Just-In-Time Compilation and JIT Memory Regions on macOS

Abstract:

Just-In-Time (JIT) compilation is a performance technique that collides with memory safety guarantees, especially Write XOR Execute (W^X) enforcement. macOS hardened this surface over several releases, resulting in a per-thread memory permission model enforced by hardware on Apple Silicon.

This talk explores the evolution of JIT memory management on macOS: the introduction of MAP_JIT, hardened runtime entitlements, and Apple Silicon’s enforcement of W^X through APRR and thread-local permission toggles via pthread_jit_write_protect_np. We’ll discuss how these features map to kernel-enforced page permissions, how PAC and BTI constrain code reuse, and why some exploit primitives (like RWX memory) are less viable within protected regions on Macs.

The session will provide detection opportunities for JIT exploits (Safari, Rosetta 2), and explain how understanding their constraints is great for threat modeling surfaces in macOS processes, detecting anomalous memory transitions, and building hardened JIT engines. We’ll conclude with tooling ideas, guidance for runtime developers, and areas for future detection research.