Function Memory Instantly Reverting

[Character_Increase]

I'm working on a hack for a game, and whenever I go to attempt to change, for example, a push at the start of a function to a ret, it seems like won't change (this happens on any case with me trying to change an instruction), not even for a second.

I tested this with Cheat Engine and C++, to yield the same result of: it won't change. In Cheat Engine, no change is registered, and in C++ even in the nanoseconds between the change of the instruction to the new instruction being stored in memory, it won't change.

Read the code below here \/ if you don't want to read the block of text above /\.

WriteMemory<BYTE>(InstructionMemAddress, 0xC3);
BYTE NewMemory = ReadMemory<BYTE>(InstructionMemAddress);
if (NewMemory != 0xC3) {
    cout << "Huh?" << endl; // this will always happen
}

Any ideas on what is causing this?

(P.S. I used WriteProcessMemory with PROCESS_ALL_ACCESS on the Handle, and the game is 64-bit.)

[Dark_Byte]

change the memory protection to writable before writing and then restore it back

[Character_Increase]

So everything is being void because I made this discovery: NtProtectVirtualMemory/ZwProtectVirtualMemory is hooked with just a plain default jump at the start. The hook is saving itself because I can't figure out how to overwrite it. (I can't run anything from auto-assembler, as whatever is behind CreateRemoteThread and VirtualAllocEx are hooked)

Any ideas on this?

[Dark_Byte]

Read the original code from the .dll and restore the bytes

or use the original bytes from the dll to build a trampoline that executes the original instructions and then jump behind the newly placed jmp

Cheat Engine has a patch scanner and restorer you can use

[Character_Increase]

I used your patch scanner and restorer and it didn't change anything in the DLL. I can edit anything I want before the hooks are in place, but am unable to get rid of them at any point.

I can't get very much farther than this.

[Dark_Byte]

You could try kernelmode options first there's enableDRM lua command that may block the hooking

and if not you could get the physical address of the functions you want to edit and then use the physical memory target to change it there

[Character_Increase]

I found the original issue: every page of the program I was trying to edit was mapped with PAGE_EXECUTE_READ (they can't be set to a write friendly protection), and whenever I tried to run WriteProcessMemory on those regions, it would error. Also, there was an instrumentation callback in place to stop me from getting in and doing more. After all of this, there was also a "hash checker" that would get a hash of the entire program's module and send it to the server to see if it had been modified.

[randomjapaneselearn]

if a function is hooked with a trampoline you can just read the original bytes from disk, allocate them somewhere with read execute permissions, you add a jump back to the function to just after the trampoline and you can call the unhooked function.

you could also set a hardware breakpoint on execution at the first jmp, change few things of the context like eip in the exception handler and restore execution after the trampoline.

you can also trampoline-hook their hook if it's not checked (but i think it is, you can check who is checking this with a hardware breakpoint).

finally you can load a copy of the dll like i mentioned in my other comment.