Sorry about using another username (password problems).

Phantom process? ...Oh, this is only theoretical. I don't have a "phantom process" actually running, I was just wondering if it could be done. I didn't see what you meant when you suggested taskinfo for some reason. Thanks anyway though, I like it!

About what you said:
Quote:
The location of the file's memory location may be determined in the program's own code. This is why it may not be possible to save just any ole program running in memory. You'd have to know the program code itself. You can probably find and copy the program's address space and stack to file using the process handle, but anything else is program-specific.
I don't see why that should be a problem. There are dissasemblers that work by running the code (sort of) I guess in a "sandbox" environment, so you should be able to write a program that goes through the code of the program looking for all the parts that load other modules, etc. and put it back in sequence, and then save it.
Essentially, if the CPU can follow the code through and have no problem running every part of the program, then another program should be able to go through every part of the program and save it sequentially the way it must have been originally (an exe or whatever). Do you see what I mean? I think it can be done.