Researcher demonstrates partial Switch 2 exploit for homebrew
Sammy Hajhamid says a tethered software exploit can enable homebrew, game modding and save backups, but stops short of kernel-level control.
A security researcher has demonstrated a software exploit for Nintendo’s Switch 2 that provides partial access to the console and allows homebrew software to run. The method is tethered and requires a macOS or Linux computer on the same network, according to Ars Technica’s report.
Researcher Sammy Hajhamid, who uses the name Pepsipu, says the exploit begins with a 32-bit integer overflow in SmileBasic 4, a programming environment for Nintendo hardware. He then used a buffer overflow in the console’s FileSystem services to gain further access.
Hajhamid says the access enables game modding and reverse-engineering, save-file backups and access to many of the console’s peripherals. He demonstrated modded characters in Mario Kart World.
The exploit provides userland access, which leaves developers in a limited environment. It does not give the kernel-level control needed for full access to the hardware.
SmileBasic 4 has been delisted from the Switch eShop worldwide. Ars Technica reported that a Japanese demo remained accessible, but whether it can trigger the exploit is unclear.
The report says the method works on firmware 23.0.1, though a future update may patch the vulnerability. Nintendo addressed a separate vulnerability in the original Switch through a hardware redesign in 2018.
