Noxara Anti-Cheat Suite
NoxShield Dashboard| Time | Account | ID | HWID | Event | Detail | Severity |
|---|
| ID | Account | Character | HWID | IP | Connected | Last Sync |
|---|
Click a row to expand events and take action.
| Risk | Player | Account | ID | HWID | Events | Sources | Severity | Last Seen |
|---|
| HWID | Account | Character | IP | Reason | Banned By | Banned At | Expires |
|---|
Search by character name, account name, or account ID to find associated HWIDs.
Click a row to expand details inline, or "Open Dossier" for the full per-entity investigation view.
| Account | Account ID | Character | HWID | Last Seen | Status |
|---|
Live behavioral scoring of connected players. Scores accumulate from input telemetry every 30s and decay over time. Kick threshold: 60 | Ban threshold: 150 (tune in Settings tab)
| HWID | Account ID | Score | Reports | Status | Last Update |
|---|
HWIDs ranked by composite reliable-signal score. Banned HWIDs sort to bottom. Score weights: CheatProcess hits ×1.0 (primary signal) • Distinct accounts ×3 capped at 30 • HWID-rotation count ×0.5 • Currently-online ×1.5 multiplier • Browser research (CovidHax_Window) ×0.2 • Capture mismatch ×0.01. Click "Open Dossier" to see full evidence before banning.
| Score | HWID | CP hits | Accts | HWID rot | Online | Why this rank | Last event | Actions |
|---|---|---|---|---|---|---|---|---|
| Click Refresh to load. | ||||||||
Server-side detectors that scan telemetry independently of the bot-score system. Both are usable today on existing v=1 telemetry; v=2 (QPC + key-identity) will sharpen accuracy further. Anomalies here are flags for review, not auto-actions — open the dossier and decide.
Flags HWIDs that emitted N+ telemetry windows with keys pressed while the mouse was fully stationary (keys≥5 & path_ent≤1 & clicks≤1 & straight=0). Strong AFK-pot fingerprint that does not depend on key-timing analysis, so it's immune to the unit/polling artifacts noted in feedback_check_units_before_acting.
| HWID | Account ID | AFK Windows | Total Keys | First Seen | Last Seen | |
|---|---|---|---|---|---|---|
| Click Refresh to load. | ||||||
Flags accounts that bound to N+ distinct HWIDs in the lookback window. Threshold defaults to 6 (calibrated 2026-05-18 against PrimaryRO: 4 caught legitimate multi-PC players, 6 narrows to clear outliers). Honest player with 2 PCs will not flag; a HWID spoofer cycling identities every session will.
| Account ID | Distinct HWIDs | First Seen | Last Seen | |
|---|---|---|---|---|
| Click Refresh to load. | ||||
Flags currently-tracked HWIDs with N+ consecutive 0x0014 telemetry windows where keys were active (keys≥5 or clicks≥5) AND the game window was NOT in foreground (fg_match=0). Sustained pattern = broadcast macro injecting input into a backgrounded game window. Honest alt-tabs don't sustain.
In-memory view: profiles age out 1h idle. For historical review open the HWID's Dossier.
| HWID | Account ID | Current Streak | Peak Streak | Score | Last Update | |
|---|---|---|---|---|---|---|
| Click Refresh to load. | ||||||
HWIDs whose rolling 0x0034 reaction-time distribution shows mean < max_mean_us (default 80,000 µs = 80ms) over 10+ samples. Human reflex floor is ~150-200ms; sub-80ms with low variance = autopot. Requires 0x0034 events from the DLL's hp_correlator.cpp.
| HWID | Account | Samples | Mean (µs) | StdDev (µs) | Score | |
|---|---|---|---|---|---|---|
| Click Refresh. | ||||||
HWIDs with N+ observed 0x0035 EVT_INJECTED_INPUT events (external tool injecting WM_KEYDOWN from a non-keyboard-driver thread). Every event is +20 score and a panel-visible row. Legit overlay tools (Discord, Razer, NVIDIA) can be muted via Detector Config → Suspicious module allowlist — substring match against the from_module= field in the detail.
| HWID | Account | Count | Score | Last Update | |
|---|---|---|---|---|---|
| Click Refresh. | |||||
Map-level aggregation of detection events. Shows where cheating concentrates. Input anomaly events (behavioral telemetry) are excluded.
Autotrade hubs (gold_mart, prontera vending row) dominate the raw counts and drown out actual cheat hotspots. Add map-name substrings to exclude; the filter persists in this browser only.
| Map | Events | Bar |
|---|
| ID | Username | Role | Created | Last Login |
|---|
| HWID | Max Clients | Label | Set By | Created |
|---|
High-precision detections — cheat tools, injected input, and network hooks — grouped by machine. This is the signal; the volume counts at the bottom are mostly benign background noise.
High-precision: a known cheat/bot tool was running. This is act-on-it.
| Signal | What | Account | Char | Hits | Last seen | Status |
|---|
Injected input and network hooks have real false positives — macro keyboards, AHK binds, VPN/overlay software all trip these. Not a ban on their own; open the dossier and look for a bot pattern (sustained, exact-interval, huge volume) before acting.
| Signal | What | Account | Char | Hits | Last seen | Status |
|---|
| HWID | Reason | By | When |
|---|
| Code | Detector | Events | Machines |
|---|
High counts on Suspicious Module and Screenshot Evasion are usually false positives (background apps, overlays) — they're logged, not acted on. The Confirmed threats table above is what needs your attention.
XP is granted by the server (rAthena NPC) — the panel configures the season + rewards and can GM-override a player's progress. Tier curve: tier N costs 100 + 75×(N−1) XP (tier 1 = 100, tier 30 = 35,625 total).
