Software jailbreak reportedly breaks open Switch 2 firmware 23.0.1

A developer says they have built the first public software-only jailbreak for the Nintendo Switch 2, opening the door to homebrew, game modding and save dumping via a flaw in the Switch 1's SmileBA...

AI-drafted from 5 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

A developer going by pepsipu says they have released the first public jailbreak for the Nintendo Switch 2 that works entirely in software, no custom chip or soldering required. The tool, called ns2jb, reportedly runs on the console's current firmware, version 23.0.1, according to the developer's write-up.

It is what hackers call a tethered exploit: it has to be re-run every time the console restarts, rather than sticking permanently. Once active, the developer says it grants arbitrary code execution as an ordinary system module, and even as the console's built-in filesystem module, which in turn opens up homebrew software, reverse engineering and modding of Switch 2 games, pulling save files off the console, and access to hardware peripherals through memory-mapped I/O. A thread on r/emulation summarises the same capability list and notes the tethered caveat.

Why the exploit goes through a Switch 1 program

The write-up describes trying the obvious route first: a WebKit flaw reached through a rigged Wi-Fi captive portal, the kind of browser exploit that has powered console jailbreaks for years. It stalled. Modern mitigations got in the way: execute-only memory that hides useful code locations, pointer authentication that stops forged function pointers being called, and control-flow integrity checks that block most of the signing tricks that would normally work round that.

So the developer switched targets, to the older Nintendo Switch, whose root of trust is already broken and which lacks pointer authentication entirely. The entry point is SmileBASIC, a programming and game-creation app with previous form: it was the vector for a 3DS jailbreak called smilehax some years back. According to the write-up, a 32-bit integer overflow in SmileBASIC's array handling causes a memory copy that wraps around and reads data it should not, leaking a pointer that sits just before any array in memory. From there the exploit builds arbitrary memory read and write, and eventually full control of program execution, on the Switch 1 side, before the chain is extended across to compromise the Switch 2.

The account also describes using an AI coding agent, referred to as Codex, to drive much of the engineering, with a hardware rig built from USB capture devices and a Bluetooth-controlled lever rigged to physically press the console's power button after crashes. The blog is candid that the jailbreak itself took roughly two weeks of real effort, while a demonstration mod of Mario Kart World, a Switch 2 exclusive, was built in a day largely for fun.

What the demo shows, and what is still unclear

That demo adds extra racers to Mario Kart World's roster, among them Cinnamoroll, Peter Griffin and Hatsune Miku, visible in screenshots from the console's own screen in the write-up. It is a flashy proof of concept rather than a finished modding toolchain, and the developer is upfront that it exists to show the jailbreak works, not to ship a product.

What is not yet confirmed anywhere in these accounts is what Nintendo does next. SmileBASIC's history as a jailbreak entry point on the 3DS suggests a pattern: platform holders tend to respond to this kind of exploit by pulling the offending app or patching the flaw it relies on. Nothing in the sources so far states that Nintendo has acted against SmileBASIC on the Switch 2's storefront, so any delisting remains an expectation based on precedent rather than a reported fact. A short post on GBAtemp calls it simply “good times are finally here”, while a thread on r/SBCGaming is more cautious, noting only that “there are interesting times ahead” alongside a similarly fresh PS5 jailbreak, without claiming any first-hand knowledge.

For now the jailbreak is tethered, technical and aimed at developers rather than casual users. Whether a persistent version follows, and whether Nintendo moves to shut the SmileBASIC door that made it possible, are the two obvious questions nobody has answered yet.

Sources

Image: pepsipu.com

More news from Gaming World