{delphi 注入指定进程。 }
function InjectToSpecificProcess(AProcess: string): BOOLEAN;
var
Module, NewModule: Pointer;
Size, BytesWritten, TID, PID: LongWord;
ProcessHandle: LongWord;
hRemoteThread: Cardinal;
begin
Module := Pointer(GetModuleHandle(0)); //这句偶尔会出错。获得自身模块句柄
Size := PImageOptionalHeader(Pointer(Integer(Module) +
PImageDosHeader(Module)._lfanew + SizeOf(DWORD) +
SizeOf(TImageFileHeader))).SizeOfImage;

//GetWindowThreadProcessId(FindWindow('Shell_TrayWnd', nil), @PID);
//ProcessHandle为需要注入的进程 PID
PID := GetProcessIDFromExename(AProcess);
ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, PID); //打开进程

VirtualFreeEx(ProcessHandle, Module, 0, MEM_RELEASE);
NewModule := VirtualAllocEx(ProcessHandle, Module, Size, MEM_COMMIT or
MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if NewModule <> nil then
begin
WriteProcessMemory(ProcessHandle, NewModule, Module, Size,
BytesWritten);
//远程打开进程，传递注入函数入口地址@CodeToRunAfterInjection
hRemoteThread := CreateRemoteThread(ProcessHandle, nil, 0,
@CodeToRunAfterInjection,
Module, 0, TID);
if BOOLEAN(hRemoteThread) then Result := True else Result := False;
end else
Result := False;
CloseHandle(ProcessHandle); //关闭线程句柄
end;