• Sammy Hajhamid published ns2jb, a software-only tethered jailbreak for the Nintendo Switch 2 targeting firmware 23.0.1.
• Grants native arbitrary code execution with permissions of ordinary sysmodules and the built-in fs module, enabling homebrew, game modding, MMIO peripheral access, and save file backups.
• Exploit chain and development process:
  • Leveraged OpenAI's Codex as the primary coding and agentic reasoning model, orchestrating multiple instances with goal-oriented tasks.
  • Automated the physical feedback loop using a custom hardware harness with JetKVMs (for HDMI capture and controller input) and a SwitchBot Bluetooth pusher to reboot the console on crashes so Codex could iterate autonomously.
  • Directed Codex to explore WebKit initially; while it achieved a userland control-flow hijack via a WebKit n-day, PAC, CFI, and XOM mitigations blocked arbitrary IPC calls.
  • Switched focus to backwards-compatible Switch 1 software, where Codex identified an exploitable 32-bit integer overflow in SmileBASIC's REMOVE command to achieve out-of-bounds read/write and ROP.
  • Discovered a heap buffer overflow in the built-in fs sysmodule via path normalization (/..\ in GetEntryType), which Codex paired with cache object manipulation to gain stable arbitrary read/write.
  • Elevated permissions to PID 1 (FullPermission) and hijacked the loader (ldr) ExeFS domain-table entries to run unsigned native code under any sysmodule's NPDM permissions (specifically ro).
  • Used ro permissions to map and patch writable views of fs memory, gaining arbitrary code execution in built-in sysmodules.
• Demonstrated practical viability by using Codex to mod the Switch 2 exclusive Mario Kart World with custom characters in a single day.

Hacker News Discussion

• Commenters emphasized that decrypted fs read/write access paves the way for rapid Switch 2 game dumping, potentially leading to native PC recompilations and early emulation.
• High interest centered on the methodology of pairing LLMs like Codex and Claude with physical test rigs (KVMs, capture cards, and mechanical switch pressers) for 24/7 firmware and hardware reverse engineering.
• Readers shared practical implementations of hardware-in-the-loop automation, debating setups like Wi-Fi SD cards, SD multiplexers, and custom microcontroller jigs.
• Several participants criticized Nintendo's bug bounty program on HackerOne, arguing that the reported ~$50k cap is too low to incentivize private disclosure of a high-impact, multi-stage zero-day chain.
• Discussions debated the broader commercial impact, noting that while mainstream console owners rarely jailbreak devices, one-click emulation on handhelds like the Steam Deck represents Nintendo's primary piracy concern.