There is also userfaultfds on Linux: they're a file descriptor on which the kernel will send fault events, and let a userland process handle the page fault. So

There is also userfaultfds on Linux: they're a file descriptor on which the kernel will send fault events, and let a userland process handle the page fault. So, e.g., you alloc a blank page into memory: it isn't mapped yet, so the first read will trigger a page fault. You register that page with your userfaultfd. You (Dota, here) never read from it. If the userfaultfd receives an even that the page is faulting, then it isn't Dota/you that's reading from it. Judging from the comments it sounds like Windows has similar capabilities. … there are all sorts of false-positives here. (Or with any honeypot, really.) Many are mentioned elsewhere in the comments… (Cf., userfaultfd(2).)