NoCheatPlus

NoLogo

NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!

Features Permissions Commands Configuration Jenkins

Introduction

NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.

NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.

Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).

NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.

The following plugins might be useful to have a look at.

CompatNoCheatPlus (cncp)

Make plugins like mcMMO, Citizens, MagicSpells or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or ticket request for cncp.

Orebfuscator

Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have".

Downloads and History of Changes

  • Download officially approved versions on the Files page at BukkitDev.
  • Development builds have been moved over to the Jenkins at EcoCityCraft.
  • Do not download from any other source, do not use jars other people send you.
  • Changes by build number can be examined in the Jenkins changes list.
  • All commits can be seen in the GitHub commit history.
  • Plugin statistics are no longer reported to mcstats.org.

Support

Documentation Resources

Contact us

  • Quick questions can be asked on this page,
    or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC)
  • For real issues or feature requests please create a new ticket or add to an existing ticket.
  • To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.

Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).

You must login to post a comment. Don't have an account? Register to get one!

  • Avatar of HubToo HubToo Jan 20, 2015 at 21:40 UTC - 0 likes

    @edcsg: Go

    Hello,

    I had a similar problem, but unrelated with water. Walking was very jerky, and after teleporting i couldn't even walk in any direction. The log had several Failed SurvivalFly messages while i was not flying, so i disabled the corresponding config item and everything went back to normal.

    Curiously, i had also some complaints with CreativeFly, while i was not using a creative gamemode. I disabled that too as i don't see the point to limit players in creative mode?

    For information, i'm using a Cauldron server, with the Lord of the Rings mod.

    Best regards,

  • Avatar of asofold asofold Jan 19, 2015 at 12:08 UTC - 0 likes

    @edcsg: Go

    You can send a PM with BukkitDev? The "ncp version" command would print output to where you run it from (e.g. console, best to copy test) - if you run the NCP development build 787, the version information will also be printed in the nocheatplus.log.

    BFAK:asofold,90573112,4305cd44b773216e4e4b4865b3831dcc3c507c15087fb5cfeebd9392050724fc

    NoCheatPlus
    Latest beta release (+ 1.8.3, approved) NoCheatPlus 3.12.0-RC-sASO-b813
    (Development builds, 1.8: Jenkins)

  • Avatar of MasterMithrandir MasterMithrandir Jan 19, 2015 at 12:04 UTC - 0 likes

    @asofold

    I really appreciate your extensive answer, you really are putting a lot of effort in the fight against hacks, and helping users like me understand the intricacies of your plugin.

    Thanks again, your answer gives me some new directions on how to approach these issues.

    Servidor Español: sv1.mithrandircraft.es

  • Avatar of edcsg edcsg Jan 19, 2015 at 10:31 UTC - 0 likes

    @asofold

    As you said, should be vertical upward speed in the water. How to improve?

  • Avatar of edcsg edcsg Jan 19, 2015 at 10:21 UTC - 0 likes

    @asofold The full output "NCP version" command? Nocheatplus\nocheatplus.log? Still? Your e-mail address? I can take it, send mail to you?

  • Avatar of asofold asofold Jan 19, 2015 at 09:50 UTC - 0 likes

    @edcsg: Go

    That's because the swimmingspeed modifier is meant to modify the horizontal speed of swimming :p, not the vertical speed for jumping out of the water.

    I assume there is no jump-potion effect involved, but that with Cauldron maybe the water block shape can't be interpreted by NCP.

    Can you post the full output of the "ncp version" command? There is more information contained than plugin and server versions, i am interestd in the MCAccess part right now (if you post the full output. we don't need to ask back too much).


    Seems there has been a ticket for Cauldron/1.7.2 already (Ticket 791). Last time we checked the moving events of Cauldron were producing totaly different output to CraftBukkit/Spigot + vanilla clients, but for jumping out of water we might examine the MCAccess version.

    Last edited Jan 19, 2015 by asofold
  • Avatar of edcsg edcsg Jan 19, 2015 at 07:12 UTC - 0 likes

    @asofold I'm sorry, seems to set swimmingspeed is not effective. Following my problem! I can't go(Fig.)

    1

    Every time to be transferred back to the place(Fig.)

    2

    And then return to NCP news(Fig.)

    3

    I use the version is: 3.11.1

    The server version: Cauldron 1.7.2

    Thank you for your reply.

