[kccqzy]

You don't need to get the key per se, depending on your exploit. You just need a single valid signed pointer that's involved in your ROP gadget.