Why 2K's shot cheaters
never go away.

The short version

A cheat device doesn't change the game. It only changes when your release arrives. Everything 2K does against it has to work on timing, and the game has no rule that treats a half-court step-back or a contested jumper differently from any other shot.

• The cheat lives outside the game. A Cronus Zen or Titan Two sits between the controller and the console and passes itself off as an ordinary controller. The console sees nothing foreign.
• A script only fixes your release. It doesn't change the starting chance, the defense or the window. It just lands Excellent nearly every time.
• In the built-in tuning, that's enough. The timing bonus is green or miss: an Excellent on any look of 20% or better becomes a make before the roll. A script that always lands Excellent only needs a 20% look.
• Nothing singles out the shots scripts love. A half-court step-back in 3v3 is a normal jump shot, and no contest is heavy enough to refuse Excellent in the built-in tuning (why).
• 2K27 fights scripts by moving the timing. It can change jump-shot speed at random, switch the set of speeds every seven minutes, hold back a hot shooter's input for a few frames, and flag rhythm shots whose stick never moves like a real thumbstick. In the built-in tuning these are switched off; 2K's servers can switch them on online.
• The shot code isn't the only check. The machines in an online game vote out the one whose game drifts from the rest, 2K's servers can send the game small scripts to run and answer, conduct rules kick idle players, and every game sends 2K a result report.
• Bans are slow because the evidence is statistical. A good script looks like a great shooter until there are enough games to compare.

How to use this

You can't stop a script from landing Excellent, but in the Park, Rec and Pro-Am you can make its shots worse before they're released, and you can make your report count.

• Contest from the start of the shot. Deadeye doesn't work on a three that starts under a heavy contest. A defender who's already tight when the shot starts keeps the full effect of the contest.
• Make every look a bad one. A heavy contest cuts a three's starting chance to a tenth, and a smothered shot to zero. A script still needs a look of about 20% for an Excellent to become a sure make, so pressure is the one thing that works against it before the release.
• Clip the game. The tell is a release that lands in the same place every time, on every kind of shot, from every distance. A person's releases spread out.
• Report through 2K's tools. Every online game already sends 2K a result report with timing averages and spreads, and since Patch 2 the Park, Pro-Am and MyCAREER co-op reports carry each player's own game ID, so 2K can tie what you report to one player's game.
• Don't expect a ban that day. Here's why bans are slow.
• If you're the great shooter being accused, the hot-shooter hold, when 2K switches it on, can't tell you from a script either. It just makes a high percentage harder to keep.

What a script actually changes

A shot is decided in six steps: the chance before timing, the defense, the timing window, the grade, the timing bonus, then make or miss. They're explained with every number in How a shot works. Only one of them depends on your hands: where your release lands against the window. That's the one a script takes over.

A script removes your release error, the one part of a shot that depends on your hands. The starting chance, the defense and the window apply to a cheater exactly as they do to you.

Why scripts green the shots they do

Half-court step-backs in 3v3

A shot from 3v3's half-court line is about 42 feet out, short of the 47-foot heave line, so it's an ordinary jump shot with the ordinary window (the heave rules). A person misses that small window most of the time. A script releases at the same moment every time, so whenever the window is there, it greens, and in the built-in tuning an Excellent on any look of 20% or better is a make. Only a deep three's low starting chance stands in its way.

Heavily contested shots

The Excellent check uses the defense after immunity, badges and Takeover have cut it, and the built-in limit is far above any real contest (step 4). A heavy contest still cuts the starting chance and shrinks the window, which costs a person greens. It barely costs a script anything, because a script needs only the window to exist and a look of about 20%.

Would hiding the green window help?

Not against the scripts that matter. A fixed-delay script never looks at the meter. It times the release from the moment you pressed shoot, so hiding the window changes nothing for it. Only a camera setup reads the meter, and it can read the shooting animation instead, the way a meter-off player does. The game already treats meter-off shooting differently: it has its own window scale, and the Excellent bonus has a separate scale when the meter is on. Hiding the window mainly takes a tool away from honest players who learned their jumper from it.

How the cheats work

Every common console cheat sits between your hands and the console and presents itself as an ordinary controller.

