Field Guide · Anti-cheat

miHoYo anti-cheat (mhyprot, legacy)

miHoYo's earlier kernel anti-cheat shipped the drivers mhyprot2.sys and, from 2022, mhyprot3.sys with Genshin Impact, until version 4.1 in September 2023 left only its successor, HoYoKProtect.sys. Signed and independent of the game, mhyprot2.sys became the textbook bring-your-own-vulnerable-driver case in 2022 when ransomware actors used it to disable antivirus from kernel mode. Builds of both are on Microsoft's Vulnerable Driver Blocklist and the LOLDrivers list, though not the last mhyprot3 build Genshin shipped, in versions 3.1 to 4.0.1. Corrected 2026-10-20: this entry used to say the anti-cheat ships mhyprot2.sys, in the present tense; Genshin last shipped it in 2022.

kernel · with gameLoads a kernel-level driver while the game runs, then unloads it when you quit.

How it loads

While a protected game runs

Firmware it asks for

None catalogued

Games catalogued

Catalogued as of

October 2026

What it can and cannot see

miHoYo's legacy anti-cheat ran as a signed Windows kernel driver, loaded for the game. Its place in the public record is less about what it watched and more about what was done with it: in 2022, ransomware crews loaded this legitimate signed driver onto machines that never ran a miHoYo game, and used its kernel access to switch off antivirus. That is the bring-your-own-vulnerable-driver pattern, and it is why a signed driver is not the same as a safe one. No current HoYoverse game ships it, but a copy left behind by an old install can still be registered on a machine.

The same boundary applies to every anti-cheat here. Anti-cheat that runs on your PC can examine what happens on that PC, to the depth its design allows. It cannot see a second computer, a capture device, or hardware placed between an input device and the port it plugs into. That is why the presence of an anti-cheat is not, on its own, proof of anything about a player, in either direction. Vera describes what runs; it does not decide what it means.

The kernel driver

The part of this anti-cheat that runs in the Windows kernel, catalogued in the Field Guide's drivers section:

mhyprot2.sys

Games that use it

No current game in this guide uses it. Its publisher's current games use HoYoKProtect (HoYoverse anti-cheat) instead.

Source

Catalogued by Vera from the anti-cheat maker's own documentation and named public reporting (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others). Anti-cheats change; these notes reflect the public record as of October 2026. What is here is public evidence, never an accusation about a person.