An iterative method and device for detecting an approximate area occupied by computer code of a core of an operating system in a memory, the area including one or more ranges. The method includes: detecting at least one target address in the memory; determining a first area delimited by two of these target addresses; disassembling these areas at least into a part determined during the previous iteration; detecting target addresses pointed to in the disassembled areas; and searching for an additional memory range starting after the second target address obtained on the last iteration and including only computer code.