\n
<\/p>\n
A security researcher has demonstrated a software-only partial jailbreak of the Switch 2, gaining \u201cuserland\u201d access that he says \u201clets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2\u2019s peripherals through MMIO.\u201d<\/p>\n
The hack relies on the original Switch version of SmileBasic 4, the latest in a long-running series of programming environments and interpreters that run on Nintendo hardware. The so-called \u201ctethered\u201d hack also requires access to a macOS or Linux PC on the same network to run a node.js package that helps enable privileged system access.<\/p>\n
Researcher Sammy Hajhamid writes that he used OpenAI\u2019s Codex to poke at SmileBasic\u2019s language interpreter, using a custom harness that could send USB commands to the system and view results via HDMI (as well as power cycling via a Bluetooth light switch flipping device). After \u201csubstantial effort for ~2 weeks,\u201d that harness discovered a 32-bit integer overflow that occurs when removing items from an array in SmileBasic. That error gives access to an array pointer, which in turn allows read and write access to portions of system memory.<\/p>\n
From there, Hajhamid writes that he started poking around for access to the Switch 2\u2019s internal sysmodules, looking for ones that could provide more privileged access to the console\u2019s core functions. Eventually, he found a buffer overflow in the console\u2019s FileSystem services module that exposed a cached data pointer, granting arbitrary read and write privileges. From there, Hajhamid writes that he could execute \u201cprivileged filesystem actions\u201d and eventually achieve native code execution through a faked filesystem process.<\/p>\n
Hajhamid, who goes by Pepsipu online, showed off a host of new modded characters in Mario Kart World<\/em> as a proof of concept for the exploit. Others are similarly showing off simple demos and in-progress developer tools running on exploited hardware.<\/p>\n