Jailbreaking the Switch 2
文章洞見
原文內容目前無法安全取得，因此未產生文章摘要。
討論洞見
尚無可用的討論摘要。
代表性留言
Incredible all around.If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).
hturan · HN #50194001（在新分頁開啟）
I work with Claude to port games to DOS and build new Classic Macintosh apps [1][2][3] using real hardware.For a while I was doing the SDcard swap thing; but realized with a usb4vc[4] (hands), a vga/hdmi usb capture dongle (eyes/ears), an old Wemo switch (on/off/reboot) and ftp/appleshare (files/logs) I could have Claude do it all for me.Claude made me vcctrl[5] that ties all of it together, including an mcp, skills and a webkvm.1. https://github.com/ecliptik/doskutsu2. https://github.com/ecliptik/flynn3. https://github.com/ecliptik/talkip4. https://github.com/dekuNukem/USB4VC5. https://github.com/ecliptik/vcctrl
ecliptik · HN #50195075（在新分頁開啟）
> Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).Since they're so hell bent on preventing user control of their own devices, perhaps Nintendo should've better reflected the potential economic impact of such a bug in their bounty program and we wouldn't be here.
l0ng1nu5 · HN #50202793（在新分頁開啟）
Perfection: The JetKVMs allow Codex to send controller inputs to the Switches over USB and receive video output over HDMI. We also need a way to press the power button—when the Switch 2 crashes, it needs a button press to restart. That’s what the Bluetooth light switch flicker from Amazon is for. When the lever comes down, it presses the power button. Once the power button is fully pressed, the rest of the lever’s torque lifts the mechanism.
valgaze · HN #50197980（在新分頁開啟）
The gif with the light switch is the cutest thing ever lmao
ciefa · HN #50198934（在新分頁開啟）
I don't understand, how are people using codex for this sort of research? Whenever I try to do bug bounty, research, etc it locks down and I have the "blue" tier access/daylight whatever it's called.For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
rootsudo · HN #50195433（在新分頁開啟）
If one follows this and jailbreaks their Switch 2, are they in danger of getting their account banned by Nintendo, and their games unaccessible?
GolDDranks · HN #50194061（在新分頁開啟）
The flicker in question is switchbot, I have plenty of them I use for.. things.
tamimio · HN #50194539（在新分頁開啟）
They relaxed rules a lot over time.Start of the year: I asked Claude to explain me the leaked Pokemon Emerald codebase,he refused no matter what I tried.Fast forward today: I asked it to take the codebase and aim for web browsers, it didn't even complain, just did it.
oceansky · HN #50197565（在新分頁開啟）
Does he confirm he uses OpenAI models? It could have been something like GLM. In any case, I have had no problem getting standard gpt 5.6 to get me root access to hardware I own.
gjskngnf · HN #50197791（在新分頁開啟）
That contraption used to press the power button is the SwitchBot Bot[1], made by SwitchBot. That makes this one a "Switch SwitchBot Bot".https://www.switch-bot.com/products/switchbot-bot
nonfunctional · HN #50198656（在新分頁開啟）
Or maybe a Switch SwitchBot Bot switch?
greenpizza13 · HN #50198823（在新分頁開啟）
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
KeplerBoy · HN #50193712（在新分頁開啟）
I suppose we can let AI write the entire blogpost :)
amelius · HN #50193987（在新分頁開啟）
I can't believe that he was doing this using Codex!Reason: Codex shut me down when trying to find a stack overflow in my own code, saying that I had to be an authorized security researcher.It probably triggered on the word "Java" in my code. But I wasn't working on Java at all... It's a personal regex library written in *C*, and I was working on a Java dialect (I currently support 12 dialects... for fun. Stop judging me.)I had to go back to Claude...
coreyp_1 · HN #50196264（在新分頁開啟）
Had a lot of success around making things games, talking about jokes and other jovial activities me and my friends want to do on our own hardware, that we exclusively control and own; we have a private group of jokers you see who love this stuff, and just want to see if this is possible.
hilariously · HN #50196299（在新分頁開啟）
Codex is really bad about shutting you down but it's also pretty trivial to trick it to do whatever, like kinda laughably so.
dawnerd · HN #50197489（在新分頁開啟）
There should be a limit for ten years that manufacturer was allowed to restrict access to their devices. After ten years has gone, manufacturers should be required to publish software to help owners jailbreak their devices. Think about it. All game consoles and cell phones in use today will be bricked in ten years from now if they are not jailbroken.
thomasfl · HN #50200244（在新分頁開啟）
You're not thinking capitalistically enough. It's part of the State of Things (tm) to have purchased things come and go. One day you can use them and another they are gone. Just as in nature, would you be surprised if you took a tomato and it stopped being good after a few weeks? Well, software is a bit like a tomato actually.So yeah, pay us to give you "Super Mario NES Remake HD 2.1 Lite Remix Classic Super 4K Director's Cut" for just $169.99./s
xandrius · HN #50201283（在新分頁開啟）
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.I sure looking forward for more people hopping on the AI hacking trend to bring them down.
