Hacking Speculations about Switch 2 hacking

[Newhouse-Estates]

The most interesting thing here is that it's a userland without the use of a save game exploit or use of the webkit.
Very curious indeed.

 

[Flame]

You know what this means.

Spoiler

 

[XRTerra]

It will be interesting to see Switch 2's running LLMs in the future. Piss poor bandwidth but the GPU needed is technically there for a decent 7B runner. It'll also be fun to see DLSS 4.5 "running" whenever Linux gets ported.

 

[ChibiMofo]

It will be interesting to see Switch 2's running LLMs in the future. Piss poor bandwidth but the GPU needed is technically there for a decent 7B runner. It'll also be fun to see DLSS 4.5 "running" whenever Linux gets ported.

The Switch 2 has 12GB of RAM shared between CPU and GPU. LLMs of the now are not happy with that amount and LLMs of the future will LOL at it. As for DLSS 4.5, that's been discussed over on Reddit. (The very limited GPU on the S2 cannot realistically handle 4.5, which is why Nintendo wisely chose a "DLSS lite" implementation. This may come as a surprise, but they know a lot more about the tech than you or the Linux crowd do.)

But don't worry. Shitty Linux isn't getting ported because the Switch 2 is unhackable, and even if it did, Nvidia doesn't give a fck about the shitty Linux ecosystem and thus doesn't have drivers for it nor plans for that to change.

 

[DiscostewSM]

which is why Nintendo wisely chose a "DLSS lite" implementation.

Just to note, there is no "DLSS Lite". That was coined by Digital Foundry to explain what they couldn't explain. Going back some years when leaks of the Switch 2 were first pushed out, they put together a makeshift PC rig to "match" Switch 2's specs, and found that they could not achieve 4k upscaling at 60fps because it took their unit over 18ms to do the upscale. But when it came around that games were able to do 4k60 after upscale, they couldn't explain it except to suggest that another form of DLSS was made specific to that cause. They have been wrong about DLSS and Switch 2 so often (like with Cyberpunk claiming the Switch 2 version didn't use DLSS until the dev specifically told them it was using it) that most of their videos regarding the system include "corrections and apologies", only to go through the same motions again, like they needed ways to extend their videos. Let it be known that this makeshift example wasn't even the first. They did this with Switch 1 when they wanted to test a potential Doom 2016 port (which at the time there was no plans), claiming it couldn't be done. Then as fate would have it, the devs did make a port, and it performs so much better than DF's own test. DF is so disconnected from what consoles are capable with their PC obsessions that it simply isn't humorous anymore.

So how many forms of DLSS are there? We had a developer specifically say there is only one type of DLSS available to Switch 2 developers, and it's none other than Ubisoft regarding Rayman Legends: Retold.

https://www.videogameschronicle.com/features/interviews/rayman-legends-switch-2/

“One of the tricks we used to reach that quality is to lower the resolution,” explains Assandri, “for most of the GPU [resources] it depends on the resolution, so the more we reduce resolution, the less costly it will be.”

As Switch 2 owners will likely be aware, this doesn’t mean that Nintendo fans will be stuck controlling a 480p Rayman in Retold. Thanks to resolution scaling via the Switch 2’s DLSS tech, Ubisoft promises that players will experience Rayman at a 1080p output on handheld, and 4K when docked.

“The DLSS is working quite well, as you can see,” says Assandri, “When it’s docked, it’s full 4K because we don’t have to care about power consumption, so we can go a bit higher. Essentially, on Switch 2, we are quite on par with the Xbox Series S [version in terms of] quality.”

While Ubisoft Montpellier says it is still working hard to ensure that every level of the Switch 2 version runs at 60FPS, things are certainly looking promising so far. Assandri also confirmed that there is only one type of DLSS available to developers on Switch 2, and that on PS5 Pro, Rayman Legends: Retold will be taking full advantage of Sony’s recently released new upscaling technology, PSSR2.

 

[XRTerra]

The Switch 2 has 12GB of RAM shared between CPU and GPU. LLMs of the now are not happy with that amount and LLMs of the future will LOL at it. As for DLSS 4.5, that's been discussed over on Reddit. (The very limited GPU on the S2 cannot realistically handle 4.5, which is why Nintendo wisely chose a "DLSS lite" implementation. This may come as a surprise, but they know a lot more about the tech than you or the Linux crowd do.)

But don't worry. Shitty Linux isn't getting ported because the Switch 2 is unhackable, and even if it did, Nvidia doesn't give a fck about the shitty Linux ecosystem and thus doesn't have drivers for it nor plans for that to change.

7B LLMs right now can run in 12GB just fine, even with just 8GB dedicated to the GPU. I would know, because I've tried. That is what I was referring to.

That's also why I "quoted" running. It's not gonna work, but I'd like to see it try. And you don't need to be a pedantic douchebag. Nvidia drivers also work quite well on Linux.

Also, as far as I'm aware, the Switch 2 runs "full" DLSS just fine. I believe whatever DF saw was just a botched implementation in that game (assuming Hogwarts Legacy, I watched the video as well). Of course, it's still somewhat heavy, but devs have managed and many Switch 2 games with DLSS look and run just fine e.g FF7 Rebirth and RE9. We don't know what version of DLSS it is besides that it isn't "lite" DLSS. Generally it's either a version of DLSS 3 or a version of DLSS 4, leaning towards transformer but could be a later CNN version because that's how the Switch 2's DLSS looks to me when eyeing it.

 

[hippy dave]

You know what this means.

