The Rowhammer attack is the most intrusive among micro-architectural attacks,for it is capable of actively flipping bits in DRAM cells,enabling privilege-escalation attacks on various platforms.In order to set up Rowhammer against binaries in the Linux page cache,the Waylaying algorithm is applied to stealthily move binaries onto arbitrary physical addresses without exhausting system memory.However,the Waylaying algorithm may run randomly for days,along with heavy disk swapping I/O loads which significantly degrades system performance.We present Memway,an accelerated version of Waylaying algorithm which is much faster and resource-saving.We eliminate 90%running time by utilizing tmpfs for in-memory swapping.Besides,by combining the original page cache eviction mechanism with posix_fadvise API,we can relocate target binary 100 times faster,shrinking total running time from days to minutes.Equipped with the fast Memway+fadvise algorithm,we demonstrate practical Rowhammer attacks against binaries,which takes only 15-200 minutes to covertly relocate victim binary,and less than 3s to flip the binary code.Finally,possible countermeasures and detection methods against this attack are briefly discussed.