Cheat Engine

[iPromise]

Well since both functions have calls to functions in kernel mode (NtWriteProcessMemory/NtReadProcessMemory) it makes sense for an anti-hacking system to set a hook on the entry-point on those kernel mode functions via their driver.

If thats the case then can't we just restore the original bytes. What I mean is that:

[Dark Byte]

It's possible, but to do that you must have kernel access yourself, and if you have kernel access you can use other functions as well.
Also, they can check if it has been unhooked and act accordingly, like turning of your psu

[iPromise]

then can't we just simply emulate another Read/WriteProcessMemory function and before it calls sysenter, make it jump to our code which does a hookhop and jumps back to the original kernel function?

is that what you did for cheat engine or did you create our own read/writeprocessmemory function which made use of your driver?

[Dark Byte]

I created my own read and write functions
But yes, it's possible. Every thread has a KThread object which controls the function table to use. If you change your own threads to a table that points to unhooked copies it might work.
Problem is that kthread is service pack dependant and not well documented