任天堂Switch 2纯软件越狱ns2jb演示，tethered模式支持23.0.1固件
未证实尚未证实：这是爆料或传闻类报道，相关方没有确认，请勿当作已确定的消息。
Switch 2 jailbreak "ns2jb" demonstrated, software-only exploit, tethered
开发者pepsipu演示了任天堂Switch 2纯软件tethered越狱ns2jb，支持23.0.1固件（若可信则为首个此类利用）。该利用通过SmileBASIC解释器32位整数溢出实现用户态原生代码执行，重启可清除不留持久修改，需SmileBASIC 4.4.9与局域网PC等条件，已展示在Mario Kart World加载自定义角色。
同一新闻，精选展示《任天堂Switch 2遭ns2jb纯软件漏洞破解》
Developer pepsipu has released technical details for a userland exploit for the Nintendo Switch 2 called ns2jb.
If credible, this is the first software-only, tethered jailbreak for Nintendo's latest console and even supports the latest 23.0.1 firmware.
A video showcasing custom modded characters in Mario Kart World (Switch 2)
In the blog article, which details how the jailbreak was achieved they go on to say the exploit bypasses standard webkit mitigations by exploiting a 32bit integer overflow in the Switch 1 backward-compatible SmileBASIC interpreter.
Being tethered means that the exploit does not offer coldboot persistence or custom firmware (CFW) currently, instead it successfully demonstrates arbitrary native code execution within the system's fs (filesystem) and ro sysmodules.
What does this mean for developers and homebrew authors? Currenty, this unlocks the ability to execute native code, dump encrypted Switch 2 save files, reverse engineer exclusive titles and to even directly interface with system hardware via MMIO. While full kernel level control is currently off limits, even just having access to the filesystem allows for people to poke around - as demonstrated with Mario Kart World in the above video which shows custom characters such as cinnamoroll and red from Angry Birds playable in the game.
How was the hack achieved?
To achieve this, pepsipu built an automated physical hardware test rig around a Switch 1 and Switch 2 using JetKVMs (for remote HDMI output and USB controller input) and a bluetooth switchbot (automated physical button presser) to press the power button when the console crashed. Using LLM agents (Codex) he ran them with the task of vulnerability research and exploitation.
What is needed to get the hack setup?
Running the demo requires SmileBASIC 4.4.9, a PC on the same local network running Node.js 22+ and 20MB of save data space.
The jailbreak leaves no persistent modification to the system. A simple console restart cleanly restores the original fs and ro processes and removes the exploit payload from memory.
来源：Gbatemp · gbatemp.net