How a green script times a shot

1. You press shoot. The script sees the press before the console does.
2. It waits a fixed delay tuned to your jump shot, often one per shot type.
3. It sends the release at exactly that moment, whatever your thumb does.
4. Better scripts add a few milliseconds of random wobble so the timing looks less mechanical.

The camera setup is the hardest case. It reacts to what's on screen instead of a fixed delay, so it adapts to lag and to every jumper the way a person would, only with near-perfect precision.

Why the console can't detect the device

• It copies the controller's identity. A Zen or Titan reports the same USB identity as an official PlayStation or Xbox controller.
• It passes the license check through. Consoles check that a controller is licensed with a cryptographic challenge, and the device hands that challenge to the real controller.
• The game only sees button reports. In 2K's code, a shot is a press time and a release time. There's no program or memory change to find.
• 2K can't add deep checks on console. Sony and Microsoft own the system and the USB layer, so 2K can't ship kernel anti-cheat there.
• Platform fixes get patched around. When a console blocks a device, its makers usually ship new firmware.

What 2K27 does about it

2K27's shot code has a group of settings built against scripts, and all of them work on timing. Mike Wang put the design plainly: "There's no RNG factor that will make you randomly miss shots." The code randomizes when you have to release, not whether a perfect release goes in.

// 1. Random speed on signature jump shots, people only
if anti_cheat_speed_on and the shooter is a person:
    speed = weighted pick of 5 values from table[t]
    // t switches among 3 tables every 420 s of game time, in shuffled order
    effect grows from a minimum on jump shots needing 60 or less to full at 95
    // during the shot the speed eases in, reaching full a set number
    // of frames before take-off

// 2. A random input hold for hot shooters
if attempts ≥ min_attempts and field_goal_pct ≥ min_pct:
    hold this controller's next input for 0 … max_frames frames

// 3. Rhythm-shot stick check
every frame of a person's rhythm gesture:
    moved_x |= stick.x is between the middle and the edge
    moved_y |= stick.y is between the middle and the edge
if either axis never moved in between:
    push the timing at least N frames off perfect
    count one flagged shot for this player and log it

Speed that changes with the situation

Separately from the anti-cheat, every jump shot's speed is drawn at random from a range whose width comes from your base's timing (Your build). Stamina and the closest defender shift both the range and the moment the shot starts, and a small random spread is always added on top. That's ordinary variation a person reads from the animation; a fixed delay can't. On top of it, the target itself can move on contested shots:

tier   = great shooter if rating ≥ 90, good if ≥ 75, bad if ≥ 60   // built-in cutoffs
t      = min(defense / full_contest_defense, 1)
range  = blend(tier.open_range, tier.contested_range, t)
target = perfect_moment + random(range)          // in frames

The hot-shooter hold

The game counts each player's attempts and makes. Once both pass 2K's thresholds, the game holds that player's controller input for a random 0 to N frames, drawn fresh each time. A script times its release from the moment it sent the press, so the hold knocks it off the animation. A person watching the animation just adjusts.

The rhythm stick check

Rhythm shooting times a jump shot or free throw with a stick motion instead of a button. A real thumbstick always passes through in-between positions. Input that only ever jumps between the center and the edge is what a macro, a remapped key or a script produces, so that release is pushed off perfect and counted.

What it means for cheating

• 2K moved from catching scripts later to making them miss now. Rotating speeds, random spread and held input all target a fixed delay. The stick check targets fake stick input.
• A good script beats the stick check. A device that sends smooth stick values passes it.
• Script makers can patch around part of it. Anything visible in your inputs, like holding sprint into a pull-up, can get its own delay. A random draw that changes every shot can't be read from the buttons.
• Camera setups still get through. They watch the animation the way a person does, so a speed change shows on their screen too.
• Honest great shooters pay too. The hot-shooter hold can't tell a great shooter from a script. It just makes a high percentage harder to keep.

