little boring info..

following information is from asprotect.dll, for the data attatched to the end of aspr section
the va's / offsets whatever, change per exe/dll, but the id words remain the same..

word_4113DC dw 3E9h     ; .code:0040EC33r  decrypt info for call / jump (e8 / e9)
word_4113E0 dw 3EAh     ; sub_40FD10+106r  crypted_entrypoint_decrypt_key
word_4113E4 dw 3EBh     ; sub_40FD10+16Br  file failed crc check..
word_4113E8 dw 7D1h     ; sub_40E66C+F7r   trial_days
word_4113EC dw 7D2h     ; sub_40E66C+17Ar  time trial string
word_4113F0 dw 7D3h     ; sub_40E66C+19Fr  ?
word_4113F4 dw 7D4h     ; sub_40E66C+222r  ?
word_4113F8 dw 7D5h     ; sub_40E66C+B6r   unregistered version string?
word_4113FC dw 7D6h     ; sub_40E66C+247r  ?
word_411400 dw 0BBBh    ; sub_40FF58+56r   ?
word_411404 dw 0BBDh    ; sub_40FD10+123r  crc_size / how many bytes to crc?
word_411408 dw 0FA1h    ; sub_410060+15Dr  (80h, could be some rsa key thing?)
word_41140C dw 0FA2h    ; sub_410060+179r  (80h, could be some rsa key thing?)
word_411410 dw 0FA3h    ; sub_410060+A7r   app title
word_411414 dw 0FA4h    ; sub_40E66C+94r   ?
word_411418 dw 1389h    ; .code:0040F4CAr  crypted mangled rdata
word_41141C dw 138Ah    ; .code:0040F504r  asciiz decrypt key(s)
word_411420 dw 138Bh    ; .code:0040F535r  rdata / asciiz id byte info
word_411424 dw 1771h    ; sub_40FD10+C2r   aspr license info
word_411428 dw 1B59h    ; sub_40F8B8+30r   crypted_entrypoint
word_41142C dw 1B5Ah    ; .code:0040F566r  file_crc / also used to decrypt entrypoint
word_411430 dw 1F41h    ; sub_410060+195r  new_hook / null_sub
word_411434 dw 1F42h    ; sub_410060+1BAr  new_hook / null_sub
word_411438 dw 1F43h    ; sub_410060+EBr   new_hook / ??
word_41143C dw 1F44h    ; sub_410060+C6r   new_hook / db 00, b8, xx,xx,xx,xx, c3
word_411440 dw 1F45h    ; sub_410060+1DFr  new_hook / trial days, and days left
word_411444 dw 1F46h    ; sub_410060+204r  new_hook / ??
word_411448 dw 1F47h    ; sub_40E66C+D1r   new_hook / ??
word_41144C dw 1F48h    ; sub_410060+229r  ... 1f49,1f4a & 1f4b too (aspack.exe v2.11)
word_411450 dw 2329h    ; sub_410060+110r  ??


data_dump.bin from asprotect.exe (v1.1)

dw 0001h
dd size_of_this_data

dw 0fa4h    ; id
dd size     ; size of following data
db ?,?,?,?  ; dunno what this value is

dw 07d1h
dd 4
dd trial_days   ; 1eh

dw 07d2h
dd size
db '30 day string',0

dw 07d5h
dd size
db 'unregistered version',0

dw 1f41h
dd 4
dd rva_new_hook     ; if this hook isnt hooked, asprotect causes an exception

dw 1f42h
dd 4
dd rva_new_hook     ; dunno about this hook though..

dw 1f44h
dd 4
dd rva_new_hook?    ; or this one..

dw 0fa1h
dd size (80h, could be some rsa key thing?)
db ? dup (?)

dw 0fa2h
dd size (80h again)
db ? dup (?)

dw 0fa3h
dd size
db 'app title?',0

dw 2329h
dd size
db ? dup (?)

dw 1771h
dd size
db 'aspr license info',0

dw 138bh
dd size
db ? dup (?)    ; rdata id byte info (see rdata_v1_09.asm)

dw 138ah
dd size
db ? dup (?)    ; asciiz decrypt key(s)

dw 1389h
dd size
db ? dup (?)    ; crypted mangled rdata

dd rva_of_thunk
db lib_id_byte
db 'libname',0

db asciiz_id, size_of_asciiz, 'crypted asciiz'
...
db asciiz_id, size_of_asciiz, 'crypted asciiz'

dd rva_of_thunk
db lib_id_byte
db 'libname',0

db asciiz_id, size_of_asciiz, 'crypted asciiz'
...
db asciiz_id, size_of_asciiz, 'crypted asciiz'

dd 0

dw 1b5ah
dd 4
dd file_crc ; also used to decrypt entrypoint (if its not NULL)

dw 1b59h
dd 4
dd crypted_entrypoint

dw 03e9h
dd 2
db ?,? ; decrypt info for call / jump (e8 / e9)

dw 0bbdh
dd 4
dd crc_size ; how many bytes to crc?

dw 03eah
dd 4
dd crypted_entrypoint_decrypt_key

dw 0002h
dd NULL


----------------------

data_dump.bin from cv.exe (v2.3.0.66)

dw 0001h
dd size_of_this_data

dw 03ebh
dd size
db 'corrupt file',0 ; file failed crc check..

dw 03edh
dd size
db 'fatal error',0  ; unknown error to me..

dw 1771h
dd size
db 'aspr license info',0 ; Jouri Kaplan..- Developer License -

dw 138bh
dd size
db ? dup (?)    ; rdata id byte info

dw 138ah
dd size
db ? dup (?)    ; asciiz decrypt key(s)

dw 1389h
dd size
db ? dup (?)    ; crypted mangled rdata

dd rva_of_thunk
db lib_id_byte
db 'libname',0

db asciiz_id, size_of_asciiz, 'crypted asciiz'
...
db asciiz_id, size_of_asciiz, 'crypted asciiz'

dd rva_of_thunk
db lib_id_byte
db 'libname',0

db asciiz_id, size_of_asciiz, 'crypted asciiz'
...
db asciiz_id, size_of_asciiz, 'crypted asciiz'

dd 0

dw 1b5ah
dd 4
dd file_crc ; also used to decrypt entrypoint (if its not NULL)

dw 1b59h
dd 4
dd crypted_entrypoint

dw 03e9h
dd 2
db ?,? ; decrypt info for call / jump (e8 / e9)

dw 0bbdh
dd 4
dd crc_size ; how many bytes to crc?

dw 03eah
dd 4
dd crypted_entrypoint_decrypt_key

dw 0002h
dd NULL