You look at all code that looks for op codes. You will find it in the
byte code verifier, in the inner interpreter, and probably other
places. Then you do monkey see, monkey do.

Try searching for a strings matching the names of byte codes.

You might take a week to learn forth and how a forth interpreter
works. This will serve you in good stead. Just stick with a 16 bit
version and figure out how the inner loop works to execute a string of
tokens.

To extend the bytecodes, you probably want to disable the JIT first. You
can usually do that with a command line option then it means you only
need add handling for additional bytecodes in the interpreter. You will also
need to initially turn off the verifier as it will reject unrecognized
bytecodes.

I'm not knowledgable of the internal specifics of Kaffe, but I would check
the interpreter to see if they use any additional bytecodes internally after
class loading and verification (sometimes VMs do special things with
invokes, get/put/field/static, or others).

As for standard VM bytecodes, you have available bytecodes 203-255
IIRC. (also 186? which is unused). Depending on how many instructions
you wish to add, you can either map them as single bytes each or use
"escape" prefixes to extend the instruction set as they were considering
with the impdep1/impdep2  bytecodes (254/255) in the JVM spec,
similar to the way the "wide" prefix is used. You also need to consider
what, if any parameters, the bytecodes will have e.g. constant pool
indices, local variable indices, constants, (I/O addresses?), or other.

Mark...