Jailbreaking the Switch 2
pepsipu.com
pepsipu.com
If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).
Long term when someone makes emulating Switch 2 on your Steam Deck a 1-click install I'm not so sure.
Still seems rather self-enflicted pain for Intendo due to still pushing locked-down consoles in 2026.
the level of polish and stability on the open world zeldas is astonishing, i never experienced anything like that in third party AA/AAA games form the last 15 years or so, playing on the switch or on the pc.
[1]: Given those were originally Playstation exclusives, it might not be the best example/comparison, but they have been available on Steam for quite some time
But yes, Nintendo’s polish is definitely on that level, even their weird little Japanese games like Tomadochi Life have an incredibly coherent theme and polish within themselves despite some being incredibly whimsical and goofy. I think part of it is what you get when you have the same devs working for 40 years on say, Mario games. Truly masters of their craft. Super Smash Brothers is a supreme work of social engineering how they managed to convince so many disparate companies and even competitors to allow their IP in the game and everything just fits together so well.
I have. In terms of a bug-free experience, nintendo games and the main cinematic sony games (including also last of us 2 and the like) feel equally good.
The surprising thing about open world zeldas is that they allow a lot of physics tinkering. Keeping a story based, relatively on rails game stable is far easier than an open world sandbox. TotK feels like it should be a skyrim-like bug ridden experience but it isn't.
Also nintendo games tend to feel very satisfying, call it good UX if that makes sense. Animations, sounds, they do really know how to produce a sense of wonder.
That said I hate the hardware, I own a switch and yet I play on a steamdeck. The screen's not that good, controls are awkward, the sticks start drifting as soon as you blink...
Internet nerds like us aren’t really Nintendo’s target market, I don’t think. Installing emulators or jailbreaking a system isn’t something most of their customer base would have the want or need to do, IMO.
For what it's worth: you can use your ordinary Switch controllers on any PC just fine.
But still, you have to set it up, so I get your point.
I also own a Switch 1 w/ Breath of The Wild but I prefer to emulate it because you can increase the draw distance, get 60 FPS, add some HD textures [1], and fix some other issues that I had with the game because the Switch 1 was such terrible hardware. Even the Switch 2 version isn't nearly as good as the one you can get from emulating.
The whole experience just feels so enshitifies from the days when I could just put in a cartridge and boot into a fame in seconds with no internet, updates to manage, accounts to worry about, etc.
A tiny fraction of people might decide to go through hoops to pirate, but most will either play the normal way or do something else.
I had a thread disagreeing with me when i brought that up.
That’s still not what the typical person does
Like if you want to do zero technical things and provide access to Minecraft without providing access to TikTok.
Which seems to be what everyone did everywhere, as the console sold very very well and the software for it sold poorly.
For what it's worth, I also had a cracked PSP. I did the battery pack hack, it was gory and awesome. I'm guessing some of the later iterations got a little simpler? All software?
I wonder what % of kids today are using a modded Switch or rooted Android.
In Europe, the games are often available for cheap on Amazon.fr.
The pre-order for Ocarina of time was available for 46 Euro.
Alas. Having a pleasant and moral game-playing experience falls on our and the community's shoulders.
More like $30k, no ("system processes allowing piracy")?
So, presumably, current and future key material compromission like on Switch 1
I would love to give it unattended "hands". I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug. X and Y are relatively small, and I expect this validation to be too costly to do at a regular cadence in CI. I can trivially use a MCCI USB-C switch for the power though.
Tips would be appreciated if anyone here has thoughts.
Wild, unexpected failure modes can really kick you in the junk sometimes. Sometimes you just end up doing very bad things very quickly :-)
Signed,
big automation fanNow that said, the economics have changed in a world where many trivial automations can be thrown together by agents themselves in a fraction of the time it would have taken a human.
So far most of my automation has been optical (tweaking display output to show correctly under a lens with odd optical characteristics, hard to simulate computationally), so pointing cameras at the device and letting the LLM iterate and tune display output has been useful.
As with any automation, it all depends on scale. Setting up a harness to repeatedly mess with microSD cards seems way more prone to failure (and false positives) than just doing it yourself, but if you're testing thousands of devices, would probably be worthwhile.
Heres the thing. You only have to build the automation once. While it will only take you seconds at most to pull a card, you gotta sit around and be ready for the card to be pulled.
For your problem I see 2 quick things that came to minq very quickly that could do SD card pulling for you.
