As protectors move into (e.g., using Intel VT-x to trap memory accesses), user-mode and even ring-0 dumpers are becoming obsolete. The next generation of dumpers will likely be hypervisors themselves, running beneath the protected process and dumping memory from the EPT (Extended Page Tables) without the process ever realizing it.
Once the OEP is reached, the process is paused. z3rodumper enumerates all memory regions with PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_READ attributes, identifies which belong to the main module, and dumps them to disk. z3rodumper