Breaking the Switch 2: The `ns2jb` Exploit

Author: Sammy Hajhamid
Date: October 18, 2026
Target Firmware: 23.0.1

🚀 Introduction

The ns2jb tool represents a software-based, tethered jailbreak specifically designed for the Switch 2. By leveraging this exploit, users can execute arbitrary native code within the context of standard sysmodules, as well as the critical fs (filesystem) sysmodule.

What does this enable?

Running custom homebrew applications.
Modifying and reverse-engineering Switch 2 exclusive titles.
Extracting save files for external backup.
Directly interacting with Switch 2 hardware peripherals via MMIO.

To the best of my knowledge, this is the inaugural exploit of its kind for the Switch 2 hardware.

To prove the efficacy of ns2jb, the developer Codex successfully modded Mario Kart World (a Switch 2 exclusive). With help from friends at Dabney House for playtesting and character selection, they added several custom racers.

Added Character	Status
Cinnamoroll	✅ Added
Red	✅ Added
Tole Tole	✅ Added

Media Gallery:

[First Gameplay Clip] $\rightarrow$ 0:09
[Second Gameplay Clip] $\rightarrow$ 0:05
Photos: [Result 1], [Result 2]

🛠️ The Hardware Setup

To streamline the process, a physical harness was constructed around both a Switch 1 and a Switch 2. The goal was to allow Codex to operate independently.

~~"set a goal to jailbreak the switch 2. make no mistakes"~~ (Note: I did not actually use this exact prompt; I set a goal for userland code execution, though that specific attempt failed. The Mario Kart mod was "vibecoded" in a single day for amusement.)

The Rig Components:

JetKVMs: Used to relay USB controller inputs and capture HDMI video output.
Bluetooth Light Switch (Amazon): A mechanical workaround to trigger the power button.
Lever Mechanism: Once the button is depressed, the lever's torque resets the system.

💻 Achieving Code Execution

Path A: The WebKit Attempt

Naturally, the browser was the first target. Codex attempted a "native control-flow hijack" using a WebKit n-day delivered via a fake Wi-Fi captive portal.

However, this path hit several walls:

XOM (Execute-Only Memory): Even with read/write access, finding gadgets for arbitrary IPC calls is nearly impossible.
PAC (Pointer Authentication Code): Constructing signed pointers is difficult without a specific signing gadget.
CFI (Control-Flow Integrity): Most call sites are type-checked, blocking unauthorized jumps.

Verdict: It's a long shot. Given the Nintendo BBP rewards, many have likely tried and failed here.

Path B: The `smilehax2` Approach

The strategy shifted toward Switch 1 games because:

They are developed by third parties.
They lack the modern protections of the Switch 2 (e.g., $\text{PAC} = \text{False}$ ).
The Switch 1 root of trust is already compromised, allowing for code decryption.

The goal was to find a Switch 1 game with an embedded browser (similar to an Electron app) to trigger an RCE. While some findings remain private, the breakthrough came from SmileBASIC. Since smilehax previously pwned the 3DS, it was a prime candidate for a new vulnerability.

The Vulnerability: Integer Overflow Codex discovered a 32-bit integer overflow in the BASIC interpreter's array removal logic. The system checked: $\text{position} + \text{count} = \text{array.length}$

If the sum wraps around, it becomes negative, bypassing the length check. The subsequent memmove operation looks like this:

memmove( 
    backing + position * 8,            // Start of gap
    backing + (position + count) * 8,  // Elements after gap
    (length - position) * 8            // Bytes to copy
);

The Exploit Scenario: If we have a string array $R$ of length 4 and execute REMOVE R, H60000000, H3FFFFFFF:

The values wrap, resulting in memmove(backing, backing - 8, 32).
This pulls the 8 bytes immediately preceding the array (which happen to be the pointer to the array itself) into the array.
The system throws an "Out of memory" error, but the memory corruption has already occurred.

Because the pointer is now treated as the length of $R[0]$ , the string length becomes massive, granting Out-of-Bounds (OOB) read/write capabilities.

🔑 Escalating to Sysmodule RW

The final step was moving from userspace to a privileged process. The targets were:

Ordinary Sysmodules
Built-in Sysmodules (specifically the fs module)

Codex investigated several services based on historical bug patterns:

audio and ldn (known for previous Switch 2 bugs).
NV service (GPU drivers are typically high-value targets).

The fs sysmodule... (Article ends here)

Breaking the Switch 2: The `ns2jb` Exploit

Author: Sammy Hajhamid
Date: October 18, 2026
Target Firmware: 23.0.1

🚀 Introduction

What does this enable?

