Switch 2 jailbreak "ns2jb" released. Software-only exploit, tethered
Developer pepsipu has released details of ns2jb, a software-only, tethered userland exploit for the Switch 2 that reportedly works on the latest 23.0.1 firmware.
Developer pepsipu has released technical details for a userland exploit for the Nintendo Switch 2 called ns2jb.
If credible, this is the first software-only, tethered jailbreak for Nintendo's latest console and even supports the latest 23.0.1 firmware.
A video showcasing custom modded characters in Mario Kart World (Switch 2)
In the blog article, which details how the jailbreak was achieved they go on to say the exploit bypasses standard webkit mitigations by exploiting a 32bit integer overflow in the Switch 1 backward-compatible SmileBASIC interpreter.
Being tethered means that the exploit does not offer coldboot persistence or custom firmware (CFW) currently, instead it successfully demonstrates arbitrary native code execution within the system's fs (filesystem) and ro sysmodules.
What does this mean for developers and homebrew authors? Currently, this unlocks the ability to execute native code, dump encrypted Switch 2 save files, reverse engineer exclusive titles and to even directly interface with system hardware via MMIO. While full kernel level control is currently off limits, even just having access to the filesystem allows for people to poke around - as demonstrated with Mario Kart World in the above video which shows custom characters such as cinnamoroll and red from Angry Birds playable in the game.
The jailbreak leaves no persistent modification to the system. A simple console restart cleanly restores the original fs and ro processes and removes the exploit payload from memory.
How was the hack achieved?
To achieve this, pepsipu built an automated physical hardware test rig around a Switch 1 and Switch 2 using JetKVMs (for remote HDMI output and USB controller input) and a bluetooth switchbot (automated physical button presser) to press the power button when the console crashed. Using LLM agents (Codex) he ran them with the task of vulnerability research and exploitation.What is needed to get the hack set up?
Running the demo requires the SmileBASIC 4.4.9 Switch game; a PC on the same local network running Node.js 22+ and 20MB of save data space. Full instructions are at the link below.Can I install custom firmware now?
Not yet: it’s tethered, there’s no CFW and it doesn’t survive a reboot. This is very very early stages.
pepsipu’s ns2jb technical write-up
