koumodgp

A server integrity, anticheat and exploit-prevention plugin for dedicated Valheim servers.

koumodgp keeps a server's players on the exact mod set the admin expects, catches cheaters, and blocks common exploits. It is installed and configured by the server owner and is meant for legitimate server administration. The same koumodgp.dll runs on the server and on clients.

Exploit protection — 3 exploits blocked (all on by default)

These are the headline additions. Each is enabled out of the box and enforced across all clients:

1. Animation-cancelling — binding an emote to the attack key to interrupt a swing and attack faster. koumodgp refuses emotes while you're mid-swing, so attacks play at normal speed.
2. Dungeon escape — building a log inside dungeon to glich outside allowing to glide/fly from top of the dungeon. koumodgp blocks building anything except the campfire inside dungeons.
3. World-seed leak — the printseeds console command handing normal players the world seed (used to look up bases/dungeons on seed-map sites). koumodgp disables the command for players.

What else it does (anti-cheat)

• Mod whitelist — every client reports its loaded BepInEx plugins; the server compares them to the admin's list and kicks mismatches (missing, extra, or wrong-version mods).
• Integrity check — detects code from unauthorized third-party injectors that patch the game at runtime (the usual way cheats are injected into a modded client).
• State audit — checks well-known game flags (god mode, fly, ghost, free build) that external trainers toggle. These are never set for a normal player.
• Program check (Windows clients) — matches running program names / window titles against a list of known cheat tools (WeMod, Cheat Engine, trainers — shipped active by default).
• Exclusive characters — kicks characters that have played on other worlds, enforcing fresh, server-only characters (on by default).

Admins (on the server's adminlist.txt) are fully exempt and never checked or logged.

Install

1. Put koumodgp.dll in BepInEx/plugins/ on the server and on every client.
2. Start the server once. It creates:
   • BepInEx/config/koumodgp.cfg — settings.
   • BepInEx/config/koumodgp/required/ — folder for required mods.
   • BepInEx/config/koumodgp/allowed/ — folder for optional mods.
   • BepInEx/config/koumodgp/signatures.txt — cheat-tool signatures.
3. Configure it (below), then kougp reload in the console — or restart.

Step 1 — Set your allowed mods (drop-a-DLL)

You do not edit text for mods. Just drop the mod .dll files (or whole plugin folders) into the folders and koumodgp reads each one's id and version automatically:

• BepInEx/config/koumodgp/required/ — every client MUST run these exact mods + versions. Put every client-side mod your modpack uses here.
• BepInEx/config/koumodgp/allowed/ — permitted if a client has them, but not required (e.g. optional qol mods like camera build).

Any mod a client runs that is not in either folder → the client is kicked.

Step 2 — Detect external cheats (signatures)

To catch standalone cheat programs (things that run as their own app, not as a game mod), add their names to BepInEx/config/koumodgp/signatures.txt — one per line. A signature is a lowercase text fragment matched against running process names and window titles.

Shipped active by default:

wemod
cheatengine
trainer
wand

Rules:

• One signature per line, no # in front (lines starting with # are comments).
• Matching is a contiguous substring — trainer matches "Valheim … 21 Trainer"; but valheim trainer would NOT match that title because the words aren't adjacent.
• Use distinctive fragments. Avoid single broad words that could match innocent programs.

Step 3 — Discord logging (optional)

In BepInEx/config/koumodgp.cfg under [Logging]:

DiscordWebhookUrl = https://discord.com/api/webhooks/xxxx/yyyy

Leave empty to disable. When set, koumodgp posts the exact kick reason (type + detail) plus the player name and SteamID, and lifecycle/admin events. All timestamps show in each viewer's own local timezone automatically. Full detail of every detection is always written to BepInEx/config/koumodgp/violations.log.

After changing the webhook URL you must restart the server (URL is read at startup).

Recommended: keep InjectedAssembly = Flag

Under [Policy] in the cfg, leave InjectedAssembly = Flag (the default). In-memory assemblies have many legitimate causes (mods' embedded dependencies, runtime-generated code), so this logs them for your review instead of auto-kicking — you get a Discord/audit note naming the mod or DLL and can ban manually if it's actually a cheat. Real injected tools that patch the game are still kicked automatically by the foreign-Harmony check regardless of this setting.

Exploit #1 — Block animation-cancelling (on by default)

Valheim attacks recover on an animation timer. The exploit binds an emote to the attack key — pressing it interrupts the swing so the stab lands faster than a legit player can manage ("animation cancelling" / emote-cancel). koumodgp refuses emotes while you're attacking, so attacks always play at their normal speed. Chat /cheers and normal keybound emotes still work outside of combat. In [Combat]:

PreventAnimationCancel = true      # master toggle (default true)
AnimCancelRecoverySeconds = 0.75   # how long after a swing emotes stay blocked (default 0.75)

Exploit #2 — Block dungeon-escape building (on by default)

Players can build logs inside dungeon to glitch outside of dungeon, this allows them to fly/glide from a very high place. koumodgp blocks building everything except the campfire inside dungeons, so there's nothing to climb out on. In [Dungeon]:

RestrictDungeonBuilding = true     # master toggle (default true)
DungeonAllowedPieces = fire_pit    # comma-separated prefab names allowed inside dungeons

The build ghost turns red and shows the normal "can't build in dungeon" message. Add prefab names to DungeonAllowedPieces if you want to permit more pieces inside dungeons.

