add blog link 06

Author: xcellerator

Diff for: 3_RootkitTechniques/3.4_hiding_directories/README.md

@@ -4,6 +4,8 @@
 
 > Updated to use [ftrace](https://www.kernel.org/doc/html/latest/trace/ftrace.html) instead of directly modifying kernel memory
 
+> There is now a blog post explaining this module in a lot more detail. You can check it out [here](https://xcellerator.github.io/posts/linux_rootkits_06/).
+
 > Sadly, this module is a lot bigger when we use ftrace. The reason is that we end up repeating the hook function *four* times - two copies each of both `sys_getdents` and `sys_getdents64`, using both the `pt_regs` struct and the old-fashioned function declaration (for kernel versions <4.17 - looking at you Ubuntu 16.04...)
 
 This is probably the most complicated syscall hook yet. As far as the kernel module goes, the structure is the same as the others in this section - we find the syscall table, and then hook a syscall with our own replacement, in this case, we hook `sys_getdents64`.