NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
-
View User Profile
-
Send Message
Posted May 18, 2014Hi. I have to register here, because admin of Minecraft server where i play banned me for that: http://screenshooter.net/1181291/tpmumtw Please help me prove him wrong. I never using any cheats.
-
View User Profile
-
Send Message
Posted May 17, 2014@bananoke
1. You would add a cmd:... action to the actions list, like appending " vl>5000 cancel cmd:ban_fight_angle", then you introduce to NCP what ban_fight_angle means, by adding an entry to the strings section of the configuration, e.g. "ban_fight_angle: ban [uuid]" or "ban_fight: ban [player]" for using the name. Might also add a log action, but usually banning should get logged on the console.
Note that the accumulated sum of levels in "ncp info" is not the violation level a player reaches during playing.
2. Violation levels differ a lot amongst checks. In my opinion the only valid way to add banning is to test cheat clients and see what levels you reach (not recommending running cheat clients at all - might need to reinstall the machine afterwards :p). Some checks can have rare pretty big false positives, e.g. survivalfly for the case of extreme latency, though some NCP has to prevent, because the result from strange Minecraft/CraftBukkit behavior, resulting in extreme moves on rare occasions. In fact many cheats produce occasional small violation levels rather, so with banning the big ones one might catch the false positives - in general moving of players is a very unreliable thing, i would not ban there. Candidates could be fight.angle, but i can't tell a level for which it pays to ban.
3. His info getting removed? You mean the violation history? I don't think that would be much relevant, concerning memory consumption or so, because data would be kept until shutdown only.
Banning has the problem that cheat clients adapt to us, in order to create as few as possible violations, thus you would tend to ban players who suffer a bug or a regular false positive or some other networking oddity.
@SaDb0y
Most of the time cheat clients adapt to the limits plugins like NoCheatPlus set, thus people can still activate the cheats, but the gain from it is limited.
Now the questions is what can they really do...
@bananoke
With lagging players hopping about in circles around each other, some things could accumulate, als regarding that the info command does not show how long the player needed to collect all the violations - a minute of a cheater can match a day of a fighter.
If the player reaches that quickly, it could well be cheating. Don't be blinded by the vl sum (16000 for angle), the whole system needs a rework to allow for auto-judgment better - look at the values in brackets:
Edit: the violation levels relate to the added amounts of violation level, not to the total level, that could also be misleading, because the actions for a check relate to the level noted in log actions with [violations].
So a high n probably is a better indicator than the VL sum. Best compare to trusted players. An indicator for cheats can be the amount of fight checks that triggered with somewhat significant numbers n (provided it's not a full day in an arena or so) and also because the improbable check kicked in. Still even with these stats you can't be 100% sure, because you need to relate them at least to the time that the player needed to reach those. Likely cheating, slight chance of rare fast-clicking + lagging player fighting a lot, would not ban, unless you get more specific input.
-
View User Profile
-
Send Message
Posted May 17, 2014I have one more question -
http://screenshooter.net/1181291/tpmumtw
this player using some kind of cheats right? i can be 100% sure of that?
-
View User Profile
-
Send Message
Posted May 17, 2014Hello, I got some problems here, Now there is some hacks that has an option to bypass NoCheatPlus like WeepCraft, and most of the players in my server can use Anti Knockback, Kill Aura, Speed hacks. and I'm using the latest version of NoCheatPlus.
-
View User Profile
-
Send Message
Posted May 17, 2014guys i have 3 questions
1. fight: canceldead: true yawrate: active: true angle: active: true threshold: 50 actions: cancel vl>100 log:angle:3:5:f cancel vl>250 log:angle:0:5:cif cancel
How should i edit this to make auto ban players with lvl 5000+ fight.angle?
2. That would be ok if i ban every player who get 5000lvl or + in fight.angle, moving.speed or fly? I know that autoban mode is not the best idea, but with lag getting lvl 5000 is almost not possible right? that config would be ok?
3. When player get autoban for cheats, then his ncp info can be removed automicaly?
-
View User Profile
-
Send Message
Posted May 17, 2014@MyPictures
Can you reproduce it either way?
@mcmonkey4eva
Usually problems with interact.visible are related to running a server version for which NCP does not have access to the block shapes that the server would use.
I am not 100% sure what's up with snow, because the height level is calculated by NCP anyway, though the interact.visible check might be slightly different than the on-ground checking.
We ask for the output of the "ncp version" command usually, or at least the add the server version to reporting something, in order to be able to relate it to known issues on either side.
So does "ncp version" tell that the bukkit-api-only module is in use? If so, we'd recommend to update - note that the current dev-build branch will be pushed as release this weekend, unless there is any sever issues reported within "no time".
-
View User Profile
-
Send Message
Posted May 16, 2014@mcmonkey4eva
You use a outdated NoCheatPlus version with a up to date CraftBukkit version. So NoCheatPlus cant get direct NMS access and is forced to only use the bukkitAPI which has some side effects for some checks (Visible cant calculate the block shapes properly anymore if its forced to use the BukkitAPI only). Updating NoCheatPlus should solve your issue.
