[SEC] NoCheat v3.4.1 - Detect and Fight the exploitation of various Flaws/Bugs in MC [CB 1.1 R4]

did you go to genius school?

Bump

Definately going to give this one a shot, by the sound of it - awesome.

I'm especially interested in how it behaves in unusual situations and if you can reliably produce false positives (it prevents you from doing stuff you should definitely be allowed to do), e.g. how does it behave in flowing water, stationary water, on ladders, minecarts, moving through portals, respawning. Stuff like that which I haven't yet tried (enough).

Also, does it prevent other bukkit plugins from working as expected?

You need to add a feature where it bans them if they attempt this too much. That would make a lot of people's day.

You could always have it keep track of how many of these bogus events it gets, and have a way for other plugins to read this number and act accordingly.

Breaks on ladders, but it successfully stopped flying! Improve it and I'll be using it on my server. Thanks for your work!

wtb Permissions and ladders

I've been able to create 3 false positive scenarios.

• Ladders as mentioned above. Added detail to this case is that the ladders work fine if every vertical space is filled with a ladder. When ladders are spaced as nearly everyone does the error message is triggered.
• Half-Blocks(id 44) over air. Your server position on half blocks is actually one lower so instead of being on top of the blocks you are standing on what is below them serverside.
• TNT cannon. Launching the player straight up I was able to trigger the message. This one doesn't really matter since without god mode you're half dead from the blast.

Edit: After some testing I believe your plugin also combats noclip as well. While you can still fly through blocks once you turn off noclip you are teleported back to where you started from.

@Evenprime Will try this tomorrow. I am really looking forward to testing it out. I want to know if you could add logging and if there is a message to the user who tries to speed hack if you could add that to disable since I don't want people to know were watching there every mood.

I really want to know if this causes to many calculations and if it does what would a 50+ Server act?

Thanks for the detailed report. Ladders and Half-Blocks should be easy to fix. For the TNT I'll probably take a bit longer.

I currently try to get the detection right, then I'll add support for that. I think I'll put the source code up for the next version (it still needs some documentation to be presentable). Calculations are really minimal, just a bunch of double adds/subs and comparisons.

I look forward to the fix with ladders, then i will try it out.

seems like a bug fix for bukkit or minecraft all together. good work

Does this work on people who set their clocks forward to run and break things at super speed?

No it doesn't work on that since all the player movements are legitimate just sent at a faster pace than normal. With a modded client I believe you would be sending at the normal rate while moving too far in each event.

You could check the interval at which things happen to verify the rate.

Three Thumbs Up! Thanks for the hardwork! Much appreciated.

@Evenprime: you will be a legend to all server admins if this works out.

- I also managed to get a false positive on ladders... additionally I put myself into an endless loop of NoFlyPlugin was triggered messages, getting reset to a starting point from which no the plugin would be triggered again. And this was using the web browser client. So a few ideas for improvement on an awesome plugin already.

- Permissions will be very helpful, as an admin, I use Zombe which is handy in a pinch to clean stuff up - but I ban anyone else using it... I know - do as I say not as I do, but just trying to create fair game play for the players.

- Custom actions on trigger. The afforementioned loop made me think this right away. Perhaps a configurable setting for when the mod catches illegal movement. OnFly: logonly/kick/ban/resetpos/echo world <name> is trying to cheat!

- Logging the action of course would be very handy for admins to review. I think until you manage to cleanup false positives this will be the fastest way to get your release out. Instead of the position reset and warning to the player, just have it quietly logged, as to queue the moderators of a server who they should be keeping an eye on.

Keep up the GREAT work on this MOST NEEDED plugin that I could have possibly ever wanted...

Version 0.2 is up.

- Ladders, half blocks, stairs are now treated correctly
- I removed the message to the player and instead log a message on the server with more details
- I now count the number of cancelled events. It is appended to the server log message
- Now with sourcecode repository online. You can therefore have a look and/or adjust it to your needs till I support Permissions and other stuff

TNT and other explosions still aren't treated yet at all. I have to first experiment a bit with how exactly they influence player movement.
Setting the system clock forward isn't recognized as a cheat yet. But will likely be at some point. I believe I'll go with something like counting the move events for every x seconds and if there have been more than the expected maximum of y, trigger something.

EDIT: As you can see in the source code, I sacrificed precision for performance a lot. I tried to completely avoid expensive calculations like floating point divisions or multiplications. So far I have been successful which hopefully causes this plugin to not kill server performance with dozens of players.

I like this but theres just one problem for me. I use the flight mod to help admin my server, is there a way where you can ignore the admin/op for a server?

Any plans to do this Evenprime? I'd be most appreciative.

Unless someone finds a serious bug in the meantime, I'm going to work on Permissions now which will include that.

Eventually yes. But I make no promises as to when I'll add it.

Could you check if the player is in ops.txt file and allow them to fly if the player is OP?

Why not use a server side mod that would probably not trigger this such as magic carpet?

Great work! Once permissions or ignore based on ops.txt is added, I will use this.

I love the idea of this plugin but I was able to generate several false positives just while running around. I am currently transcoding a video file so I may be representing a population that uses weaker machines during my test, as there was a lot of client-side lag. I generated a few log reports and noticed "pull backs" when jumping around on the corners of blocks, like at a diagonal, from one corner to another. Not many, but a few. And then I entered 2 inf-loops when jumping on a castle wall's staggered ramparts. I warped to get out of it. I entered the second inf-loop while jumping down into a stairwell onto wooden stairs. For now I am going to uninstall this but look forward to it's continued production!

This.

hmm you should probably rename your plugin it covers more than flying... perhaps nocheat or something similar if that is taken.

I like it, I think permissions are something atm which isn't THAT necessary, especially as the new bukkit permissions will come out soon. I would focus more on making sure it is bugfree (because otherwise people can't use it) and to add more cheat detecting to it.

After the official bukkit permissions comes out you could go for the permissions. I don't honestly know why I need a nofly mod as an admin, I have serverside plugins which allow everything I need and those already support permissions. Just my 2 cents...

Thanks for the bug description.

I think I found the problem. Minecraft gives players that "fall against a wall" (I lack a better description) a small height boost to place them above wherever they are bumping against, if there is space above. This can happen a lot when you cut corners by walking diagonally across a gap, but also sometimes on stairs.

That is fixed now and I uploaded a new version.

I'm still working on Permissions, just thought doing a quick fix for that problem now will help you finding other bugs while I work.

PS: The new source code is up at github. So if you don't want to wait you can have a look at the changes there and/or compile it yourself.