Jailbreaking the Switch 2

A new Switch 2 jailbreak

The author released ns2jb, a jailbreak for the Switch 2. A jailbreak is a way to bypass a console's locks so you can run code the maker did not approve. This one needs no extra hardware, but it is "tethered," so it needs a computer connected to work. The author says it is the first exploit of this kind for the Switch 2.

Key facts

• The exploit can run native code as any ordinary sysmodule (a built-in system program) and as the built-in fs sysmodule.
• The jailbreak took about 2 weeks of hard work.
• The Mario Kart World mod was made in one day.
• A JetKVM device sends controller inputs over USB and receives video over HDMI.
• An Amazon Bluetooth light switch flicker presses the power button to restart a crashed console.

How the hunt worked

The author used an AI coding tool called Codex to help search for a way in. First, Codex tried a web browser attack (WebKit), which is a popular target for console hacks. That path did not give the access needed, so the author looked at Switch 1 games. SmileBASIC, a game tool with a large C++ codebase, was chosen because it had been hacked before on the 3DS. Codex found a integer overflow bug there. An overflow is when a number gets too big and wraps around into a wrong, negative value. This bug could let an attacker copy memory in the wrong place.

Why it matters

Being able to run custom code lets people make homebrew (fan-made programs), mod games, and back up save files. It also gives a way to study how the console works. The author says this is a major step for the Switch 2, which had no public exploit like this before.

What to watch

• Whether the Codex goal to reach userland code execution through WebKit succeeds.
• Whether the SmileBASIC bug leads to a full exploit, since the author has not shared all findings yet.
• How Nintendo responds with security updates.