-
View User Profile
-
Send Message
Posted May 16, 2014I don't know if this is fixed in a dev build (I'm on NCP 3.10.9-RC-sMD5NET-b673) but I found something weird... in this situation: http://i.imgur.com/ipgrz3h.png the snow block is unbreakable. When he tries to break it, it shows: http://i.imgur.com/Jy8UJUd.png
-
View User Profile
-
Send Message
Posted May 15, 2014@HGspindy
Latest development build of NC+ (Jenkins) addresses this issue (Have to set strict to true for the InstantBow check).
-
View User Profile
-
Send Message
Posted May 15, 2014New Hack: Multi-Arrow. Players can shot multiple arrows (5-10) in 1 second.
It is a very annoying hack and NoCheatPlus does not detect it.
Version: NoCheatPlus 3.10.11-BETA-sMD5NET-b690
-
View User Profile
-
Send Message
Posted May 15, 2014@Dy1an362
No. The only NC+ team MC accounts active atm are asofold and MyPictures.
-
View User Profile
-
Send Message
Posted May 15, 2014@Dy1an362
its fake, nevermind.
-
View User Profile
-
Send Message
Posted May 15, 2014Some guy logged in our server with the name NoCheatDev and said he was a developer for NCP. I assume and believe no but for clarification, is he?
-
View User Profile
-
Send Message
Posted May 15, 2014@Darknessorising
@FabioZumbi12
Alright :).
@StaNNiE0
Plugins reloading plugins has proven problematic in the past - reload seems to be ok-ish with NCP now, but we always had problems with plugin manager plugins. Not sure if we can do anyting to improve compatibility on that, but basically "ncp reload" or restarting should be the way to go. Could also be that plugins that hook into NCP have been written to only consider the case of all plugins getting disabled/enabled as it is with reload and restart.
@LordKainzo
We are setting worlds to null for temporarily used Location instances. If such an object gets passed to any external API there would be trouble, because before other plugins could process it, the world would be set to null due to the cleanu (necessary to prevent memory leaks due to world references).
I found a spot with passable violations (very common), which might pass a Location instance for which the world gets set to null. Not sure if this explains why there is the exception in the player-join handling of NCP, though. This is corrected in build 697.
-
View User Profile
-
Send Message
Posted May 14, 2014<<reply 2179815="">>
The player is trusted. Its NCP triggering the kick and the errors - in my belief it could be something setting a world to null - but i have no idea what could be doing that.
23:06:34 INFO: Version information
23:06:34 INFO: #### Server ####
23:06:34 INFO: #### NoCheatPlus ####
23:06:34 INFO: Plugin: 3.10.9-RC-sMD5NET-b673
23:06:34 INFO: MCAccess: 1.4.6|1.4.7|1.5.x|1.6.1|1.6.2|? / Bukkit-API
-
View User Profile
-
Send Message
Posted May 14, 2014<<reply 2181180>>
@asofold
NCP Version: 3.10.11-BETA-sMD5NET-b690
Spigot Version: git-Spigot-1377 (MC: 1.7.5) (Implementing API version 1.7.5-R0.1-SNAPSHOT)
After startup 0 errors.
Edit: I think I screwed it up when reloading it with another plugin.
All commands are working now.
Not sure if the regen hack still works since I banned those hackers.
Greetings.
-
View User Profile
-
Send Message
Posted May 13, 2014Yoo, '?' with quotes works!! ThankYou!!
-
View User Profile
-
Send Message
Posted May 13, 2014@asofold
Thanks!! Helped a lot and now i know for next time!
-
View User Profile
-
Send Message
Posted May 13, 2014@StaNNiE0
There seems to be some other problem then (permissions plugin or a startup error?). Did you check the startup log for errors? What's latest (build number?)? Which version of CraftBukkit/whatever are you using?
The regen is not caught by NCP ?
@jet315
Adding to @Darknessorising: The notifications give you an idea of what is happening, for big servers you will likely turn them off, rather. NCP is configured to prevent stuff by default, so usually the alerts mean that something has been prevented for the x-th time. Alerts usually don't appear with every violation, but after a certain amount/level of violations. Since server owners have a much different view on things, there is no "way to do it right" in general, though i would also prefer to rework the alerting/levels system, if i should find the resources to do it.
We only use kicking where we are somewhat sure that false postiives are rare and also where we think that kicking is needed for performance reasons, or because an action means trouble for the server, e.g. crashing or extreme spamming. We don't bring in too much kicking also because NCP usually prevents enough to not need to kick. We don't encourage banning for similar reasons, specifically for checks that have false positives more often, e.g. if influenced by client-side or networking lag.
Things differ a lot by type of server/players and size of servers, but kicking and banning is problematic, because Minecraft+Bukkit does not give too much means of verifying most things in an efficient way.
@TheOnlyRealTGS
Our bakery license has expired!
@Darknessorising
Alright: /? might work. Your problem is now that it shows the default Bukkit "no permission" message? If you add '/?' to the nopermission commands list, that is the default behavior - what do you want to reach or what do you expect to happen instead?
-
View User Profile
-
Send Message
Posted May 13, 2014@asofold
ok So I entered "/?" into the config to block /? and it changes it to - /? which I understand but it still says the same boring message "Were sorry... Is a mistake" even after I do /ncp reload.