If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
I'm working on a IoT device at work and have been the "hands in the lab" for my agent this week. It's been a really weird experience. Making changes to the update/recovery process, so I have to validate several permutations of fault injection (i.e.: abrupt power loss during update step X while on starting version Y).
I would love to give it unattended "hands". I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug. X and Y are relatively small, and I expect this validation to be too costly to do at a regular cadence in CI. I can trivially use a MCCI USB-C switch for the power though.
Tips would be appreciated if anyone here has thoughts.
The Switch 1 sold about 150m units, the Steam Deck’s sold 6m.
Internet nerds like us aren’t really Nintendo’s target market, I don’t think. Installing emulators or jailbreaking a system isn’t something most of their customer base would have the want or need to do, IMO.
According to wikipedia, they sold over 23 million units of the switch 2 and over 155 million of the switch. Not that I agree with their aggressive practices but it clearly works. That's a lot more than the Steam Deck btw.
Totally, convenience always wins. I think this is more of a hardware sales issue for Nintendo though — if what I understand is true, I'd bet that we see Switch 2 games running on other systems before we see a CFW/decrypt-encrypt stack for running pirated games on the Switch 2 itself.
Who gets the bounty money in that case? By the looks of the article, Codex did all of the work actually finding a bug. Shouldn't the money go to OpenAI?
Ah, you're right! Depends on their generosity, but I'd imagine piracy and running exclusives on non-Nintendo hardware is more of a risk to their business than a bootROM exploit.
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
I don't know. I feel like the blog reads as very human written and enjoyable overall. Also what's 2 weeks of real work (in tandem with an agent) compared to a few hours for the blog?
PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
The chances of getting banned for this are extremely high. The Switch 2 has plenty of mechanisms to detect tampering. Even if you were completely offline during the process and then reset the Switch afterward, there are logs. People have already been banned for using the MIG Switch to play backups of Switch 1 games on the Switch 2.
I wonder if this would be a reason to sue in the EU ? IIRC you can even replace the firmware without voiding the warranty, unless the manufacturer can prove the firmware cause the issue.
Here I guess you could just RMA the device or even sue Nintendo for retaliating after you just used the device you bought ?
I jailbroke my Switch 1 the day I bought it, was banned from Nintendo Online the next day. The only games I bought were physical. I was told this would happen, so it wasn’t an issue at all.
I’ve told my friends if you plan on playing online on it, definitely don’t jailbreak.
never go online and even if you reset the console afterwards , assume the console will get banned when connect to the internet as they know to look for markers of customer firmware.
Switch 1 hacks bypass this by copying ofw from flash onto the microSD card and patching it there to my crude understanding, so that unsigned code never touches the firmware on the system memory.
Something like this definitely will be needed again for the Switch 2 so I'd only do this if you don't care about being banned.
And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
Basically, since it wasn’t possible to extract the files from Switch 2 games, fans who wanted to listen to the Mario Kart World soundtrack outside of the game would record the audio output from their console and exploit glitches in-game to prevent sound effects from playing and phase-cancel overlapped recordings of the same song with each recording being interrupted in different parts to isolate the music then crossfade the remaining segments into the complete track.
Almost every console jailbreak required the use of a specific game, going all the way back to the original Xbox. PS1 and 2 required a specific disc or swapping in a legit disc. Even the NES required a real game cart alongside your third party carts.
It turns out that opening locks is a hell of a lot easier when you have a key.
Console hacking has been like that for a very long time. But usually after the first exploits are found and hackers can start playing with things, many more follow. Though Nintendo has been stripping down the OS every new console so there’s less interesting stuff to exploit outside of games.
I remember having to buy GTA Liberty City Stories to jailbreak the PSP. Then there was the infamous Cubic Ninja jailbreak which caused the game to become worth hundreds of dollars.
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.
And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.
yes at least with GKC I immediately know that game is not playable offline instead of needing to go to https://www.doesitplay.org and hope that someone already documented the game I am looking at, which is the case with PS5
They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.
Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.
options for switch1, ps5, xbox: Disc or code in box.
options for switch 2: Full game on cartridge, switch 2 edition (including switch 1 support), Game Key Card (half physical), Code in the box.
I don't see why should nintendo be blamed for providing more options. if anythng you should blame the publishers for chosing "Code in the box" (looking at you diablo) when GKC would do. or GKC when full cartridge would do.
Incredible all around.
If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).
I'm working on a IoT device at work and have been the "hands in the lab" for my agent this week. It's been a really weird experience. Making changes to the update/recovery process, so I have to validate several permutations of fault injection (i.e.: abrupt power loss during update step X while on starting version Y).
I would love to give it unattended "hands". I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug. X and Y are relatively small, and I expect this validation to be too costly to do at a regular cadence in CI. I can trivially use a MCCI USB-C switch for the power though.
Tips would be appreciated if anyone here has thoughts.
Automation wins, every single time.
Short term the argument that 'piracy exists yet doesn't affect steam sales' holds true.
Long term when someone makes emulating Switch 2 on your Steam Deck a 1-click install I'm not so sure.
The Switch 1 sold about 150m units, the Steam Deck’s sold 6m.
Internet nerds like us aren’t really Nintendo’s target market, I don’t think. Installing emulators or jailbreaking a system isn’t something most of their customer base would have the want or need to do, IMO.
Would people still go to such lengths if Nintendo just released their games for the hardware people actually have, like the SteamDeck & PC ?