Running custom homebrew applications.
Modifying and reverse-engineering Switch 2 exclusive titles.
Extracting save files for external backup.
Directly interacting with Switch 2 hardware peripherals via MMIO.

To the best of my knowledge, this is the inaugural exploit of its kind for the Switch 2 hardware.

Added Character	Status
Cinnamoroll	✅ Added
Red	✅ Added
Tole Tole	✅ Added

Media Gallery:

[First Gameplay Clip] $\rightarrow$ 0:09
[Second Gameplay Clip] $\rightarrow$ 0:05
Photos: [Result 1], [Result 2]

🛠️ The Hardware Setup

To streamline the process, a physical harness was constructed around both a Switch 1 and a Switch 2. The goal was to allow Codex to operate independently.

The Rig Components:

JetKVMs: Used to relay USB controller inputs and capture HDMI video output.
Bluetooth Light Switch (Amazon): A mechanical workaround to trigger the power button.
Lever Mechanism: Once the button is depressed, the lever's torque resets the system.

💻 Achieving Code Execution

Path A: The WebKit Attempt

Naturally, the browser was the first target. Codex attempted a "native control-flow hijack" using a WebKit n-day delivered via a fake Wi-Fi captive portal.

However, this path hit several walls:

XOM (Execute-Only Memory): Even with read/write access, finding gadgets for arbitrary IPC calls is nearly impossible.
PAC (Pointer Authentication Code): Constructing signed pointers is difficult without a specific signing gadget.
CFI (Control-Flow Integrity): Most call sites are type-checked, blocking unauthorized jumps.

Verdict: It's a long shot. Given the Nintendo BBP rewards, many have likely tried and failed here.

Path B: The `smilehax2` Approach

The strategy shifted toward Switch 1 games because:

They are developed by third parties.
They lack the modern protections of the Switch 2 (e.g., $\text{PAC} = \text{False}$ ).
The Switch 1 root of trust is already compromised, allowing for code decryption.

If the sum wraps around, it becomes negative, bypassing the length check. The subsequent memmove operation looks like this:

memmove( 
    backing + position * 8,            // Start of gap
    backing + (position + count) * 8,  // Elements after gap
    (length - position) * 8            // Bytes to copy
);

The Exploit Scenario: If we have a string array $R$ of length 4 and execute REMOVE R, H60000000, H3FFFFFFF:

The values wrap, resulting in memmove(backing, backing - 8, 32).
This pulls the 8 bytes immediately preceding the array (which happen to be the pointer to the array itself) into the array.
The system throws an "Out of memory" error, but the memory corruption has already occurred.

Because the pointer is now treated as the length of $R[0]$ , the string length becomes massive, granting Out-of-Bounds (OOB) read/write capabilities.

🔑 Escalating to Sysmodule RW

The final step was moving from userspace to a privileged process. The targets were:

Ordinary Sysmodules
Built-in Sysmodules (specifically the fs module)

Codex investigated several services based on historical bug patterns:

audio and ldn (known for previous Switch 2 bugs).
NV service (GPU drivers are typically high-value targets).

The fs sysmodule... (Article ends here)

Jailbreaking the Switch 2

Breaking the Switch 2: The `ns2jb` Exploit

🚀 Introduction

🛠️ The Hardware Setup

💻 Achieving Code Execution

Path A: The WebKit Attempt

Path B: The `smilehax2` Approach

🔑 Escalating to Sysmodule RW

Jailbreaking the Switch 2

Breaking the Switch 2: The `ns2jb` Exploit

🚀 Introduction

🛠️ The Hardware Setup

💻 Achieving Code Execution

Path A: The WebKit Attempt

Path B: The `smilehax2` Approach

🔑 Escalating to Sysmodule RW

Breaking the Switch 2: The ns2jb Exploit

🚀 Introduction

🛠️ The Hardware Setup

💻 Achieving Code Execution

Path A: The WebKit Attempt

Path B: The smilehax2 Approach

🔑 Escalating to Sysmodule RW

Breaking the Switch 2: The ns2jb Exploit

🚀 Introduction

🛠️ The Hardware Setup

💻 Achieving Code Execution

Path A: The WebKit Attempt

Path B: The smilehax2 Approach

🔑 Escalating to Sysmodule RW

Breaking the Switch 2: The `ns2jb` Exploit

Path B: The `smilehax2` Approach

Breaking the Switch 2: The `ns2jb` Exploit

Path B: The `smilehax2` Approach