1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor: identify regions of code that include API code pages to be monitored; probe and lock code pages that include the identified regions of code; and remap the code pages as execute-only.