PTC String Pointer Usage

An NOP does not change the value of something, it removes the operation present at that address in memory. Hence "No Operation Present".

You would not be NOPing the string, you would NOPing the operation that Pushes the value of the string onto the stack.

Here is some of the radar function that is responsible for the NX chams.

Currently push offset aSkelmodelstenc is pushing a value of 0 onto the stack, meaning the Chams are not enabled. By removing that operation you are stopping the value from being pushed onto the stack, turning the chams on.

By writing the original bytes back, you are writing the original operation back, turning the chams off.

He mean's that if you NOP the address that pushes the value, while the chams are on, meaning its pushing a value of 1 onto the stack, the chams will still be on.