place a bp on memory when you change it ,then wait for the bp ( breakpoint ) to be hit ( executed ) this will tell you exactly where that location was scanned from then take out the routine that checks it or function bypass it with a detour if you dont understand these terms , go to msdn and search for them.