[luke0016]

> Traditional Unix implementation of ps and similar tools work by directly reading the appropriate data structures from kernel (through /dev/kmem or something to that effect).

This is not correct - /dev/kmem and similar are typically only readable by root. If what you say were correct, ps and friends wouldn't work for unprivileged users (unless they were setuid root, which they're not).

[Erwin]

Some version of *BSDs probably fixed that with some sysctl interface, but on older Unixes you would read the kernel memory to get that system information.

You can see a ps.c implementation here: https://searchcode.com/codesearch/view/29853364/

which uses kvm library: https://www.freebsd.org/cgi/man.cgi?query=kvm&sektion=3&apro...

[trasz]

FWIW, in FreeBSD libkvm also uses the sysctl interface, it doesn’t read kernel memory directly.