Damnit, that's the book I'm trying to buy right now to fight this, and the bookstore is all out...

That was my theory as well in that they moved some process code into driver mem.

Anyway I can still dump most program memory using another conventional technique, but as you say if some is in driver mem I need ring0 code. Not too much trouble, just have to have a good reference, hence the book.

-Lunar