A season is live when now is between Starts and Ends. Editing the dates changes the duration immediately. Delete removes the season + its reward grid; player XP/claims are kept unless you tick the box.
Item ID is the rAthena item. Icon = identifiedResourceName from iteminfo. Set item ID to 0 to clear a slot.
| Tier | XP | Free | Premium | |||||
|---|---|---|---|---|---|---|---|---|
| item | qty | name / icon | item | qty | name / icon | |||
| Account | Name | XP | Tier | Premium | Claimed (free / prem) | Actions |
|---|
Captcha mode uses rAthena's built-in macro detection system. Ensure captcha images are registered in captcha_db.
Live behavioral scoring. When a player's cumulative score crosses Kick, they're disconnected. When it crosses Ban, the HWID is auto-banned. Scores decay over time (2 points/min) so transient noise doesn't accumulate.
Ban must be ≥ Kick — a ban-without-kick threshold makes no sense. Defaults: Kick=60, Ban=150 (tuned conservatively to avoid false positives during launch). Changes take effect immediately on next telemetry ingest, no sidecar restart.
OpenAI-backed chat translation. Each player picks their language in noxshield.ini
(chat_language); incoming foreign chat is translated into it. Enter your own
OpenAI API key — usage is billed to your OpenAI account, so set daily/monthly caps to bound spend.
Supported: English (en), Indonesian (id), Filipino (tl), Thai (th) + de/fr/es/pt/it/pl/ru/tr/ja/ko/zh/vi.
Hot-reload: takes effect immediately, no restart.
…
Run read-only diagnostic commands against this sidecar — no SSH needed. Type help for the list.
Handy for translation: status (is it enabled + key set?), translate th Hello there
(live test — shows the exact OpenAI error if it fails), logs 200 translate (recent translation activity).
Type a command and hit Run. 'help' lists what's available.
Pull + apply a new sidecar binary from the operator's update host. Applying RESTARTS the sidecar — connected players drop for ~10s (and this panel logs you out; just log back in). Downloads are verified (SHA-256 + signature) and auto-roll-back if the new build doesn't come up healthy, so a bad update can't take you offline.
SHA-256 of every NoxShield.dll build accepted at auth. One per line, 64-char hex (case-insensitive — saved as uppercase). Mismatched builds get OP_KICK at auth-time, so seed a new DLL hash before rolling it to players or you'll lock everyone out. Hot-reload: changes take effect on next auth, no sidecar restart, no active-session disconnects.
WARNING: empty list rejects ALL DLLs. Always keep at least the in-field hash + the new hash during a rollout, then prune the old hash one release cycle later.
SHA-256 of every primaryro.exe build accepted at auth. One per line, 64-char hex (case-insensitive — saved as uppercase). Empty list = open mode (every EXE accepted). Mismatched builds get OP_KICK at auth-time with the "Client outdated - please run the patcher to update" message. Hot-reload: changes take effect on next auth, no sidecar restart, no active-session disconnects.
WARNING: setting an EXE allowlist activates strict mode — players whose primaryro.exe hash isn't on the list will be rejected at auth. Empty list returns to open mode (no EXE check).
Challenges each client to prove the in-memory NoxShield.dll matches a trusted reference image (defeats a dummy client that just absorbs the handshake).
Reference .dll files live in the sidecar's reference_dir — one per shipped DLL build, dropped there once.
Everything below is hot-reload: no sidecar restart, no active-session disconnects.
Upload the exact NoxShield.dll you ship to players. The sidecar names it by its SHA-256 and stores it — no SSH, no path to type. One per shipped build.
Upload a reference first, then run log mode and watch for false-positives (every legit DLL build needs its own reference). Flip to kick only after a clean soak — and only once every shipped DLL hash has a reference here, or genuine players on an unreferenced build get kicked.
Server-authoritative check that each client's GRF content matches an Ed25519-signed feed (a client can't forge it — unlike the client-side manifest). The feed is generated by Patch Studio on each publish and pulled from feed_url. Enable/mode are hot-reload; feed_url + the pubkey are config-managed.
Run log mode first and watch the diag console (logs 50 grf) for [grf] FAIL — those tell you whether the feed matches what players actually run. Only flip to kick after a clean soak across a Star.grf change. A stale feed in kick mode mass-kicks players; the sidecar keeps the current + previous revision, covering one publish of lag.
Maps where the client LGP skill-marker overlay must not render — one base map name per line, lowercase, no extension (e.g. prontera, prt_fild08). Pushed to every client live (no restart, no re-ship); players can't override it. Empty = LGP allowed everywhere.
Optional. Powers two dossier actions: Summarize this player (writes a 200-word narrative GM brief) and Draft response (writes a player-facing reply for Discord/tickets). NOT used as a detector — verdicts still come from the rule-based pipeline. Claude just reads the dossier and writes it up.
API key from console.anthropic.com → Settings → API Keys. Stored in config.json (root:root mode 600). Key is masked in the UI after save; submit with the field blank to keep the existing key, or check "Clear key" to remove it.
| When (UTC) | Admin | Action | HWID | Tokens in/out | $ USD | Error |
|---|---|---|---|---|---|---|
| No calls yet this month. | ||||||
Master switch OFF halts all in-flight captcha queues immediately — the poller NPC stops firing macro_detector even for active queue rows. Independent from Enforcement Mode above.
Regenerate writes 100 fresh BMPs + a new captcha_db.yml to every configured rAthena instance. Run @reloaddb on each affected map-server afterward.
Lists pending + active captcha triggers. Cancel marks every queued row for the account as cancelled, so the in-game poller stops firing.
Each toggle filters events server-side before they hit the database, audit log, or Discord webhook.
The DLL still runs every detector — only the sidecar's filter view changes. Edits persist to
/opt/noxshield/config.json immediately; no restart required.