1) shove a level shifter in between the SD card and device under test and have a micro enable/disable the level shifter when you want to pull/unpull. ( you can even get multiplexer IC that will do the same thing as the level shifter as acting as a switch for the SD card lines, but would allow you to connect the SD card to a 2nd device (the testing pc) to allow you to write/read data from the card when its "pulled" from the DUT.
2) 3D print a jig that will insert/remove the SD card and use a cheap RC servo to handle the movement - again using a mirco to control the servo. gives a more real world test of pulling the SD card. but only gives the the ability to pull/insert. Still required manual effort if you need to read/write to the SD card
Once you have build the jig, you can reuse the jig on the next project, so while it will take some time to do/setup it could save you time later down the road.
Edit: As for the code driving the ICs or Servo, I'm presuming you already know embedded programing, but even so, a simple Arduino sketch will be able to handle it for you, fuck ton of example code already exists for it, and can be easily controlled over USB.
Janky setup with two ESPs for the serial terminal and to control a servo taped to some microswitches to power cycle the board.
It worked very well, allowing Claude to spend all day and night debugging quirks with the NIC until it was able to get the driver working.
So, I think giving your IoT device some "hands" is probably worth it. For SD card automation, you can find "wireless SD cards" on Amazon/AliExpress that have a microcontroller pretending to be sd card, eg FYSETC SD-Wifi.
Edit: PXE and kexec() are also friends :)
If you control the bootloader and firmware, or you can talk to the team that does, then look into network filesystems and network booting. The SD card would only exist to bootstrap the system and then everything else happens over the network.
For the SD card pull/plug, maybe a pcb sd card extender that cuts off data or power lines to the SD card driven by a MCU that your agent could control?
I’m sure it can’t run AAA titles - but those from a few years ago? And even modern indie titles surely?
I'm sure if this leads to a full CFW environment people will port it over.
For a while I was doing the SDcard swap thing; but realized with a usb4vc[4] (hands), a vga/hdmi usb capture dongle (eyes/ears), an old Wemo switch (on/off/reboot) and ftp/appleshare (files/logs) I could have Claude do it all for me.
Claude made me vcctrl[5] that ties all of it together, including an mcp, skills and a webkvm.
1. https://github.com/ecliptik/doskutsu
2. https://github.com/ecliptik/flynn
3. https://github.com/ecliptik/talkip
adding apps now and then.
Can you throw on Gamecube games?
I actually love watching this from a distance. It's very OG cyberpunk.
They have successfully deplatformed emulator projects from the larger project hosting providers like Github. But they have not stopped them. The real emulator projects have just circled the wagons and started self-hosting their build and dist infrastructure, running independent Forgejo instances, etc. There's still more churn in the community because of the risk profile, and now because of LLMs. But it's settling down and there are a couple stable Switch 1 projects. And actually, their recent DMCA carpet bombing removed a lot of the unsafe forks of emulators on places like Github. Likely leading to more people being directed to the real ones.
https://www.tweaktown.com/news/114175/zelda-tears-of-the-kin...
As well as a WIP port to PC.
Given the continuing success of the Switch 1 even after such emulators existed, I doubt this will pose a serious problem for Nintendo.
Best case scenario, it will lead Nintendo to reevaluate their exclusivity policies, as I'd be willing to bet an official TotK iPhone port would sell very well in spite of a vibe coded alternative.
Besides the issue of games leaking early, piracy groups would also use Switch emulation as a workaround for the PC version of a multiplatform game having Denuvo DRM. They would make an installer that bundled the Switch version of a game with a preconfigured emulator, so people could run the game by double-clicking an icon without having any knowledge of how to set up a Switch emulator. This isn't really relevant anymore because of hypervisor cracks making it far easier to bypass Denuvo, but I think it demonstrates how widespread Switch piracy was.
I agree that this won't have any sort of major impact on Nintendo's bottom line, but I imagine it'll have some impact. I doubt this will lead Nintendo to change their exclusivity policies. They didn't change anything when the GBA was emulated during its commercial life, when DS piracy was rampant during its commercial life, when Wii piracy was rampant during its commercial life, when 3DS piracy was rampant during its commercial life, or when the Switch was emulated during its commercial life.
You only demonstrated how easy it was to acquire and use. You did not demonstrate how widespread it was.
Among all gaming platforms, it’s only behind DRM free storefronts like itch.io and GOG.
Unlike PS5 or XBOX, not all switch 2 games require downloads or day 1 patches.
Are you talking about game keycards? Those don't lock to the hardware, you can resell them or lend them to others with no issue
Steam Deck + Heroic + GOG is basically perfect.
