I successfully wrote a program which unlocks the unreal mode (I can write to memory by mov byte [ebx] when ebx is bigger than 0xFFFF) but I don't know how to run code over the address 0xffff so that eip is bigger than that. When I use a jmp instruction, it just simply crashes (I set up code in that memory area).