D3D-Hook Absturz

#include <windows.h>
#include <cstdio>
#include <d3d9.h>
#include <d3dx9.h>

#pragma once
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")


typedef HRESULT (WINAPI* tEndScene)(LPDIRECT3DDEVICE9 pDevice);
tEndScene oEndScene;

void *DetourFunc(BYTE *src, const BYTE *dst, const int len) // credits to gamedeception
{
	BYTE *jmp = (BYTE*)malloc(len+5);
	DWORD dwback;

	VirtualProtect(src, len, PAGE_READWRITE, &dwback);

	memcpy(jmp, src, len); jmp += len;

	jmp[0] = 0xE9;
	*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;

	src[0] = 0xE9;
	*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;

	VirtualProtect(src, len, dwback, &dwback);
	
	return (jmp-len);
}

void DrawRect (LPDIRECT3DDEVICE9 Device_t, int X, int Y, int L, int H, D3DCOLOR color)
{
	D3DRECT rect = {X, Y, X+L, Y+H};
	Device_t->Clear(1, &rect, D3DCLEAR_TARGET, color, 0, 0); // bei Google gibt’s näheres
}

HRESULT __stdcall hkEndScene(LPDIRECT3DDEVICE9 pDevice)
{
   	const D3DCOLOR txtPink = D3DCOLOR_ARGB(255, 255, 0, 255); // Alpha, Rot, Grün, Blau
	DrawRect (pDevice, 10, 10, 200, 200, txtPink);
	return oEndScene(pDevice);
} 

bool bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(;*szMask;++szMask,++pData,++bMask)
		if(*szMask=='x' && *pData!=*bMask )
			return false;
	return (*szMask) == NULL;
}
DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
	for(DWORD i=0; i < dwLen; i++)
		if( bDataCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
			return (DWORD)(dwAddress+i);

	return 0;
}

void InitHook()
{
    HMODULE hModule = NULL;
    
    while(!hModule)
    {
        hModule = GetModuleHandleA("d3d9.dll"); 
        Sleep( 100 ); 
    }
			DWORD* VTableStart = 0;
			DWORD FoundByGordon = dwFindPattern((DWORD)hModule, 0x128000,
(PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
			memcpy(&VTableStart, (void*)(FoundByGordon+2), 4);

			dwDrawIndexedPrimitive = (DWORD)VTableStart[82]; // für mehr: blick in die d3d9.h werfen!
			dwEndScene = (DWORD)VTableStart[42];
    oEndScene = ( tEndScene )DetourFunc((PBYTE) 0x7542CE09,(PBYTE) hkEndScene, 5);

}

void RunHook()
{
    CreateThread(0, 0, (LPTHREAD_START_ROUTINE) InitHook, 0, 0, 0);
}

BOOL WINAPI DllMain(HINSTANCE hInst,DWORD reason,LPVOID reserved)
{
    if( reason ==1 )
    {
        RunHook();
    }
    
    return true;
}