Skip to main content

Nintendo Switch 2 Hacked via Pure Software Vulnerability

A developer has hacked the Nintendo Switch 2 using a pure software vulnerability applicable to the latest firmware. The hacked console can run homebrew software and game mods, but the hack is not permanent; the jailbroken state disappears after restarting the console.

任天堂Switch 2已通过纯软件漏洞被破解

Reportedly, the Nintendo Switch 2 console has been hacked via a pure software vulnerability. Developer pepsipu demonstrated this hack by running modified content within Mario Kart World. The vulnerability, named ns2jb, is said to work on Switch 2 firmware version 23.0.1 and does not require hardware modification chips.

To demonstrate its capabilities, pepsipu modified the Switch 2-exclusive game Mario Kart World, adding custom characters including Cinnamon Dog.exe, Hatsune Miku, Peter Griffin, and RED. The developer stated that ns2jb allows running native code and provides permissions useful for homebrew development, game research, save backups, and game modification.

However, this is far from a complete or permanent Switch 2 jailbreak solution. Ns2jb is limited; it cannot persist after a reboot and currently does not offer a persistent custom firmware solution. After restarting the console, the exploit is removed from memory, and the affected processes are restored to their normal state.

任天堂Switch 2已通过纯软件漏洞被破解

This method exploits a vulnerability in the Switch 1 version of SmileBASIC when running in Switch 2 backward compatibility mode. Pepsipu's full technical analysis delves deeper into how access is obtained, but the key point is that the vulnerability ultimately allows native code execution with elevated system privileges.

Furthermore, there is other evidence supporting the credibility of this jailbreak tool. Developer Gezine recently disclosed a universal vulnerability affecting both the original Switch and the Switch 2, stating that he had communicated with pepsipu and considered the tool to be "legitimate." Gezine also mentioned that pepsipu was aware of his own userland exploit, which is distinct from ns2jb.