In UE4, there's a level array that contains many actors, with a game potentially having hundreds to thousands of actors. I've been trying to access the memory addresses of the game process using iOS's task_for_pid and mach_vm_region. However, when I iterate through the actor array, the game detects my access attempts, even though I haven't modified any data.
Initially, I thought there might be page fault detection within the game, but this theory was dismissed. When reading, I used mincore to determine the page state, so I'm puzzled about how the game is able to monitor my memory address accesses.
The game operates in user space, and theoretically, it shouldn't have kernel permissions to perform such monitoring. Yet, I'm uncertain why this game can detect mere memory access operations.
Accessing other memory addresses won't be monitored, but once the actor address is accessed, it gets monitored. For example, int nameID = *(int*)(actor+0x18); then, you'll face a ban, but it's not a 10-year ban, just 1 to 30 days.