I think you mean the D3D Device pointer in Engine.exe, not sure how to find it
it's in Engine.exe not ntdll.dll , just press run or change module , then search this : mov edx, dword ptr[ecx+A8] , go up and you will find it mov eax,[pDevice] i think not sure