DWORD dwNtHeader=((PIMAGE_DOS_HEADER)pMem)->e_lfanew;
  int iSecNum = (PIMAGE_NT_HEADERS((char*)pMem + dwNtHeader))->FileHeader.NumberOfSections;
  DWORD dwFirstSecHeader = dwNtHeader + sizeof(IMAGE_NT_HEADERS);
  int k;
  DWORD codeLength,codeRVA,codeOffset,OldEntry;
  callAddress = newcode;
  endAddress = ending;
  codeLength = reinterpret_cast<DWORD>(endAddress) - reinterpret_cast<DWORD>(callAddress);
  DWORD add=(DWORD)(newcode);
  DWORD add1=(DWORD)(ending);
  codeLength=add1-add;
  for(k=0;k<iSecNum;k++)
  {
    if (((PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->Misc.VirtualSize
      -(PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->SizeOfRawData)
      >codeLength)
    {
      codeRVA = (PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->Misc.VirtualSize
        + (PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->VirtualAddress;
      codeOffset = (PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->Misc.VirtualSize
        + (PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->PointerToRawData;
      (PIMAGE_SECTION_HEADER((char*)pMem + dwFirstSecHeader + k*sizeof(IMAGE_SECTION_HEADER)))->Characteristics =0xc0000040;
      RtlMoveMemory((char*)pMem + codeOffset,callAddress,codeLength);
      OldEntry = (PIMAGE_NT_HEADERS((char*)pMem + dwNtHeader))->OptionalHeader.AddressOfEntryPoint + (PIMAGE_NT_HEADERS((char*)pMem + dwNtHeader))->OptionalHeader.ImageBase;
      (PIMAGE_NT_HEADERS((char*)pMem + dwNtHeader))->OptionalHeader.AddressOfEntryPoint = codeRVA;
      
      break;
    }

  }

AddressOfEntryPoint修改成功，我想先执行newcode，然后回到原AddressOfEntryPoint，文件改了以后，没有执行AfxMessageBox，用peid看EP区段也没有内容，怎么办？？
void newcode()
{
  AfxMessageBox("dd");
  __asm
  {
    jmp OldEntry
  }
}

void ending(int)
{
       
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课