FlexLM: Finding LM_SEED1-3 or ENCRYPTION_SEED3-4

1. I was able to find the seeds1-2 for 'target 1' name make a working license usable only with the vendor daemon (so it works fine as network license, even if the server runs locally). However, the target does not accept standalone license, even if I make them locked and time limited. I assume that this is because of not knowing seeds3-4, is that correct? These are probably used locally but not in the vendor daemon.

I don't see that this assumption is correct. It should be nothing to do with seeds3-4. Some Guru in this thread had already shown us that after v8.2 seeds3-4 did not take any role in the SIGN= or SIGN2= generation. Actually, it only used for l_handshake between vendor daemon and the protected clients' handshaking. The real seeds used for SIGN or SIGN2 generation are derived from 3 unsigned long double-words which are indirectly derived from 3 lmseeds.
IMHO, FlexLM is indeed a very good software protection which is almost becoming unbreakable when upgrading to version 10.8.x ECC protection. The only time-reasonable breaking way is through binary program patching. So simple rule is if NO PATCHING then only original legal vendor can generate good license.