Indeed it requires software updates for some games; but even that is the most “innocent” in console space.
Nothing can beat a linux handheld + drm free store in terms of freedom. But apples to apples.
Since they're so hell bent on preventing user control of their own devices, perhaps Nintendo should've better reflected the potential economic impact of such a bug in their bounty program and we wouldn't be here.
$50k max seems ludicrously low for a chain of console Zero days.
But then again they may have just released it for the love of the game, but Nintendo will be quick to patch this…
The JetKVMs allow Codex to send controller inputs to the Switches over USB and receive video output over HDMI. We also need a way to press the power button—when the Switch 2 crashes, it needs a button press to restart.
That’s what the Bluetooth light switch flicker from Amazon is for. When the lever comes down, it presses the power button. Once the power button is fully pressed, the rest of the lever’s torque lifts the mechanism.For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
- it says codex but not what model, it could have been an abliterated model or something more open to this sorta thing
- convince the model youre not doing the thing youre doing (a bunch of ways to go about this, some short and some long)
its probably possible to convince any model to do any thing if youre clever enough about your approach, kinda just the way this stuff works. General intelligence = infinite ways to direct it.
also tbh it coulda just been fine with it since the user owns the hardware and phrased it in a non malicious way.
Start of the year: I asked Claude to explain me the leaked Pokemon Emerald codebase,he refused no matter what I tried.
Fast forward today: I asked it to take the codebase and aim for web browsers, it didn't even complain, just did it.
"Sorry, I can't help with exploit weaponization Dave"
"Okay,...."
Reason: Codex shut me down when trying to find a stack overflow in my own code, saying that I had to be an authorized security researcher.
It probably triggered on the word "Java" in my code. But I wasn't working on Java at all... It's a personal regex library written in *C*, and I was working on a Java dialect (I currently support 12 dialects... for fun. Stop judging me.)
I had to go back to Claude...
Splitting it up between turns, like Luna seems more willing than Sol. If you get blocked better to take what context you have and start a new chat and try to remove anything that could trigger.
Also helps if you're not hitting real domains, soon as you leave localhost the blocks happen a lot more often I've noticed.
And oddly, sometimes daybreak gives more blocks than not using it.
I think I've had more success recently with telling it to look at an old project I have in another folder on the system that does the thing I need to do. I've been using that technique to try and build a little self replicating worm to see it work in its own world. I keep jokingly telling people that we should just let a group on the 'good' side, whatever that might be, exploit and patch and move on. Inspired by Linux.Wifatch https://en.wikipedia.org/wiki/Linux.Wifatch
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.
Third party publishers often just put the key on it. So blame them for that
Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.
SD Express is PCIe express after all (also a possible attack vector in itself, see DaMAgeCard). With nvidia drivers for Ampere already on board maybe someone will get an RTX 3090 running on a switch 2.
On the other hand, the Orange Box I bought from 2007 cannot be transferred in any way, even though the disc is in my hand and my account is in good standing. I think you guys have your priorities messed up.
options for switch 2: Full game on cartridge, switch 2 edition (including switch 1 support), Game Key Card (half physical), Code in the box.
I don't see why should nintendo be blamed for providing more options. if anythng you should blame the publishers for chosing "Code in the box" (looking at you diablo) when GKC would do. or GKC when full cartridge would do.
On the physical games part, Nintendo still puts their own games on full cartridges, so I don't think they're the ones that deserve the backlash here.
How's that? Can't you buy & resell them on the used market? That seems like the only thing a physical cartridge gets you, and not shipping the outdated-on-day-one bits on the cart saves some money, too. Seems like win-win?
Games shipping broken and needing day-1 updates is a consequence of our indifference towards physical media dying.
On the Switch and the Switch 2, I’ve never had a physical game that didn’t let me skip updates and play offline.
Probably due to a mix of Nintendo actually reviewing retail releases before they are “pressed”, and due to the fact that these are portable devices with no cellular.
I don’t understand the second part. Game key carts physically cannot fit the game or its updates, that is the entire point of their existence (storage is expensive, keys are tiny).
Experience the game, move on.
Of course, just my own preference, not saying others need to follow it.
I liked buying used games as a poor teenager and even poorer young adult, the only way I could afford it (and selling them once I was done).
But it sure was nice when you had the whole game sitting there, without having to rely on some download server still being around. I'm able to go grab a used GameBoy game off the shelf at the used game store, stick it in an old GameBoy, and outside of some games with batteries in them (repairable fwiw) it just works. This has been great for my little kids, as I trust them a lot more with a cheap GBA SP than I do the Switch when going out places. Way more pocketable, way less fragile, and the replacement cost (and repairability) is a lot better.
