I can't post links yet, but you need to find the pointer address. There is a great guide on MaxConsole (search for "finding pointer codes with gateway ram dumps")
The output AR code from that tutorial is a code that executes a specific set of instructions to find the target address. If you want...