ggprotect64.sys

nProtect GameGuard anti-cheat driver

From INCA Internet Co.

Status

On a known-vulnerable list

Known variants

1 distinct hashes

Field notes

ggprotect64.sys is a kernel driver for nProtect GameGuard, one of the most widely deployed (and most controversial) anti-cheat systems in online gaming. GameGuard is used by MapleStory, Undecember, and many Asian MMORPGs. It operates at a very deep kernel level, intercepting system calls and monitoring processes in ways that have drawn persistent criticism from the PC gaming community for interfering with legitimate software.

The driver is on the public LOLDrivers list. GameGuard's aggressive kernel access surface is precisely the kind of broad IOCTL interface that appears on vulnerable driver lists: the same hooks that detect cheat tools also expose a wide attack surface to anything else on the machine.

If you play a game that uses GameGuard, the driver is expected. There is no user-level fix for the access surface; the decision is GameGuard's publisher's to make.

What the record shows

ggprotect64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.

What this means, plainly

Presence is not proof of misuse. Driver files on the LOLDrivers list commonly ship with legitimate hardware tools, gaming software, or vendor utilities. Their presence is recorded as evidence on a record. It is never treated as a verdict about a person.

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “ggprotect64.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/ggprotect64-sys