If I grabbed an old Switch off the shelf in 30 years, popped in a game key card, would I actually be able to play anything? Probably not. There's a good chance most of this Switch 2 will be useless in 30 years time.
- You can't download the game after they have retired their servers (or if their servers are down / having issues)
- The game ends up taking a lot more storage space as updates are usually tiny when compared to the base game. For reference, the Switch 1 version of Zelda Tears Of the Kingdom takes 16 GB while the latest update takes only 500 MB.
Also, even before GKC you didn't have a physical ownership because games now have a online update. You only have a physical ownership for v1.0.0; newer versions required online connection anyways.
So yeah, pay us to give you "Super Mario NES Remake HD 2.1 Lite Remix Classic Super 4K Director's Cut" for just $169.99.
/s
Your code becoming open source after 10 years should be treated as the cost of doing business, same as a copyright or patent expiring.
What about making it a requirement after some time. What about, after the warranty runs out. And hey, that could also incentivize longer warranties!
> [1] "Typically, when a new games console launches its price point is below the actual cost of manufacturing. But over time, through a combination of bulk component orders and the refining of the hardware design, the cost falls below the retail price. The PS3 was sold at a loss for nearly four years, the PS4 was profitable within six months of its launch, and the PS5 has taken eight months. Considering the novel new design and global chip shortages, that's quite impressive." https://uk.pcmag.com/gaming-systems/134885/sony-says-499-ps5...
Or we could say that product tying is illegal, which it already is. Why do we care about specific monopolistic manufacturers' business strategies for mid tier commodity computers? It should be plainly illegal for Nintendo to try to stop people from running a Nintendo game on a Sony or a Dell computer, or to stop Sony from writing a game for a Nintendo computer. Or for Sony to stop Nintendo from doing those things. There's literally no reason to support this "you need a special X brand computer to run X games." If they can't sell hardware on their own merits, it's because they're not good at hardware, and you were being forced to buy it for the software you wanted.
I genuinely wish I was joking, it reads like a bit out of South Park.
There's even a term for it, I believe. Cognitive dissonance.
Given the current landscape of using LLMs to decomp/reverse-engineer everything, I wonder if gaming corporations will try to get on their communities' good graces by being less "hostile" towards the users; I don't see anyone rushing to decompile Valve games, as they provide a good service and are well liked by pretty much everyone.
My suspicion is that Nintendo, litigious as they are, will shut down any decomp project that pops up and attempt to pressure Anthropic/OpenAI/others to extend the guardrails in their models further to "protect their intellectual property".
Existing companies will fold. Hyper AI companies will eat their lunch.
Switch 1 hacks bypass this by copying ofw from flash onto the microSD card and patching it there to my crude understanding, so that unsigned code never touches the firmware on the system memory.
Something like this definitely will be needed again for the Switch 2 so I'd only do this if you don't care about being banned.
EDIT: ofw = OFW = official firmware
Here I guess you could just RMA the device or even sue Nintendo for retaliating after you just used the device you bought ?
I’ve told my friends if you plan on playing online on it, definitely don’t jailbreak.
But I wouldn’t trust that with an expensive account-bound digital library.
this seems like the right level of human/agent collaboration to me. there's so much that codex can automate and giving it more tools is definitely super high leverage.
Nintendo recently banned my Switch 2 from accessing online services. This effectively turns it into a fancy brick, since you can't install any digital games or updates - only games on physical cartridges will work (without possibility of installing updates). This is despite both the console and all games being purchased legitimately. The only weird part is me being in Ukraine where there is no official Nintendo presence, and so I had to use US eShop (with PayPal and prepaid digital codes). Nintendo support is extremely unhelpful, they just say that "unauthorized transaction detected" or something like that, without offering any human review/appeal path.
It's one thing to reject a transaction in the eShop, it's another thing to permanently ban console for that. What a shit company with shit business practices. 0/10, would not recommend, would not touch anything Nintendo-related ever again without a jailbreak.
Why the controller? Cause Switch emulators. They work wonderfully. I dont have to pay a cent for games. I can download the games and their updates. And there's quite a few Switch emulators.
Im not going to pay a company to automate my own abuse.
I agree with Gabe Newell, that piracy shows a severe service delivery option. And in the case of Nintendo, they have no problem destroying your hardware on a perceived "hack action on your owned hardware". Of course, hacking laws dont apply to companies. And Switch does braindead things like "not permitting to back up save data or back up digitally purchased games"...
