The virtual address is not necessarily the same as the disk offset.
Actually, it seems that the security directory is one of the few places where a disk offset is intentionally used. Trying to compensate for the virtual address results in failure in this case.
I have been amending the code to make it more robust however, and shall submit a revised version tomorrow.