[VulnDiscuss] Locating GHEAP and recovering heap chain

In their article "The Analysis of RPC Long Filename Heap Overflow..." NSFOCUS descibes, that the best way to use API "is to cover the default heap of PEB with another heap". But alse mention, that "Winsocket uses GHEAP,which was assigned as process default address at the initialization of dll ,the heap  will be abnormal when call function of Winsock." In their opinion the only way to use the WINSOCK API is to locate the GHEAP and modify it or to recover the chain. My question is if anyone know how to locate GHEAP or to recover the chain. I was trying to searching for the article "Utilization of released heap structure...", but so far I wasn't albe to find it.