As another method for using LdrUnlockLoaderLock, we could do a scan for the (fairly unique) magic number 0x1000000000000000 and simply overwrite it with ULLONG_MAX (after modifying memory protection of the page), allowing a valid cookie to be generated for any given thread ID. This seems more simple than scanning for the call to LdrpReleaseLoaderLock and less likely to change in the future.
As another method for using LdrUnlockLoaderLock, we could do a scan for the (fairly unique) magic number 0x1000000000000000 and simply overwrite it with ULLONG_MAX (after modifying memory protection of the page), allowing a valid cookie to be generated for any given thread ID. This seems more simple than scanning for the call to LdrpReleaseLoaderLock and less likely to change in the future.