A bit more info:
The path I described works on WinNT.
But on Win9x, the Ldr is not part of the PEB.
Another path is to follow the loaded DOS header -> PE header -> import table. But that only works when you explicitly import. It doesn't work on the implicit import.
I've spent a few days stuck on something.
A Windows program is loaded, FS/GS points to the TEB, which points to the PEB, which points to the Ldr.
My Ldr pointer is null. And I don't think it should be. I think Kernel32 is always loaded. In fact, it is in my imports table.