What 2K27 reports after every game

When an online game ends, 2K27 sends three reports to 2K. Between them, 2K gets each player's timing consistency, their meter habits, a count of flagged rhythm shots, and a note on anyone the anti-cheat removed.

cheater report   for each flagged player: player id, session, status

game report      per player: result, shot button vs shot stick use,
                 flagged rhythm shots, box score
                 meter fill: shots, average, spread
                 shot chart in 16 court zones, green releases

timing report    per player, for each way of shooting
                 (jump shot meter on / off, rhythm timing meter on / off,
                  rhythm tempo meter on / off):
                 shots, average timing error, timing spread

Why the average and the spread are the right numbers

The spread of a player's timing error is exactly what separates a person from a fixed-delay script: people spread out, scripts stack. The average shows a habit, like always releasing a little early. 2K27 splits both by meter setting, so a meter-off player is compared with the right group. The game itself adds spread to everyone through the random target shift, which is why one game's numbers are never enough.

• The flagged-shot count goes up by one exactly when the rhythm stick check flags a shot. So 2K gets a count of each player's fake-stick rhythm shots, every game.
• The timing numbers come from every shot's distance from perfect, capped at one second, kept as a running average and spread for each way of shooting.
• The cheater report lists each player whose cheat status is set. On PC, that happens when the anti-cheat asks the game to remove someone.
• The upload changed shape. 2K20 sent ten-bucket timing histograms with every game's results. 2K27 sends them only for 2K League games (below). Every other game sends the average and spread instead.

What every result report carries

Those three reports aren't the whole story. Every online mode also builds a result report for 2K's servers. Park, Pro-Am, MyCAREER's NBA games (solo and co-op), its drills and workouts, MyPLAYER online games, MyTEAM and its park, The W Online, Play Now Online, Legacy mode and the 2K League each have their own. They share one core.

game:        game id, session, game type, time played
             up to 16 answers to server challenges      // see "Beyond the shot"
each user:   win, loss, dropped, quit, completed, how the game ended
             teammate grade, and the plays behind it
             (good shot defense, stops, smart double teams,
              stopped fast breaks, stopped alley-oops)
each player: the box score, plus greens made on jump shots,
             layups and dunks, and in total
by mode:     Park court, streak and event; grind points, rep and badge XP;
             Takeover XP; whether skill boosts were free

The 2K League gets the full picture

timing, for jump shots, layups and free throws:
    a ten-bucket histogram, total shots, total timing error
expected makes, for threes, twos, layups and free throws:
    the sum of every shot's chance
also: catch-and-shoot and pick-and-roll makes and attempts,
      contest and block impact sums, inside and on the perimeter,
      passes thrown and caught, touches, dribble moves, time on the ball

Beyond the shot: the rest of 2K27's fair-play code

The shot code is one layer. 2K27 also makes sure every machine in a game agrees, lets 2K's servers ask the game questions, and enforces conduct rules. None of these care how you time a jumper, but together they decide who stays in a game and what 2K hears about it.

When machines disagree

In an online game, every console or PC runs the same game at once and the machines keep checking that they still match. If one drifts, the game decides which machines are right by vote.

each machine in the game (up to 14) reports a check value of its game state
machines with the same value form a group
majority = the biggest group              // on a tie, the first one found

if the majority and this machine's group both have at least 2 machines:
    split: the groups can carry on as separate games
otherwise, one of three outcomes, each logged:
    keep this machine / remove a machine / end the game
the result report records "out of sync" or "completed after a split"

Questions from 2K's servers

2K's server sends a challenge: a small script
if the report already holds 16 answers:  skip it
run the script                     // only the first, if there are several
store its answer in this game's result report
if anything goes wrong:  skip it and log why

Conduct rules

The same part of the code that handles online cheating also enforces how people behave in a game. Each mode's setup turns these rules on and sets their limits, and 2K's servers can override them, so the game itself carries no fixed limits.

Settings against gameplay exploits

2K27's gameplay tuning also has settings aimed at exploits rather than cheats. Each has a value in the built-in tuning, and 2K's servers can change it online:

• Dribble shoves: a ball handler who shoves far enough into a defender, with the ball far enough from their hand, can fumble.
• The far-post exploit: a set distance and a penetration threshold to stop it.
• Exploit layups: their own strip chance.
• Fake-stick rhythm shots: the timing push from the stick check above.

