NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
-
View User Profile
-
Send Message
Posted Jan 17, 2013[INFO] This server is running CraftBukkit version git-Bukkit-1.4.7-R0.1-1-gf172c52-b2603jnks (MC: 1.4.7) (Implementing API version 1.4.7-R0.2-SNAPSHOT)
[SEVERE] [NoCheatPlus] Could not set up MC version specific access. 2013-01-17 12:53:45 [SEVERE] java.lang.NoClassDefFoundError: net/minecraft/server/IBlockAccess at java.lang.ClassLoader.defineClass1(Native Method) at java.lang.ClassLoader.defineClass(ClassLoader.java:791) at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142) at java.net.URLClassLoader.defineClass(URLClassLoader.java:449) at java.net.URLClassLoader.access$100(URLClassLoader.java:71) at java.net.URLClassLoader$1.run(URLClassLoader.java:361) at java.net.URLClassLoader$1.run(URLClassLoader.java:355) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:354) at org.bukkit.plugin.java.PluginClassLoader.findClass0(PluginClassLoader.java:80) at org.bukkit.plugin.java.JavaPluginLoader.getClassByName0(JavaPluginLoader.java:300) at org.bukkit.plugin.java.PluginClassLoader.findClass0(PluginClassLoader.java:76) at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:53) at java.lang.ClassLoader.loadClass(ClassLoader.java:423) at java.lang.ClassLoader.loadClass(ClassLoader.java:356) at fr.neatmonster.nocheatplus.compat.MCAccessFactory.getMCAccess(MCAccessFactory.java:25) at fr.neatmonster.nocheatplus.NoCheatPlus.initMCAccess(NoCheatPlus.java:105) at fr.neatmonster.nocheatplus.NoCheatPlus.getMCAccess(NoCheatPlus.java:98) at fr.neatmonster.nocheatplus.utilities.BlockProperties.<clinit>(BlockProperties.java:247) at fr.neatmonster.nocheatplus.NoCheatPlus.onEnable(NoCheatPlus.java:434) at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:217) at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:457) at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:381) at org.bukkit.craftbukkit.v1_4_R1.CraftServer.loadPlugin(CraftServer.java:282) at org.bukkit.craftbukkit.v1_4_R1.CraftServer.enablePlugins(CraftServer.java:264) at net.minecraft.server.v1_4_R1.MinecraftServer.j(MinecraftServer.java:321) at net.minecraft.server.v1_4_R1.MinecraftServer.e(MinecraftServer.java:300) at net.minecraft.server.v1_4_R1.MinecraftServer.a(MinecraftServer.java:259) at net.minecraft.server.v1_4_R1.DedicatedServer.init(DedicatedServer.java:149) at net.minecraft.server.v1_4_R1.MinecraftServer.run(MinecraftServer.java:399) at net.minecraft.server.v1_4_R1.ThreadServerApplication.run(SourceFile:849) Caused by: java.lang.ClassNotFoundException: net.minecraft.server.IBlockAccess at org.bukkit.plugin.java.PluginClassLoader.findClass0(PluginClassLoader.java:70) at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:53) at java.lang.ClassLoader.loadClass(ClassLoader.java:423) at java.lang.ClassLoader.loadClass(ClassLoader.java:356) ... 31 more
-
View User Profile
-
Send Message
Posted Jan 16, 2013Ok. Like i said. I played on this server tested forcefeild out, and i instantly got banned/kicked, as soon as i hit someone. So they fully blocked forcefield. Just be able to block nodus forcefeild. Or make it so if one turns on forcefueld and attemps to hit multiple targets, use that to detect forcefeild. So if is hitting multiple targets, then that is how you should try to stop it! :)
-
View User Profile
-
Send Message
Posted Jan 16, 2013@UnitedFactions
Not implemented yet but its kinda on the list :).