  • Avatar of asofold asofold Jan 18, 2015 at 22:31 UTC - 1 like

    @MasterMithrandir: Go

    • Xray: I do recommend Orebfuscator or anything that tracks such.
    • Anti tracer: i would in general recommend too (lower the entity range settings in spigot, some hiding players approach like PlayersInCubes, some spamming fake stuff approach maybe too, ProtocolLib based also).
    • Anti aura - there is multiple aspects, it depends on the chosen approach.
      • Cancelling fighting events means that either plugin might cancel the events, thus the other plugin receives different data and might be rendered inoperable, potentially concerning all checking methods (risk may or may not be low).
      • Methods to spawn fake entities (also players) have already been bypassed by at least one client, it's a matter of time until those are much useless.
      • Currently (1.7.10 + 1.8) some fight checks in NCP are rendered inoperable by â change in CraftBukkit which we overlooked (much fewer attack attempts get put through to Bukkit plugins from then on), affected are at least fight.speed and combined.improbable. We have been planning to change a lot on the fighting checks and now we have to replace even more parts. Some parts might be removed, some might get an equivalent for use with ProtocolLib, some might not be replacable, but we will add new/other checks. That being said, there is more justification for a (temporary) replacement than has been before, not sure there is actually decent replacements ready at present. Our goal is to revamp basics of fight checks until the next weekend. We will (not sure if until next weekend) implement some completely new methods, so fight checks will change around a lot within the next few weeks.

    Concerning tracers, i am not sure if we want to implement something there.

    • Spawning fake entities: This can be effective if those entities are far away and can't be distinguished from normal entities (occasional fake moving ?) - chances are good that cheat clients will easily detect entities that do nothing or are invisible or appear too close to the player, not moving regularly etc.). So in general i think we won't implement this, which also has the advantage that other plugin developers can excel at this and provide an easy to add thing, which also will not conflict.
    • Spigot entity ranges: A good basic measure, hides players if far away. People say it doesn't hide based on vertical distance though. This means best performance in comparison to all other methods - whenever you want to have a maximum distance for seeing someone, this might be an option, at least for an additional thing.
    • Using the vanish API (PlayersInCubes): Hides players if far away, also by vertical distance. Drawbacks are the players list might not work (can be fixed by packet sending), commands that rely on the who-can-see-who API, only works for players.
    • Using ProtocolLib:
      • We might add a simple thing, as we have to extend much onto the packet level anyway (e.g. prevent sending certain packets to players, if too far away).
      • I could imagine experimenting with a much optimized+simplified ray-tracing approach, for who can see who, but this is a pretty complex task and wouldn't happen anytime soon (unless other developers would love to share technique+effort).
  • Avatar of MasterMithrandir MasterMithrandir Jan 18, 2015 at 20:38 UTC - 0 likes

    @asofold

    Would you recommend relying on other plugins which claim to have the solution for other hacks NCP does not? Like Tracers, Auras...

    (Always bukkit aproved, or Spigot aproved (this last method of approvals which I do not know of the liability of))

    Will NCP implement any functions against these other common server pvp hacks?

    Last edited Jan 18, 2015 by MasterMithrandir
  • Avatar of asofold asofold Jan 18, 2015 at 18:06 UTC - 0 likes

    @kangarkooo: Go

    I forgot to mention that Ticket 364 is meant to be the point of reference for pistons + moving (even if slime blocks are or will be a special case with pistons).

    @Bobcat00: Go

    The version detection only attempts to get a result like "1.8.1" to have a rough idea of the Minecraft version in use, hard coded examples. I probably add reflection to ask Minecraft directly, also ProtocolLib.

    Some features might also depend on if it is Spigot or CraftBukkit, which then will also be checked for. I rate it more important to prevent enabling of some workarounds that provide overhead or even risk for certain server versions, if the cause for the workarounds has been fixed for that server version. Have you encountered any issues with it?

    @edcsg: Go

    We tried some mod(s) a while ago and found that they let the players move totally different than CB/spigot with vanilla clients. This is a big problem because our moving checks more or less pinpoint the vanilla behavior, i cannot guarantee that we will be able to fix such within some time frame. In future we might add (potentially simplified) replacement checks for anti-flying, which might then rather check the average speed instead of the exact location-to-location coordinate changes.

    That being said, we first need to find out what exactly happens.

    • Please tell us the output of the "ncp version" command.
    • Do players always have problems with landing in water, or is it just an occasional issue.

    If you have time to do this (it can be done on a crafty live server with SSD):

    • Can you run development build 786 and create a debug trace?
      • Set the log file name to "logs", then issue the "ncp reload" command.
      • Use "ncp debug playername" with the name of a player who will jump into water a couple of times, reproducing the issue a couple of times.
      • Issue "ncp reload" again to end the debug logging and to switch the log file.
      • Send us the log file (zip or paste).

    A workaround for water can be to allow faster moving in water in general (allows a lot of speeding in water!): Add "swimmingspeed: 200" to the survivalfly section of the configuration to allow twice the speed in water (you later check if you lower it).

    checks:
      # ....
      moving:
        # ...
        survivalfly:
          swimmingspeed: 200
        # ...
    

    Sorry for the long text, i forgot about the translator :p.

Facts

Date created
Apr 02, 2012
Categories
Last update
Mar 21, 2015
Development stage
Release
License
GNU General Public License version 3 (GPLv3)
Curse link
NoCheatPlus
Downloads
1,235,162
Recent files

Authors