Hi CrackZ:
I have read your flex2004 and applied it to my target.But there are some
differences with you essay.
First, I must patch my target's "bad flag 2" with 1, 0 dose't work.
next, I mush patch bad flag 1 from 10 to 0 at the same time.It differs from
your essay:

"There is however an alternative approach which involves forcing the licensing layer to do the old style SIGN=12 chars checkout and it simply involves patching ***ONLY*** the 2nd bad flag we found inside _l_n36_buf() "

With the two patches you told us, My target works fine. But the bad flag 2 puzzles me. I don't not the meaning when it is set to 2 and 1 and 0.

Thank you and Forgive my poor English.

could someone explain to me in simple terms how to patch ( target ) please
thank you

Sure:

You take your (target),
Open it with a Hex editor,

and you change one or more bytes,

in other words,
You patch it.

The only lagging detail is knowing: Which byte(s) to patch, and What bytes to change them to.

But those details are complex, and you want simplicity.