alt Hacker NewsJailbreaking the Switch 2
Comments
Perfection:
The JetKVMs allow Codex to send controller inputs to the Switches over USB and receive video output over HDMI. We also need a way to press the power button—when the Switch 2 crashes, it needs a button press to restart.
That’s what the Bluetooth light switch flicker from Amazon is for. When the lever comes down, it presses the power button. Once the power button is fully pressed, the rest of the lever’s torque lifts the mechanism.I don't understand, how are people using codex for this sort of research? Whenever I try to do bug bounty, research, etc it locks down and I have the "blue" tier access/daylight whatever it's called.
For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
That contraption used to press the power button is the SwitchBot Bot[1], made by SwitchBot. That makes this one a "Switch SwitchBot Bot".
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
There should be a limit for ten years that manufacturer was allowed to restrict access to their devices. After ten years has gone, manufacturers should be required to publish software to help owners jailbreak their devices. Think about it. All game consoles and cell phones in use today will be bricked in ten years from now if they are not jailbroken.
I can't believe that he was doing this using Codex!
Reason: Codex shut me down when trying to find a stack overflow in my own code, saying that I had to be an authorized security researcher.
It probably triggered on the word "Java" in my code. But I wasn't working on Java at all... It's a personal regex library written in *C*, and I was working on a Java dialect (I currently support 12 dialects... for fun. Stop judging me.)
I had to go back to Claude...
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
Wild to see the outrage on bluesky and twitter over how this hack has "no soul" and that despite wanting to pirate desperately, many claim they'll wait for a "more ethical", human developed exploit.
I genuinely wish I was joking, it reads like a bit out of South Park.
Layoffs "because of AI" (plus cheap money drying up and offshoring) versus individuals hacking devices and software, and making dummy copies of paid software that are "good enough" for most users. I wonder if that might be an early sign of a turning point in the IT economic cycle, where companies will need to invest more in security services and specialists with extra knowledge who know where and how to make the most of AI before their rivals do.
Nightmare scenario for Nintendo.
Given the current landscape of using LLMs to decomp/reverse-engineer everything, I wonder if gaming corporations will try to get on their communities' good graces by being less "hostile" towards the users; I don't see anyone rushing to decompile Valve games, as they provide a good service and are well liked by pretty much everyone.
My suspicion is that Nintendo, litigious as they are, will shut down any decomp project that pops up and attempt to pressure Anthropic/OpenAI/others to extend the guardrails in their models further to "protect their intellectual property".
Fair warning that Nintendo likes to remote-kill both Switch 2 consoles and the game cards used by them once they detect jailbreaks from all future accesses to online services, so you should probably take steps to permanently detach your Switch from all online services and from WiFi before experimenting with this, and expect that selling any game carts from your jailbroken console can land you in hot water with the buyer reporting your info to Nintendo someday. Thanks, secure attestation of burned-in serial numbers! (This was in the news last year iirc? but not so much of interest to HN at the time.)
If one follows this and jailbreaks their Switch 2, are they in danger of getting their account banned by Nintendo, and their games unaccessible?
The Switch 2 jailbroken with the help of a Switch Flicker. Really funny.
> The jailbreak itself took substantial effort for ~2 weeks. This seemed like a subtle statement about how impressive this is. Pre-LLM, it seems like putting in substantial effort would take a lot longer to achieve this result.
Great writeup! The light switch switching the switch 2 is hilarious.
Note that you can probably alleviate the "pain" of typing in the smilebasic by writing (or vibing) the raspberry pi pico (or similar) to emulate a keyboard and type the code in.
I haven't got the PoC to land successfully on my device yet, but it does seem to be legit.
PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
really nice work, and an enjoyable read too
this seems like the right level of human/agent collaboration to me. there's so much that codex can automate and giving it more tools is definitely super high leverage.
This is absolutely insane.
Even if the frontier can figure out a way to put controls in, how does the genie stay in the bottle entirely moving forward?
I had assumed Codex would disallow hacking, have I been wrong all this time or are people jail breaking Codex first?
dang that was involved. got it connected to my jetkvm and copied to clipboard with matching spacing in the file, i can see how a normal person could not follow this.
but im exited for whats to come next.
Nintendo has been really pissing away the indie developer scene. They basically shut down since release any way for indie game developers to get involved in developing Switch 2 games. So i appreciate this jailbreak.
I wonder if we're gonna get a situation like Switch 1 where the first generation has the ability to software jailbreak and run modded firmware with later generations requiring a mod chip
Just tell me when I can download games and where to get them.
Due to the eMudhra certificates, I hope we can see more of this particularly since they did offer a code signing intermediate cert that anyone can use.
Looking forward to the eventual full jailbreak. Maybe sooner rather than later with all of the advanced AIs of today.
Nintendo recently banned my Switch 2 from accessing online services. This effectively turns it into a fancy brick, since you can't install any digital games or updates - only games on physical cartridges will work (without possibility of installing updates). This is despite both the console and all games being purchased legitimately. The only weird part is me being in Ukraine where there is no official Nintendo presence, and so I had to use US eShop (with PayPal and prepaid digital codes). Nintendo support is extremely unhelpful, they just say that "unauthorized transaction detected" or something like that, without offering any human review/appeal path.
It's one thing to reject a transaction in the eShop, it's another thing to permanently ban console for that. What a shit company with shit business practices. 0/10, would not recommend, would not touch anything Nintendo-related ever again without a jailbreak.
I am dumbfounded on why Nintendo still allowed a game that allows to run a full coding language, one that already led to an exploit on the 3DS.
This is great. I wanted to prototype some couch co-op games and be able to play them on my Switch 2.
What SW is needed for the jailbreak to work? Is it worth trying to buy a used console now?
It's unfortunate that this requires a specific $25 game (SmileBASIC 4)
These jailbreak things seem coordinated to me. Hm... someone cannot bear the success of certain companies.
> thanks to my friends in Dabney House ...
Cool to see this happened at Caltech :)
Does Nintendo et al have teams dedicated to jailbreaking their own consoles first before a jailbreak is found in the wild ?
Do they use AI to review their code for exploits?
Would be lovely if hardware pricing and AI finally killed consoles and exclusives. Not that expensive hardware price wouldn't also fuck pc hard, but fingers crossed some time cone where where things peg around a common PC config like steam machine. I know the more likely path is locking big budget AAA games behind streaming.
North Korea would two birds one stone pretty hard, fucking with Japan and gain all the soft power if they spend some of that hacking talent pool fulltime Sony and Nintendo emulation... using American AI.
A lot of software in the pre-ai era has relied on how intensely tedious it would be to crack as their primary sense of security, and it certainly seems like systems built in that way are going to be much more vulnerable now.
gta 6 on switch 2?
And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
FYI, Nintendo probably already saw this and is going to instaban anyone who attempts this.
They are the worst of the worst when it comes to nuking systems from orbit.
Love the power button nubbin doing the hard work
Imagine an open console, that sells games anyway, because they are fairly priced and convenient. The console producer doesn't have to spend money to harden security, secure processors and can focus on performance instead.
Oh wait, is that not the Steam deck?
[dead]
[dead]
Showing off the exploit by infringing copyright, just goes to show you that these exists are primarily used to steal from developers via piracy.
Publishing this is unethical because it's obvious that this will be used almost exclusively for piracy.
Incredible all around.
If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).