A security researcher has demonstrated a partial jailbreak of the Nintendo Switch 2 that requires no hardware modification, giving users "userland" access to the console. According to the researcher, the exploit "lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2's peripherals through MMIO."
The method starts with the original Switch version of SmileBasic 4, the latest entry in a long-running series of programming environments and interpreters for Nintendo hardware. The hack is described as "tethered," meaning it also depends on a macOS or Linux computer on the same network running a node.js package that helps enable privileged access to the system.
The researcher, Sammy Hajhamid, who goes by Pepsipu online, wrote that he used OpenAI's Codex to probe SmileBasic's language interpreter. He built a custom harness that could send USB commands to the console and read the results over HDMI. A Bluetooth light-switch-flipping device handled power cycling.
After what he called "substantial effort for ~2 weeks," the harness uncovered a 32-bit integer overflow that occurs when items are removed from an array in SmileBasic. The flaw exposes an array pointer, which in turn allows reading and writing portions of system memory.
With that foothold, Hajhamid went looking for the console's internal sysmodules, hoping to find one that would offer more privileged access to core functions. He identified a buffer overflow in the FileSystem services module that exposed a cached data pointer and granted arbitrary read and write privileges.
From there, he wrote, he could carry out "privileged filesystem actions" and ultimately achieve native code execution through a faked filesystem process.
As a proof of concept, Hajhamid showed off a host of new modded characters in Mario Kart World. Other people are also demonstrating simple programs and in-progress developer tools running on exploited hardware, suggesting early interest in the access the exploit provides.
