DWORD32 *buffer = (DWORD32 *)pIrp->AssociatedIrp.SystemBuffer;
 DWORD32 processesPid = *buffer;
 PEPROCESS process;
 NTSTATUS status = PsLookupProcessByProcessId(processesPid, &process);

 if (!NT_SUCCESS(status))
 {
  return;
 }

 PULONG ptr = (PULONG)process;
 ULONG offset = 0;

 for (ULONG i = 0; i < 512; i++)
 {
  if (ptr[i] == processesPid)
  {
   offset = (ULONG)&ptr[i + sizeof(INT_PTR)] - (ULONG)process;
   break;
  }
 }

 if (!offset)
 {
  return;
 }

 PLIST_ENTRY currListEntry = (PLIST_ENTRY)((ULONG)process + offset);

 DbgPrint("Current: %#x", process);
 DbgPrint("Prev: %#x", currListEntry);
 DbgPrint("process: %#x", process);
 DbgPrint("offset: %#x", offset);
DbgPrint("blink: %#x",  currListEntry->Blink);