• Sammy Hajhamid published ns2jb, a software-only tethered jailbreak for the Nintendo Switch 2 targeting firmware 23.0.1.
• Grants native arbitrary code execution with permissions of ordinary sysmodules and the built-in fs module, enabling homebrew, game modding, MMIO peripheral access, and save file backups.
• Exploit chain and development process:
  • Leveraged OpenAI's Codex as the primary coding and agentic reasoning model, orchestrating multiple instances with goal-oriented tasks.
  • Automated the physical feedback loop using a custom hardware harness with JetKVMs (for HDMI capture and controller input) and a SwitchBot Bluetooth pusher to reboot the console on crashes so Codex could iterate autonomously.
  • Directed Codex to explore WebKit initially; while it achieved a userland control-flow hijack via a WebKit n-day, PAC, CFI, and XOM mitigations blocked arbitrary IPC calls.
  • Switched focus to backwards-compatible Switch 1 software, where Codex identified an exploitable 32-bit integer overflow in SmileBASIC's REMOVE command to achieve out-of-bounds read/write and ROP.
  • Discovered a heap buffer overflow in the built-in fs sysmodule via path normalization (/..\ in GetEntryType), which Codex paired with cache object manipulation to gain stable arbitrary read/write.
  • Elevated permissions to PID 1 (FullPermission) and hijacked the loader (ldr) ExeFS domain-table entries to run unsigned native code under any sysmodule's NPDM permissions (specifically ro).
  • Used ro permissions to map and patch writable views of fs memory, gaining arbitrary code execution in built-in sysmodules.
• Demonstrated practical viability by using Codex to mod the Switch 2 exclusive Mario Kart World with custom characters in a single day.

Hacker News Discussion

• Commenters emphasized that decrypted fs read/write access paves the way for rapid Switch 2 game dumping, potentially leading to native PC recompilations and early emulation.
• High interest centered on the methodology of pairing LLMs like Codex and Claude with physical test rigs (KVMs, capture cards, and mechanical switch pressers) for 24/7 firmware and hardware reverse engineering.
• Readers shared practical implementations of hardware-in-the-loop automation, debating setups like Wi-Fi SD cards, SD multiplexers, and custom microcontroller jigs.
• Several participants criticized Nintendo's bug bounty program on HackerOne, arguing that the reported ~$50k cap is too low to incentivize private disclosure of a high-impact, multi-stage zero-day chain.
• Discussions debated the broader commercial impact, noting that while mainstream console owners rarely jailbreak devices, one-click emulation on handhelds like the Steam Deck represents Nintendo's primary piracy concern.

Wario's Woods was the last official NES game to be released in North America. Because of its late release date, it is the first and only NES game with an ESRB rating.

Describing Nintendo's philosophy as "lateral thinking with withered technology" -- common in its early days and with its three most-recent consoles, Wii, Wii U, and Switch. I discussed its new-found commitment to supporting its older consoles regarding statements that it made about the Switch's life-cycle.

1991 article on a very questionable proposal by Minnesota lottery officials to make it possible for NES owners to use their game consoles to purchase lottery tickets.

Clever use of this quote. How can you do anything but love it?

Dit is de basis geweest voor het denken rondom alle hardware van Nintendo. Fun gameplay is belangrijker dan flashy technologie. Liever oudere tech gebruiken en die op een innovatieve manier inzetten dan altijd de latest en greatest in willen zetten.

Mooi verhaal

Oxford College Library is offering a Game Night on April 14, 2017, 7-11 pm! We hope to see you there!