just experiment
its like patching a program thats been compressed 4 times
just hook into each layer, everytime hooking the exit point, so you can hook into the new layers..
if crc is used, you may have to patch that to use the real crc (crc may be used to decrypt oep amoung other things)
i patched it hooking where he repz movsd's the unpacked data into its real va's .. about 4 patches + the 'crack' patch .. @ the repz movsd's, esi / edi contain a base for you to use to patch the new code .. (patch using [edi+xx] or sth)
go fourth, and experiment! took me around 3-4 hrs to get a 2 byte patch done, hehe