Sorry, meant 'UNIX the monolithic kernel'; yes, ps and siblings (e.g. iostat) need to get the running system's symbol table. Know that feeling! I added the following to one of the kernel data files: char *endsys &end; and then in programs which grab the system's symbol table, I have an nlist() entry: "_endsys", with the follwing code: /* Check that the namelist applies to the current system. */ checknms(symfile) char *symfile; { char *chkloc, *chkval; if (nl[0].type == 0) cerror("No namelist\n"); chkloc = nl[ENDSYS].value; chkval = rdloc(chkloc); if (chkval != nl[END].value) { cerror("Symbol table in %s doesn't match running system\n", symfile); } } on the theory that pretty much any change at all is going to result in a change in the system's size (and thus the address of 'end'). Although in a split I/D system, this may not be true (you could change the code, and have the data+BSS remain the same size); I should probably check the location of 'etext' as well... Anyway, a rebuilt system may result in the address of 'endsys' changing, and thus the rdloc() won't return the contents of the running system's 'endsys', but the chances of an essentially-random fetch being the same as the value of 'end' in /unix are pretty slim, I would say... Noel