10.4.1 kvm routines

Many systems use routines such as kvm_open, kvm_nlist, and kvm_read to access kernel data structures directly via the /dev/kmem device. In general, these programs will open /dev/kmem, read the kernel's symbol table, locate data in the running kernel with this table, and read the appropriate addresses in the kernel address space with these routines. Because this requires the user program and the kernel to agree upon the size and format of data structures read in this fashion, such programs often have to be rebuilt for each kernel revision, CPU type, and so forth.