@KevinEssence
Some other NC+ users say that the chat checks are already too sensitive. However we dont want to block that fast because some players talk like this:
However if you want to make them stricter then take a look at our config page: http://dev.bukkit.org/server-mods/nocheatplus/pages/documentation/configuration/#w-size-16px-chat-subsection-size
I guess you have to try out to find your optimal settings.
@REDTURTL3S
Actually we don't have any "forcefield check" because its impossible to block it completely. However we can make it a lot weaker with our fight checks: http://dev.bukkit.org/server-mods/nocheatplus/tickets/336-forcefield-still-working-after-the-instalation/#c1
It depends on what your forcefield does, if a normal player wins against your forcefield then its a bad forcefield ;P.
We already try to make our fight checks better, you can add suggestions or ask questions about it here: http://dev.bukkit.org/server-mods/nocheatplus/tickets/51-forcefield-aimbot-reach/
-
View User Profile
-
Send Message
Posted Jan 16, 2013I love this plugin. Just on thing. Its not preventing forcefield. Is this a know bug, or is it just me? Please fix! :)
-
View User Profile
-
Send Message
Posted Jan 16, 2013What would I change to make the spam system a bit more sensitive on detection of spam? Some players spam like 5 messages + in a row without nothing happening. Using latest version.
-
View User Profile
-
Send Message
Posted Jan 16, 2013@asofold
Is it possible to delete the log file with a command? I get pretty big log files every now and then and I would like it to delete itself and reload the config, so it creates a new nocheatplus.log file, however I used to do that with a cronjob, but perhaps you can just clean the file with a command, so far I've not been able to find one.
Thanks anyway!
Greetings
-
View User Profile
-
Send Message
Posted Jan 16, 2013@Pr07o7yp3
Oh some reasons.
We got held up with [short version: see b) and the last paragraph below the line!]...
a) A "safeguard" was introduced in the middle of 1.4.5, leading to a considerable amount of overhead with implementation+testing+bug fixing, for almost no gain so far, though some developers might (have) use(d) this opportunity to go somewhere else. We also get told that there might be more than 0 Bukkit staff people telling other people that NCP is causing some issue in question, while it is rather to be expected to be caused by inventory manipulation plugins or CB itself. Peculiar enough, word reaches us by hearsay that at the same time other plugins are advertised by the same / similar people.
b) There are other things to patch / work on.
c) It would most likely need a slightly heavier addition/recode, which will also mean applying new technique, being instable for some amount of time. While we have to care for "bugs" which are related to Essentials or MultiVerse changing their spawn locations (their natively stored ones!), this will rather be postponed until we have an overall stable base. It might be easier to fix than the speed on ladders, which have the problem that players often dive into ladders with a high initial speed, thus we will need some model accounting for the "entry speed" for a medium and possibly even friction.
d) I have tried to keep my fingers off the basic conception of the moving/flying checks, though i adapted and fixed and re-structured parts of those and also added things, i still have a full recode in mind for those, to be able to go with more precision where precision is possible.
e) Do you know a plugin that does it better? Currently we allow like 30% speed up, some others at least recently allowed like 60% as far as i know. Not sure about SafeGuard.
The problem with very precise speed judgement is that you have to account for the medium the player is in (on-ground, air, water, web... ground+jump-in-air?, ground+jump-in-water?...), potentially also have to account for the "entry speed", cope with CraftBukkit not putting through all events (better for performance but, judging the number of packets gets imprecise and also the moment of the player touching the ground sometimes gets lost), account for varying speeds due to sneaking+sprinting+jumping+normal. The modeling has to play well with the necessary workarounds (specialties of CB/MC, incorrect positions sent, missing touch-ground, strangely shaped moves with sprint+jump), or even make them superfluous.
If we do one thing wrong with this, hack clients will update to put a short moment of sneaking or sprinting in between now and then and the check will be spoiled. So if i take a go on this, i want the modeling to be something that actually pays off in relation to the time needed to implement it.
-
View User Profile
-
Send Message
Posted Jan 16, 2013Ok, why don't you fix Nodus Sprint (fast) hack? It works a lot of time and nobody fix this. :( Why?
