Need help reaching EndScene for 3.3.5a

[yeahlol]

I've read the threads up and down, making the adjustments for the code I find (corrections from other users) but I cant seem to get it to work. When I run the code It crashes when the program runs the last statement:

process.Asm.Inject(pEndScene);

I don't know if it matters, but this is running with a private server I've set up for my self to be able to learn without fearing a patch or anything.

The code Im trying to get to work is fetched from at http://www.ownedcore.com/forums/worl...ml#post2045573 ([Sample Code] EndScene Hook with ASM and blackmagic)

    public struct Direct3D
    {
        // From http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-bots-programs/wow-memory-editing/300463-wow-3-3-5-12340-info-dump-thread.html#post1917706
        public static uint Direct3D9__Device = 0xC5DF88;
        public static uint Direct3D9__Device__OffsetA = 0x397C;
        public static uint Direct3D9__Device__OffsetB = 0xA8;
    }

    public class HookManager
    {
        private BlackMagic process;

        private bool mainThreadHooked;
        private bool ExecutingCode;

        private uint codeCave;
        private uint injectionAddress;
        private uint returnAddress;

        public HookManager(BlackMagic process)
        {
            this.process = process;

            this.mainThreadHooked = false;
            this.ExecutingCode = false;

            this.codeCave = 0;
            this.injectionAddress = 0;
            this.returnAddress = 0;
        }

        private void HookApplication()
        {
            if (!process.IsProcessOpen)
                throw new Exception("Process is not open");

            uint pDevice = process.ReadUInt(Direct3D.Direct3D9__Device);
            uint pEnd = process.ReadUInt(pDevice + Direct3D.Direct3D9__Device__OffsetA);
            uint pScene = process.ReadUInt(pEnd);
            uint pEndScene = process.ReadUInt(pScene + Direct3D.Direct3D9__Device__OffsetB);
            
            if (process.ReadUInt(pEndScene) == 0xE9 && (codeCave == 0 || injectionAddress == 0))
            {
                DisposeOfHook();
            }
            if (process.ReadUInt(pEndScene) != 0xE9)
            {
                try
                {
                    mainThreadHooked = false;

                    codeCave = process.AllocateMemory(2048);
                    injectionAddress = process.AllocateMemory(0x4);

                    process.WriteInt(injectionAddress, 0);

                    returnAddress = process.AllocateMemory(0x4);
                    process.WriteInt(returnAddress, 0);

                    process.Asm.Clear();

                    process.Asm.AddLine("mov edi, edi");
                    process.Asm.AddLine("push ebp");
                    process.Asm.AddLine("mov ebp, esp");

                    process.Asm.AddLine("pushfd");
                    process.Asm.AddLine("pushad");

                    //Test for waiting code?
                    process.Asm.AddLine("mov eax, [" + injectionAddress + "]");
                    process.Asm.AddLine("test eax, eax");//test eax, ebx"); // corrected as in http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-bots-programs/wow-memory-editing/305473-sample-code-endscene-hook-asm-blackmagic-6.html#post2053805
                    process.Asm.AddLine("je @out");

                    //Execute waiting code
                    process.Asm.AddLine("mov eax, [" + injectionAddress + "]");
                    process.Asm.AddLine("call eax");

                    //Copy pointer to return value
                    process.Asm.AddLine("mov [" + returnAddress + "], eax");

                    process.Asm.AddLine("mov edx, " + injectionAddress);
                    process.Asm.AddLine("mov ecx, 0");
                    process.Asm.AddLine("mov [edx], ecx");

                    //Close Function
                    process.Asm.AddLine("@out:");

                    //Inject Code
                    uint sizeAsm = (uint)(process.Asm.Assemble().Length);

                    process.Asm.Inject(codeCave);

                    int sizeJumpBack = 5;

                    // create jump back stub
                    process.Asm.Clear();
                    process.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                    process.Asm.Inject(codeCave + sizeAsm);// + (uint)sizeJumpBack);

                    // create hook jump
                    process.Asm.Clear(); // $jmpto
                    process.Asm.AddLine("jmp " + (codeCave));
                    process.Asm.Inject(pEndScene);
                }
                catch
                {
                    mainThreadHooked = false; return;
                }
                mainThreadHooked = true;
            }
        }

The error I get, and I get it when it runs the last line (

process.Asm.Inject(pEndScene);

), is

This application has encountered a critical error:
ERROR #132 ... Fatal Exception
The instruction at "" referenced memory at "". The Memory could not be "written".

I should have the right memory addresses? And I'm running Visual Studio as Administrator.

In my main program, Im just trying to Dance:

            var wowProcess = Process.GetProcessesByName("Wow")[0];
            BlackMagic process = new BlackMagic(wowProcess.Id);
            FunctionManager funcMngr = new FunctionManager(process);
            funcMngr.LuaDoString("DoEmote(\"dance\");");

FunctionManager looks like:

        public class FunctionManager
        {
            private BlackMagic process;
            private HookManager aHook;

            public FunctionManager(BlackMagic process)
            {
                this.process = process;
                this.aHook = new HookManager(process);
            }

            public void LuaDoString(string command)
            {
                int nSize = command.Length + 0x100;
                uint codeCave = process.AllocateMemory(nSize);
                uint moduleBase = (uint)process.MainModule.BaseAddress;

                // address from http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-bots-programs/wow-memory-editing/300463-wow-3-3-5-12340-info-dump-thread.html#post1917693
                uint FrameScript__Execute = 0x819210;

                process.WriteASCIIString(codeCave, command);

                process.Asm.Clear();

                String[] asm = new String[] 
            {
                "mov eax, " + codeCave,
                "push 0",
                "push eax",
              
                "push eax",
                "mov eax, " + (FrameScript__Execute),
                
                "call eax",
                "add esp, 0xC",
                "retn",    
            };

                aHook.InjectAndExecute(asm);
                process.FreeMemory(codeCave);
            }
        }