Jailbreaking the Switch 2

(pepsipu.com)

110 points | by ledoge 4 hours ago

10 comments

  • aarroyoc 1 minute ago
    PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
  • hturan 31 minutes ago
    Incredible all around.

    If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.

    Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.

    Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).

    • TuxSH 14 minutes ago
      > Worth noting too that this would have easily fetched >$50k

      More like $30k, no ("system processes allowing piracy")?

      • hturan 6 minutes ago
        Ah, you're right! Depends on their generosity, but I'd imagine piracy and running exclusives on non-Nintendo hardware is more of a risk to their business than a bootROM exploit.
    • mentos 24 minutes ago
      Short term the argument that 'piracy exists yet doesn't affect steam sales' holds true.

      Long term when someone makes emulating Switch 2 on your Steam Deck a 1-click install I'm not so sure.

      • hturan 5 minutes ago
        Totally, convenience always wins. I think this is more of a hardware sales issue for Nintendo though — if what I understand is true, I'd bet that we see Switch 2 games running on other systems before we see a CFW/decrypt-encrypt stack for running pirated games on the Switch 2 itself.
      • lachiflippi 15 minutes ago
        Very unlikely to happen via emulation, there's Switch 1 games that the Steam Deck struggles to run already.
  • KeplerBoy 1 hour ago
    Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
    • amelius 33 minutes ago
      I suppose we can let AI write the entire blogpost :)
      • KeplerBoy 24 minutes ago
        I don't know. I feel like the blog reads as very human written and enjoyable overall. Also what's 2 weeks of real work (in tandem with an agent) compared to a few hours for the blog?
  • GolDDranks 22 minutes ago
    If one follows this and jailbreaks their Switch 2, are they in danger of getting their account banned by Nintendo, and their games unaccessible?
    • ada-h00k 10 minutes ago
      The chances of getting banned for this are extremely high. The Switch 2 has plenty of mechanisms to detect tampering. Even if you were completely offline during the process and then reset the Switch afterward, there are logs. People have already been banned for using the MIG Switch to play backups of Switch 1 games on the Switch 2.
    • asimovDev 11 minutes ago
      never go online and even if you reset the console afterwards , assume the console will get banned when connect to the internet as they know to look for markers of customer firmware.

      Switch 1 hacks bypass this by copying ofw from flash onto the microSD card and patching it there to my crude understanding, so that unsigned code never touches the firmware on the system memory.

      Something like this definitely will be needed again for the Switch 2 so I'd only do this if you don't care about being banned.

    • GolDDranks 18 minutes ago
      (I'm interested in Homebrew, and I'd love to port my self made game dev framework on Switch 2, but I'm afraid of losing everything)
    • StilesCrisis 14 minutes ago
      Definitely a risk.
  • xacky 32 minutes ago
    The Switch 2 jailbroken with the help of a Switch Flicker. Really funny.
  • attels33 21 minutes ago
    What SW is needed for the jailbreak to work? Is it worth trying to buy a used console now?
    • wickedsickeune 4 minutes ago
      This works on the latest firmware, until they patch it, you can buy even new consoles that are vulnerable.
    • monegator 7 minutes ago
      written at the top: current 23.01 version (i did get the sw2 on first day because you never know but...)
  • enricozb 22 minutes ago
    > thanks to my friends in Dabney House ...

    Cool to see this happened at Caltech :)

  • _imnothere 32 minutes ago
    IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.

    I sure looking forward for more people hopping on the AI hacking trend to bring them down.

    • chocochunks 23 minutes ago
      GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.

      And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.

      • asimovDev 10 minutes ago
        yes at least with GKC I immediately know that game is not playable offline instead of needing to go to https://www.doesitplay.org and hope that someone already documented the game I am looking at, which is the case with PS5
    • cyberrock 6 minutes ago
      They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.
    • croes 20 minutes ago
      The Nintendo cartridges contain the full playable version of the game.

      Third party publishers often just put the key on it. So blame them for that

  • RicoElectrico 30 minutes ago
    And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
  • Velocifyer 32 minutes ago
    It's unfortunate that this requires a specific $25 game (SmileBASIC 4)
    • unrented7977 7 minutes ago
      Almost every console jailbreak required the use of a specific game, going all the way back to the original Xbox. PS1 and 2 required a specific disc or swapping in a legit disc. Even the NES required a real game cart alongside your third party carts.

      It turns out that opening locks is a hell of a lot easier when you have a key.

    • Gigachad 29 minutes ago
      Console hacking has been like that for a very long time. But usually after the first exploits are found and hackers can start playing with things, many more follow. Though Nintendo has been stripping down the OS every new console so there’s less interesting stuff to exploit outside of games.
    • xacky 12 minutes ago
      I remember having to buy GTA Liberty City Stories to jailbreak the PSP. Then there was the infamous Cubic Ninja jailbreak which caused the game to become worth hundreds of dollars.
    • StilesCrisis 13 minutes ago
      This gives visibility to a lot more unencrypted code, so just give it time. More bugs will be found quickly now that the code is inspectable.