What is ns2jb? The Switch 2 jailbreak situation explained
ns2jb is a software-only Switch 2 jailbreak for firmware 23.0.1. Here's what happened, what it can and can't do, Nintendo's response and a FAQ.
Before Thursday, the Switch 2 jailbreak scene was basically non-existent and was even a bit of a running joke. But a single tweet from researcher pepsipu changed all that when he released ns2jb.
pepsipu said:i jailbroke the nintendo switch 2
so i modded cinnamoroll, peter griffin, hatsune miku, and more into Mario Kart World, a switch 2 exclusive
pepsipu tweet (X)
The tweet included a short video of Mario Kart World running on the Switch 2 with custom character models.
Since then, the Switch 2 jailbreaking scene has expanded rapidly, with significant developments over the last 72 hours. Nintendo has since pulled a Switch 1 game, SmileBASIC 4 which is required for the exploit , from the eShop.
Here is what happened, what the current exploit can and can't do, and what you need to know about it.
What is ns2jb?
ns2jb is a software-only, non-persistent jailbreak for the Switch 2 on firmware 23.0.1. It was released by security researcher Sammy "pepsipu" Hajhamid[↗].
Non-persistent means nothing survives a reboot. Restart the console and the exploit is gone, and you have to run it again.
There is no custom firmware and no kernel compromise.
What ns2jb can do so far:
- Native code execution with the privileges of the fs (filesystem) sysmodule [↗].
- Dumping of internal storage and ordinary sysmodule code, which pepsipu used for offline analysis. [↗].
- Game modification: pepsipu added custom characters to Mario Kart World. [↗].
What it may be able to do, but is unproven:
- Dumping games and apps. hexkyz says fs can dump any binary below kernel level, but no full game dump has been shown [↗].
- Persisting across reboots (hexkyz: in theory, through early system savedata manipulation), or running from another entry point such as the browser (hexkyz and pepsipu)[↗] [↗].
How does it work? It starts with an integer overflow (a maths error) in SmileBASIC 4 (details below). A heap overflow in the fs filesystem service then lets that code break out of the SmileBASIC game and a further flaw in how the system loader trusts fs lets it launch its own code [↗][↗].
What is SmileBASIC? It's a Switch 1 title that allows for simple BASIC programming, letting users write, run and share their own games and programs, so it actually contains a full interpreter (basically a computer program that executes code line-by-line). The 3DS version was exploited years ago (via smilehax), which is perhaps why pepsipu looked there first.
To find the Switch 2 exploit, pepsipu ran several instances of OpenAI's Codex against real consoles, with a motorised switch lever pressing the power button after each crash so the AI could keep trying without any manual intervention [↗]. Codex wrote the heap-grooming that keeps the exploit stable, which hexkyz called "the truly novel and valuable contribution from the AI" [↗].
What happened and when?
All times are GMT.
Thursday 22 October- 03:59 – pepsipu announces the jailbreak on X with a video of the modded characters running on real hardware [↗].
- 07:38 - Gezine, the PS5 Y2JB developer, retweeted it saying: "Talked with this guy. Seems legit." [↗]
- 09:43 – Gezine suggests: "I think it's possible to make untethered switch 2 jailbreak. Similar to Y2JB at PS5." [↗]
- 11:09 - Gezine adds: "Smallbasic4 is not strictly needed. So I wouldn't update to latest firmware to get that game."[↗]
- ~14:22 – SmileBASIC 4 is pulled from the EU and UK eShops; the US follows around 17:00 [↗] [↗].
- 15:34 – Alula teases a second entry point using Japanese-eShop demos built on the Artemis Engine. Hours later he clarifies that it needs a tampered save from an already-hacked Switch 1[↗][↗].
- 18:55 – hexkyz's technical write-up circulates, calling ns2jb the modern equivalent of the Switch 1 "nspwn" [↗].
Friday 23 October- 00:18 – RavensClawX shows the first Switch 2 homebrew launcher, which runs code in SmileBASIC via its GPU shaders rather than as a native app [↗].
- 05:12 - Gezine tells people not to worry about scalpers selling "exploit games": saying "I am pretty sure you don't have to worry about 'scalping exploit game' as there is something like M*g switch."[↗]
- 12:29 - members report the exploit stalling at step 2/4 ("Acquiring FS memory"), so we added a warning to the news post that users are reporting bricked consoles. The reports are unconfirmed [↗].
- 14:53 – RavensClawX releases HBLauncher v0.2.0 [↗], followed at 16:21 by an FTP server limited to SmileBASIC 4's own files[↗].
- 19:40 – Gezine tweets: "Bad news. I got email from Nintendo...
