Code injection protection

To gain control of an application, attackers may inject code into the application to control it from within its own process. This can, for example, be used to read encrypted SSL communication or intercept user input such as passwords.

This type of threat is more common on rooted devices since injecting code into another application would otherwise have been prevented by the operating system sandbox.

App Shielding can detect the presence of code hooks, as well as typical code injection frameworks such as Xposed or Cydia Substrate. In most cases it can also block injection of code into the process.

For native libraries of the application, App Shielding can detect changes in the import section of the libraries at run time and changes in text section if the code is hooked or modified by insertion of software breakpoints.