# JITScanner: Just-in-Time Executable Page Check in the Linux Operating System +
## 3 The JITScanner System
### Executable-Page Access Interception  
Within JITScanner's framework, the primary focus lies in intercepting a genuine access to an executable virtual page, particularly when the CPU actively fetches an instruction from that specific virtual page. Consequently, our solution does not initiate checks on any executable virtual page until the moment when the application actually requires the binary code contained within it. In line with the typical on-demand paging process, this need arises after an executable page is allocated by the kernel and placed into an RAM frame. Subsequently, the pagetable of the application is updated, granting the execution capability and making the page accessible. It is precisely at this point--when the CPU fetches instructions from the executable page--that JITScanner intervenes to conduct the necessary checks and verifications, ensuring the integrity and security of the fetched binary code. To precisely identify the moment when a memory page is initially accessed for an instruction fetch, our solution employs a series of strategically placed kernel probes within the page fault handling process. Specifically, we utilize the kprobe subsystem provided by the Linux operating system to set up a hook on the return of a core page-fault handling procedure. In greater detail, we have installed a kretprobe on the handle_mm_fault() procedure within the Linux kernel. Upon completion of this procedure's execution, the target page that triggered the fault has already been materialized in RAM. At this stage, we can conduct the synchronous check on its content since it is now available in memory. Additionally, we take a snapshot of the page, which is managed for subsequent examination by the asynchronous check. This approach allows us to precisely time the execution of checks and efficiently manage the content of accessed pages for both synchronous and asynchronous analysis. An essential consideration in our hook execution is to perform the page check only if the accessed page for instruction fetch is a legitimate page within the address space. Anyattempt to access a non-legitimate page does not result in the actual materialization of the page in RAM through the operating system's handle_mm_fault() function. Instead, it leads to the delivery of the SIGSEGV signal to the application, indicating a segmentation fault or an invalid memory access attempt. This distinction is particularly pertinent in our management of WX (Write-Execute) pages. For these pages, an \"original\" page fault triggered by the operating system--associated with the first access to the virtual executable page, which we intercept using the hook--is insufficient for checking the absence of malicious signatures. As a result, careful consideration is necessary to ensure that our page checks are executed only when the accessed pages are legitimate within the application's address space, thereby optimizing the effectiveness of our security measures while avoiding unnecessary checks on non-legitimate pages. For managing WX (Write-Execute) pages, we have developed an innovative kernel-level mechanism that dynamically adjusts the actual page permissions while the program is executing. Despite these dynamic modifications, the page remains \"logically\" accessible at the application level in both Write (W) and Execute (X) modes. This kernel-level facility operates entirely transparently to the actual program, ensuring that the application is unaware of these permission modifications. However, it grants us the capability to monitor and track page access--whether for writing data or fetching instructions--throughout the program's execution. Essentially, this facility establishes a shadow state machine that aligns with the legitimate permissions granted to the application for the page. By dynamically managing and tracking the permissions without the application's knowledge, we can maintain security while ensuring necessary access to the pages, offering a nuanced and transparent approach to managing WX pages.