First ROM Shadowing
Let&#x27;s suppose your PC system ROM was 64 KiB F000:0000 to F000:FFFF (F0000 to FFFFF linear). If it wasn&#x27;t a 286 or higher, then it couldn&#x27;t simply use protected&lt;-&gt;real-mode virtual memory tricks to copy ROMs and remap memory pages. Instead, there would need to be a motherboard-assisted hardware mechanism to redirect the decoding of the top 4 bits matching 1111 from ROM to copy to and steal some RAM. It would probably be easiest to do this at boot (during POST) by temporarily mapping future shadow ROM (RAM) to RAM, copy the ROM-&gt;RAM, and then remap that RAM over the ROM. Let&#x27;s borrow A000:0000 since we&#x27;re in text mode 0x3 using 4 KiB of the EGA&#x2F;VGA frame buffer at B800:0000 and assume there&#x27;s no other adapter configured to use this area.<p><pre><code>    ; copy 64 KiB from F000:0000 -&gt; A000:0000
    ; registered not saved: AX CX SI DI
    ; registered saved: CS DS ES FLAGS
    ; 12 bytes of stack required

    PUSH DS
    PUSH ES
    PUSHF

    CLD           ; technically, this isn&#x27;t needed
                  ; we&#x27;re copying all 64 KiB and
                  ; could wrap backwards

    MOV AX, F000h
    XOR SI, SI
    MOV DS, AX

    MOV AX, A000h
    XOR DI, DI
    MOV ES, AX

    MOV CX, 8000h  ; 64 KiB &#x2F; (sizeof(word) == 2)

    REP MOVSW      ; DS:[SI] -&gt; ES:[DI]
                   ; 16 bits at a time until CX == 0

    POPF
    POP ES
    POP DS

</code></pre>
segment:offset addressing in real-mode<p>linear address = segment * 16 + offset<p>With the exception of some memory areas are mapped only by hardware decoding the segment but not the offset to where reads beyond offset FFF0 wrap around instead of pointing to adjacent memory.<p>AC00:FFFF (BBFFFh linearly) != B000:BFFF<p>There are variations of real mode on 286+ that use linear flat addressing outside of protected mode (it would be 16 MiB for 286 and 386SX, and 4 GiB max for 386+) by messing with the hidden masks of the segment registers by switching to protected mode temporarily. The downside is all of the system provided (ROM) real-mode interrupt handlers, OS, and drivers would need to be rewritten for this different addressing scheme. It&#x27;s called unreal mode. Hypothetically, you could algorithmically transpile ROM code by parsing instructions and rewriting them. Real-mode interrupt handlers are stored in a table of 256 far pointers at 0000:0000 to 0000:03FFF.