XP is a little more complicated than newer systems due to the use of a single driver for both port and miniport; however, getting the original pointers is fairly straight forward depending on how you do it.
more here........http://www.malwaretech.com/2015/03/bootkit-disk-forensics-part-3.html