First Software Jailbreak Hits Nintendo Switch 2 as the ns2jb Exploit Cracks Firmware 23.0.1 Without a Modchip

Nintendo's latest hybrid console has just experienced its first public software security breakthrough. Security researcher Sammy Hajhamid, known online as pepsipu (a Caltech undergraduate with past experience at Trail of Bits, Zellic, and OtterSec), has published the source code and technical write-up for ns2jb on GitLab (technical write-up), the first software-only tethered jailbreak demonstrated on the Nintendo Switch 2 running the latest 23.0.1 system firmware.

Unlike hardware modifications that require soldering a physical modchip onto the motherboard, this exploit chain operates entirely through software vulnerabilities. It enables arbitrary native code execution with the privileges of any ordinary system module (sysmodule) as well as the built-in fs filesystem module.

Check Availability Nintendo Switch 2 on Amazon→

Custom Characters in Mario Kart World and Local Save Data Backups

To demonstrate what the exploit chain can accomplish on retail hardware, Hajhamid shared gameplay footage recorded with fellow students at Caltech's Dabney House. The videos show four-player split-screen races in the Switch 2 exclusive Mario Kart World featuring custom character mods injected directly into the game, including Walter White, Goku, Hatsune Miku, Steve, Sans, Reze, and Cinnamoroll.

Beyond modding first-party Nintendo Switch 2 titles, the privilege level achieved by ns2jb unlocks several foundational capabilities for homebrew developers and researchers:

• Local Save File Extraction: Users can back up and export their save data directly off the console's internal storage without relying on paid cloud subscriptions.
• Native Homebrew Execution: Bypassing loader verification checks allows unsigned native binaries to run with ordinary sysmodule permissions.
• Hardware and Crypto Research: Running native code inside the fs module grants direct orchestration of its cryptographic hardware, including NCA4 container decryption, alongside access to most system peripherals through Memory-Mapped I/O (MMIO).

An Automated Hardware Rig Where OpenAI Codex Reboots the Console

The methodology behind the discovery highlights how rapidly console security research is evolving, echoing the recent wave of AI-assisted decompilation and exploit hunting on PlayStation 5. Hajhamid built an automated hardware harness connecting both an original Switch and a Nintendo Switch 2 to two JetKVM units, allowing an AI agent to send USB controller inputs and read HDMI video output in real time.

Because kernel or sysmodule crashes require a physical press of the power button to reboot the console, the researcher attached an Amazon Bluetooth SwitchBot rocker directly above the Switch 2 power button. Multiple instances of OpenAI Codex were then tasked with probing system components, crashing the console, rebooting it automatically, and iterating on memory corruption primitives.

From SmileBASIC 4 to the fs Sysmodule: How the Exploit Chain Works

While initial attempts focused on the built-in WebKit browser via a custom Wi-Fi captive portal, the Switch 2's modern ARMv8 defenses,specifically Execute-Only Memory (XOM), Pointer Authentication Codes (PAC), and Control Flow Integrity (CFI),made arbitrary IPC calls through WebKit impractical for rapid iteration. Hajhamid instead pivoted to backward-compatible Switch 1 games, which lack PAC compilation and can be decrypted using existing Switch 1 keys.

The programming application SmileBASIC 4 (previously targeted by smilehax on the Nintendo 3DS) provided the ideal userland entry point:

1. Userland Entry via smilehax2: Codex uncovered a 32-bit signed integer overflow inside the BASIC interpreter's array removal routine. Executing REMOVE R,&H60000000,&H3FFFFFFF causes position + count to wrap into a negative value (0x9fffffff), tricking memmove into shifting the 8-byte array pointer preceding the buffer into the string length field of R[0]. This creates an out-of-bounds read/write primitive that escalates to ROP.
2. Compromising the fs Sysmodule: From SmileBASIC 4, the chain targets the GetEntryType IPC command on an IFileSystem handle. Passing a path with a parent-directory backslash sequence (/..) triggers a helper in Path::Normalize that copies the string into a fixed 0x301-byte heap buffer without bounds checking, overflowing into an adjacent BufferedStorage cache entry to achieve arbitrary read/write (ARW) inside fs.
3. Native Code Execution via ldr and ro: Using ARW in fs, the exploit sets SmileBASIC's saved PID to 1 (granting FullPermission and bypassing Service Manager ACL checks like smhax). It then performs a time-of-check to time-of-use swap on the ldr sysmodule's ExeFS IPC handle, pairing the legitimate signed main.npdm metadata of the ro module with a custom executable main, and finally uses kernel SVCs (MapProcessMemory) with fs's KProcess handle (0xffff8001) to patch fs code in memory.

Why a Tethered Exploit Is Not Yet a Full Custom Firmware

Despite the technical milestone, ns2jb comes with clear practical boundaries for everyday console owners. Because it is a tethered jailbreak, the modified state resides strictly in volatile memory: powering down or rebooting the Nintendo Switch 2 completely clears the exploit, returning the hardware to a stock uncompromised state until the sequence is triggered again through SmileBASIC 4.

Consequently, this release is neither a persistent boot-time Custom Firmware (CFW) on the scale of Atmosphère nor a turnkey piracy tool. Since Nintendo can delist SmileBASIC 4 from the eShop or patch the Path::Normalize heap overflow in a future firmware update beyond version 23.0.1, Hajhamid notes that porting the fs vulnerability trigger to WebKit via a data-only attack is the most promising next step for offline accessibility.

My Perspective

Watching firmware 23.0.1 on the Nintendo Switch 2 open up without a soldering iron or hardware modchip brings back immediate memories of the classic 3DS and early Switch homebrew eras. What stands out most here is the sheer ingenuity of the testing setup: strapping a smart-home light switch presser to the console so an AI coding agent can autonomously crash, reboot, and fuzz system modules is a fascinating glimpse into the future of console security research. For players who care about local save backups and creative modding in games like Mario Kart World, this is a huge first step,though anyone hoping to experiment should expect Nintendo to pull SmileBASIC 4 from the eShop and push a system update very quickly.

Written by Chaya "Chayane"

🧠 Deep Learning AI & Dev 🗽 New York & Montreal

Based on the outskirts of New York City, Chaya 'Chayane' spent five years studying software engineering in Montreal before returning to her home state. A Full-Stack developer and Deep Learning AI architecture researcher, she explores neural networks and algorithmic optimization while engineering data pipelines for Retrocharting and Gamescharting alongside Grimtag. A gamer for over 20 years and an avid collector of Nintendo history and The Legend of Zelda, she explored World of Warcraft's Azeroth before bringing her deep technical background to video game analysis.

Ecosystem: 🕹️ Retrocharting Join our Discord

All articles by Chaya →