I was reviewing solutions submitted to crackmes.de and one that got rejected caught my attention.
The patch made by the user didn't work on any Vista versions.
I usually don't do this but I looked deeper into it.

The patched crackme under IDA is being rebased to a random ImageBase.
As a side-effect, IDA can't follow the code and everything disappears from the project database.
IDA can force it to remain at its normal ImageBase but this is the first time that I've seen an executable behave that way.

http://img158.imageshack.us/img158/19/rebasetg9.th.png (http://img158.imageshack.us/my.php?image=rebasetg9.png)
http://img158.imageshack.us/my.php?image=rebasetg9.png

It looks a lot like a Vista-specific anti-debugging trick but wasn't intended that way by the author of the patch.
I'm pretty sure that it is closely related to Vista and ASLR.

I assume that the loader detects a "faulty" patch and triggers some sort of special panic mode.
I have not found a more plausible explanation but maybe somebody has a better one.

Here is the crackme, patch and solution:
http://rapidshare.com/files/110731226/cm2.rar.html

TiGa

IDA 5.1.0.899 has no problems with the exe.