Again, the arrogance is talking. Im not going to give you any hints anymore :)Quote:
If you patch an API temporarily and patch it back to it's original state before the AC runs there is no way to detect this method. Which is why the Vanguard AC from Valorant now installs itself to run at boot-time. That is the only condition where you can detect it.
Web-browsers virtualize code and compile it JIT, but the source of what is compiled is stored in a memory section of the process that was just allocated by VirtualAlloc(). So your answer reveals you don't know anything about basics of low-level memory operations.
So all BE needs is the byte signature any of your UI icons/source of html. Very simple to detect.
Keep replying, reveals more of your incompetence.