title: How to create memory region/section with following properties (checked by QueryWorkingSetEx and VirtualQuery)?
body: <p>I need to make memory region/section with following properties:</p>
  
  <p><code>VirtualQuery</code> function checked on such region should return:</p>
  
  <ul>
  <li>AllocationProtect: 0x20 [<code>PAGE_EXECUTE_READ</code>]</li>
  <li>Protect: 0x20 [<code>PAGE_EXECUTE_READ</code>]</li>
  <li>State: 0x1000 [<code>MEM_COMMIT</code>]</li>
  <li>Type: 0x40000 [<code>MAPPED</code>]</li>
  </ul>
  
  <p><code>QueryWorkingSetEx</code> function checked on such region should return:</p>
  
  <ul>
  <li>Valid: 1</li>
  <li>Shared: 1</li>
  <li>ShareCount: 2</li>
  <li>Node: 0</li>
  <li>LargePage: 0</li>
  <li>Locked: 0</li>
  <li>Bad: 0</li>
  <li>Win32Protection: 0x20 [<code>PAGE_EXECUTE_READ</code>]</li>
  </ul>
  
  <p>Additionally, this region cannot be mapped to disk file (<code>INVALID_HANDLE_VALUE</code> when creating mapped file section). Also it should be filled with desired data before it comes with only <code>PAGE_EXECUTE_READ</code> access.</p>
  
  <p>Moreover, it's not possible to change protection of such sector (using <code>VirtualProtect</code> function) to <code>PAGE_READONLY</code> or <code>PAGE_WRITECOPY</code>, despite it's <code>PAGE_EXECUTE_READ</code>. It indicates that it could have undocumented SEC_NO_CHANGE property.</p>
  
  <p>It's possible to do it because it exists in a malware that I am debugging, but it's difficult for me to replicate, also few people in a team failed, I will be impressed if someone will provide me with information about how to create it.</p>