程序代码：

function MySpyFn(param:Pointer):integer;stdcall;
var
  pInParam: pInjetionParam;
  ItemNum,I,Ret: Integer;
begin
  pInParam:= pInjetionParam(param);

  ItemNum:= pInparam.GetFun(pInparam.TagWnd,LB_GETCOUNT,0,0);
  for I:= 0 to ItemNum - 1 do
  begin
     pInparam.GetFun(pInparam.TagWnd,LB_GETTEXTLEN,
      I,0);
    Ret:= pInparam.GetFun(pInparam.TagWnd,LB_GETTEXT,I,
      Integer(@));
    if Ret <> LB_ERR then
    begin
       3737;
       @(,WM_COPYDATA,0,
        Integer(@));
    end;
  end;

  Result:= 1;
end;

程序代码：

function TForm1.InjetionCode(TagProcessHand: THANDLE; pCode:Pointer;
  param: Pointer): BOOL;
var
  InjetionCodeLength: DWORD;
  CodeAddress: Pointer;
  ParamAddress: Pointer;
  WriteByte: DWORD;
  Tid: THandle;
begin
  Result:= False;
  InjetionCodeLength:= DWORD(@TForm1.btn1Click) - DWORD(@MySpyFn);

  CodeAddress:= VirtualAllocEx(TagProcessHand,Nil,
    InjetionCodeLength + SizeOf(InjetionParam) + SizeOf(Integer), MEM_COMMIT,
    PAGE_EXECUTE_READWRITE);

  if CodeAddress = nil then
    Exit;

  if not WriteProcessMemory(TagProcessHand, CodeAddress, pCode,
    InjetionCodeLength, WriteByte) then
  begin
    VirtualFreeEx(TagProcessHand,CodeAddress,0,MEM_DECOMMIT);
    Exit;
  end;

  ParamAddress:= PChar(CodeAddress) + InjetionCodeLength;
  ParamAddress:= Pointer(Integer(ParamAddress) and (not 3));

  if not WriteProcessMemory(TagProcessHand,ParamAddress,param,
    SizeOf(InjetionParam),WriteByte) then
  begin
    VirtualFreeEx(TagProcessHand,CodeAddress,0,MEM_DECOMMIT);
    Exit;
  end;

  FTagRomtThread:= CreateRemoteThread(TagProcessHand,Nil,0,
    CodeAddress,ParamAddress,0,Tid);

  FRmoteAllocMemory:= CodeAddress;

  Result:= True;
end;