Overview of the Jailbreak

A recent breakthrough by security researcher Sammy Hajhamid has unveiled a software-only partial jailbreak for the Nintendo Switch 2, allowing for “userland” access. This development signifies a leap forward for enthusiasts and developers interested in homebrew applications and gaming modifications.

Technical Details of the Hack

The jailbreak exploits SmileBasic 4, a programming environment that operates on Nintendo devices. To execute the hack, users need access to a macOS or Linux computer within the same network. A node.js package runs on the PC to facilitate privileged system access.

Hajhamid, who is known online as Pepsipu, utilized OpenAI’s Codex to investigate the SmileBasic language interpreter further. By developing a custom harness capable of sending USB commands and displaying results via HDMI, he identified a critical vulnerability—a 32-bit integer overflow linked to item removal from an array in the software. This flaw grants access to an array pointer, enabling both read and write operations within system memory.

Exploring the Switch 2’s Internal Functionality

Following this initial discovery, Hajhamid sought deeper access to the console’s internal modules. His research led him to a buffer overflow in the FileSystem services module, which revealed a cached data pointer. This vulnerability opened the door to arbitrary read and write capabilities within the system, culminating in privileged filesystem actions and the ability to execute native code via a simulated filesystem process.

Demonstration of the Exploit

As a proof of concept, Hajhamid showcased a variety of modified characters within Mario Kart World. Other developers have also started presenting simple demonstrations and tools built on the exploited hardware, signifying the ongoing excitement within the community surrounding this new potential.