[AndMetal]

Looks like I was right:
aa.php

	// Find the AA ID in the profile or select a new slot to train the AA
	for($x = 1; $x <= 240; $x++){
		
		// AA ID Value
		$aa_id = asc2uint(substr($char->profile,$x*8+428,4));

		// Find first open available slot in profile
		if($aa_id == 0){
			if(!isset($aa_open)){
				$aa_open = $x;
			}
		}

		// if train_id matches a previous AA then stop and save the slot #
		if($_POST['train_id'] == $aa_id){
			$aa_slot = $x;
			$aa_value = asc2uint(substr($char->profile,$x*8+432,4));
			break;
		} elseif(($aa_id == 0) && ($aa_open < 1)) {
			$aa_open = $x;
		}
	}

...

for ($x = 1; $x <= 240; $x++) {
	$aa_array[asc2uint(substr($char_blob,$x*8+428,4))] = asc2uint(substr($char_blob,$x*8+432,4));
}

Should be able to fix this one of 2 ways: either change the for values to 0/239 instead of 1/240, or change the substring to ($x-1)*8+428/($x-1)*8+432. I personally went the first route.

Should also be some more in aa_adv.php:

for ($x = 1; $x <= 240; $x++) {
	$aa_array[$x] = array( 0 => asc2uint(substr($char_blob,$x*8+428,4)), 1 => asc2uint(substr($char_blob,$x*8+432,4)));
}

It also looks like the locations are defined in schema.sql, so that will be the semi-hard part:

UPDATE editor_values SET location = (location - 8) WHERE name LIKE 'aa_%'

One thing I'm not sure about with the above code, though, is that the server is really weird about how it reads and stores the AA values. The ID is basically the ID in the profile minus the value it is set to minus 1. I think it's mainly because the IDs sort-of start at 0, not 1 (which is mainly why I ended up starting from 0 instead of 1).

The part that writes the values looks right, but I'm not sure about how it pulls it later in the code. This is how I ended up reading it (is kinda old, so a little sloppy):

// AA_Array[240]
	for ($x = 0; $x <= 239; $x++) {
		$aa = asc2uint(substr($profileResult,$x*8+428,4));
		$value = asc2uint(substr($profileResult,$x*8+432,4));
		if ($aa != 0) {
			$Profile["aa_array"][($aa-($value-1))] = $value;
		};
		unset($aa);	// Probably not very efficient...
		unset($value);	// Same...
	};
	unset($aa);
	unset($value);

Could probably do it a little better this way:

// AA_Array[240]
	for ($x = 0; $x <= 239; $x++) {
		$aa = asc2uint(substr($profileResult,$x*8+428,4));
		if ($aa != 0) {
			$value = asc2uint(substr($profileResult,$x*8+432,4));	// 1 call to constant > 2 calls to variables/functions
			$Profile["aa_array"][($aa-($value-1))] = $value;
		};
		$aa = 0;	// Otherwise, can cause some issues in the loop since it carries over
		$value = 0;	// Same
	};
	unset($aa);	// Help free a little memory
	unset($value);	// Same

On a somewhat unrelated note, just as an added feature, you may want to include the AA description in somewhere (I didn't see it, unless I overlooked it):

SELECT text FROM editor_dbstr WHERE type = 4 AND id = $aa_value[0]

For reference, this is a query I used for viewing the AA info, including text loaded in a table "dbstr_us" (I tried to make a window as close to the client as I could):

SELECT a.skill_id, a.name, a.cost, a.max_level, a.spellid, (a.classes + a.berserker) AS classes, d.text FROM altadv_vars a, dbstr_us d WHERE a.skill_id=d.id1 AND d.id2='4' AND a.type='$_GET[type]' AND classes & '$ClassesBit[$_GET["class"]]' ORDER BY a.skill_id

Anyways, enough of my rambling, this should take care of the original issue.