extern "C" NTKERNELAPI PVOID NTAPI PsGetProcessWow64Process(IN PEPROCESS Process);

typedef struct _PEB_LDR_DATA32
{
    ULONG Length;
    UCHAR Initialized;
    ULONG SsHandle;
    LIST_ENTRY32 InLoadOrderModuleList;
    LIST_ENTRY32 InMemoryOrderModuleList;
    LIST_ENTRY32 InInitializationOrderModuleList;
} PEB_LDR_DATA32, * PPEB_LDR_DATA32;

typedef struct _LDR_DATA_TABLE_ENTRY32
{
    LIST_ENTRY32 InLoadOrderLinks;
    LIST_ENTRY32 InMemoryOrderLinks;
    LIST_ENTRY32 InInitializationOrderLinks;
    ULONG DllBase;
    ULONG EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING32 FullDllName;
    UNICODE_STRING32 BaseDllName;
    ULONG Flags;
    USHORT LoadCount;
    USHORT TlsIndex;
    LIST_ENTRY32 HashLinks;
    ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;

typedef struct _PEB32
{
    UCHAR InheritedAddressSpace;
    UCHAR ReadImageFileExecOptions;
    UCHAR BeingDebugged;
    UCHAR BitField;
    ULONG Mutant;
    ULONG ImageBaseAddress;
    ULONG Ldr;
    ULONG ProcessParameters;
    ULONG SubSystemData;
    ULONG ProcessHeap;
    ULONG FastPebLock;
    ULONG AtlThunkSListPtr;
    ULONG IFEOKey;
    ULONG CrossProcessFlags;
    ULONG UserSharedInfoPtr;
    ULONG SystemReserved;
    ULONG AtlThunkSListPtr32;
    ULONG ApiSetMap;
} PEB32, * PPEB32;

LARGE_INTEGER time = { 0 };
				time.QuadPart = -250ll * 10 * 1000;

				KAPC_STATE apc;
				PEPROCESS targetproc;

				PsLookupProcessByProcessId((HANDLE)buffer->pid, &targetproc);
				KeStackAttachProcess(targetproc, &apc);

				// Get PEB
				PPEB32 pPeb32 = (PPEB32)PsGetProcessWow64Process(targetproc);

				if (pPeb32 == NULL)
				{
					return NULL;
				}

				// Wait for loader a bit
				for (INT i = 0; !pPeb32->Ldr && i < 10; i++)
				{
					KeDelayExecutionThread(KernelMode, TRUE, &time);
				}

				// Still no loader
				if (!pPeb32->Ldr)
				{
					return NULL;
				}

				// Search in InLoadOrderModuleList
				for (PLIST_ENTRY32 pListEntry = (PLIST_ENTRY32)((PPEB_LDR_DATA32)pPeb32->Ldr)->InLoadOrderModuleList.Flink;
					pListEntry != &((PPEB_LDR_DATA32)pPeb32->Ldr)->InLoadOrderModuleList;
					pListEntry = (PLIST_ENTRY32)pListEntry->Flink)
				{
					UNICODE_STRING ustr;
					PLDR_DATA_TABLE_ENTRY32 pEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY32, InLoadOrderLinks);

					RtlUnicodeStringInit(&ustr, (PWCH)pEntry->BaseDllName.Buffer);

					UNICODE_STRING shait;
					RtlUnicodeStringInit(&shait, L"client.dll");

					if (RtlCompareUnicodeString(&ustr, &shait, TRUE) == 0)
						buffer->data = (PVOID)pEntry->DllBase;
				}

				ObfDereferenceObject(targetproc);

				// Detach target process
				KeUnstackDetachProcess(&apc);