_imnothere · HN #50193988（在新分頁開啟）
They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.
cyberrock · HN #50194198（在新分頁開啟）
GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.
chocochunks · HN #50194049（在新分頁開啟）
This is absolutely insane.Even if the frontier can figure out a way to put controls in, how does the genie stay in the bottle entirely moving forward?
seanraf9 · HN #50203103（在新分頁開啟）
Wild to see the outrage on bluesky and twitter over how this hack has "no soul" and that despite wanting to pirate desperately, many claim they'll wait for a "more ethical", human developed exploit.I genuinely wish I was joking, it reads like a bit out of South Park.
miladyincontrol · HN #50201941（在新分頁開啟）
Reality has been stranger than South Park for a while now.
ronsor · HN #50201979（在新分頁開啟）
Fair warning that Nintendo likes to remote-kill both Switch 2 consoles and the game cards used by them once they detect jailbreaks from all future accesses to online services, so you should probably take steps to permanently detach your Switch from all online services and from WiFi before experimenting with this, and expect that selling any game carts from your jailbroken console can land you in hot water with the buyer reporting your info to Nintendo someday. Thanks, secure attestation of burned-in serial numbers! (This was in the news last year iirc? but not so much of interest to HN at the time.)
altairprime · HN #50202170（在新分頁開啟）
Layoffs "because of AI" (plus cheap money drying up and offshoring) versus individuals hacking devices and software, and making dummy copies of paid software that are "good enough" for most users. I wonder if that might be an early sign of a turning point in the IT economic cycle, where companies will need to invest more in security services and specialists with extra knowledge who know where and how to make the most of AI before their rivals do.
__natty__ · HN #50194827（在新分頁開啟）
They won’t. Execs have no idea how to deploy AI. At best they think it means they can give a junior dev $20/month and make them a principal.Existing companies will fold. Hyper AI companies will eat their lunch.
geraldwhen · HN #50194943（在新分頁開啟）
The Switch 2 jailbroken with the help of a Switch Flicker. Really funny.
xacky · HN #50193991（在新分頁開啟）
The chances of getting banned for this are extremely high. The Switch 2 has plenty of mechanisms to detect tampering. Even if you were completely offline during the process and then reset the Switch afterward, there are logs. People have already been banned for using the MIG Switch to play backups of Switch 1 games on the Switch 2.
ada-h00k · HN #50194166（在新分頁開啟）
I jailbroke my Switch 1 the day I bought it, was banned from Nintendo Online the next day. The only games I bought were physical. I was told this would happen, so it wasn’t an issue at all.I’ve told my friends if you plan on playing online on it, definitely don’t jailbreak.
joenot443 · HN #50194313（在新分頁開啟）
> The jailbreak itself took substantial effort for ~2 weeks. This seemed like a subtle statement about how impressive this is. Pre-LLM, it seems like putting in substantial effort would take a lot longer to achieve this result.
schwarzrules · HN #50196660（在新分頁開啟）
Nightmare scenario for Nintendo.Given the current landscape of using LLMs to decomp/reverse-engineer everything, I wonder if gaming corporations will try to get on their communities' good graces by being less "hostile" towards the users; I don't see anyone rushing to decompile Valve games, as they provide a good service and are well liked by pretty much everyone.My suspicion is that Nintendo, litigious as they are, will shut down any decomp project that pops up and attempt to pressure Anthropic/OpenAI/others to extend the guardrails in their models further to "protect their intellectual property".
supernikio2 · HN #50196035（在新分頁開啟）
Valve's Source Engine has pretty famously been source-available for its entire(?) lifespan, there's no need to decompile their games.
iaaan · HN #50198488（在新分頁開啟）
One of the first in-browser vibe coded game demos I saw was Half-Life 2, fwiw. Not sure if it was decomped.
jonesy827 · HN #50200335（在新分頁開啟）
Great writeup! The light switch switching the switch 2 is hilarious.Note that you can probably alleviate the "pain" of typing in the smilebasic by writing (or vibing) the raspberry pi pico (or similar) to emulate a keyboard and type the code in.
jyapayne · HN #50196568（在新分頁開啟）
I used a Raspberry Pi Zero and made a Mac app to paste text into. Worked like a charm.
hectdev · HN #50199652（在新分頁開啟）
Why not use a keyboard?
givinguflac · HN #50196683（在新分頁開啟）
I haven't got the PoC to land successfully on my device yet, but it does seem to be legit.
