koumodgp

koumodgp

A server integrity, anticheat and exploit-prevention plugin for dedicated Valheim servers.

koumodgp keeps a server's players on the exact mod set the admin expects, catches cheaters, and

blocks common exploits. It is installed and configured by the server owner and is

meant for legitimate server administration. The same koumodgp.dll runs on the server and on

clients.

Exploit protection — 4 exploits blocked

The headline additions, enforced across all clients (1–3 on by default; #4 opt-in):

• Animation-cancelling — binding an emote to the attack key to interrupt a swing and attack

faster. koumodgp refuses emotes while you're mid-swing, so attacks play at normal speed.

• Dungeon escape — building a log inside dungeon to glich outside allowing to glide/fly from top of the dungeon. koumodgp blocks building anything

except the campfire inside dungeons.

• World-seed leak — the printseeds console command handing normal players the world seed

(used to look up bases/dungeons on seed-map sites). koumodgp disables the command for players.

• Boss-altar build cheese — spamming campfires/spike-traps around a boss altar so the boss

spawns into fire/traps. koumodgp blocks fire/trap building near altars (off by default).

What else it does (anti-cheat)

• Mod whitelist — every client reports its loaded BepInEx plugins; the server compares them

to the admin's list and kicks mismatches (missing, extra, or wrong-version mods).

• Integrity check — detects code from unauthorized third-party injectors that patch the game

at runtime (the usual way cheats are injected into a modded client).

• State audit — checks well-known game flags (god mode, fly, ghost, free build) that external

trainers toggle. These are never set for a normal player.

• Program check (Windows clients) — matches running program names / window titles against a

list of known cheat tools (WeMod, Cheat Engine, trainers — shipped active by default).

• Exclusive characters — kicks characters that have played on other worlds, enforcing fresh,

server-only characters (on by default).

• Disguised-cheat detection — catches injected cheats that don't patch the game and hide behind

a real mod's name (e.g. a cheat menu calling itself "Jotunn"):

• Impostor check — a loaded assembly using an installed mod's name but not actually that mod

→ kick ([Policy] ImpostorAssembly).

• Unowned component check — a live in-game component from injected code no installed mod,

the game or the engine accounts for → flag ([Policy] OrphanBehaviour).

• Framework names are no longer trusted by name alone — injected code must be the real mod or a

declared dependency, otherwise it's flagged (InjectedAssembly).

Every detection is written to violations.log and posted to the Discord webhook (flag or kick).

Admins (on the server's adminlist.txt) are fully exempt and never checked or logged.

Install

• Put koumodgp.dll in BepInEx/plugins/ on the server and on every client.
• Start the server once. It creates:
• BepInEx/config/koumodgp.cfg — settings.
• BepInEx/config/koumodgp/required/ — folder for required mods.
• BepInEx/config/koumodgp/allowed/ — folder for optional mods.
• BepInEx/config/koumodgp/signatures.txt — cheat-tool signatures.
• Configure it (below), then kougp reload in the console — or restart.

Step 1 — Set your allowed mods (drop-a-DLL)

You do not edit text for mods. Just drop the mod.dll files (or whole plugin folders)

into the folders and koumodgp reads each one's id and version automatically:

• BepInEx/config/koumodgp/required/ — every client MUST run these exact mods + versions.

Put every client-side mod your modpack uses here.

• BepInEx/config/koumodgp/allowed/ — permitted if a client has them, but not required

(e.g. optional qol mods like camera build).

Any mod a client runs that is not in either folder → the client is kicked.

Step 2 — Detect external cheats (signatures)

To catch standalone cheat programs (things that run as their own app, not as a game mo