HACKED
Well, i took a deeper look yesterday and decided to practice a little hacking this a bit since i got a heavy flu and got some spare time. As i previusly pointed, all apc can be patched without even touch anithing. As its designed calling external executables, i did my own hack, just proof of concept, of how make APC trial to full.
you should see this on the proof
From now i just did it for action plugins, you can take a look to this app i just generated for proof:
http://puu.sh/toKKL/b20f0956b5.rar
it uses a plugin generated with apc, see bsplugin.lmd it has only a function <bsplugin.fugggddddd();> that just shows a dialog message with "k" text
how?
well not so easy preparing everithing to make it as edit some hex
You need first rename 478908.dat to flac.exe and 8685379.dat to polink.exe, then, create your own 478908.dat as some exe that calls flac.exe with same arguments, and the same with 8685379.dat. Apart from calling the real exe, now we have a pre compiler and a pre linker events, that we can use to edit the files to make the plugin patched.
To begin, on the pre compiler we recive these arguments:
fakeflac.exe "c:path oile.asm" "c:path oile.obj" that just compiles asm code into a coff object, these files usually are located in documents/apc/pluginname/Temp
So you can now know the asm file by the first argumnet, then open it, go to LuaFunctions def and replace bytes by the content on the previous path. i did it with a little of c#
So at this point LuaFunctions should contain the contents of the plugin.tmp.lua instead the path to it.
Then i wanted to remove the message of trial version at starup, for that i edited the file action.o on _irPlg_Action_RegisterActions as follows:
action.o pathed noerror:
http://puu.sh/toMa6/74a1960393.o
Now, we silenced the plugin but code isnt loading, so we need to make some more changes. I made a simple C code to generate a object i could bind to load the code. so i wrote:
typedef unsigned long DWORD;
extern int __stdcall MessageBoxA(DWORD , char* , char* , unsigned int);
extern char* __cdecl GetLuaFunctions();
extern char* __cdecl GetPluginXMLX();
extern int __cdecl GetSizeLuaFunctions();
extern int __cdecl GetSizePluginXMLX();
extern int __cdecl luaL_loadbuffer(DWORD*, char*, int, char*);
extern int __cdecl lua_pcall (DWORD*, int, int, int);
typedef unsigned long _DWORD;
typedef char _BYTE;
typedef char byte;
void xor_crypt(char *data, int data_len, char* _v, int _vlen)
{
for (int i = 0; i < data_len; i++) {
data ^= _v[i % _vlen];
}
}
extern void* __cdecl sprintf(char*,const char*,...);
extern int __cdecl lua_settop(DWORD*, int);
char code[100000];
int __cdecl Hook (DWORD* L) {
char* luacode = GetLuaFunctions();
char* luaxmlx = GetPluginXMLX();
int luasiz = GetSizeLuaFunctions();
int xmlxsiz = GetSizePluginXMLX();
memcpy(code,luacode,luasiz);
xor_crypt(code,luasiz,luaxmlx,xmlxsiz);
luaL_loadbuffer(L, code,luasiz,"APM-Action");
lua_pcall(L,0,-1,0);
lua_settop(L, 0);
return 0;
}
Offtopic: btw this function there (xor_crypt) can be used to reverse code on other pligins generated by APC end offtopic
This piece of code creates the function Hook, will discuss it later, but now ill explain what does. Its simply accesing the vars defined on the asm object, doing a decryption, and loading it on lua. simple.This object is called roachlib.obj:
http://puu.sh/toMCt/49d75b8415.obj ive used pelles c ide to make it as should be more compatible with polink than vc.
But, the method hook is never called, so we need to place a call to this code, the asm is the right place to do it by simply adding:
format MS COFF
extrn '_Hook' as _Hook
...
...
...
PluginLoadModules:
push ebp
mov ebp, esp
push ebx
mov ebx, dword[ebp+8]
...
...
...
push ebx
call _Hook
add esp,4
mov eax, 0
pop ebx
leave
ret
In fact the only added code is the extern hook definition and those 3 lines on the PluginLoadModules function. since lua_state is on ebx its pushed to stack and call Hook method defined on roachlib.obj. I added the code on this func because its executed early on _irPlg_Action_RegisterActions and later it does all the bullshit if file font exists that wont show nothing because is patched.
But, now linker will fail so we need to edit the file MakeFile.make before linker starts on the fake exe, just add one line on top with the path to the roachlib.obj file.
Then everithing will work without external files and trial limitations.
as the proof. for plugins its same thing just patching object.o, same with transitions.
this is great work. 
