2 comments

[ 0.89 ms ] story [ 12.3 ms ] thread
As mentioned in the article, this doesn't hide processes from statically linked executables because he's using LD_PRELOAD.

And busybox is a common statically linked executable, so you can trivially discover this with /bin/busybox ps or /bin/busybox top.

That's absolutely brilliant!