# Analysis of Tizen Security Model and Ways of Bypassing It on Smart TV Platform
## 5 Example of Attack Scenario
### Attacking WebBrowser
#### 5.1.1. Bypassing DEP  
At this point, we achieved full access to _WebBrowser_ process memory. Unfortunately, we cannot execute our code directly as our data are allocated only in the memory with PROT_READ | PROT_WRITE (RW) flags, and we lack PROT_EXEC (X) permission; this is caused by the presence of DEP [46]. We decided to bypass it by the application of a variant of ROP (Return-Oriented Programming) [50; 51] called JOP (Jump-Oriented Programming) [51; 52]. Similarly to ROP, it also uses existing code fragments in process executable memory to achieve code execution. Nevertheless, JOP does not utilize a stack but instead uses a series of jump (in the case of ARM branch) instructions. Once we are able to execute pieces of existing process code to achieve our goals, we have to change memory properties from RW to RWX. We can put our code in memory, but it does not have PROT_EXEC--(X) flag, so as a result, we would not be able to run it. Therefore we decided to use function \(\mathtt{mprotect}\) to change memory settings. However, firstly, we have to find a way to call it. Similar to Webkitities project ([[http://acez.re/ps-vita-level-1-webkitities-3/](http://acez.re/ps-vita-level-1-webkitities-3/)]([http://acez.re/ps-vita-level-1-webkitities-3/](http://acez.re/ps-vita-level-1-webkitities-3/)), accessed on 15 December 2021) we looked for the function, which would allow us to use it to change memory protections. As a result, we need an object which fulfills three criteria: it should have virtual methods, the function should have parameters of basic types, and the object should be easy to locate in memory. One of the appropriate objects was _textarea_ with function \(\mathtt{setScrollLeft}\). At this point, we spray many _textarea_ objects; once we locate one, we modify its _vtable_ to achieve code execution. Still, there remains the issue of not having anything to execute. Moreover, even if we set the address of \(\mathtt{setScrollLeft}\) to \(\mathtt{mprotect}\) (Listing 3), we will not be able to use it as we need to set three parameters, whereas \(\mathtt{setScrollLeft}\) allows us to set only one of them. To solve those issues, we search for code fragment (gadget), which will load from memory location values of R0-R3 registers and execute function passed in R3 register (Listing 4). When we find it, we can change address of \(\mathtt{setScrollLeft}\) function to this part of code and instead of calling \(\mathtt{setScrollLeft}\) function localized gadget code will be executed. Now we only need to put appropriate values in the right places in memory and find the address of \(\mathtt{mprotect}\) function to pass it to R3 register (Listing 5). Because of the characteristic features of this function, it is easy to find. Finally, we can call \(\mathtt{setScrollLeft}\) function with one argument--address of the memory where the parameters we want to change and protection flags are stored. ```
intmprotect(void*addr,size_tlen,intprot);
```  
On ARM platform arguments are passed in registers R0-R3. Therefore, we decided to use a gadget that is part of didReceivePluginControllerProxyMessage function of _PluginControllerProxy_ object. It sets R0-R3 values and executes function pointed by R3 register. ```
text:45 ABC368;CODEXREF:WebKit::PluginControllerProxy:: didReceivePluginControllerProxyMessage(CoreIPC::Connection*,CoreIPC:: MessageDecoder&). text:45 ABC36E LDR R0,[R0,#0x1C] text:45 ABC370 DR R2,[R1,#4] text:45 ABC372 LDR R3,[R0] text:45 ABC374 LDR.W R3,[R3,#0 xA4] text:45 ABC378 CBZ R2, loc_45 ABC37E text:45 ABC37A LDR R1,[R1] text:45 ABC37C BX R3
```  
Listing 4: WebKit gadget that loads R0-R3 register values from memory and executes function passed in R3. This allows us to set all three parameters by loading R0-R3 register values in JavaScript code and execute any function (which address we set in R3 register) by using only a few lines of JavaScript code (Listing 5).