Update README.md

Author: Cvar1984

README.md

@@ -2,7 +2,11 @@
 [![CodeFactor](https://www.codefactor.io/repository/github/cvar1984/sussyfinder/badge)](https://www.codefactor.io/repository/github/cvar1984/sussyfinder)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)
 
-PHP web application that scans a directory for files with specific extensions (e.g., PHP scripts) and checks for suspicious tokens or patterns within the files. The application uses various PHP functions and techniques to achieve this, including recursive directory scanning, file token extraction, and token comparison.
+PHP web application that scans a directory for files with specific extensions (e.g., PHP scripts) and checks for suspicious tokens or patterns within the files.
+
+The application uses various PHP functions and techniques to achieve this, including recursive directory scanning, file token extraction, and token comparison.
+
+This tool is designed to help identify potentially malicious PHP files in a web server environment, but it should be used with caution as it may produce false positives and has the capability to delete files.
 ## Requirements
 - PHP4/PHP5/PHP7/PHP8
 - VirusTotal APIKey (Optional)
@@ -29,27 +33,27 @@ please provide the source files if you want to make pr to add your own hash data
 ## Breakdown
 Here's a breakdown of the code:
 
-1. The code starts by defining various arrays, including 
-- `$ext` (file extensions to scan)
-- `$tokenNeedles` (suspicious tokens to look for)
-- `$whitelistMD5Sums` (MD5 sums of files to skip)
-- and `$blacklistMD5Sums` (MD5 sums of files to remove).
-2. The code then defines several functions, including
-- `recursiveScan` (recursively scans a directory for files)
-- `sortByLastModified` (sorts an array of files by their last modified time)
-- `getSortedByTime` (recursively lists files by descending modified time)
-- `getSortedByExtension` (recursively lists files by array of extensions)
-- `getFileTokens` (extracts lowercase tokens from a file)
-- `inStringArray` (checks if a needle exists in an array of strings)
-- `compareTokens` (compares tokens and returns matched tokens)
-- `urlFileArray` (fetches an array of strings from a URL), and a HTML template for the web application.
-3. The code then initializes the `$ext` array with various PHP file extensions.
-4. The code defines the `$tokenNeedles` array with suspicious tokens or patterns to look for within the files.
-5. The code fetches the MD5 sums of files to skip and files to remove from URLs using the `urlFileArray` function.
-6. The code then defines the HTML template for the web application, including a form for users to input the directory to scan.
-7. Inside the form, the code checks if the user has submitted the form. If so, it retrieves the directory path from the form input, calls the `getSortedByExtension` function to get the sorted files, and then iterates over the files to check for suspicious tokens or patterns.
-8. If a suspicious token or pattern is found, the code displays a message indicating the file path and the suspicious tokens.
-9. The code also includes a button to copy the results to the clipboard.
-
-
-Overall, the selected code is a PHP web application that scans a directory for suspicious PHP files and checks for suspicious tokens or patterns within the files. The application uses various PHP functions and techniques to achieve this, including recursive directory scanning, file token extraction, and token comparison.
+1.Helper Functions:
+* `recursiveScan`: Recursively scans a directory and returns an array of readable and non-readable files.
+* `sortByLastModified`: Sorts an array of files by their last modified time.
+* `getSortedByTime`: Combines recursive scanning and sorting by modified time.
+* `getSortedByExtension`: Filters files by specified extensions and sorts them.
+* `getFileTokens`: Tokenizes the content of a file and returns an array of tokens.
+* `inStringArray`: Searches for a string in an array (case-insensitive).
+* `compareTokens`: Compares two arrays of tokens and returns matches.
+* `urlFileArray`: Fetches content from a URL and returns it as an array.
+* `vTotalCheckHash`: Checks a file hash against the VirusTotal API.
+
+2.Configuration Arrays:
+* `$APIKey`: An array to store VirusTotal API keys.
+* `$ext`: An array of file extensions to scan.
+* `$tokenNeedles`: An array of potentially suspicious PHP functions and keywords to look for.
+
+3.Scanning Logic:
+* When the form is submitted, it scans the specified directory.
+* It checks each file against the whitelist, blacklist, and VirusTotal API.
+* It also performs token analysis to look for suspicious functions.
+* The results are displayed in an HTML table, with different colors indicating various levels of suspicion.
+
+4.File Operations:
+* The script can delete files that match the blacklist or are identified as malicious by VirusTotal.