                   =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                              CASPR v1.012
                     A cool unpacker for ASProducts
                   =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                   (c) 2000,2001 Coded by SAC/UG2001!
                         aLL rIGHTS rEVERSED! ;)

I. Intro :
^^^^^^^^^^
  ASProducts are included ASPack and ASProtect.

  ASPack is a very well win32 packer. Since v2.11 ASPack uses the
  Win95.Marburg's polymorphic engine.

  ASProtect is a very powerful win32 protector. It has compression,encryption,
  anti-debugging code,anti-disassembler code,crc checking,anti-dumping, etc.
  features. It uses also strong cryptographic algorithms like Blowfish,Twofish,
  TEA,etc, and also uses RSA1024 - very strong public keys cryptographic
  algorithm - as registration keys generation. It communicates with the
  application through API hooks including import hooks(GPA hook) and export
  hooks. Furthermore, since v1.1 ASProtect uses the Win95.Marburg's polymorphic
  engine.ASProtect v1.11c was added anti-Apihook code(stolen from Win32.Crypto)
  and the BPE32's polymorphic engine.
  The big question:  Is it a super virus or a commercial protector?

  CASPR is a cool unpacker for ASProducts. It is designed for experienced
  crackers, not for newbies. Sorry, its source code can't be provided.


II. Features :
^^^^^^^^^^^^^^
    Support for ASProtect v0.95b - v1.2x and ASPack v1.00b - v2.11x
    Own decryption and decompression code
    Import table rebuilding engine
    Export table rebuilding engine
    Resources recovering engine
    x86 CPU emulator
    Win32(Win9x/Me/NT/2k/XP) compatible


III. Usage :
^^^^^^^^^^^^
  CASPR has no GUI, you must run it under command line:

        CASPR [-|/L] <input> [[-|/P] output]

              -L        Open CASPR.INI in the input files directory

              input     May contain wildcard characters (* and ?)

              -P        The output is the path name.

              output    Will be used with a single file input only


  CASPR.INI contents the following:

    [Options]

    Import=0x80000707

           Bit 31: Ignore the import table.
       Bits 12-30: N/A
           Bit 11: IIDDN_RVA is available.(Bit 3 must be set)
           Bit 10: IIBN_RVA is available.
           Bit 9 : IIOFTD_RVA is available.
           Bit 8 : IID_RVA is available. Now you can ignore it.
         Bits 4-7: N/A
           Bit 3 : Generate another form. All DLL names are placed together.
           Bit 2 : Generate the original thunk data.
           Bit 1 : Generate the shorten import table.
           Bit 0 : Place the import table except IAT into the last section.


    Export=0x80000100

           Bit 31: Ignore the export table.
        Bits 9-30: N/A
           Bit 8 : IED_RVA is available.
         Bits 0-7: N/A

       TLS=0x80000101

           Bit 31: Ignore TLS
        Bits 9-30: N/A
           Bit 8 : ITLSD_RVA is available.
         Bits 1-7: N/A
           Bit 0 : Don't searching for TLS. Place TLS into the last section.

  Resource=0x80000301

           Bit 31: Ignore the resources.
       Bits 10-30: N/A
           Bit 9 : IRData_RVA is available.
           Bit 8 : IRD_RVA is available. Will be used in the future.
         Bits 1-7: N/A
           Bit 0 : Don't rebuild the resources.
                   Place the moved resources into the last section.

Relocation=0x80000102

           Bit 31: Ignore the relocations
       Bits 10-30: N/A
           Bit 8 : IR_RVA is available. Will be used in the future.
         Bits 2-7: N/A
           Bit 1 : If the relocations don't exist,
                   then do not set IMAGE_FILE_RELOCS_STRIPPED.
           Bit 0 : N/A

  NOTE: Some options are used only for ASProtect.


    [RVAs]

       IID=0x00000000
           IMAGE_IMPORT_DESCRIPTOR's start address
           Now you can ignore it.

