Write Access on Win9x

[nikola]

Hi,
i was trying to do API hooking on win9x so i need write access in kernel32.dll memory pages. As you know VirtualProtect wont do that job but there is an undocumented way to perform this thru a VxDCall4. I tested this and it worked, but i need this code relocatable, and not using an import table so i need to do GetProcAddress for this call. VxDCall has no real procedure name so it should be imported by ordinal. Its ordinal is 5 but when i do
push 5
push KernelBase
call GetProcAddress
i get 0 in eax :/
Any help?