NoCheatPlus

NoLogo

NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!

Main Features Permissions Commands Configuration Jenkins

Introduction

NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.

NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.

Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).

NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.

The following plugins might be useful to have a look at.

CompatNoCheatPlus (cncp)

Make plugins like mcMMO, Citizens, MagicSpells or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or ticket request for cncp.

Orebfuscator

Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have".

Downloads and History of Changes

  • Download officially approved versions on the Files page at BukkitDev.
  • Development builds have been moved over to the Jenkins at EcoCityCraft.
  • Do not download from any other source, do not use jars other people send you.
  • Changes by build number can be examined in the Jenkins changes list.
  • All commits can be seen in the GitHub commit history.
  • Plugin statistics are no longer reported to mcstats.org.

Support

Documentation Resources

Contact us

  • Quick questions can be asked on this page,
    or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC)
  • For real issues or feature requests please create a new ticket or add to an existing ticket.
  • To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.

Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).

You must login to post a comment. Don't have an account? Register to get one!

  • Avatar of KirjoZzZ KirjoZzZ Apr 06, 2014 at 08:44 UTC - 0 likes

    @MyPictures: Go Here you go:

    Version information Server git-Spigot-1370 (MC: 1.7.5) NoCheatPlus Plugin: 3.10.9-RC-sMD5NET-b673 MCAccess: 1.4.6|1.4.7|1.5.x|1.6.1|1.6.2|? / Bukkit-API

    Last edited Apr 06, 2014 by KirjoZzZ

    JoZzZ Team Gaming

  • Avatar of MyPictures MyPictures Apr 06, 2014 at 07:56 UTC - 0 likes

    @KirjoZzZ: Go

    NoCheatPlus has a command called "/ncp version" and @asofold wants you to put here what that command outputs to you (You need permissions to run this command as player or just run it in the console).

    BFAK:MyPictures,68804,4095b7e13e1842a5c6922a5b3a9094d1f7dbb5f4e7e36f133280ab58fa2882b0

  • Avatar of KirjoZzZ KirjoZzZ Apr 06, 2014 at 04:22 UTC - 0 likes

    @asofold: Go

    Im using Spigot 1.7.5 Not sure what you mean by Can you show the full output of the "ncp version" command?

  • Avatar of asofold asofold Apr 04, 2014 at 21:48 UTC - 0 likes

    @KirjoZzZ: Go

    It means than NCP can't hook into the server to get more precise block-shape information and other, so it will use some "minimal compatibility" hook, only using the Bukkit-API that the servers variations usually all implement, usually happens if you are running a Minecraft version for which NCP has not yet been updated, or if you are running a more "exotic" mod that supports Bukkit but is differing from CraftBukkit.

    To probably fix it:

    • Can you show the full output of the "ncp version" command?
    • What CraftBukkit or other mod build are you running?

    BFAK:asofold,90573112,4305cd44b773216e4e4b4865b3831dcc3c507c15087fb5cfeebd9392050724fc

    NoCheatPlus
    Latest release (1.7.2-1.7.9, approved) NoCheatPlus 3.10.12-RC-sMD5NET-b700
    (Development builds (1.7.10): Jenkins)

  • Avatar of KirjoZzZ KirjoZzZ Apr 04, 2014 at 20:56 UTC - 0 likes

    Hi Im recieving this:

    [21:50:09 INFO]: [NoCheatPlus] Enabling NoCheatPlus v3.10.9-RC-sMD5NET-b673 [21:50:09 WARN]: [NoCheatPlus] Could not set up native access for your specific Minecraft + serve r-mod version. [21:50:09 WARN]: [NoCheatPlus] API-only MCAccess: Some features will likely not function properly , performance might suffer. [21:50:09 WARN]: [NoCheatPlus] Check for updates at BukkitDev: http://dev.bukkit.org/server-mods /nocheatplus/ [21:50:09 WARN]: [NoCheatPlus] Development builds: http://ci.ecocitycraft.com/job/NoCheatPlus/ [21:50:09 INFO]: [NoCheatPlus] McAccess set to: 1.4.6|1.4.7|1.5.x|1.6.1|1.6.2|? / Bukkit-API [21:50:09 INFO]: [NoCheatPlus] Added block-info for Minecraft 1.5 blocks. [21:50:09 INFO]: [NoCheatPlus] Added block-info for Minecraft 1.6.1 blocks. [21:50:09 INFO]: [NoCheatPlus] Added block-info for Minecraft 1.7.2 blocks. [21:50:09 INFO]: [NoCheatPlus] Inventory checks: FastConsume is available, disabled InstantEat. [21:50:09 INFO]: [NoCheatPlus] Version 3.10.9-RC-sMD5NET-b673 is enabled.

    Can anyone help?

    Last edited Apr 04, 2014 by KirjoZzZ
  • Avatar of Red_Jay Red_Jay Apr 04, 2014 at 01:55 UTC - 0 likes

    @asofold: Go

    Yes I know it can be annoying but it's more annoying when people talk in 1 word sentences instead of having just 1 message. I'll try that, thanks.

