                     =-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                             CASPR v0.952
                     A cool unpacker for ASProtect
                     -=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                     (c) 2000 Coded by SAC/UG2000!

I. Intro :
^^^^^^^^^^
  ASProtect is a very powerful win32 protector. It has compression,encryption,
  anti-debugging code,anti-disassembler code,crc checking,anti-dumping,etc.
  features. It uses Blowfish,Twofish,TEA,ect. which are strong cryptographic
  algorithms, and also uses RSA1024 - very strong public keys cryptographic
  algorithm - as registration keys generation. It communicates with the
  application through API hooks including import hooks(GPA hook) and export
  hooks. Furthermore,ASProtect v1.1 uses Win95.Marburg's polymorphic engine.

  CASPR is a cool unpacker for ASProtect. CASPR is designed for experienced
  crackers, not for beginners. Sorry! Its source code can't be provided.

II. Features :
^^^^^^^^^^^^^^
    Support ASProtect v0.961b - v1.1.
    Own decryption and decompression code.
    Import table rebuilding engine.
    Export table rebuilding engine.
    API hook technic.
    Win32(Win9x,WinMe,WinNT and Win2k) compatible.

III. Usage :
^^^^^^^^^^^^

  CASPR has no GUI,you must run it under command line.
  Now CASPR requires EliCZ's ApiHooks to run.

   For EXE:

      ApiHooks -nq CASPR.dll <ASPRed.exe> or CASPR <ASPRed.exe>

   For DLL:

      ApiHooks -nq CASPR.dll CASPRLDR.exe <ASPRed.dll> or CASPRDLL <ASPRed.dll>

  If successfully, .EX_(.DL_) is created. .EX_(.DL_) is the unpacked EXE(DLL).
  Otherwise it shows that the program is not protected by ASProtect
  or the program is protected by an unknown ASProtect version.

IV. Known bugs :
^^^^^^^^^^^^^^^^
  1. The original positions of the resources moved by ASProtect can't be found.
     They are placed in a new section which is called '.cas'.  You must
     recover them manually with your experience.

  2. The original position of the export table can't be found too when it
     contains only ASProtect's export APIs. The following is same as above.

  3. The names and characteristics of sections have been deleted or modified.
     You can only recover them with your experience.

  4. If the protected program uses ASProtect's APIs,please wait for my
     ASProtect's API emulator or you can modify it by yourself.
     (VAG/UG2000 is currently also coding an API emulator and unpacker
      for ASProtect.)

  5. If some executable codes of the protected program are encrypted,you can't
     recover them until you get a real key of the protected program.
     (Maybe this is not a bug.:)

  6. ASProtect has so many different versions. Maybe CASPR can't detect some
     of them.If you find a new version,please send it to me.

V. Plan :
^^^^^^^^^
   ASProtect's API(import and export hooks) emulator - For beginners.
   x86 CPU emulator - Have not to use API hook technic.
                       Defeat the polymorphic encryption thoroughly!

VI. Greetings :
^^^^^^^^^^^^^^^
  Christoph Gabler and all UG members, EliCZ(Win32 Pioneer), Aaron,etc.

  Special Greetings: Alexey Solodovnikov - It's easy to defeat ApiHooks.
                                           I am waiting for next anti-ApiHooks
                                           ASProtect version.

VII. Contact me:
^^^^^^^^^^^^^^^^
Email : webmaster@SAC.home-page.org
Homepage : http://SAC.home-page.org

VIII. History (Fight with ASProtect):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ Added
- Removed
! Updated
 Fixed

  11.21.2000  v0.952
    Code  :  ! support another ASProtect version - Thank Roman A.!

  11.20.2000  v0.951
    Code  :  ! support ASProtect v0.962b!

  11.17.2000  v0.950
    Code  :  ! support old ASProtect version(v0.961b) - Thank A.E.!

  11.15.2000  v0.940
    Code  :   decrytion code - Thank hying!

  11.14.2000  v0.931
    Code  :  ! support another ASProtect version - Thank totnak!

  11.12.2000  v0.930
    Code  :  ! support another ASProtect v1.0 - Thank Snow Panther!

  11.09.2000 CASPR v0.920 released to Christoph Gabler again!

  11.01.2000
    Crack :  AZPR v3.51 Regged and CloneCD v2.8.2.1 Regged!

  10.30.2000  v0.920
    Code  :  ! support new ASProtect v1.1
    Crack :  CloneCD v2.8.1.1 Regged!

  10.28.2000  v0.910
    Code  :  ! support new ASProtect v1.1
    Crack :  ASProtect v1.1 Regged!

  10.26.2000  v0.901
    Code  :  ! support another ASProtect v1.0

  10.22.2000  CASPR v0.900 released to Christoph Gabler! (But no response)

  10.18.2000  v0.900
    Code  :  + support DLL. (thanx a lot to EliCZ)
             ! decryption code.

  10.14.2000  v0.800
    Code  :  + export table rebuilding engine.
             ! decryption code.
    Crack :  ASPack v2.11 Regged! (spent less 1 hour)

  10.11.2000  rAD v0.5 released! - It used my old method,I think CASPR is better!

  10.10.2000  v0.700
    Code  :  + own decryption code!
             + relocations recovering code for DLL.

  10.08.2000  v0.600
    Code  :  + own decompression code!

  10.07.2000  v0.500
    Code  :  + resources recovering engine.
             + TLS recovering engine.
             ! detection code for some old ASProtect versions.

  10.06.2000  v0.400
     Code :  + PE header recovering code.
             ! import table rebuilding engine(can output the short import table).
             ! detection code for ASProtect v1.1.

  10.05.2000  ASProtect v1.1 released!

  10.04.2000  v0.300
     Code :  + detection code for ASProtect.
             + decrypt and decompress sections and dump them.

  10.03.2000  Begin to code this unpacker.

  09.xx.2000  v0.2xx
    Code  :  ! import table rebuilding engine for new ASProtect version.
    Crack :  AZPR v3.21 Regged and CloneCD v2.7.7.3 Regged!

  08.xx.2000  v0.1xx
    Code  :  ! import table rebuilding engine for new ASProtect version.

  07.xx.2000  v0.1xx
    Code  :  ! import table rebuilding engine for new ASProtect version.
    Crack :  ASProtect v1.0 Regged and AXPR vx.xx Regged!

  06.xx.2000  v0.0xx - Begin to analyse ASProtect.
    Code  :  + import table rebuilding engine for ASProtect v1.0.

  06.01.2000  ASProtect v1.0 released!
