digging out stuff from process address space

[Rayan Zachariassen]

q1: (curiosity) How can I reliably determine the end of the envp strings
	in the process address space?  I.e. what is between the last
	environment string value and stackbas(0) (from core.h) ?

q2: (problem) What magic do I need to read the top of user stack through
	/debug/<pid>?  I tried the following sequence:

		fd = open("/debug/<pid>", 0);
		fcntl(fd, DFCSTOP, 0);
		nfd = fcntl(fd, DFCOPENT, x);
		lseek(nfd, stackbas(some low number), 0)
		read(nfd, buf, sizeof buf)
		fcntl(fd, DFCRUN, &(something which is CLEARNOSIG))

	with x being variously 0, i, and &i, where i=0 or
	i=stackbas(some low number) without luck.  I also tried seeking
	and reading from fd, but got something that looks like initialized
	data and/or symbol table.  stackbas(some low number) ~= 0x7fffc700

q3: (curiosity) What is the reason to require the process to be stopped
	before doing DFCOPENT or read() from it?  This limits the usefulness
	of the operations provided.

My purpose is to rummage through the inherited environment of an arbitrary,
running, possibly critical, process (like login shells...).

Thanks for any info

rayan