以下是运行NOTEPAD.EXE，在01001EDD处OD中断结果：
01001ED6  |.  8B3D 48120001 MOV EDI,DWORD PTR DS:[<&USER32.CheckMenu>; |USER32.CheckMenuItem
01001EDC  |.  50            PUSH EAX                                 ; |hMenu
01001EDD  |.  FFD7          CALL EDI                                 ; \CheckMenuItem

      用VB编写的程序A(原代码见后面)在01001EDD这个地方读出 EAX 里的数值(0x9868706A)与OD中断处EAX(0x1BD9051D)不一样，请教一下问题出在哪里？
    另外程序A退出后，发现NOTEPAD.EXE仍在进程中运行（没有窗口显示），如何终止NOTEPAD.EXE运行？

'===Vbcode===
Private Sub Command1_Click()
Dim idh As IMAGE_DOS_HEADER
Dim inh As IMAGE_NT_HEADERS
Dim ish As IMAGE_SECTION_HEADER
Dim pi As PROCESS_INFORMATION
Dim si As STARTUPINFO
Dim context As CONTEXT86
Dim ImageBase As Long, ret As Long, i As Long
Dim addr As Long, lOffset As Long, addr1 As Long
si.cb = Len(si)

sTarget = "C:\WINDOWS\NOTEPAD.EXE"
CreateProcess vbNullString, sTarget, 0, 0, False, CREATE_SUSPENDED, 0, 0, si, pi
SuspendThread pi.hThread
DebugActiveProcess pi.hProcess
WaitForDebugEvent DebugEv, 10
context.ContextFlags = CONTEXT86_INTEGER
GetThreadContext pi.hThread, context
ImageBase = VirtualAllocEx(pi.hProcess, ByVal inh.OptionalHeader.ImageBase, inh.OptionalHeader.SizeOfImage, MEM_RESERVE Or MEM_COMMIT, PAGE_READWRITE)
context.Dr0 = &H1001EDC
context.Dr7 = BREAK_DR7_FLAG
SetThreadContext pi.hThread, context
rr = ReadProcessMemory(pi.hProcess, ByVal context.Eax, addr1, 4, 0)
ResumeThread pi.hThread
ContinueDebugEvent pi.hProcess, pi.hThread, dwContinueStatus
CloseHandle pi.hThread
CloseHandle pi.hProcess
Label1 = "进程:" & pi.hProcess & " 线程:" & Hex(pi.hThread) & _
  " 寄存器Eax:" & Hex(addr1) & " 读内存状态:" & rr
End Sub

Private Sub Command2_Click()
End
End Sub

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课