Abstract:—Many mechanisms have been proposed and de-ployed to prevent exploits against software vulnerabilities. Amongthem, W X is one of the most effective and efﬁcient. W Xprevents memory pages from being simultaneously writableand executable, rendering the decades old shellcode injectiontechnique infeasible.In this paper, we demonstrate that the traditional shellcodeinjection attack can be revived through a code cache injectiontechnique. Speciﬁcally, dynamic code generation, a techniquewidely used in just-in-time (JIT) compilation and dynamic binarytranslation (DBT), generates and modiﬁes code on the ﬂy in orderto promote performance or security. The dynamically generatedcode fragments are stored in a code cache, which is writableand executable either at the same time or alternately, resultingin an opportunity for exploitation. This threat is especiallyrealistic when the generated code is multi-threaded, becauseswitching between writable and executable leaves a time windowfor exploitation. To illustrate this threat, we have crafted a proof-of-concept exploit against modern browsers that support WebWorkers.To mitigate this code cache injection threat, we propose anew dynamic code generation architecture. This new architecturerelocates the dynamic code generator to a separate process,in which the code cache is writable. In the original processwhere the generated code executes, the code cache remains read-only. The code cache is synchronized across the writing processand the execution process through shared memory. Interactionbetween the code generator and the generated code is handledtransparently through remote procedure calls (RPC). We haveported the Google V8 JavaScript engine and the Strata DBTto this new architecture. Our implementation experience showedthat the engineering effort for porting to this new architectureis minimal. Evaluation of our prototype implementation showedthat this new architecture can defeat the code cache injectionattack with small performance overhead.

Dual-force: Understanding WebView Malware Via Cross-Language Forced Execution

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Dissecting Android Malware: Characterization and Evolution

AirBag: Boosting Smartphone Resistance to Malware Infection.

Unleashing the Walking Dead: Understanding Cross-App Remote Infections on Mobile WebViews.

Reviving Android Malware with DroidRide: and How Not To.

Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

From Image to Code: Executable Adversarial Examples of Android Applications.

Catch Me If You Can: Evaluating Android Anti-Malware Against Transformation Attacks

Malware Detection in Adversarial Settings

MalModel: Hiding Malicious Payload in Mobile Deep Learning Models with Black-box Backdoor Attack

Automated Generation of Event-Oriented Exploits in Android Hybrid Apps

Iframes/Popups Are Dangerous In Mobile Webview: Studying And Mitigating Differential Context Vulnerabilities

Exploiting and Protecting Dynamic Code Generation.

DroidChameleon

JSLess: A Tale of a Fileless Javascript Memory-Resident Malware

Using HTML5 to Prevent Detection of Drive-by-Download Web Malware

Ransomware Attacks in Cyber-Physical Systems: Countermeasure of Attack Vectors Through Automated Web Defenses

Defensor: Lightweight and Efficient Security-Enhanced Framework for Android

Enhancing Linux System Security: A Kernel-Based Approach to Fileless Malware Detection and Mitigation

Feature-level Malware Obfuscation in Deep Learning