I tried to detour the DIP (with fatboy88 VTable and StarterKid methods) but then GameGuard detected it. It seems GameGuard detect the DIP first 5 bytes (the DIP address). Once as long DIP detoured (even I delayed it until the game starts), it still detected. I know there is another way called mid-function (nTKid WDDM) method, but that one is quite tedious as I need to attach suddenattack.exe run-time for debugging (I have a shitty computer - core 2 duo with 3gb ram). Please let me know if there is any available method... (PS: Please do not recommend me HWBP method as my pc is WINXP :/)