A prominent security researcher has successfully executed a software-only partial jailbreak on the Switch 2, gaining access to what is termed “userland.” This access enables various functionalities, including the ability to run homebrew applications, reverse engineer and modify Switch 2 games, back up saved files, and interact with most peripherals via MMIO.

This groundbreaking hack relies on the original version of SmileBasic 4 for the Switch, a programming environment from a longstanding series designed to operate on Nintendo hardware. Dubbed the “tethered” hack, it necessitates a connection to a macOS or Linux PC on the same network to run a node.js package that facilitates enhanced system access.

Researcher Sammy Hajhamid, known online as Pepsipu, utilized OpenAI’s Codex to analyze SmileBasic’s language interpreter. By developing a custom harness that could send USB commands and view the outcomes through HDMI, he identified a critical 32-bit integer overflow occurring when items are removed from an array in SmileBasic. This vulnerability grants access to an array pointer, thereby allowing read and write access to segments of the system memory.

Hajhamid further explored the console’s internal sysmodules to find additional avenues for privileged access. His efforts uncovered a buffer overflow in the FileSystem services module, which exposed a cached data pointer, thereby enabling arbitrary read and write capabilities. Subsequently, he achieved native code execution by simulating a filesystem process.

Demonstrating the potential of this exploit, Hajhamid showcased several new modded characters in Mario Kart World. Other developers have also began showcasing simple demos and ongoing projects utilizing the exploited hardware.