Firstly, a php/cgi based programm might not be an rootkit - rootkits are usually assocated with malware that hides itself in a kernel, not just a malwares.
If you sure are that it is a rootkit, you have two choices:
- Offline analysis - given a image of the powered down system, you can analyse what files it has changed. Similarly, you can analyze the binaries the same way you analyze other malwares.
- Online analysis - this is what rootkits try to prevent on themselfs, or on the malwares they hide; however, often you can perform some analysis.
Unlike normal malwares, binary instrumentation or debugging of rootkits is much harder as they are running in the same security level as the rest of the kernel and you have to attach a debugger to the kernel. You might choose to use KGDB for example.
Offline analysis is much like reverse engineering other malwares, but with a mind to the fact that the codes is relative to the kernel, etc. Things may be many more complex. For this, IDA has already been mention. This is a standard industry tool for such things.
So the process is not so different to a normal malwares, really.