You can mark a page as inaccessible (not present), and then, in the page fault handler, note somewhere that it was accessed and then allocate it/make it readabl

You can mark a page as inaccessible (not present), and then, in the page fault handler, note somewhere that it was accessed and then allocate it/make it readable. you might not trigger the cheater-flag on a single access (because of, as mentioned, antivirus etc.) but if your page gets accessed over and over again, you can be quite certain that someone is reading it who probably shouldn't...