创建了一个CREATE_SUSPENDED的傀儡进程，用幕后进程替换了傀儡进程之后报错0xc0000005，弄了好几天也没弄懂，我裂开了，哪位大侠路过帮帮忙

WIN7 x64系统，vs2017 x86编译器，两个进程都是32位进程。

typedef NTSYSAPI NTSTATUS(__stdcall *ZwUnmapViewOfSection)(HANDLE, PVOID);
int main()
{
//加载ZwUnmapViewOfSection函数
HMODULE hModule = GetModuleHandle(L"ntdll.dll");
if (hModule == NULL)
    return FALSE;
    ZwUnmapViewOfSection UnmapViewOfSection =  (ZwUnmapViewOfSection)GetProcAddress(hModule, "ZwUnmapViewOfSection");

//将幕后进程读取到缓存
FILE* pFile = NULL;

_wfopen_s(&pFile, filePath1, L"rb");
if (pFile == NULL) 
{
    MessageBox(0, L"fopen_s fail", 0, MB_OK);
    return (INT_PTR)TRUE;
}

fseek(pFile, 0, SEEK_END);                            
DWORD szFile = ftell(pFile);                        
fseek(pFile, 0, SEEK_SET);                            

BYTE* pFileBuffer = (BYTE*)malloc(szFile);        
fread(pFileBuffer, szFile, 1, pFile);    
fclose(pFile);

//幕后进程的头信息
PIMAGE_DOS_HEADER pDosH = (PIMAGE_DOS_HEADER)pFileBuffer;
PIMAGE_FILE_HEADER pFileH = (PIMAGE_FILE_HEADER)((BYTE*)pDosH + pDosH->e_lfanew + 4);
PIMAGE_OPTIONAL_HEADER pOptH = (PIMAGE_OPTIONAL_HEADER)((BYTE*)pFileH + IMAGE_SIZEOF_FILE_HEADER);
PIMAGE_SECTION_HEADER pSectionH = (PIMAGE_SECTION_HEADER)((BYTE*)pOptH + pFileH->SizeOfOptionalHeader);

PROCESS_INFORMATION pi = { 0 };
STARTUPINFO si = { 0 };
si.cb = sizeof(STARTUPINFO);
BOOL created = CreateProcess(filePath3, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
int err;
if (!created) {
    err = GetLastError();
    return 0;
}

CONTEXT context = { 0 };
context.ContextFlags = CONTEXT_FULL;
GetThreadContext(pi.hThread, &context);

//从线程上下获取取基址
SIZE_T read;
DWORD oldBase;
bool hasRead = ReadProcessMemory(pi.hProcess, (PDWORD)(context.Ebx + 0X8), &oldBase, sizeof(DWORD), &read);
if (!hasRead) {
    return 0;
}

//卸载傀儡进程镜像
NTSTATUS flag = UnmapViewOfSection(pi.hProcess, (BYTE*)oldBase);
if (flag < 0) {
    return 0;
}

//申请虚拟空间的内存
LPVOID addrExe = VirtualAllocEx(pi.hProcess, (LPVOID)pOptH->ImageBase,
    pOptH->SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

if (addrExe == NULL) {
    return 0;
}

//替换傀儡进程
SIZE_T written;
bool isOk = FALSE;
//头部分
isOk = WriteProcessMemory(pi.hProcess, (LPVOID)addrExe, pFileBuffer, pOptH->SizeOfHeaders, &written);
//节部分
for (int i = 0; i < pFileH->NumberOfSections; i++) {
    isOk = WriteProcessMemory(pi.hProcess,
                                (LPVOID)((BYTE*)addrExe + pSectionH[i].VirtualAddress), 
                                pFileBuffer + pSectionH[i].PointerToRawData, 
                                pSectionH[i].SizeOfRawData, 
                                &written);
}

//修改线程上下文
DWORD imageBase = (DWORD)addrExe;
context.Eax = imageBase + pOptH->AddressOfEntryPoint;
WriteProcessMemory(pi.hProcess, (PDWORD)(context.Ebx + 0X8), &imageBase, sizeof(DWORD), &written);
SetThreadContext(pi.hProcess, &context);

ResumeThread(pi.hThread);
return 0;
}

1.调用Nt/ZwUnmapViewOfSection（）卸载镜像会报错

2.不卸载镜像，在空闲内存插入别的进程然后修改重定位表显示停止工作

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法