Make the rootkit hard to detect

Since `sys_read` must be called to read `/proc/modules`, where information about loaded kernel modules are stored, if we have it hooked, we can just edit out the line that says our rootkit is loaded, and so on.

Replace `ps`, `top`, `netstat` and `lsof` to not show the processes which the rootkit is running. (#9)

Maybe continuously scan the process list and temporarily remove its files if the start of a Tripwire process is detected. [Source: section 5.2.2 of "A Taxonomy of Software Deceptive Interpretation in the Linux Operating System"](https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.896.494&rep=rep1&type=pdf).