Scenario 1: the player can sniff the network.
This can be kind of prevented with HTTPS.
Only, if the player has full control of the client he might patch the client in order to provide and maybe modify the plain text information directly at the application (i.e. game). But this is not covered by your assumptions in scenario 1.
Scenario 2: ... and has access to the source code of the game (not of the server).
Make sure that the source code the client has is not sufficient to play the game, i.e. implement relevant parts of the games logic out of reach of the client: at the server. How this can be done depends a lot on how the game works.
Apart from that you can try to obfuscate the code to make reverse engineering harder, digitally sign any messages from the server so that an attacker cannot fake these (although he might just change the code to disable the signature check) ... But at the end you can only make it harder and not impossible. Knowledgeable players might for example try to write their own server which implements a similar game logic you have in order to be no longer dependent on your servers.
This means is must be easier and more attractive to pay you instead of trying to hack the game. It can help for this if the game is cheap enough to begin with. Or if there are attractive out-of-game items which make it worth to pay.
As for making hacking harder it might be useful to have several versions of the game with different kind of protections in it so that "generic" hacks will only cover few of the game versions which makes it again more cheap just to buy instead of to hack the game. Or make parts of the communication specific for each game installation, i.e. depending on the user id user for authentication. Another way against the spread of generic hacks is to release new versions regularly which interact differently with the server and which would require the development of a new hack, thus frustrating users which rely on the hacks instead of paying.