A security researcher has demonstrated a software-only partial jailbreak of the Switch 2, gaining “userland” access that he says “lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals through MMIO.”
The hack relies on the original Switch version of SmileBasic 4, the latest in a long-running series of programming environments and interpreters that run on Nintendo hardware. The so-called “tethered” hack also requires access to a macOS or Linux PC on the same network to run a node.js package that helps enable privileged system access.
Researcher Sammy Hajhamid writes that he used OpenAI’s Codex to poke at SmileBasic’s language interpreter, using a custom harness that could send USB commands to the system and view results via HDMI (as well as power cycling via a Bluetooth light switch flipping device). After “substantial effort for ~2 weeks,” that harness discovered a 32-bit integer overflow that occurs when removing items from an array in SmileBasic. That error gives access to an array pointer, which in turn allows read and write access to portions of system memory.
From there, Hajhamid writes that he started poking around for access to the Switch 2’s internal sysmodules, looking for ones that could provide more privileged access to the console’s core functions. Eventually, he found a buffer overflow in the console’s FileSystem services module that exposed a cached data pointer, granting arbitrary read and write privileges. From there, Hajhamid writes that he could execute “privileged filesystem actions” and eventually achieve native code execution through a faked filesystem process.
Hajhamid, who goes by Pepsipu online, showed off a host of new modded characters in Mario Kart World as a proof of concept for the exploit. Others are similarly showing off simple demos and in-progress developer tools running on exploited hardware.
Still, the current “userland” exploit keeps any Switch 2 homebrew developers trapped in a relatively small sandbox, and falls well short of the kernel-level access that would provide full control of the hardware.
Putting the genie back in
If the SmileBasic name sounds familiar to you, it’s probably because the 3DS version of the same software was key to the so-called smilehax exploit on that handheld back in 2016. Nintendo removed SmileBasic from the 3DS eShop shortly after that hack became public, and SmileBasic 4 has similarly already been delisted from the Switch eShop worldwide (though a Japanese demo version that may work similarly is still accessible as of this story’s publication).
That delisting could help slow the spread of this exploit to the wider base of Switch 2 owners that haven’t previously purchased and/or downloaded SmileBasic. But others in the Switch 2 hacking community are already teasing some similar exploits that appear to work using other games. And while the current exploit works on the latest Switch 2 firmware version (23.0.1), this particular vulnerability seems likely to be patched out in imminent firmware releases, which will be required for continued access to many Nintendo services and future game releases.
So while this exploit is definitely unwelcome news for Nintendo, it’s not nearly as problematic as the “unpatchable” original Switch exploit that surfaced in 2018. That hack required a complete hardware redesign to ensure that future systems were not susceptible.
Still, the fact that Switch 2 hackers have gotten this far just over a year after the console’s release is not a good sign for the overall impregnability of Nintendo’s system software. Get ready for another never-ending cycle between console hackers and the hardware makers trying to keep them out of their console’s deepest recesses.
