This is how you could detect knark. After running kstat s, the next step would be to run ps-ef along with kstat P and compare the two. If the are any differences in the two you can then take the correct action. Keep in mind that memory locations can change from box to box . As I said earlier, detecting LKM rootkits with kstat is quite simple.
Lets look at adore.
Should be at 0xc013022c Table 10. This is a good thing because it allows us the ability to detect each one separately. Again, once this has been done, the administrator can then run kstat P and ps-ef and compare the two to figure out what processes are running and hiding. The last rootkit we will look at is rkit. This rootkit does not hide itself as well as the other two do.