Researcher Demonstrates Software-Only Partial Jailbreak of Switch 2
Researcher demonstrates tethered partial jailbreak of Switch 2 using SmileBasic 4 flaw, Ars Technica reports.
The hack relies on the original Switch version of SmileBasic 4, a programming environment and interpreter that runs on Nintendo hardware. Ars Technica describes it as the latest in a long-running series of such environments and interpreters. The method is a so-called tethered hack: it also requires access to a macOS or Linux PC on the same network to run a node.js package that helps enable privileged system access.
Researcher Sammy Hajhamid writes that he used OpenAI’s Codex to examine SmileBasic’s language interpreter. He built a custom harness that could send USB commands to the system and view the results over HDMI, and that could power-cycle the console through a Bluetooth device that flips a light switch, according to the report.
After “substantial effort for ~2 weeks,” the harness found a 32-bit integer overflow that occurs when items are removed from an array in SmileBasic. That error gives access to an array pointer, which in turn allows read and write access to portions of system memory, Ars Technica reported.
The demonstrated access is partial and tethered, rather than a full unlock of the console. Ars Technica’s report focuses on the software flaw and the researcher’s method for reaching userland access.