Easy just use the Program Counter to cycle through all the code-space keeping R0 and R2 as zero. When you hit an instruction that makes R2 the same value as the stuff in 0x00000 (as R0 is 0x00000 ...