ReadProcessMemory

STARTUPINFO si;
SECURITY_ATTRIBUTES sa;
SECURITY_DESCRIPTOR sd;
PROCESS_INFORMATION pi;
//-----------------------------------------------
void __fastcall TForm1::Button1Click(TObject *Sender)
{
 //Бездумно взято из другой программы
 char app_spawn[128];
 strcpy(app_spawn,Edit1->Text.c_str());
 InitializeSecurityDescriptor(&sd,SECURITY_DESCRIPTOR_REVISION);
 SetSecurityDescriptorDacl(&sd,true,NULL,false);
 sa.lpSecurityDescriptor=&sd;
 sa.nLength=sizeof(SECURITY_ATTRIBUTES);
 sa.bInheritHandle=true;
 GetStartupInfo(&si);
 si.dwFlags=STARTF_USESHOWWINDOW;
 si.wShowWindow=SW_SHOWMAXIMIZED;
 if(!CreateProcess(app_spawn,NULL,NULL,NULL,true,NULL,NULL,NULL,&si,&pi)){ShowError();return;}
}
//-----------------------------------------------
void __fastcall TForm1::Button2Click(TObject *Sender)
{
 //Это самое сохранение
 void *Buf;
 DWORD rd;
 ReadProcessMemory(pi.hProcess,0,Buf,sizeof(Buf),&rd);
}