当然是先修改EIP,否则call指令岂不是导致无限循环?
《Intel® 64 and IA-32 Architectures Software Developer's Manual》里面已经明确说了:
3.5 INSTRUCTION POINTER
The instruction pointer (EIP) register contains the offset in the current code segment for the next instruction to be executed.