-
View User Profile
-
Send Message
Posted Jan 15, 2013@asofold
Well most "NC+ proof" marked hacks are adapted bots so yea... I don't say it blocks EVERYTHING but the most critical (and non critical) stuff is covered and works as you said.
-
View User Profile
-
Send Message
Posted Jan 15, 2013@MyPictures
Pretty optimistic judgement :) - let's say the checks we have are for a good part well in place, and we don't expect too many surprises on quite a few of those.
There are ways to gain advantages, some still hurt (depending on the server type/situation), but most critical things are somewhat covered.
-
View User Profile
-
Send Message
Posted Jan 15, 2013@lANTHONYl
It doesn't mater what client the hacker uses, NC+ has defences against every kind of abusive movements that a player does.
@Adrenalineq
@Sheeperia
Thanks. I'm glad we could help you with that.
-
View User Profile
-
Send Message
Posted Jan 15, 2013@asofold
Nuker probably work. My Head-Admin report it to me, check it please :3 and say me why Jenkins don't work ;P
-
View User Profile
-
Send Message
Posted Jan 15, 2013I just found this pringles client http://youtu.be/6V0HkdAUUyU
I'm sure people are aware of it, i'm just curious of the defense NCP has against it.
-
View User Profile
-
Send Message
Posted Jan 15, 2013Hi again!
Yesterday my servers IP got posted on hackforums.net. Together with LogBlock and DynamicBan i was not forced to activate the whitelist, and we fought off the attack. None of the hackers managed to get even out of the spawn city before they got banned, and that's only a 100 block walk. One guy managed to grief 3 glass blocks, and that't the only thing they managed to do :P
So thank you, your plugin is severely underrated!
-
View User Profile
-
Send Message
Posted Jan 15, 2013@Luzitano
You need a plugin like Orebfuscator against xray.
@jaimecamara
Force field can not be 100% blocked. But it is limited in effect by NCP.
-
View User Profile
-
Send Message
Posted Jan 15, 2013I wonder how I do to block the hack of force field in my server using the nocheatplus!
-
View User Profile
-
Send Message
Posted Jan 14, 2013Okay - But some guys just reported me someone standing on a portal and didnt moved.. then they just gaved him stuff and he didnt grabbed - they even filmed it.. then they just got attagcked - so i looked forward for this and found him using that Hack.. Freaking guys.. ruinning MC .. starting with Xray .. this guys should "die" -.-"
-
View User Profile
-
Send Message
Posted Jan 14, 2013@Luzitano
It is not (yet) blocked, if the cheater keeps to distance and event-sequence constraints.
-
View User Profile
-
Send Message
Posted Jan 14, 2013Hello mate - today i found a guy using FreeCam hack .. i got proofs from other guys and i checked and was true - this hack ยป http://www.youtube.com/watch?v=SLKHP4Wy7gI Anyway this plugin can stop that?
-
View User Profile
-
Send Message
Posted Jan 14, 2013@harl
@Apoc22932
A ticket would make sense if you really find an issue. I can't make out if there is one, or if you are just wondering if NCP does anything at all, because nothing happens.
First thing to make sure is to have matching versions of Craftukkit/Spigot and NCP. Also check the startup log if it enabled at all, or if any other exceptions with NoCheatPlus occur.
If it is on a live server with a couple of players, you can also check the nocheatplus.log file in the plugins/NoCheatPlus folder, there will most likely be some entries for the slightly higher violations, though only if someone went beyond some limits, be it cheating or false positives (some checks currently must throw false positives, like the passable check, which checks against noclip stuff - unfortiunately Minecraft lets players move before they have received and rendered the chunk they stand on, so there are small passable violations to be expected with logins and teleporting and the like).
What often happens is that people test a hack client, but still have op or the '*' or other check-bypass permissions, thus they can't generate violations.
The other thing is for servers using very few permissions for admins/techs, you might be missing the nocheatplus.admin.notify permission, which is necessary to receive in-game alerts.
So far. We need better overview pages :) .