I have made some (superficial) investigations of my own. It turns out that function called here is responsible for drawing "next frame" of animation: Code: 0988:1F00 03C2 add ax,dx 0988:1F02 054000 add ax,0040 0988:1F05 50 push ax 0988:1F06 9A9600E51E call 1EE5:0096 0988:1F0B 83C406 add sp,0006 0988:1F0E B80100 mov ax,0001 0988:1F11 50 push ax [b]0988:1F12 9A34012403 call 0324:0134 <== draw[/b] 0988:1F17 83C402 add sp,0002 0988:1F1A 8B848218 mov ax,[si+1882] ds:=0001 Unfortunately NOPing it gives pretty ugly results. Unlike fast scrolling on poles when trying to "go across"... You have nailed it in first go... As I just experienced, one should not put segment numbers in hex searches. Code: [b]b8 01 00 50 9a 34 01[/b] 82 01 - these are hex codes in .exe file of assembly code from 0988:1F0E on. The segment number is different, just like you said. I must say I don't like this segment addressing - apart from problems you presented, it is not unique. If I have some linear address in Cheat engine, I cannot go and toggle breakpoint in say 327a5 address, because it can be 327a:0005 or 3270:00a5 or many others. I think you are right - I recognize this 2BBD segment. I think no IDA version would recognize overlays because (I think) it is not standardized thing (like every app which uses overlays does this the same way). I lately have been playing Warlords 2 and it seems that it loads new code all the time - I debugged it and then when later (like two tiles of movement later ) I went for the same address it contained very different code. It's kinda beautiful (seeing the lengths programmers went to overcome limits layed by "old" hardware) but also pain in the... I won't be meddling with drivers anytime soon.