Spoiler

View attachment 581477

Pan down plz. Research purposes.

 

[RyanTheArchivist]

The most interesting thing here is that it's a userland without the use of a save game exploit or use of the webkit.
Very curious indeed.

That heavily limits what the possible entrypoints could be but, this will likely go unrevealed for a while.

 

[bth]

No, literally no software exploit has been found yet, and it's very unlikely because apparently Nintendo for once did a good job in securing their software (after all, the Switch 2 OS is based on the 1's, and as you said the last known ones are for firmwares from several years ago)

there's been several viable methods / attack vectors, it's just there isn't much to gain presenting a method to the public using them, due to the reasons i already mentioned (rp2040/rcm bug) for the switch 1 ecosystem.

but up until 21.0.0 (i.e. 20.5.0 highest) there was a reasonable vector to exploit, and 20.5.0 released september 29th 2025, last year.

 

[Migueljejejd]

A userland that works on all fws and doesn’t require a specific game or update is very much useful

Especially for those who can research kernal deeper. Just because you can’t pirate games yet doesn’t mean it’s nothing ¯\_(ツ)_/¯

You can investigate the kernel using switch 1, and even after about 6 years, you can't find a way to access the kernel of switch 1 through the first step of userland. Basically, they have total freedom to audit switch 1, you know, thanks to hacking, modchips, and having firmware (Horizon OS), etc., and still nothing has been found in 7 years. Because if you told me that switches 1 and 2 were in the same situation and nobody could see anything inside switch 1, I would understand, but years go by and access (softmod) the kernel of switch 1

 

[bth]

You can investigate the kernel using switch 1, and even after about 6 years, you can't find a way to access the kernel of switch 1 through the first step of userland. Basically, they have total freedom to audit switch 1, you know, thanks to hacking, modchips, and having firmware (Horizon OS), etc., and still nothing has been found in 7 years. Because if you told me that switches 1 and 2 were in the same situation and nobody could see anything inside switch 1, I would understand, but years go by and access (softmod) the kernel of switch 1

It's not that "no one has found anything".
Why reveal anything before the console has reached end of life?
I've found several fun things over the years, it's just that sharing it would technically infringe on certain parts of the DMCA, and also be counter-intuitive as there already are means to enter a means to launch homebrew code. (Atmosphere - rcm bug/rp2040)

You're basically making the assumption, because you have not seen a public softmod for switch 1 for 7 years, that "there isn't a way",

https://en.wikipedia.org/wiki/Survivorship_bias

one could create a convoluted chain of firmware specific vtables (ipc calls) to make "fun" things happen.

such as potentially ldn up until 20.5.0

or potentially nfc until 21.0.0

those are just methods that are disclosed publically
https://switchbrew.org/wiki/Switch_System_Flaws

as the nfc entry one implies, one can leverage SM ( https://switchbrew.org/wiki/Services_API ) to get access to other services... which is how other official sysmodules use each others functions

 

[_iggyman_]

New info by Gezine

 

[ChibiMofo]

So you need to update your firmware to use this useless non-exploit.

Got it!

 

[FernandoRocker]

So you need to update your firmware to use this useless non-exploit.

Got it!

Useless?

But people around here, X, YouTube and Reddit are saying that they will be playing the Ocarina of Time Remake on an emulator this December thanks to this "jailbreak".

 

[RyanTheArchivist]

Useless?

But people around here, X, YouTube and Reddit are saying that they will be playing the Ocarina of Time Remake on an emulator this December thanks to this "jailbreak".

To people around here there is no jailbreak unless they can pirate content. But most consoles do start with userland homebrew.

 

[fst312]

To people around here there is no jailbreak unless they can pirate content. But most consoles do start with userland homebrew.

Can retroarch be considered that homebrew. I know every cfw system and what not has it but I think that and tico will run great on switch 2.

 

[RyanTheArchivist]

Can retroarch be considered that homebrew. I know every cfw system and what not has it but I think that and tico will run great on switch 2.

Yes Retroarch would fall under userland. Emulators and homebrew games would fall under userland.

 

[geraltbutcherofblaviken]

So you need to update your firmware to use this useless non-exploit.

Got it!

factually not what gezine said. he said a savegame exploit requires latest firmware, 22.x, because it connects online. this one needs 20.x which is the day 1 firmware you needed to enable sd express support anyway. so unless someone was an idiot and just left it in box without setting it up day one and enabling sd drivers, they would be at 20.1.1 which is the correct one for this userland exploit

 

[RyanTheArchivist]

factually not what gezine said. he said a savegame exploit requires latest firmware, 22.x, because it connects online. this one needs 20.x which is the day 1 firmware you needed to enable sd express support anyway. so unless someone was an idiot and just left it in box without setting it up day one and enabling sd drivers, they would be at 20.1.1 which is the correct one for this userland exploit

Thats the exact state my second Switch 2 is in. I took it out of the box 1 day after the system released, updated it, and put it back in the box. Also worth noting that Gezine is unlikely to release this exploit anytime soon so it will still be a bit.

 

[ronin47]

factually not what gezine said. he said a savegame exploit requires latest firmware, 22.x, because it connects online. this one needs 20.x which is the day 1 firmware you needed to enable sd express support anyway. so unless someone was an idiot and just left it in box without setting it up day one and enabling sd drivers, they would be at 20.1.1 which is the correct one for this userland exploit

What does it mean? That I should have updated my console day 1 instead of let it inside the box? Not update is the main rule of scene. One year ago, how we were going to know that we should update to an specific version in order to activate SD port for a possible exploit in the future?