A software-only jailbreak for the Switch 2 runs homebrew and modded Mario Kart World
Jailbreaking the Switch 2
ns2jb is a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1. It chains a SmileBASIC integer overflow on a Switch 1 game with a path-normalization buffer overflow in the built-in fs sysmodule, then swaps the ExeFS filesystem behind the loader's IPC handle to run arbitrary native code as any sysmodule. The author used Codex agents to find bugs and modded Mario Kart World with new racers.
In practice, however, I'm doubtful of that last claim, because it's the responsibility of the fs module to ensure the served filesystem matches the NCA header's filesystem hash, and we have ARW in it.
- hturan
Incredible all around.
If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).
- rootsudo
I don't understand, how are people using codex for this sort of research? Whenever I try to do bug bounty, research, etc it locks down and I have the "blue" tier access/daylight whatever it's called.
For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
- coreyp_1
I can't believe that he was doing this using Codex!
Reason: Codex shut me down when trying to find a stack overflow in my own code, saying that I had to be an authorized security researcher.
It probably triggered on the word "Java" in my code. But I wasn't working on Java at all... It's a personal regex library written in *C*, and I was working on a Java dialect (I currently support 12 dialects... for fun. Stop judging me.)
I had to go back to Claude...
- schwarzrules
> The jailbreak itself took substantial effort for ~2 weeks.
This seemed like a subtle statement about how impressive this is. Pre-LLM, it seems like putting in substantial effort would take a lot longer to achieve this result.
- KeplerBoy
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
- Melatonic
I wonder if we're gonna get a situation like Switch 1 where the first generation has the ability to software jailbreak and run modded firmware with later generations requiring a mod chip
- _imnothere
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
- jyapayne
Great writeup! The light switch switching the switch 2 is hilarious.
Note that you can probably alleviate the "pain" of typing in the smilebasic by writing (or vibing) the raspberry pi pico (or similar) to emulate a keyboard and type the code in.