NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Jun 5, 2012where is a config explanation?
-
View User Profile
-
Send Message
Posted Jun 5, 2012Hi Neatmonster, how are you? I was wondering when the update is coming out? ;) I know that you're really busy but I really can't wait haha :)
Hope to hear from you soon :D
-
View User Profile
-
Send Message
Posted Jun 5, 2012@Kiwz
Well im not a developer or security freak. But I think that should be possible to make, the problem is if you make a mod its editable and so the "hackers" can just em install it in a hack client? and so it will be still accepted lol
-
View User Profile
-
Send Message
Posted Jun 5, 2012@MyPictures
Yes you got it right there.
Will Nodus work if you install zombe?
Would we like to turn around the logic of kicking zombe users?
If so, how about kicking those without zombe?
And then we could make our own mod that is sending the server something like zombe does, but without the zombe hacks.
-
View User Profile
-
Send Message
Posted Jun 5, 2012@Kiwz
The World Edit GUI mod doesn't talk with the server. It actually just reads the info's if you select a cuboid in WE. That's why its impossible to block/kick/detect such mods. What NCP does is just read the events that bukkit makes from a player and decide if that's a normal move/action that the player does. Like: Normal run: 5 Speed Hack: 10. NCP sees that and then it blocks/kick/ban the player (what ever you configured). NCP can only check as much as actions that the bukkit API allows it to. That what you mean does only work if the mod/hack itself gives a possibility to detect or disable it by sending a packet to the client (like zombe mod). And I don't think that the devs of Nodus and CO. will do that lol, they even try to bypass NCP protection by making the actions looks "normal". That all can be fixed if Mojang adds a MD5 check for client and server. The only problem then is that you cant join or use mods on a server. So yea a server without NCP is like shouting: "HACK ME!"
@Xerati
Well on my server I never found someone using Cave finder or whatever. OFC just pushed a update out one time that should block Cave Finder by turning Air blocks to Ores. And yea just too bad it does also affect players that play fair... But OFC is still a awesome plugin :)
-
View User Profile
-
Send Message
Posted Jun 5, 2012Back to nocheat again.
I have an idea on how to prevent nodus or other hacks.
I will try my best to explain.
First I noticed that if I have a nodus client then I am not able to install WorldEdit CUI.
Second I noticed is that WorldEdit CUI seems to be talking to the server-sided plugin.
How about making a mod that a server owner could give out to his players and this mod would crash the nodus-client but not a vanilla client.
On the server side we need a plugin that could check if this mod is sending a "key" and if its not then kick.
This key should be a key that a server-owner could change himself.
If a new player logs into your server without this mod, he gets kicked with a message that he needs to download and install a mod from http://somesitehere.something
This mod should be easy to install, like a click and it installs itself in the minecraft.jar
This is just an wild idea, dunno if this even is possible.
And yes, if this is possible, how long time would it take nodus to get around this :P
Keep it as a secret is not possible, is it?
But if this idea is possible, why not take it further...(dont ask why I sayed that)
-
View User Profile
-
Send Message
Posted Jun 5, 2012@MyPictures
OFC Only 'changes' the non-visible blocks. Caves and whatnot are still shown, when using cave finder or something similar. That's with engine 2. They can still see caves, and still see hidden bases. That's the common admin fail with OFC - they seem to think it's an end-all to xrayers, and it's not.
@Kiwz
Exactly, the only way to really make the ORE side of OFC blocked would also hinder legit players to the point it would be stupid to play at all.
My personal anti-xray is simply catching them after the fact and rolling them back as if they never existed. That way I actually REMOVE the cheater, instead of just slowing them down (not stopping them), and they have virtually no impact to the server in the end. It's the only way currently to deal with them.
-
View User Profile
-
Send Message
Posted Jun 5, 2012@MyPictures About the ofc and cave, I could config it so it would be practical impossible for a x-rayer to see ores in caves, but the legit player would suffer alot imo.
And btw, what if there is a diamond ore exposed to air and lava close by?
Anyway, sry for talking about OFC here.
-
View User Profile
-
Send Message
Posted Jun 4, 2012@Xerati
Don't think so, OFC takes the chunk that bukkit generated and mods it to a "Anti-xray chunk". So all what you cant see normally will turn to OREs. If you config OFC right the CaveFinder hack wont really work also. So OFC with engine 2 should kill xraying on a server.
@Kiwz
As @asofold said. Freecam is a 100% client based mod/hack, so NCP cant do anything about it. That's also for all other hacks that are client based (day/rain...).
