Researcher Unlocks Partial Switch 2 Jailbreak
A security researcher has demonstrated a software-only partial jailbreak for the Switch 2. The exploit provides userland access, which the researcher says can be used to run homebrew software, analyze and modify games, copy save data from the console, and reach most built-in peripherals through memory-mapped I/O.
How the Hack Works
The jailbreak is tethered, meaning it relies on external tools during operation. It uses the original Switch version of SmileBasic 4, an interpreter and programming environment from a long-running series on Nintendo hardware. The process also requires a macOS or Linux computer on the same network running a Node.js package that helps the researcher obtain privileged system access.
From Interpreter Bug to System Access
According to the researcher, known online as Pepsipu, the work involved using OpenAI Codex to probe the SmileBasic interpreter. A custom harness was used to send USB commands to the system, observe output over HDMI, and restart the device through a Bluetooth light-switch controller.
After roughly two weeks of testing, the harness identified a 32-bit integer overflow triggered while removing items from an array in SmileBasic. This flaw exposed an array pointer, allowing reads and writes to parts of system memory.
Escalating to Privileged Execution
With memory access established, the researcher examined internal system modules for paths to higher privileges. A buffer overflow was found in the console's FileSystem services module. That flaw revealed a cached data pointer and ultimately granted arbitrary read and write capabilities.
Using those privileges, the researcher performed privileged filesystem operations and reached native code execution by constructing a fake filesystem process.
Public Demos
As a proof of concept, Pepsipu displayed modified characters in Mario Kart World. Other users have also shared simple demos and early developer tools running on exploited hardware.
Comments
Leave a comment