I think people caught on this problem are looking at it wrong. Don’t look at how code has been protected - your game engine isn’t your game. You should be protecting data - look at how websites, Netflix, and Spotify protect themselves from scrapers.
On the server side, you need to monitor the resources people are requesting. You can look for two things that would be suspicious:
1 - Requesting resources in an order that doesn’t make sense in my game. IE, if you have a set of level data and a set of enemy data, where it would be expected that levels are retrieved then enemies for that level, it wouldn’t make sense if you saw back to back requests from an account for level data without requests for enemy data in-between. Or if that level sequence doesn’t make sense - IE, if level 3 has to be visited before level 2, but you see them access 1, 2, 3.
2 - Requesting resources too quickly. It wouldn’t make sense for a request for level 2’s data to come just a second after the request for level 1’s data.
If either behavior is detected on the server side, you can block their account from making further requests and pop up a bug report form on the client end. If your piracy detection system has a bug, then it’s proper to ask for details - you’ll review and unblock their account if it turns out you were wrong. If you’re right, then they’re stuck with an uneasy feeling that you’re onto them and might stop trying.
You can further monitor for if you’re ending up with a lot of accounts getting blocked in a certain part of the world - might indicate someone really determined to steal the data (without even bothering to play the game properly.)
Someone determined to steal the game could still do a proper 100% play through, capturing every single data packet, but the more value your game offers, the harder it’d be for them to accomplish.