I'm so annoyed that the Nodus client is so popular now, now everyone calls him self a "hacker" because he can install a hack client and use a GUI. Its really bad that minecraft is so easy to hack... We can just hope that this gets better in future :) (a MD5 check for client-server would kill most hacks)
-
View User Profile
-
Send Message
Posted Jun 4, 2012Still getting the "failed moving.bed.flying" when some player want to leave a bed :/ and can't leave it...
-
View User Profile
-
Send Message
Posted Jun 4, 2012@Kiwz
Ah ok, but i think that might be slightly misleading :)
The advantage of cave finding may be there, but the player is not flying on the server side, neither can blocks be broken that are far away, that just looks like it because the client is removing them from display .
@aphilosopher Im still waiting for a reply by NeatMonster, for i am experimenting in direction of provbiding compatibility. Unfortunately one would need slight changes on NoCheatPlus side due to event handling uncertainties (Listening on lowest level prevents other plugins from telling NCP to skip the event) to be able to provide a plugin that provides compatibility.
-
View User Profile
-
Send Message
Posted Jun 4, 2012@asofold
Yup, flying in free-cam mode is not a thing NCP is blokking, or even could blokk.
And flying in free-cam means flying through walls and everythin, use this and you will fast find diamonds exposed to air, water or lava (yes, they need to have some light level aswell)
-
View User Profile
-
Send Message
Posted Jun 3, 2012@MyPictures
Regarding Orebfuscator - The concept of preventing xraying is awesome, but orebfuscator doesn't block it entirely, it only slows them down. Cave finding still works, which means hidden bases/chests are not hidden. If you use the 'distance' and 'radius' stuff, then you're getting into hurting the legit players gameplay...
-
View User Profile
-
Send Message
Posted Jun 3, 2012im having issues with mcmmo, particularly superbreaker is always generating player broke blocks to fast, in the hundreds of violation level,
players say it only sometimes actualy cancels the action, even though it send the alert every time, perhaps review hooking into mcmmo?
-
View User Profile
-
Send Message
Posted Jun 3, 2012@Kiwz
They can fly? I have not seen that on my server...
Against Xray and cave-finder, Orebfuscator and similar plugins should be or become the tool of choice.
Against light cheats there is not really a very strong way to differentiate cheating from unlikeliness. I am using DarkTrace to see the average maximal light levels that surrounded blocks people mined, together with ratios one can use it to get an estimate of light cheating, but it still needs judgement and care (deleting stats now and then). If i find time or personnel to extend it i would attempt to bring in analysis of player behavior fit for tracing suspicious patterns of moving, mining, breathing, whatever - but i have not yet seen any plugins that attempted such.
-
View User Profile
-
Send Message
Posted Jun 3, 2012@MyPictures
I testet nodus today, and even with NCP its an awesome tool.
NCP will not in any way stop you from using free-cam and fly around at any speed and through walls and everything, if it wasent for Orebfuscator my server would be in a financial crisis. The next best thing to do here is using cave finder and the free-cam, it is pretty easy to find diamonds, and you just need to type the coords and go strait for them.
And theres alot of small neat tools aswell, 2xjump or more, stop rain and set to day-time and lit up caves. And not to mention all the auto-stuff you could do.
Well, am I dreaming a bit now maybe :P
Anyway, I am sure that mr.NeatMonster is well aware of Nodus, I cross my fingers and hope that Neat is a better coder than the nodus-team.
This post do not need any replyes, I just needed to empty my mind here.
-
View User Profile
-
Send Message
Posted Jun 3, 2012@MERCHANToDEATH
I have no problems with the NCP spam blocker. You just have to config it right and it will work just fine.
@Kiwz
Its not that easy lol. Its actually a very hard job to do :). But @NeatMonster did a awesome job there, cant wait for the new version of NPC! I cant even code a cake.... But back to your question: NCP blocks already most hacks from Nodus and with Orebfuscator you can block the xray hack. Just give @NeatMonster infos if you found a hack or somthing and he will try to fix it as good as he can.
Lets hope Minecraft 1.3 fixes hacks with the new API.....
-
View User Profile
-
Send Message
Posted Jun 3, 2012How about blocking clients with Nodus?
-
View User Profile
-
Send Message
Posted Jun 3, 2012I use the Heroes class plugin on my server, will this plugin stop players from using their skills?
-
View User Profile
-
Send Message
Posted Jun 2, 2012I suggest antispam features from this plugin http://dev.bukkit.org/server-mods/spamguard/