inline hook SetForegroundWindow()导致程序崩溃


#include "stdAfx.h"
#include <windows.h>
#include <tlhelp32.h>PROCESSENTRY32 pe;#pragma data_seg("Share")
HHOOK hhook=NULL;
#pragma data_seg()
#pragma comment(linker,"/SECTION:Share,RWS")HINSTANCE hInsta=NULL;
HMODULE hModule_User32;
static HANDLE hTh;LRESULT CALLBACK NULFUNC(int code,WPARAM wparam,LPARAM lparam);BYTE NewGFW[8] = {0xB8, 0x0, 0x0, 0x40, 0x0, 0xFF, 0xE0, 0x0};
BYTE OldGFW[8] = {0};//SetForegroundWindow地址
FARPROC SetForegroundWindow_Addr;
//SetForegroundWindow替代函数
BOOL MySetForegroundWindow(HWND hWnd)
{
    return TRUE;
}BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
                     )
{
    if (ul_reason_for_call == DLL_PROCESS_ATTACH)
    {
        //判断进程是否为studentmain.exe是则HOOK SetForegroundWindow
        hInsta =(HINSTANCE) hModule;
        DWORD CPID = GetCurrentProcessId();
pe.dwSize = sizeof(pe);
        HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    BOOL bMore = ::Process32First(hProcessSnap, &pe);
    while(bMore)
{
    if(strcmp(strlwr(pe.szExeFile),"studentmain.exe")==0) break;
    bMore = ::Process32Next(hProcessSnap, &pe);
}
if(strcmp(strlwr(pe.szExeFile),"studentmain.exe")==0) 
{
    if(pe.th32ProcessID == CPID)
    {
//创建HOOK线程
    hTh = CreateThread(0,0,Th,0,0,0);
}
}
}
else ;
    return TRUE;
}
//空的钩子线程
LRESULT CALLBACK NULFUNC(int code,WPARAM wparam,LPARAM lparam)
{
 return ::CallNextHookEx(hhook,code,wparam,lparam);
}//导出函数
extern "C" _declspec(dllexport) _stdcall void SetHook()
{
       hhook = SetWindowsHookEx(WH_CBT,NULFUNC,hInsta,0);
       }
       
extern "C" _declspec(dllexport) _stdcall void StopHook()
{
       UnhookWindowsHookEx(hhook);
       }
//写API HOOK 的线程
DWORD WINAPI Th(LPVOID a)
{
//得到user32.dll模块地址
hModule_User32            = GetModuleHandle("User32.dll");
//得到SetForegroundWindow地址
SetForegroundWindow_Addr           = GetProcAddress(hModule_User32,"SetForegroundWindow");*(DWORD*)(NewGFW + 1)      = (DWORD)MySetForegroundWindow;
//HOOK 头8个字节
WriteProcessMemory(INVALID_HANDLE_VALUE,(void *)SetForegroundWindow_Addr,(void*)NewGFW,8,NULL);return 0;
      }
studentmain.exe调用SetForegroundWindow()后崩溃。
求解......感激不尽...