Abusing SpeedFan driver ability of physical memory manipulation
With only access to physical memory we are able to find an EPROCESS structure by "bruteforcing" or iterating, if you will, over blocks of memory labeled with a pooltag. Pooltags with "Proc" are possible EPROCESS structures of different processes.
Cred to waryas for supplying Superfetch methods!