Theamk, besides what you mentioned there others points: 1) You keep the target process with the same name. Execve change the process name, but this one do not s

Theamk, besides what you mentioned there others points: 1) You keep the target process with the same name. Execve change the process name, but this one do not so help you being stealth. 2) You can load the next stage in a noexec (RW-only) partition and use this to load in memory. 3) Since a lot embedded devices contains selinux this is also good to bypass the execmem verification. bediger4000, I believe they are similar techniques. The difference is the ways to achieve