下面是代码（部分为伪代码）

//shellcode
ULONG_PTR WINAPI MemoryLoadLibrary_Begin(INJECTPARAM* InjectParam) {
printf("InjectParam->dwDataLength:%d\r\n", InjectParam->dwDataLength);
return 0;
}

//用于辅助计算shellcode长度
void MemoryLoadLibrary_End()
{printf("MemoryLoadLibrary_End\r\n");
}

//执行这个函数向目标进程注入shellcode
void InjectDll::RemoteMapLoadDll(HANDLE TargetProcess)
{
SIZE_T dwWrited = 0;
//初始化参数结构体
INJECTPARAM InjectParam;
RtlZeroMemory(&InjectParam, sizeof(InjectParam));

//shellcode长度
DWORD ShellCodeSize = (ULONG_PTR)MemoryLoadLibrary_End - (ULONG_PTR)MemoryLoadLibrary_Begin;

//拷贝ShellCode代码
PVOID pShellCodeBuffer = malloc(ShellCodeSize);
RtlCopyMemory(pShellCodeBuffer, MemoryLoadLibrary_Begin, ShellCodeSize);

//结构体参数赋值
InjectParam.dwDataLength = 0x1000;

////申请内存,把Shellcode和参数复制到目标进程
////安全起见,大小多加0x100
PBYTE pStartAddress = (PBYTE)VirtualAllocEx(TargetProcess, 0, ShellCodeSize +0x100+ sizeof(InjectParam), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
//结构体参数赋值
InjectParam.lpFileData = pStartAddress;

//写入ShellCode
PBYTE ShellCodeAddress = pStartAddress;
WriteProcessMemory(TargetProcess,ShellCodeAddress,pShellCodeBuffer, ShellCodeSize, &dwWrited);

//写入参数
PBYTE ShellCodeParamAddress = pStartAddress + 0x100 + ShellCodeSize;
WriteProcessMemory(TargetProcess, ShellCodeParamAddress, &InjectParam, sizeof(InjectParam), &dwWrited);

HANDLE hRemoteThread = CreateRemoteThread(TargetProcess, 0, 0, (LPTHREAD_START_ROUTINE)ShellCodeAddress, ShellCodeParamAddress, 0, 0);

//关闭资源...
}

[课程]Android-CTF解题方法汇总！