NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Dec 18, 2012@asofold
You do not hope alone on that...
-
View User Profile
-
Send Message
Posted Dec 18, 2012@MyPictures
I hope nothing stupid happened with changing to the new structure then, because i can't remember having changed it to what it was, when it was taken out...
-
View User Profile
-
Send Message
Posted Dec 18, 2012@asofold
Yes the Combined_BedLeave check in 274 works fine (as long as you use CB 2511 or lower).
-
View User Profile
-
Send Message
Posted Dec 18, 2012@joehot200
Versions? Currently we can not possibly judge it without versions, too much changes due to CB2512.
I regard ClickAimBot as similar to forcefield, against simple aiming there hardly can be done much for quick prevention. Statistical analysis of pretty general nature might take them down best (possibly with adaptive learning technique, "teach the plugin!"), but that is pretty heavy stuff in some ways. Other methods such as miss-rate analysis (more medium term) will give us only a short advantage, until the clients update to sometimes miss on certain kinds of moves, similar to force-fileds for which they are now using adaptive methods only turning around bit by bit to avoid getting caught for instance. Of course i will try to track down unlikely good fighting behavior better, but it will stay difficult, because fighting is just too simple for a hack client and even imitating "normal" fighting is not even that difficult while still giving a clear advantage. That's why i added that combined.improbable check to start combining methods, but it can't compare to analysis of behavior of general nature, yet it is much simpler to implement and promises to help a good bit, so i will extend/refine that a bit.
For flying there may be some bypasses or part-bypasses like gliding techniques, most were pretty much taken out recently, but of course they keep adapting, at least a 3-block slow jump/fly thing is known to us. Just some versions (beta) have too many new bugs taking some checks out, updated soon.
@killer21998
I seriously doubt they can alter permissions. Usually such "force-op-hacks" etc. are just tricks to let people install the clients to test and give away their passwords.
@MyPictures
Is 274 unaffected? After all i forgot :p
-
View User Profile
-
Send Message
Posted Dec 18, 2012@joehot200
That was bedfly joe. Already aware of that :) and fix should come soon. However 274 and lower is not affected by this.
@killer21998
No hackers cant change permissions on your server (they are 100% server sided). So if your permissions are free from security holes then everything will be fine with that.
-
View User Profile
-
Send Message
Posted Dec 18, 2012@joehot200
I have heard that it is something to do with the permissions, something about people being able to somehow modify the permissions to make them able to fly.
it is what all the hackers with custom clients say.
any way to fix that? i am fed up of theese custom client noobs wandering all around my server.
-
View User Profile
-
Send Message
Posted Dec 18, 2012@asofold
you dont even need forcefield, i once came on the server as a member, used ClickAimbot and Sprint, and killed everyone with diamond armour using a stone sword!!.
also, this does not block all hacks, yesterday i caught somebody flying, they were a member, they did not have /fly, and they were not creative (they were using a client).
-
View User Profile
-
Send Message
Posted Dec 18, 2012@xBlueXFoxx
Of course force-fields still are an advantage. Question is if you win the fights easily. I assume that you win more with it, certainly, but somewhat skilled players might stand a chance still.
-
View User Profile
-
Send Message
Posted Dec 18, 2012@xBlueXFoxx
Check here: http://dev.bukkit.org/server-mods/nocheatplus/tickets/336-forcefield-still-working-after-the-instalation/#c1
Forcefield is a "combined" hack. Sot it does more then just 1 illegal action. What exactly does not work? The aimbot/autoaim part of the forcefield we cant check of course.
Anything else that works for you? (Fastbreak, ....)
-
View User Profile
-
Send Message
Posted Dec 18, 2012Appears forcefield is working just fine on that server..
-
View User Profile
-
Send Message
Posted Dec 18, 2012@MyPictures
I'll check that out in a moment.
-
View User Profile
-
Send Message
Posted Dec 18, 2012@xBlueXFoxx
Get Nodus and test it on our test server: 188.165.234.196
On my tests the Nodus forcefield seem to be blocked pretty well.
-
View User Profile
-
Send Message
Posted Dec 18, 2012I'll check out the latest build, but honestly Nodus has been slipping passed nocheatplus for months now, forcefield continues to be a major issue in my PVP server, I wasn't even aware nocheatplus had anything to prevent it, because, well, it hasn't been.
-
View User Profile
-
Send Message
Posted Dec 18, 2012@xBlueXFoxx
Most are already covered in principle, however more work is needed to prevent false positives but still to allow harder bounds for hackers actually. Also mind that hack clients are very adaptive, they address all these parameters at present. So except for the inventories question, one will have to distinguish "very unlikely" or "too-pro" fighting behavior from very good or randomly unlikely fighting. Certainly i will try to tweak those, possibly distinguishing pvp from pvm or taking into account different types of situations.
Some of builds for CB2512+ might contain / have contained bugs that rendered parts of the checks ineffective (waiting on more feedback for latest builds: http://www.nocheatplus.org:8080/job/NoCheatPlus/).
-
View User Profile
-
Send Message
Posted Dec 18, 2012Any improvements coming to forcefield prevention in the next update? Here's a few things that forcefield tends to so that could be used to prevent it from being effective
Hits multiple mobs/entities per swing. Can hit players while in a chest/inventory. Can hit players/entities it's not directly facing. May hit faster than possible speed.
-
View User Profile
-
Send Message
Posted Dec 18, 2012@thetduong
@Jeruhmi
You need matching versions of your server and NCP. The betas downloadable here are buggy, which can be guessed by reading the red notice on the download page, or by its beta nature. (Rest see below.)
@Zeokon
The latest development builds (available at: http://www.nocheatplus.org:8080/job/NoCheatPlus/) do rule out some bugs which came in with adaptions to CB2512. They might still contain some problems but should be mostly fixed up. In general the builds are aimed at 1.4 in general, the should work the same way before and after CB2512 (just might contain other bugs).
-
View User Profile
-
Send Message
Posted Dec 17, 2012I updated this plugin and now everyone can hack :/
-
View User Profile
-
Send Message
Posted Dec 17, 2012Could I use http://www.nocheatplus.org:8080/job/NoCheatPlus/283/fr.neatmonster$nocheatplus/ with the latest dev build on bukkit without the NMS change, meaning bukkit without the NMS change would it work?
-
View User Profile
-
Send Message
Posted Dec 17, 2012For some reason the plugin aint working for me. And i updated the server to its latest available build.
-
View User Profile
-
Send Message
Posted Dec 17, 2012@Limeyin
There are permissions, they are linked with the permissions-button on the top of the page. Most should be current permissions.
For flying you have to enable flying on the server at first, then give yourself the permission nocheatplus.checks.moving.survivalfly - then the flying speed will still be limited, for unlimited flying (might crash the server if you allow it to "bad" people) you need the nocheatplus.checks.moving.creativefly permission , those permissions actually let you bypass the checks (survivalfly prevents flying for survival mode players, creativefly monitors flying speed not necessarily only for creative mode, actually).