Well copycrypt uses code 09 in FrogSice to protect itself from sice...and i just can't find the damn thing....

FrogSice says:

mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
VMMCall Get_DDB
mov [DDB], ecx

So after the code is executed i should land someplace after the mov ddb,ecx right?
Well the problem is i don't...i land in some funny code with lotta push [crap] and some calls to XXXstuph addresses.

So what the hell could be wrong?

You must realize that code snippets in
FrogsICE docs are just samples, you can
implement each method in many various
ways. Now you can look at FrogsICE report
or use the breakpoint proposed in the doc
to find where this method is used and how
eax,edi and ecx are handled.

Spath.

Hmm, it seems my messages are in some
strange way reposted when Opera reloads the
page from cache (without me reloading the
page). Sorry for this.

no problem I deleted the double msg, maybe they'll fix this on the 2.2 final version.

tsehp