
Of course I wasn't the first thinking about this. There even already is such a smart assembler! YAZD
Of course tricks exist that confuse even YAZD, like JP (HL) and self-modifying code, but when you read the first version, you can add more entry points and get even better results.
The program is made with C# so it's a Windows EXE, but also runs on Mono.
E.g. mono yazd.exe --addr:0xbff9 --entry:0xc000 mybind.bin mybin.lst --xref