If I recall, PS read /dev/kmem to get the proc structure which was a table of all the active processes.

The user structure of the currently running process is the only one that is guaranteed to be in memory (the others could be paged out)

and at least on our system was always located at 0140000. Any processes that were swapped you could read the user structure

so things that were stored there were often unavailable (particularly the command name). Yeah, so ps had intimate knowledge of the

layout of the kernel user and proc structures.

We moved a short version of the command name into the proc structure for reason. We added a new TTY special character ^T

(borrowed that from the KA-10 guys) to do a brief listing of the processes controlled by the current terminal from within the kernel. (Mike Muuss did this while he was playing with scheduler hacking).

Also remember for early UNIX, ps "knew" about some kernel data structures and had to compiled with the same sources that your kernel used if you want all the command field in particular to look reasonable.