Technology and Scienceupdated 53m ago2 min read
Security Researcher Sammy Hajhamid Jailbreaks Switch 2 With SmileBasic 4 Exploit
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Software-only jailbreak enables homebrew, game mods, and save backups on Switch 2. SmileBASIC 4 used as jailbreaking entry point; Nintendo delisted the app.
Save coverage image
Explore source coverage 3 source types
Directory totals describe our source library, not outlets checked for this story.
ns2jb unlocks homebrew
Security researcher Sammy Hajhamid, who goes by pepsipu online, demonstrated a software-only partial jailbreak of the Switch 2 that he said “lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals through MMIO.” Hajhamid said the hack relies on the original Switch version of SmileBasic 4 and requires access to a macOS or Linux PC on the same network to run a node.js package that helps enable privileged system access. Hajhamid wrote that after “substantial effort for ~2 weeks,” a 32-bit integer overflow in SmileBasic allowed access to an array pointer, which then enabled read and write access to portions of system memory.
Hajhamid said he later found a buffer overflow in the console’s FileSystem services module that exposed a cached data pointer, granting arbitrary read and write privileges, and he then achieved native code execution through a faked filesystem process. Hajhamid showed the exploit’s proof of concept by modding characters in Mario Kart World, and other developers were showing off demos and in-progress developer tools on exploited hardware.
SmileBASIC 4 pulled
Nintendo started removing SmileBASIC 4 from the eShop “as of today,” and the removal followed a jailbreak entry point discovery tied to Switch 2. SmileBASIC 4 could be used to enact a jailbreak on Switch 2 that was allowing people to do a number of things, including add modded characters to Mario Kart World. The exploit, called ns2jb, is said to work on Switch 2 firmware 23.0.1 and does not require a hardware modchip, and it described the jailbreak as tethered so it does not survive a reboot.
The jailbreak is software-only and tethered, meaning a user has to run it from a game every time the console is turned on for it to work. Restarting the console removes the exploit from memory and returns the affected processes to their normal state.
AI-assisted research and risk
Hajhamid used OpenAI’s Codex to poke at SmileBasic’s language interpreter, and it described a custom harness that could send USB commands and view results via HDMI. Hajhamid published a complete exploit chain called ns2jb on GBATemp and released its full source code on GitLab, and it described the exploit as entering through SmileBASIC 4 and escalating to system-module-level privileges. All retail Nintendo Switch 2 units currently running firmware 23.0.1 are affected, and it described the attack as unfolding in two stages that exploit bugs in code Nintendo’s quality-assurance process apparently never anticipated as a security boundary.
Hajhamid disclosed that he used OpenAI Codex, and it added that Codex Security identified 792 critical and 10,561 high-severity bugs across open-source repositories over its first month. The exploit requires the game SmileBASIC 4, and it framed the jailbreak as extremely complex for most people while noting users on the Switch 2 hacks subreddit were debating how big of a deal it actually is.