[7.3] Can't Write to Memory

[kartf]

As of 7.3 I can't seem to be able to write to WoW's memory. Not even cheat engine works, when I try to modify an instruction nothing happens. I'm out of process and I can read memory the way I used to, but WriteProcessMemory throws an "ERROR_INVALID_PARAMETER" and doesn't work.

I assume this is one of the many anticheating measures they added in 7.3. Is there a workaround? At least to get CE to edit memory again.

[doityourself]

remap the memory

[vegoo]

I looked at it, my bot doesn't require (so far) any code changes but I was curious.
In the end, I didn't manage to remap the image, because - I believe - to do so you need one of these:
1. Name of the file mapping object
2. Duplicated handle to the object

I don't think name exists - at least I couldn't find it in Process Hacker handles list. No idea how to get duplicated handle to this object if I don't even know where to look for it, Wow-64.exe has a lot of opened unnamed handles so how to find out which one is correct?
Also I tried VirtualProtectEx but it doesn't seem to work at all.

What is the correct approach in this case?

[ak-48]

create a new section, copy wow memory to that section, unmap the old memory, map it to the same address with the new section.

it's easily detectable because now virtualprotect can success (or you can map use sec_nochange), or if the original memory is also mapped elsewhere.

do not attempt to patch code, there's integrity checks that will crash the game and get you banned.

[doityourself]

create a new section, copy wow memory to that section, unmap the old memory, map it to the same address with the new section.

it's easily detectable because now virtualprotect can success (or you can map use sec_nochange), or if the original memory is also mapped elsewhere.

do not attempt to patch code, there's integrity checks that will crash the game and get you banned.

the remap itself will trigger some checks and cause crashes on some builds

[vegoo]

Yep, that's the case.1-2 minutes after remap its spawning child that crashes the process.

[doityourself]

Yep, that's the case.1-2 minutes after remap its spawning child that crashes the process.

it's not a 'child' that crashes it.

[ak48disk]

the remap itself will trigger some checks and cause crashes on some builds

Remap the shared PAGE_READWRITE page as well.

[dontgetban]

missclick meh