Software-only jailbreak released for Switch 2 firmware 23.0.1
Original title: jailbreaking the switch 2
ns2jb is tethered, runs native code as sysmodules, and was used to mod Mario Kart World.
Sammy Hajhamid published ns2jb, a software-only tethered jailbreak for Nintendo Switch 2 firmware 23.0.1 that the author says is the first of its kind. It runs arbitrary native code as an ordinary sysmodule and as the built-in fs sysmodule, enabling homebrew, game mods, save backups, and peripheral access through MMIO. Initial WebKit code execution via a captive portal did not yield the needed sysmodule access. The working path used a 32-bit integer overflow in the Switch 1 game SmileBASIC to gain out-of-bounds read and write, then ROP, before compromising more privileged sysmodules. The author says the jailbreak took about two weeks and a Mario Kart World mod was built in a day.
Unconfirmed: The author says it is, to their knowledge, the first such Switch 2 exploit, and some alternate findings are not disclosed.
- The exploit code is available from the ns2jb repository.
- SmileBASIC's REMOVE check wraps position plus count, then a memmove pulls in an adjacent pointer.
- The author says WebKit execute-only memory, PAC, and CFI blocked a general browser path.
- The author cannot yet publicly disclose findings from another Switch 1 game approach.
Impact: Arbitrary native code as Switch 2 sysmodules
| Product | Affected |
|---|---|
| Nintendo Switch 2 | firmware 23.0.1 |
From the original article
11 min read at pepsipu.comns2jb is a software-only jailbreak of the switch 2 for the current latest firmware 23. 0. 1 You can get a copy of the exploit from the ns2jb repository.
By pepsipu.com via kwas · pepsipu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.