NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Mar 6, 2013@CoolKill3r
Fight_Speed already limits how fast a player can hit. I would suggest to take a look at NC+ 438, the revived direction checks had some effects on forcefields and killauras in my tests.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@CoolKill3r
In Minecraft they just send that they attack a certain entity, so they can instantly hit anything in range (and in view), without ever mis-clicking.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@asofold Thanks for awnsering.
Yet i wonder, seeying how nodus works it must make the player hit rapitly around its own radius right. Coudnt you put a lock on how fast a player can hit.
Im probally very wrong on this matter.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@CoolKill3r
Autofishing can't really be prevented for the general case, since it could be a player doing the exact same thing. However one might try for a captcha thingy, riddles or some random encounters if players keep fishing a long time.
The auto hitting can not really be prevented for the general case either, since the hack client already knows the players positions long time beforehand and can just act more or less like a normal player (with eyes in the back of the head and with very good reactions). In particular we might try to make quick turning more difficult and be more accurate with the combat penalties for the turning. Of course more is thinkable, for instance detecting players turning towards other players, analysis of turning / event patterns, but those are not so simple to implement and the gain is uncertain.
Against the radar one can't do too much either without changing game play a lot. For players there would be plugin(s) like PlayersInCubes hiding players from each other on certain distance (VanishNoPacket might have such an option too, not sure which performs better for big servers). For Mobs it will be difficult, since API is missing on Bukkit-side, also the amount of calculations makes it much more heavy, not impossible though. Might be some server mods provide an extra mob-view-distance (i don't know) apart from using view distance only.
@MyPictures
Short message wins out :).
-
View User Profile
-
Send Message
Posted Mar 6, 2013@CoolKill3r
AutoFish is just a aimbot that fishes automatically, you cant really fix that without punishing normal players. For Forcefield read here: http://forums.bukkit.org/threads/anticheat-kill-aura.130937/#post-1559945
Radar cant be prevented that easy but there was a plugin that was able to kill such hacks: http://dev.bukkit.org/server-mods/playersincubes
-
View User Profile
-
Send Message
Posted Mar 6, 2013Someone tried nodus on my server and most failed using nocheat+ Yet he was able to use autofishing and instanthit (forcefield). Also it seems his radar worked, not really the worst thing tough.
Anyway to fix the first 2? thanks.
-CK3
-
View User Profile
-
Send Message
Posted Mar 6, 2013@Apple_columb
You're running latest release on BukkitDev (3.8.10-RC-b438)?
Building "something" into CB or some special build of CraftBukkit would have the potential to save a lot of performance in comparison to using a plugin, since a lot of working around things would not be needed anymore and direct access to a lot of stuff would also speed up things and prevent a lot of object creation and workarounds, potentially.
However many checks are a matter of taste concerning various aspects, and it is quite hard to determine what exactly is really needed/good to bring in. Further the Minecraft client behavior but also simply the consequences of networking aspects make some things "not possible" to do it in an exact way, so there is a lot of decisions to take. If the resulting checks are not "perfect" or even worse have severe flaws, then you will have the problem of having to add a plugin to fix it, with the danger of actually having more server load due to double checks or extra overhead. Of course it could be made configurable, but update-pace with a server mod will also be uncertain and bind NCP to that mod, which is a problem since hack-clients tend to bypass some stuff again and again.
All in all i think we are better off without too much built in, though it would be really interesting, yet many things can't be done in an exact way - a great help would be updating the Minecraft client to send extra moving events for certain transitions (ground- air, air ground) to allow precise flying and nofall checks by plugins without need for many workarounds, further the server could cease skipping moving events for certain other transitions (like moving into blocks, changing block-position). This way moving checks could be way more accurate while performing better at the same time.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@Apple_columb
Spider should work for two blocks,
maybe 3but not more.-
View User Profile
-
Send Message
Posted Mar 6, 2013NCP still sucks at blocking spider hack? Hackers can climb up at any block. Like it has ladder on it. But actually it doesn't.
Also, would it impact on perfomance if build NCP directly into bukkit.jar? Like antixray on Spigot.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@4lfalfa
I hope this is fixed in build 443.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@4lfalfa
Ok default - i forgot the option, but will have a look.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@asofold
i cant find exact-respawn in the bukkit.yml i left it all at default
-
View User Profile
-
Send Message
Posted Mar 6, 2013@4lfalfa
I will try to reproduce. Is it with exact-respawn in the bukkit.yml?
@libraryaddict
It does not yet:
http://dev.bukkit.org/server-mods/nocheatplus/tickets/328-moving-checks-do-not-account-for-set-walk-speed/
It is possible to give a speeding permission and to set the default walking speed NCP will use for reference (also speeding modifier). We might add it, though.
-
View User Profile
-
Send Message
Posted Mar 6, 2013@asofold
i respawn in the vanilla world spawn
i tested with block types like grass and stone
I recreated it with freshly downloaded files for you
downloaded: craftbukkit-1.4.7-R1.0.jar
and: R: NoCheatPlus 3.8.10-RC-b438 for 1.4.7 1 day ago
after respawn, when my violation level is not high enough for a kick and i move my mouse, then my altitude gets changes to what I believe is the initial altitude of the vanilla spawn
so to recreate it you need to add/remove some blocks on the spawn location and type /kill
additional info:
I use the Java jdk 1.7.0_15
operating system: Ubuntu 12.04.2
go get em!
-
View User Profile
-
Send Message
Posted Mar 5, 2013Are you sure that when you check for speed hacking it accounts for player.setWalkSpeed()?
Because players are reporting issues.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Fair enough. The "quick" fix is to completely disable Survival Fly :P but that has some serious repercussions.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@LordKainzo
I will try to reproduce it - no quick fix, yet.
-
View User Profile
-
Send Message
Posted Mar 5, 2013double post.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Just doing velocity doesnt work the same, it just pushes you forward a few blocks (3-5) but doesnt trigger the survival-fly., the jump skill throws you into the air and also adds velocity forward.
I tried velocity 3 to 10 and it didnt give a testncp error.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
ok, any fixes from my reports? :)