# HoYoKProtect patch (Windows, clients 9.0+)

Makes the `IsLoadMHYBase` predicate in `BH3_Data/Native/UserAssembly.dll`
return false, turning the client-side MHYP loader off. Only that file is
written; the region is confirmed from `ChannelConfig` first.

## Discovery (`hoyokprotect/discovery.rs`)

1. In `.text`, match the encoded `IsLoadMHYBase` string construction by
   byte pattern (not a fixed RVA); exactly one match.
2. The exception directory gives the containing function's bounds. It
   must start with the known prologue, end with the known boolean-return
   epilogue, and contain the match.
3. Exactly two relative `CALL`s must target the function, followed by the
   known module-check and initialization byte sequences.

`il2cpp_get_api_table` must be exported. Unknown or ambiguous results
abort.

## Edit

| Location | Original | Replacement | Effect |
| --- | --- | --- | --- |
| First 3 bytes of the function | `55 41 57` | `31 C0 C3` | `xor eax, eax; ret` |

Discovery re-runs on the edited image to confirm the disabled form, then
the file is written via `util::replace::verified`. An already-disabled
function is left unchanged.