C语言加壳为什么修改CONTEXT之后恢复线程时程序还是会崩溃?求大佬指点

Question

_IMAGE Image;
LPVOID pFunction;
DWORD dwBaseAdress;
CONTEXT Context = { 0 };
CHAR StrName[] = "C:/notepad.exe";
CHAR FileName[] = "C:/notepad.exe";
PCHAR FileBuffer = NULL;
PCHAR ImageBuffer = NULL;
STARTUPINFO si;
PROCESS_INFORMATION Shell_pi;
memset(&si, 0, sizeof(STARTUPINFO));
si.cb = sizeof(STARTUPINFO);
Image = GetOpen(FileName, &FileBuffer);//打开文件并获取文件数据
//Step1:获取自身数据

//Step2:获取自身被增加节数据

//Step3:取出增加的数据
//Step4:解密增加的数据
//Step5:拉伸数据
FileBufferToImageBuffer(FileBuffer, &ImageBuffer);//获取exe数据在被创建进程时的状态(内存映射状态)
//Step6:创建一个挂起的进程
int a = CreateProcess(StrName, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &Shell_pi);
if (!a)
{
    printf("进程创建失败...\n");
    getchar();
    return 0;
}
else
{
    printf("进程创建成功_挂起状态....\n");
}
    //获取线程CONTEXT
Context.ContextFlags = CONTEXT_FULL;
GetThreadContext(Shell_pi.hThread, &Context);

ReadProcessMemory(Shell_pi.hProcess, (LPCVOID)(Context.Ebx + 8), (LPVOID)&dwBaseAdress, 4, NULL);
printf("挂起进程的线程Context.Eax:%p - Context.Ebx + 8:%p\n", Context.Eax,dwBaseAdress);

//申请内存
pFunction = VirtualAllocEx(Shell_pi.hProcess, (LPVOID)Image.Imagebase, Image.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (pFunction == NULL)
{
printf("内存申请失败\n");
TerminateProcess(Shell_pi.hProcess, 1234);
getchar();
return 0;
}
else
{
printf("内存申请成功:%p\n",pFunction);
}

//Step8:如果指定内存地址(IMAGEBASE)申请成功就直接把拉伸后的数据贴入相应的位置,然后跳到12步接着往下执行
DWORD c = WriteProcessMemory(Shell_pi.hProcess, (LPVOID)pFunction, (LPVOID)ImageBuffer, Image.SizeOfImage, NULL);
if (!c)
{
    c = GetLastError();
    printf("程序注入失败_错误代码:%p\n",c);
    TerminateProcess(Shell_pi.hProcess, 1234);
    getchar();
    return 0;
}

//Step9:如果指定内存地址(IMAGEBASE)申请失败的话就随机申请内存
//Step10:给拉伸后的数据进行重定位
//Step11:把重定位后的数据贴入随机申请到的内存地址
//Step12:更改挂起的进程中线程的EIP
Context.Eax = Image.Imagebase + Image.Oep;
DWORD d = WriteProcessMemory(Shell_pi.hProcess, (LPVOID)(Context.Ebx + 8), (LPVOID)&Image.Imagebase, 4, NULL);
if (!d)
{
    printf("Context.Ebx + 8写入失败...\n"); 
    TerminateProcess(Shell_pi.hProcess, 1234);
    getchar();
    return 0;
}
else
{
    printf("Context.Ebx + 8写入成功:%p...\n", Image.Imagebase);

}

GetThreadContext(Shell_pi.hThread, &Context);
ReadProcessMemory(Shell_pi.hProcess, (LPCVOID)(Context.Ebx + 8), (LPVOID)&dwBaseAdress, 4, NULL);
printf("Context.Eip:%p--Context.Eax:%p--Contxt.Ebx+8:%p\n", Context.Eip, Context.Eax, dwBaseAdress);
//Step13:恢复线程*/
if (ResumeThread(Shell_pi.hThread) == -1)
{
    DWORD e = GetLastError();
    printf("线程启动失败%p\n",e);
    TerminateProcess(Shell_pi.hProcess, 1234);
    getchar();
    return 0;

}
for (int f = 0; f < 100; f++)
{
    GetThreadContext(Shell_pi.hThread,&Context);
    printf("Context.EIP:%p--Context.EAX:%p\n",Context.Eip, Context.Eax);
    Sleep(50);




}

//Step14:壳源进程退出
TerminateProcess(Shell_pi.hProcess, 1234);
return 0;

}