本人学习滴水的远程线程注入的第二块内存写入式注入，但是再练习过程中发现代码出现问题，自己经过练习，发现无法解决，是在不会，如果有做过这个练习的同学，求指点一下，多谢了，（练习是滴水三期的练习）
自己研究两三天，却还是不会，特别恳请做出这个练习的同学能指点一下，万分感谢！！！！
练习的题目如图:

自己写的代码如下:
BOOL writemem(HWND hdlg)
{
HWND wen1;
HWND wen2;
DWORD pid;
HMODULE hdllname=NULL;
DWORD dllcode=0;
//获得注入文件路径
TCHAR buffer[30];
memset(buffer,0,30);
wen1=GetDlgItem(hdlg,IDC_EDIT1);
wen2=GetDlgItem(hdlg,IDC_EDIT2);
GetWindowText(wen2,buffer,30);
void pfilebuffer=NULL;
peread(buffer,&pfilebuffer);
if(!pfilebuffer)
{
return FALSE;
}
PIMAGE_DOS_HEADER pdos=NULL;
PIMAGE_FILE_HEADER pfile=NULL;
PIMAGE_OPTIONAL_HEADER32 poptional=NULL;
PIMAGE_DATA_DIRECTORY pdata=NULL;
PIMAGE_BASE_RELOCATION pbase=NULL;
pdos=(PIMAGE_DOS_HEADER)pfilebuffer;
pfile=(PIMAGE_FILE_HEADER)((DWORD)pfilebuffer+pdos->e_lfanew+4);
poptional=(PIMAGE_OPTIONAL_HEADER32)((DWORD)pfile+20);
pdata=(PIMAGE_DATA_DIRECTORY)((DWORD)poptional+96);
pbase=(PIMAGE_BASE_RELOCATION)((DWORD)pfilebuffer+rvatofoa(pfilebuffer,(pdata+5)->VirtualAddress));
DWORD sizeofimage=poptional->SizeOfImage;
//打开注入进程
memset(buffer,0,30);
GetWindowText(wen1,buffer,30);
sscanf(buffer,"%d",&pid);
HANDLE hproc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);
char mem=(char)VirtualAllocEx(hproc,NULL,sizeofimage,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
//修复重定位表
DWORD oldimagebase=poptional->ImageBase;
poptional->ImageBase=(DWORD)mem;
while(pbase->SizeOfBlock && pbase->VirtualAddress)
{
PWORD pnum=(PWORD)((DWORD)pbase+8);
for(DWORD i=0;i<((pbase->SizeOfBlock)-8)/2;i++)
{
WORD low=pnum[i]&0x0fff;
WORD hig=(pnum[i]&0xf000)>>12;
if(hig==3)
{
DWORD rva=(DWORD)low+pbase->VirtualAddress;
//修改重定位地址
PDWORD offset=(PDWORD)((DWORD)pfilebuffer+rvatofoa(pfilebuffer,rva)); offset=*offset-oldimagebase+poptional->ImageBase;
}
}
pbase=(PIMAGE_BASE_RELOCATION)((DWORD)pbase+pbase->SizeOfBlock);
}
WriteProcessMemory(hproc,mem,pfilebuffer,sizeofimage,0);
free(pfilebuffer);
HANDLE thread=CreateRemoteThread(hproc,NULL,0,(LPTHREAD_START_ROUTINE)mem,0,0,NULL);
if (!thread)
{
VirtualFreeEx(hproc,mem,0,MEM_RELEASE);
CloseHandle(hproc);
return FALSE;
}
WaitForSingleObject(thread,-1);
GetExitCodeThread(thread,&dllcode);
hdllname=(HMODULE)dllcode;
VirtualFreeEx(hproc,mem,sizeofimage,MEM_DECOMMIT);
CloseHandle(hproc);
return TRUE;
}
错误的提示截图:

[培训]《安卓高级研修班(网课)》月薪三万计划，掌 握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法