  • Avatar of asofold asofold Apr 03, 2014 at 19:57 UTC - 0 likes

    @pookshuman: Go

    You need experience to tell cheaters, because nowadays cheat clients are highly adaptive, so they even have dedicated switches for NCP - often labeled as "bypasses", those adapt to the limits that just still work with NCP, hardly generating any violations.

    Well, check what they are doing, if in doubt - have them explain what just happened and gather some experience with that, if they reach high levels or keep triggering violations.

    Typical reasons can be:

    • Cheats
    • False positives
    • Bugs
    • Incompatibilities with other plugins.

    Gathering extreme n-values in short time usually is a sign for cheating, however the well forged cheat clients adapt so well, that the differences become rather subtle, that's why some experience is needed.

    I explained possibilities for false positives with the blockbreaking. Another check that can trigger a lot is passable, but it is usually due to a specialty in Minecraft (not a false positive, but also not a cheat, still can't be let through).

  • Avatar of pookshuman pookshuman Apr 03, 2014 at 19:22 UTC - 0 likes

    @asofold: Go

    Thank you for the detailed response. I don't understand most of it, but thanks for trying. :)

    If I observe the player while they are mining (i.e. while I am invisible) and I see an NCP notification, what should I look for to tell if they are using a cheat mod? In other words, do cheat mods make the player exhibit any odd behavior that I could use to confirm that they are modding and not just clicking really fast or lagging?

    The player that has been having these issues is a long time player and I have no reason not to trust him, but he is also playing from the UK and the server is in the US and may experience a bit more latency.

    I really don't want to accuse a good player of something without proof ... but I also don't want to allow cheats. How can I get to certainty, or 99% certain that someone is modding?

    Last edited Apr 03, 2014 by pookshuman
  • Avatar of asofold asofold Apr 03, 2014 at 19:01 UTC - 0 likes

    @pookshuman: Go

    Admittedly we could use a more striking documentation for how to judge this kind of output. A recent (pull-) request has touched this once more - we will add some better reporting commands that allow to find players with top violations and also more useful reports and collections of data for certain contexts like fighting and blockbreaking.

    Basically that output shows something odd. For lag we would expect blockbreak.frequency and blockbreak.fatsbreak to trigger most, but apparently those are hardly involved at all.

    Instead you are having a lot on blockinterat.visible and blockbreak.noswing. The visible check is relevant especially for "dumb nukers" and freecam, because it checks if the block interacted with is accessible at all and not behind a wall and such.

    One should not be too enthusiastic about the VL number, because some checks translate things like distances or time differences into VL, so you indeed need to use the stuff in brackets for judging things:

    • n = number of violations, probably most interesting for most checks.
    • a = average violation level
    • m = maximum of all violations

    Unfortunately current stats don't really show how long the player was playing, so best is always to check once and after some time again, if possible.

    This case at first looks like it could be a blunt nuker attempt. Visible and noswing trigger all the time. One can't be 100% sure, also because we don't know the time distribution. A nuker that just iterates over a cuboid might start underground and trigger visible first, then it hits visible blocks but triggers noswing because it is poorly implemented :p - a possible interpretation.

    However other possible explanations could be:

    • systematic false positives - some block shape is not interpreted right (e.g. outdated ncp version) while the player is breaking a block behind and that block keeps popping back up, this could also explain that some noswing alerts are there (roughly every second !?), we have those on WorldGuard regions with fast-breaking blocks that can not be broken due to protection - visible + noswing rather indicates to the block shape.
    • Same as above but due to a client-desync: the client assumes the block is broken, whle it is not broken on server side, however the client does not receive the cancelling - this is as with the block shape thing, it can happen with very fast breaking blocks, e.g. with efficiency 5. (Edit: This demands the player trying to break the block that keeps reappearing a couple of hundred times, because this usually only happens with few blocks - with a high efficiency tool you quickly reach hundreds, though.)

    Sorry for having this idea after writing all the text :p - you should let the player(s) show what they were doing, which block(s) were broken while standing/moving where...

    Also check if you are running the most recent version of NCP (dev build should be ok too) with 1.7.x CB/MC.

    Last edited Apr 03, 2014 by asofold
  • Avatar of pookshuman pookshuman Apr 03, 2014 at 18:09 UTC - 0 likes

    @asofold: Go

    Here is an example of one player who is having issues as well as the lag info http://pastie.org/8991919

    I don't really know how to decipher this. I see a FAQ, commands descriptions, permissions list, etc, but I can't find a link to the page that tells you how to interpret these findings.

    Where can I find what these numbers mean and what they should be?

Facts

Date created
Apr 02, 2012
Categories
Last update
May 18, 2014
Development stage
Release
License
GNU General Public License version 3 (GPLv3)
Curse link
NoCheatPlus
Downloads
983,843
Recent files

Authors