temporary .zdata bootstrap -> allocate/register a session-persistent handler page -> erase the .zdata bootstrap > handler remains until process exit. it's memory scanner that tracks the entire process and issues a ban on detecting changed code in known places it watches, just like warden but installed inside your game memory for the entire session. can pretty much read/write/execute everything it wants both inside the game client memory and outside it, your processes on computer including wrobot software can be simply read. not clear if they do that but they surely can and won't tell you that. you cannot hide your cheating software if it uses what's not allowed in-game, you cannot just detach what comes into memory because it will likely crash the game, you cannot forbid it from entering because you won't log into the world. they currently allow some modifications due to many cosmetic ones, laa, some other non-hurting others' ego altered experience which you can use as the only gap to perform around-forbidden actions. they likely decided to ban only for the known prohibited memory changes which is the right thing in terms of not getting non-cheating people negative reactions but having access to hd client and other modern non-cheating stuff. i wont be surprised they just check wrobot among your launched processes and issue a ban lol. im sorry if info is too blunt, i am not an expert , more like an advanced computer user.