Does the code match what Mike Wang said?

Mike Wang made three claims about 2K27 shooting: no randomness makes you miss, a perfect release always goes in, and shot speed changes with stamina, defensive pressure, the catch, pull-ups and signature shot grades, which he called the skill gap.

How 2K19 and 2K20 handled cheating

"None" means neither game's code has an anti-cheat setting or a flagged-shot counter. The deep-shot rule and the random target shift they did have are in How a shot works.

Why bans are slow

• Scripts add wobble to widen their spread toward a person's.
• The game adds spread to everyone through its random speeds and target shift, so a detector has to expect it.
• Connection and frame timing blur millisecond-level evidence.
• Real elite shooters have tight timing and high green rates. A wrong ban hurts them most.
• Every jumper is different. Windows change with difficulty, shot type and meter setting, so players have to be compared with others in the same situation.

One game holds only a few dozen jump shots per player. Telling a wobbling script from a great shooter takes hundreds of shots over many sessions. Then, even once a cheater is spotted, banning at once costs more than waiting:

1. Hiding the signal. An instant ban tells the script maker exactly what was caught. Banning thousands together hides it.
2. The bar for proof. A wrong ban hits someone who may have spent real money, and a higher bar needs more shots per account.
3. A person reviews it. Statistics are evidence, not proof.
4. Priorities. Each 2K game has a one-year cycle, and anti-cheat competes with features for time.

That's what players see: someone greens for months, then disappears in a wave with many others. 2K27's in-game defenses don't change that. They make scripts weaker in the meantime.

A note on PC

Every console cheat also works on PC, and PC adds software cheats. 2K27 adds EasyAntiCheat there in a peer-to-peer setup, where the anti-cheat can ask the game to remove another player, and the result is logged as a kick by the anti-cheat. It also votes out any machine whose game falls out of sync with the others (see "Beyond the shot") and reports at startup whether the PC's mod folder is empty. The catch is that the timing report is built on the player's own machine. A console guarantees that code is untouched, while a PC cheater who gets past the anti-cheat can send numbers that look human.

What 2K could do better

1. Keep a record of every shot, not just game totals. Each shot with its situation (the speed drawn, stamina, contest, whether the hold was on) would be far stronger evidence. A person's error moves with the situation; a script's stays flat even when the speed changes. 2K already sends more for the 2K League, which gets full histograms and expected makes. Every ranked mode could get the same.
2. Check raw input on every shot. 2K27 only checks rhythm-stick motions. Button shots have tells too: press lengths that repeat to the millisecond, releases that land on the same input poll every time.
3. Bring back a rule for repeated perfect deep shots. 2K19 and 2K20 had one past 60 feet. A rule that counts repeated Excellents from 35 feet and out would hit half-court scripts without touching normal shooters.
4. Aim the hold at scripts, not at good shooting. The hot-shooter hold triggers on field goal percentage alone. Triggering it on a near-zero timing spread would hit scripts and spare great shooters having a hot night.
5. Make the meter harder to read by camera. Small changes to the meter's position or shape on each shot cost a person almost nothing, and a camera setup trained on one look has to be retrained.
6. Act quietly while the evidence builds. Flagged accounts could be matched with each other or kept out of ranked modes without revealing which signal fired.
7. Make bans cost more. Console-level bans and loss of VC and items on confirmed cases mean a ban isn't solved by buying a new account.
8. Let players report a specific shot. A report tied to a replay moment, with that shot's input timing attached, gives reviewers evidence instead of a name.
9. Push the console makers for signed input. A controller's license check proves it's licensed, not that each press came from it. Only Sony and Microsoft can change that.

What 2K can't do

• See the device on console. The game only ever receives button reports.
• Block every adapter. They're legal products, and remapping hardware is also how many players with disabilities play.
• Out-design a camera. Any cue a person can learn from the screen, a camera can learn too.
• Ban instantly without hitting innocent players. The statistics need hundreds of shots, and elite shooters overlap with wobbling scripts.
• Win for good. Every detection gets studied and patched around. The real goal is to make cheating cost more than it's worth.