# JITScanner: Just-in-Time Executable Page Check in the Linux Operating System +
## 2 Related Work
They aim to enhance security by reducing vulnerabilities that may arise within the kernel space. In contrast, our solution targets the reduction of risks that are primarily dependent on the user-level portion of the application. We concentrate on fortifying security measures concerning the user-level aspects, particularly in identifying and mitigating risks associated with executable pages and their content within the application's address space. Our technique leverages a sophisticated handling of unused bits within the entries of an active program's page table. While similar approaches have been utilized by kernel-level solutions oriented towards performance improvements--such as transparently managing page contents for checkpointing [19] or in the development of distributed shared-memory layers [20]--our innovation lies in utilizing these available bits to construct a completely new shadow state machine. This state machine forms the backbone of our JITScanner technique, enabling us to dynamically manage and monitor the execution of code within an application's address space with enhanced security measures. In comparison to the OmniUnpack kernel-level security solution [21], there are distinct differences in the methodology and capabilities of our JITScanner approach. OmniUnpack intercepts the initial attempt to fetch an instruction from a modified WX (Write-Execute) page and marks the page, but the actual verification occurs at a later time. This delay could potentially allow an attacker to rewrite the malicious page, concealing its actual content before the inspection takes place. Conversely, our JITScanner utilizes page snapshots, enabling us to track every transition of an executable page's content, particularly each time it is reused for instruction fetching. This granular monitoring provides a more comprehensive observation of page content transitions, enhancing our ability to detect potential malicious alterations. Moreover, while OmniUnpack does not handle purely executable pages, limiting its ability to trace such pages in conjunction with WX pages, JITScanner overcomes this limitation. We specifically designed JITScanner to trace both purely executable pages and WX pages, which is crucial in countering sophisticated attack techniques such as ROP (Return Oriented Programming). ROP techniques exploit gadgets located anywhere within both executable and WX pages, and our comprehensive tracing capability helps prevent such exploits. Additionally, OmniUnpack's compatibility is limited to Windows XP and cannot be deployed on more recent Windows operating system releases. In contrast, our solution is designed to function with current Linux releases and aligns with the latest support for developing Linux kernel modules, providing compatibility and usability with modern Linux systems. In comparison to the work presented in [22] for Windows XP, there are several fundamental differences between its kernel-level service and our proposal with JITScanner. The work in [22] introduces a kernel-level service that logs any page accessed for execution but not considered trusted, subsequently allowing analysis of the page content to determine the presence of critical machine instruction patterns. However, there are two significant distinctions from our proposal. Firstly, the approach in [22] relies on a preliminary classification of non-malicious pages (e.g., library pages) to trigger the inspection of executable pages. In contrast, JITScanner supports the inspection of any executable page as soon as its content materializes in RAM and is accessed via an instruction fetch, without requiring prior classification. Secondly, similar to OmniUnpack, the work in [22] introduces a memory management mechanism that excludes the possibility of fetching instructions from a writable page at page mapping time. However, once the page is accessed by an instruction fetch, it becomes regularly usable after a copy is logged on the hard drive.