doc: detail exec fallback chain tiers, drop probabilities and distribution

Author: franckferman

README.md

@@ -137,7 +137,31 @@ function validateClusterState(string $login, string $pass): bool {
 }
 ```
 
-### 4. Dynamic junk code
+### 4. Exec fallback chain — weighted shuffle + random drop
+
+The shell tries multiple PHP execution functions in sequence until one works. Two layers of variance are applied per build:
+
+**Composition variance** — methods are split into two tiers:
+
+| Tier | Methods | Present |
+|---|---|---|
+| Core | `exec`, `shell_exec`, `system` | Always |
+| Optional | `passthru`, `popen`, `proc_open` | ~70% chance each (independent) |
+
+Each optional method has a ~30% chance of being absent from a given build. At least one optional method is always kept. Expected distribution:
+
+| Methods in build | Probability |
+|---|---|
+| 6 — no drop | ~34% |
+| 5 — 1 dropped | ~44% |
+| 4 — 2 dropped | ~19% |
+| 4 — all 3 dropped, 1 re-added | ~3% |
+
+**Order variance** — the active methods are assembled in a weighted random order. Core methods (`exec`, `shell_exec`) carry higher weight and statistically appear earlier in the chain, but the final order is still randomized per build.
+
+The result: YARA rules that enumerate specific combinations of exec methods ("if passthru AND popen AND proc_open are all present…") are unreliable, because the set changes every build.
+
+### 5. Dynamic junk code
 
 Between 20 and 80 decoy PHP functions are generated per run, drawn from 20 body templates × 250+ name combinations, with randomized return values, loop counts, and string literals. They are scattered around the functional core to increase noise ratio.