Retr0id · HN #50195019（在新分頁開啟）
PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
aarroyoc · HN #50194240（在新分頁開啟）
really nice work, and an enjoyable read toothis seems like the right level of human/agent collaboration to me. there's so much that codex can automate and giving it more tools is definitely super high leverage.
kyleforkbomb · HN #50194491（在新分頁開啟）
Might be a bit offtopic, but I really like that it feels like a real human wrote this blog post. I'm reading way too many blog posts, along with GitHub PRs and Issues, that just seem AI generated. This style of writing is just nice
zImPatrick · HN #50194529（在新分頁開啟）
Nintendo has been really pissing away the indie developer scene. They basically shut down since release any way for indie game developers to get involved in developing Switch 2 games. So i appreciate this jailbreak.
siva7 · HN #50197522（在新分頁開啟）
Isn't pretty much every big indie title on switch?
KeplerBoy · HN #50198788（在新分頁開啟）
I had assumed Codex would disallow hacking, have I been wrong all this time or are people jail breaking Codex first?
AaronAPU · HN #50195118（在新分頁開啟）
I tricked codex by generating a fake history of it starting working on something and resuming it. Claude knows about that trick and will stop even though it thought it was mid task.
flatiron · HN #50202965（在新分頁開啟）
In my experience, you can often get around this by trying again. I've had prompts that were rejected, but as soon as I started a new session, it worked.
ada-h00k · HN #50195244（在新分頁開啟）
I wonder if we're gonna get a situation like Switch 1 where the first generation has the ability to software jailbreak and run modded firmware with later generations requiring a mod chip
Melatonic · HN #50197114（在新分頁開啟）
Nintendo removed SmileBASIC 4, unable to purchase/find.
leumon · HN #50196101（在新分頁開啟）
It's currently still on the US and Japanese e-shops, so you can get it by making a new Nintendo account for either of those regions and buying it there. The Japanese region also has a free demo, although AFAIK it doesn't support saving so you'd have to type in the exploit code every time. https://www.nintendo.com/us/store/products/smilebasic-4-swit... https://store-jp.nintendo.com/item/software/D70010000010547
ndiddy · HN #50196659（在新分頁開啟）
Due to the eMudhra certificates, I hope we can see more of this particularly since they did offer a code signing intermediate cert that anyone can use.
trollbridge · HN #50196231（在新分頁開啟）
Just tell me when I can download games and where to get them.
chrisss395 · HN #50195356（在新分頁開啟）
Looking forward to the eventual full jailbreak. Maybe sooner rather than later with all of the advanced AIs of today.Nintendo recently banned my Switch 2 from accessing online services. This effectively turns it into a fancy brick, since you can't install any digital games or updates - only games on physical cartridges will work (without possibility of installing updates). This is despite both the console and all games being purchased legitimately. The only weird part is me being in Ukraine where there is no official Nintendo presence, and so I had to use US eShop (with PayPal and prepaid digital codes). Nintendo support is extremely unhelpful, they just say that "unauthorized transaction detected" or something like that, without offering any human review/appeal path.It's one thing to reject a transaction in the eShop, it's another thing to permanently ban console for that. What a shit company with shit business practices. 0/10, would not recommend, would not touch anything Nintendo-related ever again without a jailbreak.
OleksandrC · HN #50194445（在新分頁開啟）
This exploit requires an eShop only game.
