Hi3-Patcher/docs/hoyokprotect.md

HoYoKProtect patch (Windows, clients 9.0+)

Makes the IsLoadMHYBase predicate in BH3_Data/Native/UserAssembly.dll return false, turning the client-side MHYP loader off. Only that file is written; the region is confirmed from ChannelConfig first.

Discovery (hoyokprotect/discovery.rs)

1. In .text, match the encoded IsLoadMHYBase string construction by byte pattern (not a fixed RVA); exactly one match.
2. The exception directory gives the containing function's bounds. It must start with the known prologue, end with the known boolean-return epilogue, and contain the match.
3. Exactly two relative CALLs must target the function, followed by the known module-check and initialization byte sequences.

il2cpp_get_api_table must be exported. Unknown or ambiguous results abort.

Edit

Location	Original	Replacement	Effect
First 3 bytes of the function	55 41 57	31 C0 C3	xor eax, eax; ret

Discovery re-runs on the edited image to confirm the disabled form, then the file is written via util::replace::verified. An already-disabled function is left unchanged.