Jailbreaking the Switch 2

ns2jb is a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1 that enables running arbitrary native code as ordinary sysmodules and as the built-in fs sysmodule. The project demonstrates homebrew, game modding (notably a modded Mario Kart World), save extraction and peripheral access via MMIO. The setup used a pair of consoles, JetKVMs for USB input and HDMI capture, and a mechanical power-button actuator to recover from crashes. Initial approaches targeted WebKit via a captive-portal n-day to achieve a native control-flow hijack, but mitigations such as execute-only memory, pointer authentication (PAC) and control-flow integrity (CFI) limited how far browser-based exploits could push into privileged sysmodules.

The successful chain combined a Switch 1 SmileBASIC memory-corruption exploit and a Switch 2 fs sysmodule logic flaw. SmileBASIC yielded a 32-bit integer-wrap in REMOVE that produces an out-of-bounds memmove, turning an adjacent pointer into a giant-string length and enabling arbitrary read/write and ROP on the Switch 1. On the Switch 2, Path::Normalize can overflow a 0x301 temporary buffer when handling parent-directory paths with backslashes; corrupting BufferedStorage cache entries grants arbitrary R/W and FullPermission by setting a saved PID to 1, allowing dumping of internal storage and sysmodule code. With ARW, the loader’s ExeFS handle is swapped to serve a malicious main while fs has already provided a valid NCA header hash/signature; by controlling fs message timing via a swapped handle/event, arbitrary code can be executed as any program or built-in sysmodule.