problem solved

Construct a dummy license.dat, e.g.

SERVER hostname ANY
VENDOR ICRD c:\Flexlm\icrd.exe

FEATURE f1 ICRD 1.0 permanent uncounted 123456654321 HOSTID=ANY

Where hostname is the name of your host PC.

Run lmgrd -z ircd.exe -c license.dat

Breakpoint _l_sg(). On the 2nd hit here, follow _l_n36_buff() and breakpoint seed 1 and seed 2 in the job structure (3rd param to _l_n36_buff() function). Seeds are recovered at address 45B550 in IRCD.exe. I've jotted down 0x8A120FD3 & 0xBE390A1C in about a 2min session.

Regards,

CrackZ.