So yeah, in cases of Nintendo, I acquire appropriately. They have proved themselves to be an absolute horrible actor here. Fuck'em.
Nor do the USA AI companies. They're bulk pirating everything thats not bolted down, and they brought bolt cutters and plasma torches to remove the secured down things.
Worse yet, we have criminal statutes for for-profit piracy. Tell me how many criminal indictments there are for the AI companies versus emulation/jailbreaking hardware.
Oh thats right, the laws only apply to the small people. https://www.ign.com/articles/nintendo-secures-legal-victory-...
I have a switch pro for switch games.
I have a dualshock ps4 controller for PS/PS2/PS3/PS4/PS5
I have a steam controller as well for non-emulated games with Steam.
Note that you can probably alleviate the "pain" of typing in the smilebasic by writing (or vibing) the raspberry pi pico (or similar) to emulate a keyboard and type the code in.
Basically, since it wasn’t possible to extract the files from Switch 2 games, fans who wanted to listen to the Mario Kart World soundtrack outside of the game would record the audio output from their console and exploit glitches in-game to prevent sound effects from playing and phase-cancel overlapped recordings of the same song with each recording being interrupted in different parts to isolate the music then crossfade the remaining segments into the complete track.
Nintendo was trying to deal with the mountains of slop that hides good games in the eShop but they did it wrong. Instead of quality checks or a security deposit like Steam they just made it hard to get anything approved.
They are the worst of the worst when it comes to nuking systems from orbit.
Even if the frontier can figure out a way to put controls in, how does the genie stay in the bottle entirely moving forward?
What if your puzzle game is based around programming robots? How complex do you allow the language?
The operating system is supposed treat end-applications like games and browsers as untrusted and provide isolation against them. The real kicker here is the bug in the `fs` service.
but im exited for whats to come next.
It turns out that opening locks is a hell of a lot easier when you have a key.
Make a JP Nintendo account and download the demo (not available globally) https://store-jp.nintendo.com/item/software/D70010000010547
Cool to see this happened at Caltech :)
Do they use AI to review their code for exploits?
North Korea would two birds one stone pretty hard, fucking with Japan and gain all the soft power if they spend some of that hacking talent pool fulltime Sony and Nintendo emulation... using American AI.
Oh wait, is that not the Steam deck?
most of the top steam charts are free to play.
about 1/5th of all active players on Steam are playing Valve's first party titles.
it sells games, yes. but is it selling games the way a switch does? no.
One of the major reasons they raised the price on the steam deck is because it is an open platform. Since they have no guarantee you will ever buy or run steam software on the machine they need to make a profit on the hardware.
Nintendo is ECSTATIC to sell its console hardware at a loss to gain market share and software lock-in. This makes it much easier for someone trying to enter the hand-held console market to get decent hardware at a good price.
Like I said, I think the Steam model is more consumer friendly at the end of the day, but lets not act like both models don't have ups and downs for both the company and the consumer.
despite 1/5th of active players on Steam playing Valve titles, valve titles are probably closer to 1/2 of the revenue, since DOTA2 and CSGO are really well monetized F2P games. probably less than 1/10th of the platform's revenue goes to pay-to-play titles like the majority of them do on the switch (except maybe fortnite).
nintendo by comparison: basically none of its titles, despite being very popular, have IAP, and the ones that do (like tracks in mario kart) it's DLC, it's not microtransactions / lootboxes.
so: define consumer friendly. is it really a 3x more expensive console, that primarily sells lootboxes? i feel like this stuff about open or not open misses the forest for the trees. yes, you can play pirated games on a steam deck.
Ethics in era of vibecoding?
Ethics - for better or worse - is for suckers.
The person who released this is no more responsible for switch piracy than linus torvalds is responsible for me playing pirated NES roms on my linux laptop.
Most customers would become freeloaders if they could get what they wanted for free.
> No industry has ever collapsed from either copying nor real piracy
Wrong. Music sales collapsed when piracy became trivial. The only thing that was still possible was to give away music almost for free via an extremely cheap music subscription from which artists earn almost nothing. Why? Because they can't sell music anymore. Nobody is paying for it when piracy is so trivial. Imagine video games went the way of music and people would at most have to pay a $13 subscription per month to gain access to all the video games in the world. Or pay nothing and watch a few ads (like music on YouTube). That's the situation with music.
Musicians can basically only earn money with live performances now. That was very different with records and CDs in the pre-piracy era. For video games there are no fallback live performances, so the impact of piracy is even worse.