    IIOFTD=0x00000000
           IMAGE_IMPORT_OriginalFirstThunk_DATAs' start adress

      IIBN=0x00000000
           IMAGE_IMPORT_BY_NAMEs' start adress

     IIDDN=0x00000000
           IMAGE_IMPORT_DESCRIPTOR.DLLNAME's start adress

       IED=0x00000000
           IMAGE_EXPORT_DIRECTORY's start adress

     ITLSD=0x00000000
           IMAGE_TLS_DIRECTORY's start adress

       IRD=0x00000000
           IMAGE_RESOURCE_DIRECTORY's start adress
           Will be used in the future.

    IRData=0x00000000
           IMAGE_RESOURCE_DATA's start adress.

        IR=0x00000000
           IMAGE_RELOCATION's start adress.
           Will be used in the future.

  NOTE: All RVA values must point between ImageBase and ASPack/ASProtect's
        section, otherwise they will be ignored.
        Take your brain together and set them CAREFULLY please.


IV. Known bugs :
^^^^^^^^^^^^^^^^
  1. The names and characteristics of sections may be deleted or modified.
     You can recover them only with your own experience.

  2. If the protected program uses ASProtect's APIs, please wait for ending
     my ASProtect's API emulator or you must modify this one by yourself.
     (It's helpful to see ASProtect's help and examples.)

  3. If some executable codes of the protected program are encrypted, you
     can't recover them until you has gotten a real key of the protected
     program. (Maybe this isn't my bug.:)

  4. ASProducts have a lot of different versions. Maybe CASPR can't detect
     some of them. If you find an unknown version, please drop me a line
     and mail it to me.

  Note: I want to collect all ASProducts versions, W-H-O can help me?


V. Plans :
^^^^^^^^^^
   ASProtect's API(import and export hooks) emulator - For beginners
   CASPR GUI version.


VI. Greetings :
^^^^^^^^^^^^^^^
  Christoph Gabler, Snow Panther, ReDragon and all UG members,
  EliCZ(Win32 Pioneer), Aaron, totnak, hying, A.E., Roman A., and still more.

  Special greetings to Alexey Solodovnikov:

        -  Don't steal the babies of other persons!

        -  A better way is to use your own brain!


VII. Contact me :
^^^^^^^^^^^^^^^^^
   Email : SAC@heremail.com
Homepage : http://SAC.mainpage.net


VIII. History (Fight with ASProducts) :
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ Added
- Removed
! Updated
 Fixed

  03.05.2001  v1.012
    Code  :  ! support for another ASProtect version (Thanks to Aleph)

  03.04.2001  v1.011
    Code  :  ! support for another ASProtect version (Thanks to zadira)
             ! support for another ASPack version (Thanks to YMY)

  03.01.2001  v1.010
    Code  :  ! support for two other ASProtect versions
               (Thanks to Alexey Solodovnikov and sNoOFy !)
             ! support for two other ASPack versions
             ! minor improvement for PE
              minor bugs
    Doc.  :   a mistake (PE_Patch << ASProtect v1.2 :)

  02.22.2001  v1.000  (Thanks to ReDragon and Snow Panther as beta testers!)
    Code  :  ! support for another ASPack version
              minor bugs

  02.14.2001  v1.000 beta3
    Code  :  + Files and time statistic
              minor bugs

  02.12.2001
    Crack :  ASProtect v1.2 Regged!

  02.08.2001  v1.000 beta2
    Code  :  ! support for two new ASProtect versions(include v1.2)
             ! support for ASPack v1.00b - v1.08.02
               (Thanks to Aaron and Michael for ASPack!)
              minor bugs

  02.01.2001  v1.000 beta1
    Code  :  ! support for ASProtect v1.11x and three other versions
             + support for ASPack v1.08.03 - v2.11x
             + INI. You can now customize CASPR with your own experience
             + x86 CPU emulator
             ! refresh resources recovering engine (can rebuild resources)
             ! refresh import table rebuilding engine
             ! refresh detection code
              minor bugs
             - ApiHooks(Thanks again to EliCZ!)

  01.29.2001  AS-AntiProtect v0.98b released by VAG! COOL!

  01.01.2001  Keygens for almost ASProtected programs released by DAMN!
              Unbelievable!!

   Note: The previous history is omitted.
