I dont think its possible to get the instrumentation callback address from usermode. I just got the address from kernel and stored it as a offset so I can use it in usermode.