Still seems rather self-enflicted pain for Intendo due to still pushing locked-down consoles in 2026.
According to wikipedia, they sold over 23 million units of the switch 2 and over 155 million of the switch. Not that I agree with their aggressive practices but it clearly works. That's a lot more than the Steam Deck btw.
Totally, convenience always wins. I think this is more of a hardware sales issue for Nintendo though — if what I understand is true, I'd bet that we see Switch 2 games running on other systems before we see a CFW/decrypt-encrypt stack for running pirated games on the Switch 2 itself.
Very unlikely to happen via emulation, there's Switch 1 games that the Steam Deck struggles to run already.
> Worth noting too that this would have easily fetched >$50k
More like $30k, no ("system processes allowing piracy")?
Who gets the bounty money in that case? By the looks of the article, Codex did all of the work actually finding a bug. Shouldn't the money go to OpenAI?
Ah, you're right! Depends on their generosity, but I'd imagine piracy and running exclusives on non-Nintendo hardware is more of a risk to their business than a bootROM exploit.
The category they list in the $50k context are PSC exploits, or TSEC coprocessor exploit when executing the secure code that bootROM provides it.
So, presumably, current and future key material compromission like on Switch 1
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
I suppose we can let AI write the entire blogpost :)
I don't know. I feel like the blog reads as very human written and enjoyable overall. Also what's 2 weeks of real work (in tandem with an agent) compared to a few hours for the blog?
this was clearly human written
PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
If one follows this and jailbreaks their Switch 2, are they in danger of getting their account banned by Nintendo, and their games unaccessible?
The chances of getting banned for this are extremely high. The Switch 2 has plenty of mechanisms to detect tampering. Even if you were completely offline during the process and then reset the Switch afterward, there are logs. People have already been banned for using the MIG Switch to play backups of Switch 1 games on the Switch 2.
I wonder if this would be a reason to sue in the EU ? IIRC you can even replace the firmware without voiding the warranty, unless the manufacturer can prove the firmware cause the issue.
Here I guess you could just RMA the device or even sue Nintendo for retaliating after you just used the device you bought ?
Also, Louis Rossmann, please buy a Switch 2, apply the exploit & go online. Thanks in advance! :D
I jailbroke my Switch 1 the day I bought it, was banned from Nintendo Online the next day. The only games I bought were physical. I was told this would happen, so it wasn’t an issue at all.
I’ve told my friends if you plan on playing online on it, definitely don’t jailbreak.
never go online and even if you reset the console afterwards , assume the console will get banned when connect to the internet as they know to look for markers of customer firmware.
Switch 1 hacks bypass this by copying ofw from flash onto the microSD card and patching it there to my crude understanding, so that unsigned code never touches the firmware on the system memory.
Something like this definitely will be needed again for the Switch 2 so I'd only do this if you don't care about being banned.
EDIT: ofw = OFW = official firmware
Not your account but the Switch. That’s how it works in Switch 1
(I'm interested in Homebrew, and I'd love to port my self made game dev framework on Switch 2, but I'm afraid of losing everything)
Definitely a risk.
The Switch 2 jailbroken with the help of a Switch Flicker. Really funny.
What SW is needed for the jailbreak to work? Is it worth trying to buy a used console now?
This works on the latest firmware, until they patch it, you can buy even new consoles that are vulnerable.
written at the top: current 23.01 version (i did get the sw2 on first day because you never know but...)
my bad, skipped the top and was looking at the bottom.
> thanks to my friends in Dabney House ...
Cool to see this happened at Caltech :)
And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
For those who don’t know: https://youtube.com/watch?v=aet8rWKs-A0
Basically, since it wasn’t possible to extract the files from Switch 2 games, fans who wanted to listen to the Mario Kart World soundtrack outside of the game would record the audio output from their console and exploit glitches in-game to prevent sound effects from playing and phase-cancel overlapped recordings of the same song with each recording being interrupted in different parts to isolate the music then crossfade the remaining segments into the complete track.
It's unfortunate that this requires a specific $25 game (SmileBASIC 4)
Almost every console jailbreak required the use of a specific game, going all the way back to the original Xbox. PS1 and 2 required a specific disc or swapping in a legit disc. Even the NES required a real game cart alongside your third party carts.
It turns out that opening locks is a hell of a lot easier when you have a key.
Console hacking has been like that for a very long time. But usually after the first exploits are found and hackers can start playing with things, many more follow. Though Nintendo has been stripping down the OS every new console so there’s less interesting stuff to exploit outside of games.
I remember having to buy GTA Liberty City Stories to jailbreak the PSP. Then there was the infamous Cubic Ninja jailbreak which caused the game to become worth hundreds of dollars.
This gives visibility to a lot more unencrypted code, so just give it time. More bugs will be found quickly now that the code is inspectable.
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.
And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.
yes at least with GKC I immediately know that game is not playable offline instead of needing to go to https://www.doesitplay.org and hope that someone already documented the game I am looking at, which is the case with PS5
They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.
Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.
options for switch1, ps5, xbox: Disc or code in box.
options for switch 2: Full game on cartridge, switch 2 edition (including switch 1 support), Game Key Card (half physical), Code in the box.
I don't see why should nintendo be blamed for providing more options. if anythng you should blame the publishers for chosing "Code in the box" (looking at you diablo) when GKC would do. or GKC when full cartridge would do.
The Nintendo cartridges contain the full playable version of the game.
Third party publishers often just put the key on it. So blame them for that