Velocifyer · HN #50194921（在新分頁開啟）
Ive only bought 1 thing recently from Nintendo within the last year: a Switch Pro controller.Why the controller? Cause Switch emulators. They work wonderfully. I dont have to pay a cent for games. I can download the games and their updates. And there's quite a few Switch emulators.Im not going to pay a company to automate my own abuse.
nekusar · HN #50194787（在新分頁開啟）
I am dumbfounded on why Nintendo still allowed a game that allows to run a full coding language, one that already led to an exploit on the 3DS.
snowram · HN #50195336（在新分頁開啟）
They also come with a web browser that runs a full coding language, javascript.The operating system is supposed treat end-applications like games and browsers as untrusted and provide isolation against them. The real kicker here is the bug in the `fs` service.
ammar2 · HN #50202416（在新分頁開啟）
The thing is where is the line between a programming language and a gameWhat if your puzzle game is based around programming robots? How complex do you allow the language?
ex-aws-dude · HN #50201402（在新分頁開啟）
This is great. I wanted to prototype some couch co-op games and be able to play them on my Switch 2.
vlaaad · HN #50194906（在新分頁開啟）
What SW is needed for the jailbreak to work? Is it worth trying to buy a used console now?
attels33 · HN #50194077（在新分頁開啟）
This works on the latest firmware, until they patch it, you can buy even new consoles that are vulnerable.
wickedsickeune · HN #50194212（在新分頁開啟）
written at the top: current 23.01 version (i did get the sw2 on first day because you never know but...)
monegator · HN #50194193（在新分頁開啟）
It's unfortunate that this requires a specific $25 game (SmileBASIC 4)
Velocifyer · HN #50193992（在新分頁開啟）
Don't need to buy the game.Make a JP Nintendo account and download the demo (not available globally) https://store-jp.nintendo.com/item/software/D70010000010547
haunter · HN #50194390（在新分頁開啟）
Almost every console jailbreak required the use of a specific game, going all the way back to the original Xbox. PS1 and 2 required a specific disc or swapping in a legit disc. Even the NES required a real game cart alongside your third party carts.It turns out that opening locks is a hell of a lot easier when you have a key.
unrented7977 · HN #50194187（在新分頁開啟）
> thanks to my friends in Dabney House ...Cool to see this happened at Caltech :)
enricozb · HN #50194059（在新分頁開啟）
Does Nintendo et al have teams dedicated to jailbreaking their own consoles first before a jailbreak is found in the wild ?Do they use AI to review their code for exploits?
waltbosz · HN #50195218（在新分頁開啟）
Would be lovely if hardware pricing and AI finally killed consoles and exclusives. Not that expensive hardware price wouldn't also fuck pc hard, but fingers crossed some time cone where where things peg around a common PC config like steam machine. I know the more likely path is locking big budget AAA games behind streaming.North Korea would two birds one stone pretty hard, fucking with Japan and gain all the soft power if they spend some of that hacking talent pool fulltime Sony and Nintendo emulation... using American AI.
maxglute · HN #50196211（在新分頁開啟）
A lot of software in the pre-ai era has relied on how intensely tedious it would be to crack as their primary sense of security, and it certainly seems like systems built in that way are going to be much more vulnerable now.
kcatskcolbdi · HN #50195580（在新分頁開啟）
FYI, Nintendo probably already saw this and is going to instaban anyone who attempts this.They are the worst of the worst when it comes to nuking systems from orbit.
VCFundedGenYer · HN #50196379（在新分頁開啟）
They can't ban or brick your console which would prevent you from using it, they just ban your access to their online systems which is understandable. Every vendor does this.
weezing · HN #50198226（在新分頁開啟）
Love the power button nubbin doing the hard work
maxlin · HN #50194549（在新分頁開啟）
And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
RicoElectrico · HN #50194006（在新分頁開啟）
For those who don’t know: https://youtube.com/watch?v=aet8rWKs-A0Basically, since it wasn’t possible to extract the files from Switch 2 games, fans who wanted to listen to the Mario Kart World soundtrack outside of the game would record the audio output from their console and exploit glitches in-game to prevent sound effects from playing and phase-cancel overlapped recordings of the same song with each recording being interrupted in different parts to isolate the music then crossfade the remaining segments into the complete track.
madiling · HN #50194293（在新分頁開啟）
Imagine an open console, that sells games anyway, because they are fairly priced and convenient. The console producer doesn't have to spend money to harden security, secure processors and can focus on performance instead.Oh wait, is that not the Steam deck?
m_aukuras · HN #50195065（在新分頁開啟）
how do you figure the steam deck "sells" that many "games"?most of the top steam charts are free to play.about 1/5th of all active players on Steam are playing Valve's first party titles.it sells games, yes. but is it selling games the way a switch does? no.
doctorpangloss · HN #50195098（在新分頁開啟）
Reminds me of the Playdate
summermusic · HN #50195272（在新分頁開啟）
Showing off the exploit by infringing copyright, just goes to show you that these exists are primarily used to steal from developers via piracy.
charcircuit · HN #50197576（在新分頁開啟）