Cheat Engine

[Corruptor]

a game i play is getting updates again, and the last patch added quite an aggresive hacker protection.
Unfortunately, this protection also applies to the world editor. If youve ever used it, you will know that its pretty much unusable without third party addons, and with the new hacker protection going on, those dont work anymore.

Now, the protection itself has a lot of stuff going on: breakpoints that are being hit instantly crash the editor, tons of random exceptions (everything from illegal instructions to port I/O exceptions) are being thrown, but the one thing i dont really understand is this:

when the editor gets loaded, the entire code is encripted, but still writeable. After the new dll loads, it decripts the code and then does something with it to "protect" it somehow: after the decryption process, cheat engine can not write to it. It doesnt throw any errors, the changes simply dont apply. Trying to change the page protection to Read/write/execute (from read/execute) also has no effect and doesnt show any errors.
When i try to change the values with other debuggers (e.g x64dbg), it doesnt work either, though that debugger tells me that it failed to write to memory (though it doesnt tell me why).

Notably, other modules (e.g KERNEL32) are not protected in this way and can be written to normally.

I always thought cheat engine maps the virtual memory into its own address space and then works on that, but then i'd expect it to either be unable to read it (since the mapping somehow failed) or to write to it without noticing that the changes didnt apply (in some sort of copy on write scenario), but neither of these are the case. Im not exactly an expert on debuggers and memory architecture though.

Does anybody have an idea what could cause this behavoir? I don't really know where to start looking for something like this.

[Dark Byte]

have you tried kernelmode memory access?

or tried unmapping the view and then map a new one with the same contents there ? (check lua)

or if your system is fast enough you can try dbvm memory cloaking and then edit the page using page replacements

or if nothing works, check the physical address of the memory you're changing (requires kernelmode memory access) and then open the [Physical memory] process and edit it there

[Corruptor]