"[↗] The contents of the email haven't been published, and the claim itself is unverified. - 22:20 - a developer going by Izmysh claims to have escaped the shader sandbox: "The defenses have fallen. The sandbox is no longer a prison." A launcher called IZlauncher is promised, but its GitHub repo contains only a "COMING SOON / IN DEVELOPMENT" readme at the time of writing[↗][↗]. No proof has been shown, so treat this as an unverified claim.
Saturday 24 October- 04:55 – Izmysh posts a video of what he says is DOOM running on the console outside the shader route. Switch 2 can already run official DOOM releases, so the video alone isn't proof [↗].
- 05:09 – RavensClawX says Izmysh "has actual CPU memory execution working" [↗]. This is one developer's word, so take it at face value.
- 05:39 - NERS claims a dump of Deltarune on Switch 2[↗]. See the caveat below.
- 05:57 – bth notes that Nintendo removed SmileBASIC 4's nsuid and title ID from its eShop registry entirely, rather than just marking it as delisted [↗].
- 06:12 - Centro LEAKS shows a DuskBloods beta datamine and a Mario Kart World model, saying the first Switch 2 ROMs are being dumped. These claims are unproven [↗].
- 06:53 – fuyuka posts Super Mario Bros. running on Switch 2 homebrew, as a shader, which is how the current launcher runs code[↗].
What ns2jb can and can't do
According to hexkyz, fs can be used to dump any binary below kernel level, which covers games, apps and non-kernel sysmodules. It can't expose keys, and it is no closer to the kernel than any other sysmodule. In theory the exploit could be made to persist across reboots through early system savedata manipulation, but that is not a promise and is unproven [↗].
There is no title installer and no way to boot or dump games, so it doesn't enable piracy at this stage.On the claims of game dumps: so far they are asset-level, and no full game dump has been shown. Commenters on Reddit at /r/switch2hacks say the Deltarune files are diffs (.xdelta) applied to the Switch 1 build rather than a full Switch 2 release. That is unconfirmed, as is the dump itself[↗].
Nintendo's response
Nintendo hasn't made a public statement. Gezine's tweet [↗] suggests they have contacted him but this is unproven and the contents of the supposed email are unknown.
What Nintendo did do is pull SmileBASIC 4 from the eShops worldwide and @bth reports the game was later removed from their eShop registry entirely. Several members also report the Japanese demo that some used is gone[↗]. However, delisting the game may not help much, as pepsipu and hexkyz both say SmileBASIC 4 may not strictly be required and that any entry point that reaches fs can hit the same bug[↗][↗].
As of today, no firmware update has been released to counter this exploit.
Should you update, buy or do anything?
We're in the very, very early days of Switch 2 hacking. It could be months or even years before anything vaguely resembling the current Switch 1 scene materialises, and this exploit may not even develop beyond its current limits. But the important takeaway is that the Switch 2 is a step closer to being unlocked than it was 72 hours ago.
Gezine's advice, repeated across the GBAtemp threads, is to not update just to get the game [↗], because a cartridge-based exploit could be possible. hexkyz adds that lower firmware may also still have undisclosed bugs [↗].
We suggest keeping your console offline or using a Nintendo DNS blocker such as 90dns, not updating the firmware and waiting for further developments if you care about jailbreaking your Switch 2.
ns2jb FAQ:
Is the Switch 2 really jailbroken and/or hacked?
Partly... ns2jb gives arbitrary code execution as the filesystem sysmodule on firmware 23.0.1. However, there is no custom firmware, no kernel exploit and nothing that survives a reboot.What firmware does it work on?
ns2jb requires a Switch 2 on firmware 23.0.1[↗]. hexkyz expects the bug to be patched promptly by Nintendo, so it's unlikely anything newer than 23.0.1 won't work.Do I need SmileBASIC 4?
For now, yes. The exploit targets version 4.4.9 of the Switch 1 title and also needs a PC running Node.js installed. You must also type a ~229 line BASIC program typed in to SmileBASIC which, without the right tools to automate the process can be tedious. However, hexkyz suggests other entry points may be possible.Can I play pirated or backed-up games?
No. There is no title installer and no way to boot Switch 1/2 games.Was the Switch 2 hacked using AI?
Partly. Codex worked out how to arrange the console's memory so the bug hits the right spot every time, which is what keeps the exploit stable while pepsipu built the rig and directed the work[↗].Can games be dumped?
In principle, yes, per hexkyz. In practice only asset-level dumps have been claimed so far and even then; the Deltarune one is disputed. pepsipu's ns2jb technical write-upTL;DR
- ns2jb is a software-only Switch 2 jailbreak for firmware 23.0.1. It uses a bug in SmileBASIC 4 - a Switch 1 game title.
- It is non-persistent: so a reboot removes it.
- There is no custom firmware, no kernel exploit and no piracy.
- Nintendo has pulled SmileBASIC 4 from eShop.
- No firmware update to fix the exploit has been released yet.
- Don't update just for the game. Keep your console offline or use 90dns if you want to stay on 23.0.1.
