Wait a second, what API are we talking about here? It's safe to assume no WMI is used, so all he has to do is retrieve a specific range from system memory (c/asm) and make use of it.
For those interested: http://wiki.osdev.org/Memory_Map_(x86)
Nvm https://docs.google.com/open?id=0B7LwI1tJ08joWkd4Ti1seUsySEE