This is just a little example to simply compare
normal ps and kstat results for running processes
to find 'obfuscated ones' ...

./kstat -P|cut -f 1|grep [0-9]|cut -d \  -f 4

and

ls /proc/ |grep [0-9]|cut -d \/ -f 1|sort -n

will give you two formatted lists of pids to
be compared.