Exploit #3 — Block the world-seed leak (on by default)

The vanilla printseeds console command hands any player the world seed — which can be used on seed-map sites to locate bases, bosses and dungeons. koumodgp disables printseeds for player clients (the server console can still use it). In [General]:

BlockPrintSeed = true              # default true

Exclusive characters (on by default)

koumodgp checks whether a joining character has played on other worlds; if so, it kicks — enforcing fresh, server-only characters and blocking imported/outside progress. Honest caveat that once a player used his character on other world, the character can no longer be used in server unless the feature is disabled.

[Character]
ExclusiveCharacter = true     # set false to allow imported characters

[Policy]
ForeignCharacter = Kick       # action when a non-exclusive character joins

Admin commands

Works both in the dedicated-server console and in-game (F5 console) for admins. In-game commands are verified server-side, so only real admins can use them.

kougp status                     connected players + verification state
kougp list                       current required / optional mods + signatures
kougp listall                    every plugin loaded on the server (guid = version)
kougp reload                     reload mods + signatures and push to clients (no restart)
kougp allow add <guid> [ver]     add a required mod by id (also: remove)
kougp sig add <text>             add a cheat-tool signature (also: remove)
kougp kick <name>                kick a player
kougp ban <name>                 ban a player (bannedlist.txt)

kougp reload refreshes the mod folders and signatures live — no restart needed. (Only the .cfg settings, like the webhook URL, require a restart.)

Notes

• Cheat detections kick by default; bans are a manual admin action, but can be configured on the server to auto-ban.
• Recommended to keep InjectedAssembly = Flag to avoid false positives.
• The three exploit blocks are server-controlled and pushed to every client, so players can't disable them locally.
• I made this anti-cheat because of people I met who knows a lot of exploits/cheats. Almost all of cheats they use are blocked by this mod.

Support

Discord: jjqqwws

Changelog

All notable changes to koumodgp are documented here. This project follows Semantic Versioning (MAJOR.MINOR.PATCH).

0.8.0

Added — boss-altar build block (4th exploit)

• Blocks building fire/trap pieces near boss altars to stop the campfire/spike-spam-on-spawn cheese. When blocked, the piece can't be placed and a message shows on screen. Off by default. Config [Boss]: BlockBuildNearBossAltar (default false), BossAltarNoBuildRadius (default 20m), BossAltarBlockedPieces (default fire,torch,stake,spike,sharp; leave empty to block all building near altars).

0.7.0

Added — now blocks another 2 exploits (print seed, glitching outside dungeon)

• Dungeon-escape block — players can build logs inside dungeon allowing them to glich outside and fly/glide from a very high place.
• printseeds command block — the vanilla printseeds command handed normal players the world seed (usable on seed-map sites to find bases/dungeons). It's now disabled for player clients.

0.6.1

Added

• kougp listall console command — lists every BepInEx plugin loaded on the server as guid = version.

0.6.0

Added

• Exclusive-character enforcement A joining character that has played on any world other than this server's is kicked.

Changed

• Default cheat-program signatures now ship active: wemod, cheatengine, trainer, wand.

0.5.1

Compatibility

• Rebuilt for the latest Valheim update.

0.5.0

Fixed

• No more false-positive kicks on modded clients. Assembly detection now recognises a mod's embedded dependencies as belonging to that installed mod, so they are no longer mistaken for injected code. Trust is derived from what your installed mods actually declare, so it adapts to any modpack — no manual whitelist.

Changed

• InjectedAssembly is now advisory (Flag) by default, not a kick. In-memory assemblies have many legitimate causes, so a lone one is logged for admin review instead of kicking. Injected tools that actually patch the game are still kicked on sight by ForeignHarmony. Set the policy back to Kick if you want the old behaviour.

Added

• Localised Discord timestamps — detection posts now render the time in each viewer's own timezone (Discord dynamic timestamps), with a relative "x ago" too.

0.4.0

Added

• Prevents Animation-Cancelling — stops the emote-cancel exploit where binding an emote to the attack key makes attacks come out faster than intended. Blocks emotes while an attack is being pressed or is in progress, so the swing plays out at its normal speed. Chat /cheers and normal keybound emotes are unaffected outside of combat.
  • Server-configured under [Combat] and pushed to every client:
    • PreventAnimationCancel (default true) — master toggle.
    • AnimCancelRecoverySeconds (default 0.75) — post-swing window emotes stay blocked.

0.3.0

Added

• Auto-ban option — AutoBanDetections under [General] (default false). When enabled, a client caught actively cheating (injected assembly, foreign Harmony patch, impossible game state, or a matched cheat-program signature — internal or external) is added to the server's bannedlist.txt and disconnected, instead of only being kicked. Compliance-only issues (mod mismatch, missing companion, heartbeat failure) are never auto-banned.

0.2.0

Added

• Initial public release. Single koumodgp.dll for server and clients (role detected at runtime).
• Mod whitelist — clients report loaded plugins; mismatches are kicked.
• Integrity scan — flags injected assemblies / foreign Harmony patches.
• State audit — flags god/fly/ghost/no-cost on non-admins.
• Program scan — matches known cheat-program process/window signatures.
• Admins (adminlist.txt) fully exempt. Optional Discord webhook for generic detection notices and lifecycle/admin events. Local violations.log for full audit detail.