kaiHEN Custom Firmware Hits Nintendo Switch 2: OunceBrew Unlocks NAND Access, .NRO Homebrew, and OunceShell
The independent development scene surrounding Kyoto's newest hybrid console has just reached a major structural milestone. Security researcher Kurumuz and the OunceBrew collective have officially published the source code and release package for kaiHEN on GitHub, delivering an open-source, semi-tethered homebrew environment and minimal custom firmware (CFW) for the Nintendo Switch 2.
Inside kaiHEN's Architecture, R-Button Trigger, and Ounce Devkit
Built around the console's internal hardware codename (Ounce), kaiHEN operates through four core system components. The bootstrap binary initializes the background hen service and active plugins, while a custom ldr:ro module maps unsigned .NRO executables directly into client processes and enables Just-In-Time (JIT) code compilation.
Once the payload is initialized in memory, users do not need to re-trigger a computer script every time they switch applications: holding the R shoulder button while launching a native Switch 2 title (from the second launch onward) redirects execution straight into nx-hbmenu. The release bundle also ships with OunceShell, a VitaShell-inspired file manager built by Kurumuz and TheFl0W that integrates a local FTP server for wireless file transfers.
Check Availability Nintendo Switch 2 on Amazon→
Alongside the firmware layer, the team released the devkitPro-compatible ounce-devkit toolchain, providing three foundational pillars for developers:
- libounce: a system library modeled closely after the original Switch's
libnxAPI, allowing developers to recompile existing Switch 1 homebrew by swapping a single Makefile rule. - OunceVK: an open graphics driver exposing Vulkan 1.4, EGL, OpenGL, and OpenGL ES layers on the console's custom Nvidia GPU.
- libkaihen: the dedicated homebrew API managing JIT memory privileges and background plugin sessions.
Strict Firmware 23.0.1 Requirement and Software Entrypoints
Running this environment comes with tight software and setup constraints. kaiHEN exclusively supports consoles running firmware 23.0.1. Systems that have already installed Nintendo Switch 2 firmware 23.5.0 patching the ns2jb system exploit cannot use the tool, as Nintendo closed the vulnerability chain required to bootstrap unsigned code.
To initialize the custom firmware on a compatible unit, users need a microSD or microSD Express card (formatted as FAT32 or exFAT), active DNS filtering via 90DNS to prevent Nintendo's servers from pushing a forced update prompt ("Nag"), and one of two primary software entrypoints: SmileBASIC 4 (version 4.4.9 or the 4.4.6 demo paired with the hen.cjs Node.js script) or the original Switch 1 edition of Sid Meier's Civilization VII (version 1.0.0) via civ7-fs-kaihen. The official documentation notes that Balatro and Artemis Engine visual novels (such as Seedsow Lullaby) can also serve as secondary entrypoints once an exploited save file has been injected.
RetroArch, Moonlight, Native Ports, and Full NAND Write Risks
Right out of the gate, OunceBrew's community directory lists nearly twenty native applications and ports compiled for the Switch 2 hardware. Key utilities and media tools include the multi-system emulator RetroArch, local game-streaming clients Moonlight (for PC) and Chiaki-ng / Akira (for PS5 and PS4 Remote Play), as well as the save managers Checkpoint and PKSM.
On the gaming side, beyond the experimental native recompilation of Grand Theft Auto V running on Switch 2 hardware demonstrated by developer PLK, early releases already include native builds of UnleashedRecomp (Sonic Unleashed), Super Mario 64 EX, Sonic 3 AIR, Donkey Kong Country 2 and 3 recompilations, Sonic Robo Blast 2, and xStarbound.
However, the creators of kaiHEN emphasize both a strict anti-piracy stance and a severe hardware warning. Answering how to download commercial games for free, the official FAQ bluntly instructs users to update to firmware 23.5.0 and pay for their games on the Nintendo eShop. More importantly, because homebrew applications inherit every permission accessible to the file-system module, kaiHEN grants full read and write access to the internal system NAND. With zero sandbox protections currently in place against poorly coded or malicious .NRO binaries, running untrusted software carries a very real risk of corrupting the NAND and permanently bricking the Switch 2.
My Field Notes
Looking through OunceBrew's repositories tonight, the most impressive achievement is how cohesive the developer toolchain already is on day one. By aligning libounce with the familiar libnx API and shipping a full Vulkan 1.4 driver through OunceVK, Kurumuz and the team have spared homebrew authors months of low-level rewriting. At the same time, leaving full system NAND write permissions wide open without an intermediate safety net is a sobering reminder that this early release is built for seasoned developers: on a console with no known bootrom recovery exploit to reflash a damaged partition, a single rogue pointer in an unverified binary can turn a Switch 2 into a paperweight.
Originally from Lyon, France, gaming journalist Bastien "Orion" relocated nearly a decade ago to Quebec City's Saint-Roch district, right in the heart of eastern Canada's development studio hub. Before crossing the Atlantic, he honed his versatile reporting style across classic French gaming web portals and specialist television outlets in the 2000s and 2010s, notably with JeuxVideo.fr and JeuxNews. Equally passionate about AAA blockbusters, North American studio culture, retro preservation, and community modding projects, he anchors Pro-Gamer's transatlantic desk and real-time coverage of US and Japanese industry announcements.
