Yeah, it's a demonstration of various techniques used in more modern rootkits. As such, certain bits and pieces, like its masking of ptrace() is set to an obvio

Yeah, it's a demonstration of various techniques used in more modern rootkits. As such, certain bits and pieces, like its masking of ptrace() is set to an obvious message. The blog post regarding the release -- http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html http://www.chokepoint.net/2014/02/detecting-userland-preload... -- is much more useful than this wiki page in discussing how certain things are accomplished.