1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:

function TForm1.InjectIntoProcess(lpProcessID: Cardinal; lpDllname: String):Boolean;
var
  hProc: Cardinal;
  oAlloc: Pointer;
  cWPM: Cardinal;
  hRemThread: Cardinal;
begin
  result := false;
  SetLastError(ERROR_SUCCESS);
  hProc := OpenProcess(PROCESS_ALL_ACCESS, false, lpProcessID);
  if hProc <> 0 then
  begin
    oAlloc := VirtualAllocEx(hProc, nil, length(lpDllname), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if oAlloc <> nil then
    begin
      if WriteProcessMemory(hProc, oAlloc, PChar(lpDllName), length(lpDllName), cWPM) = true then
      begin
        CreateRemoteThread(hProc, nil, 0, GetProcAddress(GetModuleHandle('kernel32.dll'), 'LoadLibraryA'), oAlloc, 0, hRemThread);
        if GetLastError = ERROR_SUCCESS then
        begin
          result := true;
        end;
      end;
    end;
  end;
  CloseHandle(hProc);
end;                    

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:

procedure TForm1.Button2Click(Sender: TObject);
var
  psnap,msnap: THandle;
  pe32: TProcessEntry32;
  me32: TModuleEntry32;

  buffer: Array [0..255] of Byte;
  readbytes: Cardinal;

  foundp: Boolean;
begin
  psnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
  pe32.dwSize := SizeOf(pe32);

  foundp:=false;

  if Process32First(psnap,pe32)=true then begin
    while Process32Next(psnap,pe32) do
      if LowerCase(pe32.szExeFile)='programmname.exe' then begin
        foundp:=true;
        break;
      end;
    CloseHandle(psnap);

    if foundp=true then begin
      me32.dwSize:=sizeof(me32);
      msnap:=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pe32.th32ProcessID);
      if Module32First(msnap,me32)=true then begin
        while Module32Next(msnap,me32)=true do begin
          if lowercase(me32.szModule)='dllname.dll' then begin

//an dieser stelle ist oder sollte in me32.modBaseAddr die basis adresse der "dllname.dll" sein die im prozess "programmname.exe" läuft

            break;
          end;
        end;
        CloseHandle(msnap);
      end;
    end;
  end;
end;                    

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:

program test;

uses
  Windows, Sysutils;

{$APPTYPE CONSOLE}

function InjectIntoProcess(lpProcessID: Cardinal; lpDllname: String): DWord;
var
  pWriteProcessMemory: function(hProcess: THandle; const lpBaseAddress: Pointer; lpBuffer: Pointer;
    nSize: DWORD; var lpNumberOfBytesWritten: DWORD): BOOL; stdcall;

  pCreateRemoteThread: function(hProcess: THandle; lpThreadAttributes: Pointer;
    dwStackSize: DWORD; lpStartAddress: TFNThreadStartRoutine; lpParameter: Pointer;
    dwCreationFlags: DWORD; var lpThreadId: DWORD): THandle; stdcall;

  pLoadLibraryA: function(lpLibFileName: PAnsiChar): HMODULE; stdcall;

  hProc: Cardinal;
  oAlloc: Pointer;
  cWPM: Cardinal;
  hRemThread: Cardinal;
  hThreadHandle: Cardinal;
  Modulhandle: Cardinal;

  hKernelhandle: Cardinal;
begin
  Result := 0;
  hKernelHandle := GetModuleHandle('kernel32.dll');
  if hKernelHandle <> 0 then
  begin
    pWriteProcessMemory := GetProcAddress(hKernelHandle, 'WriteProcessMemory');
    pCreateRemoteThread := GetProcAddress(hKernelHandle, 'CreateRemoteThread');
    pLoadLibraryA := GetProcAddress(hKernelHandle, 'LoadLibraryA');
    if (@pWriteProcessMemory <> nil) and (@pCreateRemoteThread <> nil) and (@pLoadLibraryA <> nil) then
    begin
      hProc := OpenProcess(PROCESS_ALL_ACCESS, false, lpProcessID);
      if hProc <> 0 then
      begin
        oAlloc := VirtualAllocEx(hProc, nil, length(lpDllname)+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        if oAlloc <> nil then
        begin
          if pWriteProcessMemory(hProc, oAlloc, PChar(lpDllName), length(lpDllName), cWPM) then
          begin
            hThreadHandle := pCreateRemoteThread(hProc, nil, 0, @pLoadLibraryA, oAlloc, 0, hRemThread);
            if hThreadhandle <> 0 then
            begin
              WaitForSingleObject(hThreadhandle, INFINITE);
              VirtualFreeEx(hProc, oAlloc, 0, MEM_RELEASE);
              if GetExitCodeThread(hThreadHandle, ModulHandle) then
                Result := ModulHandle;
              CloseHandle(hThreadHandle);
            end;
          end;
        end;
        CloseHandle(hProc);
      end;
    end;
  end;
end;

begin
  Writeln(IntToHex(InjectIntoProcess(GetCurrentProcessID, 'opengl32.dll'),8));
  Writeln(IntToHex(GetModuleHandle('opengl32.dll'), 8));
  readLn;
end.