这格式看起来好累

datalen =$-codebegin
Rproc proc msgbox
invoke MessageBox, NULL, addr szText, addr szTitle, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, NULL
Rproc endp
---------------------------------------
这个部分写入目标进程当然不行了，你看看反汇编

注意重定位

.386
.model flat,stdcall
option casemap:none

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.data
	szBuffer	dd 20 dup(0),0 
	tit		db 'Notepad',0 
	pid		dd 0 
	hProcess	dd 0 
	hThread		dd 0 
	pCodeRemote	dd 0 
	xdll_Addr	db 'user32.dll',0
	xapi_Addr	db 'MessageBoxA',0
.code

codebegin:
	call Delta
Delta:
	pop ebp
	sub ebp, offset Delta    

	push MB_OK or MB_ICONINFORMATION
	lea eax, [ebp+szCaption]
	push eax
	lea eax, [ebp+szMsg]
	push eax
	push 0
	mov eax,[ebp+MessageBoxA_Addr]
	call eax
	ret

	MessageBoxA_Addr	dd	0
	szMsg			db	"Here Is a Feuny Area !!!",0
	szCaption		db	"Demo", 0

codelen =$-codebegin

start:  
	invoke	GetModuleHandle,offset xdll_Addr;Ïîëó÷àåì îïèñàòåëü ìîäóëÿ Kernel32.dll
	invoke	GetProcAddress,eax,offset xapi_Addr
	mov	MessageBoxA_Addr,eax
	invoke	FindWindow,offset tit,0 ;・µ»ØIE´°¿Ú¾ä±ú
	invoke	GetWindowThreadProcessId,eax,offset pid ;µÃµ½IE½ø³ÌPID 

	invoke	OpenProcess,PROCESS_ALL_ACCESS,FALSE,pid ;´ò¿ª½ø³Ì,µÃµ½½ø³Ì¾ä±ú 
	mov	hProcess,eax ;±£´æ½ø³Ì¾ä±ú 

	invoke	VirtualAllocEx,hProcess,0, codelen,  MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE ;//ÉêÇë¿Õ¼ä
	mov	pCodeRemote,eax 
	invoke	WriteProcessMemory,hProcess,pCodeRemote,offset codebegin,codelen,NULL ;//дÈë²åÈëµÄ´úÂë
  
	invoke	CreateRemoteThread,hProcess,0,0,pCodeRemote,0,0,0 

	mov	hThread,eax ; ・µ»ØÏ߳̾ä±ú 
	.if hThread 
		invoke	WaitForSingleObject,hThread, INFINITE ;µÈ´ýÏ߳̽áÊø 
		invoke	CloseHandle,hThread ;¹Ø±ÕÏ߳̾ä±ú 
	.endif 
	invoke	VirtualFreeEx,hProcess,pCodeRemote,codelen,MEM_RELEASE ;ÊÍ・Å¿Õ¼ä 
	invoke	CloseHandle,hProcess ;¹Ø±Õ½ø³Ì¾ä±ú 

	invoke	ExitProcess,0 

end start

严格讲 GetModuleHandle,GetProcAddress,MessageBoxA都要在codebegin中自己找。
LINK时加“/section:.text,ERW ”，因为 MessageBoxA_Addr在.code中。

对
Rproc proc msgbox
invoke MessageBox, NULL, addr szText, addr szTitle, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, NULL
Rproc endp

不行，需要重定位，而且需要自己取得函数的地址，参数也要自己PUSH

这段代码能移植到VC下吗

搞此类代码，比较累。
一般用得成的代码在A4纸上要打印50页以上，要考虑加密、解密、隐身、ANTI-ANTIVIRUS、ANTI-DEBUGER等。

又见到楼主？

其实这样的方式是很复杂，不比下面的好：

link:/base:0x13140000 /filealign:0x200 /merge:.data=.text /section:.text,RWX /subsystem:windows /libpath:\masm32\lib

.386
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib

.data
szDesktopClass     db     'Progman',0 ;explorer.exe 的窗口类
szDesktopWindow   db     'Program Manager',0
szUser32 db 'user32.dll',0
szTitle db "Hello", 0
szText db "Hello, World", 0
.data?
hModule dd ?
hWnd dd ?
hProcess dd ?
ShellSize dd ?
Pid dd ?
Written dd ?
dwTid dd ?
.code

Shellcode proc
invoke LoadLibrary,addr szUser32
invoke MessageBox, NULL, addr szText, addr szTitle, MB_OK or MB_ICONINFORMATION
invoke ExitThread,0
ret
Shellcode endp
start:
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
invoke GetModuleHandle, 0 ;获取自身模块
mov hModule, eax ;保存句柄
mov edi, eax
assume edi:ptr IMAGE_DOS_HEADER ;对应这个结构
add edi, [edi].e_lfanew ;恢复PE头
add edi, sizeof dword
add edi, sizeof IMAGE_FILE_HEADER
assume edi:ptr IMAGE_OPTIONAL_HEADER32 ;对应这个结构
mov eax, [edi].SizeOfImage ;恢复内存影象尺寸
mov ShellSize, eax ;保存其长度字节，等待写入
assume edi:NOTHING
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
invoke FindWindow,addr szDesktopClass,addr szDesktopWindow
invoke GetWindowThreadProcessId, eax, addr Pid
invoke OpenProcess,PROCESS_CREATE_THREAD or PROCESS_VM_WRITE+\
    PROCESS_VM_OPERATION,FALSE,Pid     
mov hProcess, eax
invoke VirtualFreeEx, hProcess, hModule, 0, MEM_RELEASE
invoke VirtualAllocEx, hProcess, hModule, ShellSize, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
mov hWnd, eax
invoke WriteProcessMemory, hProcess, hWnd, hModule, ShellSize, addr Written
invoke CreateRemoteThread, hProcess, 0, 0, addr Shellcode, hModule, 0, addr dwTid
invoke ExitProcess, 0
end start

熟悉的木马注入代码