It is fundamentally impossible to validate that an unmodified version of your client connects to your server.
... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware.
When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. The "debugger" can be a full-blown virtual machine. If you want to avoid that, you can try to engage in an elaborate hide&seek game where you imagine extra detection systems, and attackers counter these with variants of their own tools. This is the problem of people trying to design anti-cheat software solutions (e.g. PunkBuster); this is also the problem of people who want to sell Video-on-Demand services while preventing the customers from saving the videos locally and then publishing them on various file sharing platforms.
To sum things up, these protections don't work well, even when the data to protect is as trivial as extra lives in some game.
To avoid this, you have to make your code run on protected hardware, that will defend itself against deep inspection from its presumed owner. This is the model of gaming consoles, payment terminals and smart cards.
A TPM is an attempt at a compromise: a tamper-resistant module running within what is otherwise a normal PC; the assumption here is that a normal user will find it too hard to modify the hardware to, for instance, read and write all the RAM without going through the pieces that are under supervision of the TPM module (e.g. the CPU).
Without such hardware on the client side, what you are trying to do will not work. Unless altering the client code would be so worthless than nobody even tries. It all depends on the value of what is at stake here.