Switch 2 jailbreak: new entry point found, WebKit exploit on hold

The Switch 2 browser exploit has been put on hold, and a second way into the console has been announced. Alongside that, Nintendo has reportedly pulled a free demo in Japan, and a new homebrew launcher that can run real game ports is out. Things are moving fast, so I'll skip what I've already covered and start with the bad news.

The Switch 2 WebKit exploit is on hold until further notice

PepsiPo, the developer behind the first Switch 2 jailbreak, wrote on Discord that he won't be able to release his WebKit exploit until further notice. That's very sad. WebKit is the browser engine inside the Switch 2, and that exploit was supposed to be the gateway for people who never got SmileBASIC 4.

When someone asked whether Nintendo was involved, PepsiPo said he couldn't give any details. He also said he hopes to release what he has, in one form or another, in the future. A moderator in the Switch 2 hacking Discord then wrote that Nintendo was the one who stopped it. That's the moderator's conclusion. PepsiPo himself hasn't given a reason.

The timing matters. Several developers say the browser route stops being useful as soon as Nintendo releases new firmware. Around 24 hours after that, consoles are blocked from opening the browser. That's exactly the trick I explained before.

Why WebKit bugs are easy to find but hard to exploit on Switch 2

There's an interesting detail from a veteran hacker who has been around since the Switch 1 days. He wrote that WebKit bugs aren't hard to find, and that he has small proofs of concept for four or five public bugs that still work on firmware 23.0.0.

The hard part is turning a bug into a full exploit. On the Switch 2, two security features called CFI and PAC make each exploit chain specific to a single firmware version. So a browser exploit that works everywhere is much harder than it sounds.

Seedsow Lullaby and the Artemis engine open a second Switch 2 entry point

Now the most important news. The team behind the Switch 2 hacking Discord announced a new entry point. An entry point is the first door into the console. SmileBASIC 4 was the first door, and this is the second.

This door uses the Artemis engine, a game engine used by many visual novels that saves games as small Lua scripts. Lua is a simple programming language. In short, if you can change the save file, you can change what the game runs when it loads. The same kind of Artemis exploit has already been used on the PlayStation side, and now it's the Switch 2's turn, through a game called Seedsow Lullaby.

The announcement credits Alula and a second developer. It says SmileBASIC 4 isn't required, and notes that the filesystem exploit hasn't been tested on this route yet, though it's strongly believed it will work. The filesystem exploit is the part that gives real access, the step people know as 2.0.4 in SmileBASIC. A staff member explained that this route gives the same level of access as SmileBASIC, and that you only need the free demo.

The catch: moving the save needs a modded Switch 1

Here's the obstacle. To get the modified save file onto a Switch 2, the documented method requires a modded Switch 1. The save is moved with Nintendo's own data transfer feature, so both consoles need the same Nintendo Account, an internet connection for the transfer, and the latest firmware. That means banned Switch 1 consoles won't work either.

That last requirement is why some people have updated their consoles recently. To be fair, it's a trade off: they updated so they could do the transfer. The people working on this are also careful about what has actually been achieved. One researcher wrote that the Seedsow route already gives full code execution under firmware 22.0.0, but added that it's similar to the first stage of SmileBASIC and that there's no filesystem access through it yet.

Another developer wrote that the filesystem part is in development and will probably come out early the following week, if things go smoothly, of course. So for now the door exists, but the tool that will help you walk through it isn't out. The announcement says the bootstrapper is still being built. Not everyone is impressed, either. The developer who released his own exploit wrote that he never recommended buying any Artemis games, and called it a waste of money.

Nintendo reportedly pulled the Seedsow Lullaby demo from the Japanese eShop

Just a few hours before that announcement, the Switch 2 hacking team posted that Nintendo had removed the Seedsow Lullaby demo from the Japanese eShop. Another member confirmed it had been taken down there.

I couldn't check the Japanese store myself, and the game is still listed on Nintendo's store pages in other regions such as Europe. But if this sounds familiar, it should. SmileBASIC 4 disappeared from the eShop right after the first jailbreak too.

Don't give your Nintendo Account password to strangers on Discord

This is something I really want to warn you about. In that Discord server, people are describing a remote way to get the save file for anyone who doesn't own a Switch 1. You buy the full game, pay for Nintendo Switch Online, and give a stranger on Discord your email address and your Nintendo Account password.

Please don't hand your login details to anyone, no matter what they promise you. That's your account, your purchases and possibly your payment details. What you could do is create a separate account you don't need, with an email address you don't need, and do everything through that. That's another option, but never use your main email.

RavensClawX's HB Launcher runs native homebrew with Vulkan graphics

Now for the good news. RavensClawX has released his new homebrew launcher, called HB Launcher, and it comes with source code and a developer toolkit. The important part is that apps run as native code with a proper app interface and Vulkan graphics. Vulkan is the graphics system modern games use, so this opens the door to bigger homebrew such as game ports and emulators.

It still needs a basic underlying exploit, a modified version from another developer, and it requires four full successful attempts before it starts. Remember the Twilight Princess and Animal Crossing clips I covered before? At the time I said there was no code. Now there is, and both are on GitHub. Twilight Princess is based on a fan made PC version, and Animal Crossing is based on the PC version of the GameCube game. Both need your own disc image, and no game files are included.

He has also published a script that restarts the exploit automatically when it fails. With the exploit failing as often as it does, that's a big deal. Separately, another homebrew developer posted that their Switch 2 homebrew now has SD card access. There's no code or detail in that post yet, so I'm treating it as just a claim for now.

Eden emulator and Switch 2 games: a draft pull request, not confirmation

Moving on to emulation, a user on X posted that the Switch emulator Eden will accept patches for Switch 2 games. Here's what I actually found. There's a pull request on Eden described as a work in progress, experimental Switch 2 build. It's from a first time contributor, it's still a draft, and it hasn't been merged. I couldn't find any maintainer confirming it will be accepted.

In that pull request and on Discord, users say Pokkén Tournament runs with a patch at around 30 to 40 frames per second. There's also a clip of Pokkén Tournament running on a hacked PS5, which is definitely wild. And of course someone replied to an emulation clip saying it looks terrible. Look, it's a Switch 2 game on an emulator only a week after the first jailbreak. It's natural for it to look unfinished.

Also, Tears of the Kingdom now runs natively on PC, according to a post with nearly 40,000 views. That's a Switch 1 game rebuilt for PC, not a Switch 2 hack, but it shows how fast these recompilation projects are moving. One reminder on all of this was put best by a regular in the ReSwitched Discord: assume any download of a specific emulator is fake, because plenty of people want to get you to run malware.

AI brute forced the Switch 2 filesystem exploit, and an Atmosphere fork has started

How was the filesystem exploit found in the first place? This one blew my mind. The veteran hacker I mentioned above explained that the AI used in the research brute forced combinations of system calls and memory positions until it found a valid one. He said it wasn't reasonable for a human to do that work.

Second, Alula has started a fork of Atmosphere for the Switch 2. Atmosphere is the custom firmware for the Switch 1, if you didn't know. These are only early experiments on a derivative version, not custom firmware you can install. But it's a signal of where some developers are heading.

Nintendo's lawyers are busy, and the latest firmware is still 23.0.1

Nintendo's lawyers are busy too. This year has seen wide takedowns of Switch emulator repositories on GitHub, and there are reports of new takedown notices. I didn't find any notices aimed at the Switch 2 exploit projects themselves.

As of now, the latest firmware is still 23.0.1. So the real question is what comes first: the filesystem release and a new Nintendo firmware, or the return of the WebKit exploit.