RKProfiler LX is divided into two parts: a data collection component called “Rootkit Profiler Module” and a data interpretation component. RKPmod is a kernel module that gets loaded on the system that should be checked for the presence of a kernel rootkit. There are other ways to perform data collection, but currently only this approach is publicly available. The userland program can be used to analyse the collected information. It checks the whole kernel code as well as different kernel data sections and cpu registers.”]
Source: https://www.csoonline.com/article/2633044/new-linux-rootkit-detector-rootkit-profiler.html