Classically, tools like ps worked by opening /dev/kmem, reading the symbol list from /vmunix or wherever, and chasing data structures in kernel memory a bit like a debugger might.

These days there is usually a getter for proctitle in the form of the /proc filesystem, sysctls, etc.