unit super;

interface
uses windows, Messages, Tlhelp32;
//----------------函数声明
function GetProcessId(strProcessName: string): Integer;   //取进程ID
function dkjc_OpenProcess_Z(nProcessID: Integer): Integer;     //打开进程
function dnczs_ReadProcessMemoryInt(nProcessId:Integer;nMemoryAddress: Pointer): Integer; //读内存整数型
//-----------------------------------------------------
implementation

function GetProcessId(strProcessName: string): Integer;
//函数名:Get Process ID
//功能:获得指定进程的ID
//参数:strProcessName*****进程名
//返回值:进程ID

var
  ProcessName: string;
  ProcessID: integer;
  ListLoop: Boolean;
  tag: Boolean;
  FsnapShotHandle: Thandle;
  FProcessEntry32: TProcessEntry32;
begin
  tag := True;
  Fsnapshothandle := CreateToolHelp32SnapShot(TH32CS_SNAPPROCESS, 0);
  FProcessEntry32.dwsize := SizeOF(FProcessEntry32);
  Listloop := Process32First(FSnapshotHandle, FProcessEntry32);
  while Listloop do 
  begin
    ProcessName := FprocessEntry32.szExeFile;
    if (ProcessName = strProcessName) then
    begin
      CloseHandle(Fsnapshothandle);
      ProcessID := FProcessEntry32.th32ProcessID;
      result := ProcessID;
      tag := False;
      Break;//跳出while 循环
    end;
    ListLoop := Process32Next(FSnapshotHandle, FprocessEntry32);
  end;
  if (tag) then
  begin
    CloseHandle(Fsnapshothandle);
    result := 0;
  end;
end;

function dkjc_OpenProcess_Z(nProcessID: Integer): Integer;
//函数名:Open Process _Z
//功能:打开指定ID的进程并返回操作句柄
//参数:nProcessID*****进程ID
//返回值:操作句柄
begin
  result := OpenProcess(PROCESS_ALL_ACCESS, false, nProcessID);
end;

function dnczs_ReadProcessMemoryInt(nProcessId:Integer;nMemoryAddress: Pointer): Integer;
//函数名:ReadProcessMemoryInt
//功能:打读取内存整数型 返回 如果读取失败就返回-1
//参数:nprocessId:进程ID  ,  nMemoryAddress:读取地址
//返回值:指定内存地址的内容
//调用例子:dnczs_ReadProcessMemoryInt(nA,Pointer($486150));
var
  nTem: Integer;
  nThreadHandle: Integer;
  a: Boolean;
  readByte: DWORD;
begin
  nThreadHandle := dkjc_OpenProcess_Z(nProcessId);
  a:= ReadProcessMemory(nThreadHandle, nMemoryAddress, @nTem, 4, readByte);
  CloseHandle(nThreadHandle);
  if  a then
  begin
     Result := nTem;
  end
  else
  begin
     Result := -1;
  end;
end;
end.

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls,super,ShellAPI;

type
  TForm1 = class(TForm)
    btn1: TButton;
    edt1: TEdit;
    lbl1: TLabel;
    lbl2: TLabel;
    procedure btn1Click(Sender: TObject);
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}
function GetProcAddress(a: integer; b: string): Integer; stdcall; external 'kernel32.dll'
var
 b: array[1..3] of byte = ($C2, $10, $0);
procedure TForm1.btn1Click(Sender: TObject);
var
  pid:Integer;
  openId:Integer;
  WriteByte: DWORD;
  c: Integer;
begin
  pid := GetProcessId(edt1.Text);
  if (pid = 0) then
  begin
    ShowMessage('找不到您输入的进程!');
    Exit;
  end;
  openId :=  dkjc_OpenProcess_Z(pid);

  if (openId = 0) then
  begin
    ShowMessage('打开进程失败!');
    Exit;
  end;

  //ShowMessage(inttostr(pid));
 //ShowMessage(inttostr(openId));
  c :=  GetModuleHandle('user32.dll');
  c := GetProcAddress(c, 'SetWindowsHookExA');
  if (c = 0) then
  begin
    ShowMessage('获取函数地址失败!');
    Exit;
  end;
  // ShowMessage(inttostr(c));

  WriteProcessMemory(openId,Pointer(c), @b[1], 3, WriteByte);
  ShowMessage('OK,广播开始后,右键点全屏幕显示,退出全屏!');
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
    ShellExecute(Handle,'open','http://user.qzone.qq.com/xxxxxx/blog/1371965742',nil,nil,SW_SHOWNORMAL)
end;

end.