fixes

README.md

@@ -10,7 +10,13 @@ For initial delivery use [Kage](https://github.com/Yenn503/Kage), minimal syscal
 
 ## Why Zig over C
 
-No CRT linked, smaller binary, fewer imports for AV to flag. Comptime guarantees struct layouts match the PE spec without padding bugs. All the Win32 types, inline assembly, and raw pointer math of C but the compiler refuses to build if you get a struct offset wrong.
+No CRT. C programs pull in the C Runtime Library which adds DLL imports to your IAT. Zig just calls the OS. Smaller binary, less for AV to see.
+
+Detection engines mostly know C, C++, Rust, Go. Zig flies under the radar. Lower VirusTotal scores.
+
+Ghidra struggles with Zig binaries (open bug). IDA doesn't properly support it either. Makes reverse engineering harder.
+
+Comptime makes sure struct layouts match the PE spec. Same low level control as C.
 
 Valak replaces `time.Sleep()` in your implant's beacon loop with ChaCha20-encrypted sleep via indirect syscalls. During sleep your implant's .text is PAGE_NOACCESS, scanners get access violation. On wake, it restores and decrypts.
 
@@ -50,9 +56,8 @@ cd evasion && zig build -Doptimize=ReleaseFast
 
 ## Sliver integration
 
-See [docs/sliver-integration.md](docs/sliver-integration.md). TL;DR:
+```bash
+./scripts/integrate.sh ~/projects/sliver
+```
 
-1. Embed valak.dll bytes into `go-bridge/embed_dll.go`
-2. Drop `go-bridge/` into Sliver's `implant/sliver/evasion/valak/`
-3. Replace `time.Sleep(d)` with `valak.EvasionSleep(d)` in runner.go
-4. Build: `garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"`
+See [docs/sliver-integration.md](docs/sliver-integration.md) for prereqs and options.