Researcher achieves partial software-only jailbreak of Nintendo Switch 2

Security researcher Sammy Hajhamid, who goes by Pepsipu online, has demonstrated a partial jailbreak of Nintendo's Switch 2 game console that requires no hardware modification. The method grants "userland" (user-level) access, which he says makes it possible to run homebrew (unofficial, self-made software), reverse engineer and mod Switch 2 games, back up save files from the console, and reach most of its peripherals.

How the hack works

The exploit is built on the original Switch version of SmileBasic 4, the latest entry in a long-running series of programming environments and interpreters for Nintendo hardware. It is a "tethered" hack: it also needs a macOS or Linux PC on the same network to run a node.js package that helps enable privileged access to the system.

Hajhamid writes that he used OpenAI's Codex to probe SmileBasic's language interpreter, using a custom harness that could send USB commands to the console, read results over HDMI, and power-cycle the system with a Bluetooth light-switch flipper. After "substantial effort for ~2 weeks," the harness found a 32-bit integer overflow that occurs when items are removed from an array. The flaw exposes an array pointer, which in turn gives read and write access to parts of system memory.

The researcher then looked for internal system modules that could offer more privileged access to core console functions. He found a buffer overflow in the FileSystem services module that exposed a cached data pointer and granted arbitrary read and write privileges. That allowed him to perform privileged filesystem actions and eventually achieve native code execution through a faked filesystem process.

Demonstrations

As a proof of concept, Hajhamid showed off a range of modded characters in Mario Kart World. Others are also showing simple demos and in-progress developer tools running on exploited hardware.