A security researcher has demonstrated a software-only partial jailbreak of the Switch 2, gaining "userland" access that lets users run homebrew, reverse engineer and mod Switch 2 games, back up save files, and access most peripherals through MMIO.
The hack relies on the original Switch version of Smile Basic 4, the latest in a long-running series of programming environments that run on Nintendo hardware. The so-called "tethered" hack also requires access to a macOS or Linux PC on the same network to run a Node.js package that helps enable privileged system access.
Researcher Sammy Hajhamid, who goes by Pepsipu online, used OpenAI's Codex to poke at Smile Basic's language interpreter, using a custom harness that could send USB commands to the system and view results via HDMI. After "substantial effort for ~2 weeks," that harness discovered a 32-bit integer overflow when removing items from an array in Smile Basic. That error gives access to an array pointer, allowing read and write access to portions of system memory.
From there, Hajhamid found a buffer overflow in the console's File System services module that exposed a cached data pointer, granting arbitrary read and write privileges. He achieved native code execution through a faked filesystem process and showed off modded characters in Mario Kart World as proof of concept.
Source: Ars Technica · Summarized by HeadlinesBriefing