it's in Engine.exe not ntdll.dll , just press run or change module , then search this : mov edx, dword ptr[ecx+A8] , go up and you will find it mov eax,[pDevice] i think not sure