Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!bellcore!uunet!auspex!guy From: guy@auspex.auspex.com (Guy Harris) Newsgroups: comp.unix.questions Subject: Re: command line shown by ps Message-ID: <6252@auspex.auspex.com> Date: 24 Feb 91 03:44:57 GMT References: <478@bria> Distribution: usa Organization: Auspex Systems, Santa Clara Lines: 13 >In a general sense, what you need to do is read the kernel namelist, >get the symbol value for _proc which is the offset into /dev/kmem. Read >the proc table, and determine if the process is in core or swapped; if it >is in core, read /dev/mem, otherwise read /dev/swap, seeking to the u block >forthat process (the address of the u block is in the proc table). Overly general - I suspect Ultrix doesn't keep the command line in the U area. That was done by, possibly among other, AT&T, in one of the S5 releases, for reasons not entirely obvious to me; other systems require "ps" to grab it from the process's stack, so just stomping on top of your arguments (being careful, of course, 1) to make copies of any you may need later and 2) not to stop on stuff *outside* the argument list) should suffice.