Hacking Speculations about Switch 2 hacking

[Nakamichi]

The Wii was hacked with tweezers, switch was hacked with a paperclip and aluminium foil...

and the Switch 2 will be hacked with TWO nail-clippers, some baking powder and a toothbrush.

 

[DigBar]

There is zero chance he got into RCM, If he did he would be posting a LOT more than some image.
If he told you that then he is 100% lying.

i talked a bit with this dude, i dont think he meant rcm, he just called it that, still dont think its real bc of the font in the picutre

 

[ronin47]

But, is this the first time that the NAND is encrypted in a console?

 

[ihaveahax]

But, is this the first time that the NAND is encrypted in a console?

The internal storage has been encrypted on every Nintendo console since Wii. Since the Switch 2 has no software exploits (and may never get some), we don't have the ability to read the contents via software, nor get the encryption keys for direct physical access.

 

[bth]

i talked a bit with this dude, i dont think he meant rcm, he just called it that, still dont think its real bc of the font in the picutre

The most obvious one is his winscp "proof" picture, which implies the following:
1. he supposedly has all the switch 2 encryption/decryption keys to point he's able to mount the emmc/nand storage
2. that the switch 2 firmware has sha256 match with "0100000000000000" type titleids mixed in (switch 1 firmware ncas) with its firmware files. Why? because the titleids are embedded in both header and npdm, which would make the sha256 of the ncas be different. the switch 2's titleid format is "0400000000000000"

https://switchbrew.org/wiki/Switch_2:_Title_list

(incase you people are unaware, or forgot, all nca names are half of the sha256 value of the nca.
and the programid (ex: 0100000000000033, 0400000000000033) is in the encrypted part of the header of the nca.
even just there, ignoring the pfs/exefs partition with the npdm, already there the sha256 would be different, even if the code was identical for switch 1 and 2.

this is switch 1, 21.2.0, firmware ncas (notice instant match from their "proof".)

this is their "proof":

 

[ronin47]

Was this a fake new then? The thread about it has been locked.

Misc  Thread 'Switch 2 nand explorer'

Feb 12, 2026

(Screenshots for those who can’t load or view Twitter)

• TheStonedModder
• Replies: 18
• Forum: Nintendo Switch 2

• 
• 
• 

 

[Dat0_]

Was this a fake new then? The thread about it has been locked.

Misc  Thread 'Switch 2 nand explorer'

Feb 12, 2026

(Screenshots for those who can’t load or view Twitter)

• TheStonedModder
• Replies: 18
• Forum: Nintendo Switch 2

• 
• 
• 

Yeah, all FAKE. I mean, they are trying... but so far nothing. Year 1 win for the Switch 2. We will begin year 2 in the coming weeks... so far we have just hope. Happy gaming you all.

 

[RyanTheArchivist]

Was this a fake new then? The thread about it has been locked.

Misc  Thread 'Switch 2 nand explorer'

Feb 12, 2026

(Screenshots for those who can’t load or view Twitter)

• TheStonedModder
• Replies: 18
• Forum: Nintendo Switch 2

• 
• 
• 

Yep all fake.

 

[rull_bull]

2 interesting bugs:
https://hackerone.com/nintendo/hacktivity?type=team

Specially the ASRL one where Nintendo has agreed to disclosure

 

[RyanTheArchivist]

2 interesting bugs:
https://hackerone.com/nintendo/hacktivity?type=team

Specially the ASRL one where Nintendo has agreed to disclosure

Nothing that would help mod the console but cool for sure.

 

[bth]

These two are done on 20.5.0 or lower, with mario kart world on not-latest.

the ldn flaw was patched in 21.0.0

 

[Nakamichi]

The internal storage has been encrypted on every Nintendo console since Wii. Since the Switch 2 has no software exploits (and may never get some), we don't have the ability to read the contents via software, nor get the encryption keys for direct physical access.

how can you call yourself "ihaveahax" and then NOT have a hack for the switch 2??

 

[hippy dave]

how can you call yourself "ihaveahax" and then NOT have a hack for the switch 2??

MYTH BUSTED

 

[novabear0]

Yeah so apparently the guy just used a tool to fake sign photo's and videos.

wait so... if you can fake-sign photos and videos into the album... wouldnt it be theoretically possible to make a homebrew payload that the system interprets as a "photo" or "video" in the album before you load it? we could just do Letterbomb 2 here if that's possible. of course it'd have to be after we find a way into the console first but still

 

[emmauss]

wait so... if you can fake-sign photos and videos into the album... wouldnt it be theoretically possible to make a homebrew payload that the system interprets as a "photo" or "video" in the album before you load it? we could just do Letterbomb 2 here if that's possible. of course it'd have to be after we find a way into the console first but still

Signing something is not the same as executing it. Modern crytography don't even trust the signature of anything and will do various checks to ensure the signature is valid, like the good old bounds check, which will make letterbombs impossible

 

[OrGoN3]

Signing something is not the same as executing it. Modern crytography don't even trust the signature of anything and will do various checks to ensure the signature is valid, like the good old bounds check, which will make letterbombs impossible

Going further with that, the Switch 2 security system seems to assume user land is exploited. So like everyone else has said, you aren't going to accomplish anything with just user land. Expanding on that, there will never be a kernel exploit. This thread gets worse and worse as it progresses.

 

[novabear0]

dang, sorry for not knowing stuff i guess

 

[Eye-V-Sore]

Going further with that, the Switch 2 security system seems to assume user land is exploited. So like everyone else has said, you aren't going to accomplish anything with just user land. Expanding on that, there will never be a kernel exploit. This thread gets worse and worse as it progresses.

So if there will "never" be a kernel exploit, is that it? Are we done here? I don't fully know how this all works, but that sounds pretty damning. I'm dying to play Pokopia, Kirby Air Riders, DK Bananza, the Yakuza and Fallout ports, and so much more, but my Switch 2 is on Day 1 firmware, so I'm wary to give up.

 

[OrGoN3]

So if there will "never" be a kernel exploit, is that it? Are we done here? I don't fully know how this all works, but that sounds pretty damning. I'm dying to play Pokopia, Kirby Air Riders, DK Bananza, the Yakuza and Fallout ports, and so much more, but my Switch 2 is on Day 1 firmware, so I'm wary to give up.

To each their own. I can't tell you what to do.

 

[karmesin]

---

"Impenetrable" and "never" are words that have aged badly every single console generation without exception.

The PS3 is the textbook case. Sony called it unhackable, and for years nobody seriously challenged that, not because it was true but because OtherOS gave the homebrew scene what it needed. The moment Sony yanked it, the community shifted focus, and within a relatively short timeframe the whole thing got popped with a five-dollar USB device running custom firmware plugged into the front port. A five-dollar device.

Security on any platform is just a ratio of time, effort, and money on the table. If someone publicly offered a million dollars for a working full exploit right now, there is a very realistic chance it lands within 8 to 10 months. It always comes down to whether the target is worth the grind, not whether it is actually possible.

The bigger barrier right now is probably not the hardware itself but Nintendo's legal posture. Nintendo has become the most aggressive litigator in the console space, making it commercially and legally toxic to market any exploitation tool publicly. The Switch is already thoroughly compromised, which removes the "just for the fun of it" motivation for targeting Switch 2, and anyone who does find something meaningful has strong reason to stay quiet rather than risk landing in Nintendo's crosshairs. The friction is not technical, it is legal.