任天堂 Switch 2 仅软件捆绑式越狱漏洞利用 ns2jb 发布
Switch 2 jailbreak "ns2jb" released. Software-only exploit, tethered
开发者pepsipu发布了任天堂Switch 2的仅软件捆绑式越狱漏洞利用ns2jb，支持23.0.1固件且不提供自定义固件。该漏洞通过SmileBASIC解释器32位整数溢出实现文件系统代码执行，重启后自动清除，演示中包含马里奥赛车世界自定义角色。
同一新闻，精选展示《任天堂Switch 2遭ns2jb纯软件漏洞破解》
Developer pepsipu has released technical details for a userland exploit for the Nintendo Switch 2 called ns2jb.
If credible, this is the first software-only, tethered jailbreak for Nintendo's latest console and even supports the latest 23.0.1 firmware.
A video showcasing custom modded characters in Mario Kart World (Switch 2)
In the blog article, which details how the jailbreak was achieved they go on to say the exploit bypasses standard webkit mitigations by exploiting a 32bit integer overflow in the Switch 1 backward-compatible SmileBASIC interpreter.
Being tethered means that the exploit does not offer coldboot persistence or custom firmware (CFW) currently, instead it successfully demonstrates arbitrary native code execution within the system's fs (filesystem) and ro sysmodules.
What does this mean for developers and homebrew authors? Currently, this unlocks the ability to execute native code, dump encrypted Switch 2 save files, reverse engineer exclusive titles and to even directly interface with system hardware via MMIO. While full kernel level control is currently off limits, even just having access to the filesystem allows for people to poke around - as demonstrated with Mario Kart World in the above video which shows custom characters such as cinnamoroll and red from Angry Birds playable in the game.
The jailbreak leaves no persistent modification to the system. A simple console restart cleanly restores the original fs and ro processes and removes the exploit payload from memory.
How was the hack achieved?
To achieve this, pepsipu built an automated physical hardware test rig around a Switch 1 and Switch 2 using JetKVMs (for remote HDMI output and USB controller input) and a bluetooth switchbot (automated physical button presser) to press the power button when the console crashed. Using LLM agents (Codex) he ran them with the task of vulnerability research and exploitation.
What is needed to get the hack setup?
Running the demo requires the SmileBASIC 4.4.9 Switch game; a PC on the same local network running Node.js 22+ and 20MB of save data space. Full instructions are at the link below.
Can I install custom firmware now?
Not yet: it’s tethered, there’s no CFW and it doesn’t survive a reboot. This is very very early stages.
来源：Gbatemp · gbatemp.net