He wasn't just looking for a serial key; he was looking for the 'jump' instruction that bypassed the license check. He found it at memory address 0x0045F2A1 . With a sharp intake of breath, he swapped a 74 (JZ) for a EB (JMP). He hit Execute .