site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=BCAqqofFXfJix2rZcfh2d+jpP12Q1yMFJuhH3FBZwBmcQIT6YX4pD4AZ2m1BStXhS4Bn/D/2vk9DkbqmEg6ZIcew2NoWtTo/RjaaKSvFV9yebITLOnydwsK+0OSdLw/zgu7BtIl1bt7ofXQB1X8ghz6VCzVxeSMrDg8o0MzZj1M= And in this case, is there any reason that (since you have previously said that approximations are OK) you can't simply walk the process parent chain looking for a PID that you recognise? Actually, that's one of the more annoying situations. Imagine this: process starts (and my kext knows about it) process forks (no exec) process exits child process creates a listener ...and I know nothing of that process, and its "parent" is pid 1. -- Curtis Jones curtis.jones@gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... On 1/2/07, Michael Smith <drivers@mu.org> wrote: This email sent to site_archiver@lists.apple.com