begin

  Result := 0;

  EnabledDebugPrivilege(True); //提升本进程权限

  Getmem(pszLibAFilename, Length(GuestFile) * 2 + 1);

  StringToWideChar(GuestFile, pszLibAFilename, Length(GuestFile) * 2 + 1);

  if PID > 0 then

     dwRemoteProcessID := PID

  else  //查找目标进程ID

     FindAProcess(HostFile, False, dwRemoteProcessID);

  //打开目标进程

hRemoteProcess:=OpenProcess(PROCESS_CREATE_THREAD+PROCESS_VM_OPERATION+PROCESS_VM_WRITE,FALSE,dwRemoteProcessId);

  cb := (1 + lstrlenW(pszLibAFilename)) * sizeof(WCHAR);

  //申请虚拟内存空间

  pszLibFileRemote := PWIDESTRING(VirtualAllocEx(hRemoteProcess, nil, cb, MEM_COMMIT, PAGE_READWRITE));

  TempVar := 0;

  //复制DLL到目标进程的内存中

  iReturnCode := WriteProcessMemory(hRemoteProcess, pszLibFileRemote, pszLibAFilename, cb, TempVar);

  if iReturnCode then

    begin

            pfnStartAddr:=GetProcAddress(GetModuleHandle('Kernel32'),'Load LibraryW');

       TempVar := 0;

       //远程线程插入

       Result := CreateRemoteThread(hRemoteProcess, nil, 0, pfnStartAddr, pszLibFileRemote, 0, TempVar);

    end;

Freemem(pszLibAFilename);

end;

远程线程插入自定义函数AttachToProcess中用了另外两个自定义函数，请读者详见本文附带源代码。