I doubt they’re doing anything super clever with examining access to memory regions. From the way they use the word ‘honeypot’ and other comments here about che

I doubt they’re doing anything super clever with examining access to memory regions. From the way they use the word ‘honeypot’ and other comments here about cheating software setting team vision flags, I suspect they simply noticed some of their internal functions were commonly being used by cheating software. From there it’s simple: duplicate those functions, add “_legit” suffixes, find/replace all use of those functions in your code with the _legit-suffixed version, and add logging to the original function without breaking its functionality. You can even formally prove that the original function will never be called by legitimate clients with dead code analysis. Cheating software will go on using the original functions because they still work, not realizing that the core game logic functions they were using have suddenly become dead code with logging.