想实现一个将其他文件加载到自己的进程并执行。思路是将自己文件的IMAGEBASE设置到较高的地址，然后将文件按照运行时的格式贴到自己的进程空间的低地址，最后跳转到低地址的入口点开始执行，但是不知道最后一步要怎么跳转到入口点执行。我的方法是定义一个函数指针，用函数指针指向一个地址，但是最后报错，希望大佬进来帮忙看看，万分感谢！！！

#include <Windows.h>
#include <iostream>
#include <fstream>
using namespace std;

void (*Entry)(void);

#pragma pack(push, 1)
typedef struct _THUNK {
    DWORD data : 31;
    DWORD flag : 1;
}THUNK, *PTHUNK;
#pragma pack(pop)

DWORD r2f(LPBYTE buffer, DWORD rva);

int main()
{
    //读取文件
    ifstream infile("c:/a.exe", ios::in | ios::binary);
    if (!infile.is_open()) {
        cout << "文件打开失败" << endl;
        return 0;
    }
    infile.seekg(0, ios::end);
    int fileSize = infile.tellg();
    infile.seekg(0, ios::beg);
    char* buffer = new char[fileSize];
    ZeroMemory(buffer, fileSize);
    infile.read(buffer, fileSize);
    infile.close();


    //缓冲区拉伸拷贝到指定空间
    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)buffer;
    PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)(buffer + pDosHeader->e_lfanew);
    PIMAGE_SECTION_HEADER pSecHeader = (PIMAGE_SECTION_HEADER)((PBYTE)&pNtHeader->OptionalHeader + pNtHeader->FileHeader.SizeOfOptionalHeader);
    //需要的简写
    DWORD sizeOfImage = pNtHeader->OptionalHeader.SizeOfImage;
    DWORD sizeOfHeader = pNtHeader->OptionalHeader.SizeOfHeaders;
    DWORD numOfSec = pNtHeader->FileHeader.NumberOfSections;

    DWORD ipAddr = 0x00400000;
    DWORD entryPoint = ipAddr + pNtHeader->OptionalHeader.AddressOfEntryPoint;
    LPVOID newAddress = VirtualAlloc((LPVOID)ipAddr, sizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (newAddress == NULL) {
        cout << "内存空间申请失败" << endl;
        delete[] buffer;
        return 0;
    }
    ZeroMemory((LPVOID)ipAddr, sizeOfImage);
    memcpy((LPVOID)ipAddr, buffer, sizeOfHeader);
    //循环拷贝节
    for (UINT i = 0; i < numOfSec; i++) {
        memcpy((LPVOID)(ipAddr + pSecHeader[i].VirtualAddress),
            buffer + pSecHeader[i].PointerToRawData, 
                pSecHeader[i].SizeOfRawData);
    }

    //修复IAT表
    //先找到导入表
    PIMAGE_DATA_DIRECTORY pdd;
    pdd = &pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
    PIMAGE_IMPORT_DESCRIPTOR pid = (PIMAGE_IMPORT_DESCRIPTOR)(buffer + r2f((LPBYTE)buffer, pdd->VirtualAddress));
    //遍历导入表
    while (!(pid->OriginalFirstThunk == 0 && pid->FirstThunk == 0)) {
        //判断INT表中的值是名字还是编号
        //找到INT表首地址
        PDWORD pINT = (PDWORD)(buffer + r2f((LPBYTE)buffer, pid->OriginalFirstThunk));
        //找到IAT表首地址
        PDWORD pIAT = (PDWORD)(buffer + r2f((LPBYTE)buffer, pid->FirstThunk));
        for (int i = 0; *(pINT + i) != 0; i++) {
            if (((PTHUNK)(pINT + i))->flag == 0) {
                //是名字，创建BYNAME结构获取地址
                PIMAGE_IMPORT_BY_NAME pByName = (PIMAGE_IMPORT_BY_NAME)(buffer + r2f((LPBYTE)buffer, ((PTHUNK)(pINT + i))->data));
                /*DWORD tmp = (DWORD)(buffer + r2f((LPBYTE)buffer, pid->Name));
                cout << hex << tmp << endl;*/
                HANDLE hProcHandle = GetProcAddress(LoadLibraryA((buffer + r2f((LPBYTE)buffer, pid->Name))), pByName->Name);
                //给IAT赋值
                *(pIAT + i) = (DWORD)hProcHandle;
            }
            else {
                HANDLE hProcHandle = GetProcAddress(LoadLibraryA((buffer + r2f((LPBYTE)buffer, pid->Name))), (LPCSTR)((PTHUNK)(pINT + i))->data);
                *(pIAT + i) = (DWORD)hProcHandle;
            }
        }
        pid++;
    }

    //跳转到入口点开始执行
    Entry = (void (*)())(entryPoint);
    Entry();

    //释放内存
    delete[] buffer;
    return 0;
}

DWORD r2f(LPBYTE buffer, DWORD rva) {
    //从缓冲区获取节的信息
    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)buffer;
    PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)(buffer + pDosHeader->e_lfanew);
    PIMAGE_SECTION_HEADER pSecHeader = (PIMAGE_SECTION_HEADER)((PBYTE)&pNtHeader->OptionalHeader + pNtHeader->FileHeader.SizeOfOptionalHeader);

    //判断越界
    if (rva > pSecHeader[pNtHeader->FileHeader.NumberOfSections - 1].VirtualAddress +
        max(pSecHeader[pNtHeader->FileHeader.NumberOfSections - 1].Misc.VirtualSize,
            pSecHeader[pNtHeader->FileHeader.NumberOfSections - 1].SizeOfRawData))
        return 0xFFFFFFFF;
    if (rva < pNtHeader->OptionalHeader.SizeOfHeaders) return rva;
    //判断文件在第几个节
    UINT i = 0;
    for (; i < pNtHeader->FileHeader.NumberOfSections; i++) {
        if (rva >= pSecHeader[i].VirtualAddress &&
            rva < pSecHeader[i].VirtualAddress + max(pSecHeader[i].SizeOfRawData, pSecHeader[i].Misc.VirtualSize)) {
            break;
        }
    }
    return pSecHeader[i].PointerToRawData + rva - pSecHeader[i].VirtualAddress;
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)