program Injector;

uses
  shellapi,
  Windows;

type
  TInject = packed record
    PushLoadLibraryCommand: BYTE;
    LoadLibraryArg: DWORD;
    CallLoadLibrary: word;
    CallLoadLibraryAddr: DWORD;
    PushExitThread: BYTE;
    ExitThreadArg: DWORD;
    CallExitThread: word;
    CallExitThreadAddr: DWORD;
    AddrLoadLibrary: pointer;
    AddrExitThread: pointer;
    LibraryName: array [0 .. MAX_PATH] of Char;
  end;

{$R *.res}

  { Внедрение Dll в процесс }
function InjectDll(Process: DWORD; ModulePath: PChar): boolean;
  function Offset(struct, field: pointer): cardinal;
  begin
    Result := cardinal(field) - cardinal(struct);
  end;

var
  Memory: pointer;
  Code: DWORD;
  BytesWritten: DWORD;
  ThreadId: DWORD;
  hThread: DWORD;
  hKernel32: DWORD;
  Inject: TInject;
begin
  Result := false;
  Memory := VirtualAllocEx(Process, nil, sizeof(Inject), MEM_TOP_DOWN or MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  if Memory = nil then
    Exit;

  Code := DWORD(Memory);
  // инициализация внедряемого кода:
  FillChar(Inject, sizeof(Inject), 0);

  Inject.PushLoadLibraryCommand := $68;
  Inject.LoadLibraryArg := Code + Offset(@Inject, @Inject.LibraryName);
  Inject.CallLoadLibrary := $15FF;
  Inject.CallLoadLibraryAddr := Code + Offset(@Inject, @Inject.AddrLoadLibrary);

  Inject.PushExitThread := $68;
  Inject.ExitThreadArg := 0;
  Inject.CallExitThread := $15FF;
  Inject.CallExitThreadAddr := Code + Offset(@Inject, @Inject.AddrExitThread);

  hKernel32 := GetModuleHandle('kernel32.dll');
  Inject.AddrLoadLibrary := GetProcAddress(hKernel32, 'LoadLibraryW');
  Inject.AddrExitThread := GetProcAddress(hKernel32, 'ExitThread');
  lstrcpy(@Inject.LibraryName, ModulePath);
  // записать машинный код по зарезервированному адресу
  WriteProcessMemory(Process, Memory, @Inject, SIZE_T(sizeof(Inject)), SIZE_T(BytesWritten));
  // выполнить машинный код
  hThread := CreateRemoteThread(Process, nil, 0, Memory, nil, 0, ThreadId);
  if hThread = 0 then
    Exit;
  WaitForSingleObject(hThread, INFINITE);
  CloseHandle(hThread);
  VirtualFreeEx(Process, Memory, 0, MEM_RELEASE);
  // надо-надо умываться по утрам и вечерам
  Result := True;
end;

procedure StartHook;
var
  ShellInfo: SHELLEXECUTEINFO;
begin
  FillChar(ShellInfo, sizeof(ShellInfo), 0);
  ShellInfo.cbSize := sizeof(ShellInfo);
  ShellInfo.lpFile := PChar('hoockedexe.exe');
  ShellInfo.nShow := SW_NORMAL;
  ShellInfo.fMask := SEE_MASK_NOCLOSEPROCESS;
  ShellExecuteEx(@ShellInfo);
  InjectDll(ShellInfo.hProcess, 'inject.dll');
end;

begin
  StartHook;

end.