diff --git a/README.md b/README.md index 5115f18..8d4f6ee 100644 --- a/README.md +++ b/README.md @@ -68,7 +68,7 @@ Additional functions: | Management interface | `kill(2)` | `sys_call_table[__NR_kill]` | | Hiding (tampering) of file contents | Filtering while reading | `sys_call_table[__NR_read]` | | Hiding of files and directories | Filtering of directory entries | `sys_call_table[__NR_getdents]` `sys_call_table[__NR_getdents64]` | - | Hiding of processes and process trees | Filtering of `/proc` | Filtering PID-like numeric entries while listing `/proc`. Hidden tasks are marked using `task->flags | 0x10000000`. Not able to hide all threads and children of parent process. | + | Hiding of processes and process trees | Filtering of `/proc` | Filtering PID-like numeric entries while listing `/proc`. Hidden tasks are marked using `task->flags \| 0x10000000`. Not able to hide all threads and children of hidden (parent) process. | | Detection evasion | Hides own components | Hide files, unlinks module from `module_list`, alters contents of startup files while reading. | - https://github.com/QuokkaLight/rkduck