Global &g_init_task_addr // 태스크 디스크립터 시작주소
Global &g_init_task_list_addr
Global &g_task_struct_start_addr
Global &g_task_struct_name

Global &g_task_struct_list_next // 1.1
Global &g_task_struct_list_next_temp
Global &g_task_struct_list_offset
Global &g_task_struct_name_offset

; find the offset
&g_task_struct_list_offset=address.offset(v.address(((struct task_struct)0x0).tasks)) // 0x430
&g_task_struct_name_offset=address.offset(v.address(((struct task_struct)0x0).comm)) // comm까지의 오프셋

; find init_task address 
&g_init_task_addr=address.offset(init_task)
&g_init_task_list_addr=&g_init_task_addr+&g_task_struct_list_offset

&g_task_struct_list_next=data.quad(d:&g_init_task_list_addr)

while &g_init_task_list_addr!=&g_task_struct_list_next
(
	&g_task_struct_start_addr=&g_task_struct_list_next-&g_task_struct_list_offset
	&g_task_struct_name=&g_task_struct_start_addr+&g_task_struct_name_offset
	print "process name: " data.string(d:&g_task_struct_name)
	&g_task_struct_list_next_temp=data.quad(d:&g_task_struct_list_next)
	&g_task_struct_list_next=&g_task_struct_list_next_temp  // for debugging purpose 
)

enddo	

1.1

• offset :0x10
• 스크립트의 동작방식은 이전 게시글과 유사하다.