>... how to find a starting address without query a instance You can obtain the address of fixed SGA variable "ksusga" directly from Oracle binary: $ nm $ORACLE_HOME/bin/oracle | grep ksusga_ Inside this "ksusga" structure in SGA you can find the pointer to the array, which holds pointers to each session slot of x$ksuse. Its offset depends on Oracle version and port, but is independent of current instance parameters. "ksusga" also contains pointer to pointers to x$ksupr slots and the values of "sessions" and "processes" parameters as well. See Tanel Põder post //www.freelists.org/post/oracle-l/Using-Unix-debuggers-to-attach-to-Oracle-processes,10 and Julian Dyke presentation http://www.juliandyke.com/Presentations/SGAInternals.ppt Best Regars Andrey Nikolaev http://andreynikolaev.wordpress.com/ -- //www.freelists.org/webpage/oracle-l