Вызов процедуры из инжектированной DLL

unit Unit1;
 
interface
 
uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms,
  Dialogs, TlHelp32, Buttons, StdCtrls, jpeg, ExtCtrls, sSkinManager,
  sEdit, sGauge, sButton, sLabel, ComCtrls, sTrackBar, sPanel, sSpeedButton,
  sStatusBar;
 
type
  TForm1 = class(TForm)
    OpenDialog1: TOpenDialog;
    sSkinManager1: TsSkinManager;
    sButton2: TsButton;
    sButton1: TsButton;
    Button1: TsButton;
    sEdit1: TsEdit;
    Edit1: TsEdit;
    Edit2: TsEdit;
    sStatusBar1: TsStatusBar;
    procedure sButton1Click(Sender: TObject);
    procedure sButton2Click(Sender: TObject);
    procedure Button1Click(Sender: TObject);
 
  private
    { Private declarations }
  public
    { Public declarations }
  end;
 
var
  Form1: TForm1;
 
implementation
 
{$R *.dfm}
 
function GetOSVersion: Cardinal;
var
  OSVersionInfo: TOSVersionInfo;
begin
  Result := 0;
  FillChar(OSVersionInfo, Sizeof(OSVersionInfo), 0);
  OSVersionInfo.dwOSVersionInfoSize := SizeOf(OSVersionInfo);
  if GetVersionEx(OSVersionInfo) then
  begin
    if OSVersionInfo.dwPlatformId = VER_PLATFORM_WIN32_NT then
    begin
      if OSVersionInfo.dwMajorVersion = 5 then
      begin
        if OSVersionInfo.dwMinorVersion = 0 then
          Result := 50//Windows 2000
        else if OSVersionInfo.dwMinorVersion = 2 then
          Result := 52//Windows 2003
        else if OSVersionInfo.dwMinorVersion = 1 then
          Result := 51//Windows XP
      end;
      if OSVersionInfo.dwMajorVersion = 6 then
      begin
        if OSVersionInfo.dwMinorVersion = 0 then
          Result := 60//Windows Vista
        else if OSVersionInfo.dwMinorVersion = 1 then
          Result := 61;//Windows 7
      end;
    end;
  end;
end;
 
 
 
function ModulInjectByDen(ModulePath: PAnsiChar; ProcessID: DWORD): Boolean;
var
  hSnapshot: THandle;
  ModuleEntry32: TModuleEntry32;
begin
  Result := False;
  hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID);
  if (hSnapshot <> -1) then
  begin
    ModuleEntry32.dwSize := SizeOf(TModuleEntry32);
    if (Module32First(hSnapshot, ModuleEntry32)) then
      repeat
        if string(ModuleEntry32.szExePath) = string(ModulePath) then
        begin
          Result := True;
          Break;
        end;
      until
        not Module32Next(hSnapshot, ModuleEntry32);
    CloseHandle(hSnapshot);
  end;
end;
 
function InjectIDMetod(ModulePath: PAnsiChar; ProcessID: DWORD): Boolean;
type
  TNtCreateThreadEx = function(
  ThreadHandle: PHANDLE;
  DesiredAccess: ACCESS_MASK;
  ObjectAttributes: Pointer;
  ProcessHandle: THANDLE;
  lpStartAddress: Pointer;
  lpParameter: Pointer;
  CreateSuspended: BOOL;
  dwStackSize: DWORD;
  Unknown1: Pointer;
  Unknown2: Pointer;
  Unknown3: Pointer): HRESULT; stdcall;
var
  lpStartAddress, lpParameter: Pointer;
  dwSize: Integer;
  hProcess, hThread, lpThreadId, lpExitCode, lpBytesWritten: Cardinal;
  NtCreateThreadEx: TNtCreateThreadEx;
begin
  Result := False;
  if ModulInjectByDen(ModulePath, ProcessID) = True then
    Exit;
  hProcess := 0;
  hProcess := OpenProcess(MAXIMUM_ALLOWED, False, ProcessID);
  if hProcess = 0 then
    Exit;
  dwSize := StrLen(ModulePath) + 1;
  lpParameter := VirtualAllocEx(hProcess, nil, dwSize, MEM_COMMIT, PAGE_READWRITE);
  if (lpParameter = nil) then
  begin
    if hProcess <> 0 then
      CloseHandle(hProcess);
    Exit;
  end;
  if GetOSVersion >= 60 then
    NtCreateThreadEx := GetProcAddress(GetModuleHandleW('ntdll'), 'NtCreateThreadEx');
  lpStartAddress := GetProcAddress(GetModuleHandleW('kernel32'), 'LoadLibraryA');
  if (lpStartAddress = nil) then
    Exit;
  if GetOSVersion >= 60 then
    if (@NtCreateThreadEx = nil) then
      Exit;
  lpBytesWritten := 0;
  if (WriteProcessMemory(hProcess, lpParameter, ModulePath, dwSize, lpBytesWritten) = False) then
  begin
    VirtualFreeEx(hProcess, lpParameter, 0, MEM_RELEASE);
    if hProcess <> 0 then
      CloseHandle(hProcess);
    Exit;
  end;
  hThread := 0;
  lpThreadId := 0;
  if GetOSVersion >= 60 then
    NtCreateThreadEx(@hThread, MAXIMUM_ALLOWED, nil, hProcess, lpStartAddress, lpParameter, false, 0, 0, 0, 0)
  else
    hThread := CreateRemoteThread(hProcess, nil, 0, lpStartAddress, lpParameter, 0, lpThreadId);
  if (hThread = 0) then
  begin
    VirtualFreeEx(hProcess, lpParameter, 0, MEM_RELEASE);
    CloseHandle(hProcess);
    Exit;
  end;
  GetExitCodeThread(hThread, lpExitCode);
  if hProcess <> 0 then
    CloseHandle(hProcess);
  if hThread <> 0 then
    CloseHandle(hThread);
  Result := True;
end;
 
 
procedure TForm1.sButton2Click(Sender: TObject);
var
  hSnap:THandle;
  pe:TProcessEntry32;
begin
 pe.dwSize:=SizeOf(pe);
 hSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
  If Process32First(hSnap,pe) then
    While Process32Next(hSnap,pe) do
      if ExtractFileName(pe.szExeFile)='MP.exe' then
     edit2.Text:=IntToStr(pe.th32ProcessID);
     end;
 
procedure TForm1.sButton1Click(Sender: TObject);
begin
  if OpenDialog1.Execute then
    Edit1.Text:= OpenDialog1.FileName;
end;
 
procedure TForm1.Button1Click(Sender: TObject);
begin
 
  InjectIDMetod(PAnsiChar(Edit1.Text), StrToInt(Edit2.Text));
end;
 
end.