[TippeX]

yeh i know the complete owning document, and its far from complete owning, they missed a lot of things, some of the anti dump functions do different things when called with different parameters, i think its the vm thats causing your crash.. so you really should investigate that.. it will take some time, but its definately worth it as then you can convert the vm code back to x86 code and then you might see some of the checks you've missed which were 'embedded' in the vm 'script'...

in all honesty, the method you're using was the 'typical' method used by some of the crackers in the time, but its out of date now and isn't exactly 'clean' (by this i mean the cracked executable should be about the size of the protected one or slightly smaller.. i've seen some of the cracks using this method being 50mb+ bigger than the protected exe, and thats bad in my book)..