[Zorkov Igor]

Код:

function InjectLib(process_id: DWORD; lib_name: PChar): Integer;
var
  pfnRemote, premote_mem: Pointer;
  hProcess, hThread: THandle;
  mem_size: Integer;
  ret: LongBool;
  BytesWritten: DWORD;
  ThreadId: DWORD;
begin
  pfnRemote:= GetProcAddress(GetModuleHandle('Kernel32'), 'LoadLibraryA');
  if (pfnRemote = nil) then
  begin
    Result:= -1;
    Exit;
  end;
  hProcess:= OpenProcess(MAXIMUM_ALLOWED, False, process_id);
  if hProcess = 0 then
  begin
    Result:= -1;
    Exit;
  end;
  mem_size:= strlen(lib_name) + 1;
  premote_mem:= VirtualAllocEx(hProcess, nil, mem_size, MEM_COMMIT, PAGE_READWRITE);
  if (premote_mem = nil) then
  begin
    CloseHandle(hProcess);
    Result:= -1;
    Exit;
  end;
  BytesWritten:= 0;
  ret:= WriteProcessMemory(hProcess, premote_mem, lib_name, mem_size, BytesWritten);
  if (ret = false) then
  begin
    VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE);
    CloseHandle(hProcess);
    Result:= -1;
    Exit;
  end;
  ThreadId:= 0;
  hThread:= CreateRemoteThread(hProcess, nil, 0, pfnRemote, premote_mem, 0, ThreadId);
  if (hThread = 0) then
  begin
    VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE);
    CloseHandle(hProcess);
    Result:= -1;
    Exit;
  end;
  WaitForSingleObject(hThread, INFINITE);
  VirtualFreeEx(hProcess, premote_mem, 0, MEM_RELEASE);
  CloseHandle(hProcess);
  CloseHandle(hThread);
  Result:= 0;
end;

В Windows XP и ниже работает и для пользовательских процессов и для системных, в Windows Vista и выше мелкософт ограничил CreateRemoteThread только для пользовательских процессов