NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Oct 2, 2012@andrewkm
The latest dev build (special 126-128) are really experimental with some design changes on the chat section. Be sure that you let NC+ generate a new config if you use one of those.
@KevinEssence
Because every hacker is trying to bypass it now? xD, anyways, fight checks are hard to check so we need more time to make them better. Forcefield (Multi entities) should be blocked well with the latest build of NC+ but aura (Single entity) still needs some work to be finished.
-
View User Profile
-
Send Message
Posted Oct 2, 2012Any idea why people still can force field?
-
View User Profile
-
Send Message
Posted Oct 2, 2012asofold... PLEASE make a delay for "too many people logging in" Please oh please make a delay.
Meaning that the check doesnt work for delay time after server start. (I would make the default 5 mintues - after server startup)
Restarting a 200/200 player server on NCP 128 default config; spams the too many people logging in message and is seriously raging our players. lol we usually go from 0-100 users in a few seconds; so you can imagine how crazy the check got.
I love the check for during gameplay once rejoins settle up; but at the beggining of a server start the check should definately not be working.
-
View User Profile
-
Send Message
Posted Oct 2, 2012@asofold
Yeah I see what you mean. I was only suggesting something simple where you could have it ban players that have "confirmed" hacked clients with a configurable message. Another idea would be to have them placed at spawn for example. There are a lot of cool ideas! :)
-
View User Profile
-
Send Message
Posted Oct 2, 2012@chrishillz
We still have work to do, but are already considering how to bring in different config versions. Not sure we can provide them ourselves, needs can be very different. Probably we have to do it community driven, i.e. people show their configs made for a certain purpose - or we just add snippets for one or another check as examples how to make chat hard and similar.
@aGodlikeGuy
a) That is not my check :p
b) You already told me and i am aware of that checks weakness (thx).
c) The aura is being fought by more components including another yaw-check as well, which might simply replace the old angle check.
Checking for an average of 45 degrees changes does not make too much sense anyway (unless it is heavy weighted by other inputs) ;)
If you turn "x per tick" will certainly be adjustable (as can the amount the check will trigger for). It stays cat and mice...
-
View User Profile
-
Send Message
Posted Oct 2, 2012Just so you actually know this Asofold, your aura check can be easily bypassed using
and turning x per tick.
-
View User Profile
-
Send Message
Posted Oct 2, 2012@chrishillz
That's actually already possible, we actually do the default config how we thing it should be. If you want it the ban then you can just config the actions in the configuration file to ban and not kick.
-
View User Profile
-
Send Message
Posted Oct 2, 2012Five star movie! Watched the whole thing, great work and effort you guys have put into this! I might embed this on my forum for you, it would even make users feel like they're on level ground. :)
Only thing I can suggest like I said before are the example configs. For example instead of kicking them all the time, you could have it ban if they're confirmed hackers. You could add a MCBans integration config, provided you have that plugin installed. Lots of ideas!
Thanks! :D
-
View User Profile
-
Send Message
Posted Oct 2, 2012@asofold
Yea put it on the last place then ;P
-
View User Profile
-
Send Message
Posted Oct 2, 2012@MyPictures
Hmm, the idea is to probe the forcefield but i agree that such should be done by actions - however you do not have a way of inserting coordinates of the player... put on a list...
-
View User Profile
-
Send Message
Posted Oct 2, 2012@aGodlikeGuy
Ok. Well I choose an other one then .
@kauaiboi06
I don't see why this should be useful lol. You could kinda do that by yourself with the (actions) but that idea is just insane ;P.
-
View User Profile
-
Send Message
Posted Oct 2, 2012Is there anyway that you could make it so that if they use forcefield that 2 silverfish spawn on the side of the mob and if they hit them more then twice they get banned FOREVER??
If you can i would love u soooooo much :P
-
View User Profile
-
Send Message
Posted Oct 1, 2012@MyPictures
It's the client team avolition use, the don't actually sell it.
-
View User Profile
-
Send Message
Posted Oct 1, 2012@SuperPyroManiac
Thank you :)
@MarktheMerk2014
I would never buy that client even if it could make me fly IRL! A MC hack client with that price : 100% fake for me.
-
View User Profile
-
Send Message
Posted Oct 1, 2012@asofold
Yea, I was reading the post on HackForums. Best of luck for a patch!
-
View User Profile
-
Send Message
Posted Oct 1, 2012@MarktheMerk2014
Hello, currently the launcher to reliant hasnt been working for 2-3 weeks as confirmed by copy pasta, so I'm fairly sure this broken and outdated client isn't bypassing anything, also thanks.
-
View User Profile
-
Send Message
Posted Oct 1, 2012Hi, I would like to inform you Godlike, that the client Reliant bypasses all of these. You need to patch them, so to "test" it you need to buy it for $900 dollars.
kthnxbai P.S. Godlike is a vag, P.S.S. GodlikeCraft's glide is epic.
-
View User Profile
-
Send Message
Posted Oct 1, 2012@SuperPyroManiac
@aGodlikeGuy
That would go for the latest dev builds (probably even unreleased, yet).
@Aangiix3
I am not 100% sure about fastplace - is it about blocks or potions or what?
-
View User Profile
-
Send Message
Posted Oct 1, 2012@SuperPyroManiac
Hello @SuperPyroManiac, I just finished testing with the NC+ development team on every client that is currently being sold and I hope you will be happy to know that currently the bypasses are now completely patched, apart from Malints nofall.
-Regards GodlikeGuy
-
View User Profile
-
Send Message
Posted Oct 1, 2012Some new clients bypass the nofall and flight protection of this plugin. Avid and Malint are the only two I know of currently.