This is based on this gist by @dkrutsko. all credit should off to him.
While this gist is approaching with QueryWorkingSetEx, this piece of code is using ZwQueryVirtualMemory. What got my attention is, official document says ZwQueryVirtualMemory solely support MEMORY_BASIC_INFORMATION, but actually supports PSAPI_WORKING_SET_EX_INFORMATION under the hood. I managed to figure it out by observing it with debugger.
It must not be something new technique but was cool for me anyways.
This program first allocates arbitrary 0x1000 size memory and print the address, so u read it with whatever way. either RPM or internally get the pointer of the address and dereference it. Then this program will detect the read operation.
