Nintendo Switch 2 获首个纯软件越狱，借助 OpenAI Codex

Sammy Hajhamid, a security researcher who goes by pepsipu online, has released ns2jb, a software-only jailbreak for the Nintendo Switch 2 that runs on the latest 23.0.1 firmware. To show it off, Hajhamid modded Mario Kart World, a Switch 2 exclusive, and also dropped Peter Griffin, Hatsune Miku, Cinnamoroll, and Red from Angry Birds into the roster. It looks like OpenAI's Codex did a good chunk of the heavy lifting here. Hajhamid hooked a Switch 1 and a Switch 2 up to two JetKVMs, plus a Bluetooth light switch flicker that presses the power button whenever the console crashes, so the AI agents could keep at it on their own. An early attempt through the Switch 2's WebKit browser didn't pan out. The working chain instead starts with a 32-bit integer overflow in SmileBASIC 4, a roughly $25 Switch 1 programming app that still runs on the Switch 2, and then moves to a buffer overflow in the console's filesystem service.

The end result lets users run native code with the permissions of ordinary system modules, which opens the door to homebrew, game mods, save backups, and reverse engineering. However, the jailbreak is tethered, so it has to be run again after every reboot, and there's no kernel exploit or custom firmware yet. Fellow researcher Gezine, who disclosed a separate Switch 1 and Switch 2 userland exploit in July, said the work "seems legit." Nintendo hasn't commented so far, though given how aggressively it has gone after Switch piracy and emulators, a firmware patch seems likely, and SmileBASIC 4 might even vanish from the eShop.