[bleh]

Look at struct PlayerProfile_Struct in common/eq_packet_structs.h (~line 3192). That struct is written to the blob.

According to that, AAs start at offset 0432 (decimal). Keep in mind that there are also some AA-specific tables in the database.