As mentioned in the article, this doesn't hide processes from statically linked executables because he's using LD_PRELOAD.
And busybox is a common statically linked executable, so you can trivially discover this with /bin/busybox ps or /bin/busybox top.
