Switch 2 Deltarune files reportedly extracted as jailbreak research moves fast

Switch 2 Deltarune files have reportedly been dumped, only a couple of days after the first public software jailbreak for the console appeared. In barely a day, things went from that NS2JB jailbreak to homebrew launcher demonstrations. Since then there have been reports of game files being extracted, Doom running through homebrew, development tools being released, and Nintendo apparently contacting one of the researchers. Some of this is much bigger than I originally thought.

The story I think matters most technically is a detailed assessment of how powerful the file system exploit behind all of this is. There are important limits, though.

The Switch 2 Deltarune files are reportedly extracted, not a confirmed full game

An account posted that the Nintendo Switch 2 version of Deltarune has been dumped. The post specifically mentions the initial release containing chapters 1 through 4, and it points to a conversation in a Discord server. The Switch 2 hacking community has been going crazy over it, because this is software from Nintendo's newest console and the first public software jailbreak only appeared a couple of days ago.

The evidence circulating so far does not establish that somebody has released a complete, playable Switch 2 game image. People looking at the screenshots have pointed out that some of the files appear to be difference files, meaning changes between the original Switch version and the Switch 2 version. That's not necessarily the same thing as dumping an entire game from start to finish. Right now, the accurate headline is that Switch 2 Deltarune files have reportedly been extracted. The exact contents, and how complete that extraction is, still need to be confirmed.

This also doesn't mean you can suddenly download Switch 2 games, put them into an emulator and start playing. You would still need compatible software capable of running them, and obtaining game files is a completely different problem from building a working emulator. Even without a full game dump, though, being able to extract and inspect files from Switch 2 titles could be extremely valuable for developers.

hexkyz says the NS2JB exploit effectively gives researchers full control of Switch 2 userland

Security researcher hexkyz has shared a detailed assessment of the file system vulnerability used by NS2JB. After reading through it, I think many people are underestimating what the researcher behind the exploit achieved.

According to hexkyz, the underlying file system bug wasn't even completely new. Researchers already knew about it, and information relating to the bug had made its way into Atmosphère related work a long time ago. But knowing a vulnerability exists and turning it into a reliable exploit are two completely different things. The difficult part was manipulating how memory is organized inside the file system module, and hexkyz explains that previous attempts had trouble finding useful objects in the right places. The NS2JB developer overcame that through a complicated technique called heap grooming, with assistance from AI tools.

Once the exploit had arbitrary memory read and write inside the file system process, it could be used to gain much more powerful control of that part of the operating system. hexkyz describes the result as effectively giving researchers full control of Switch 2 userland. That does not mean the entire console has been unlocked. It means access that can help researchers extract and analyze executable code from games, applications and many system modules. They can study how software interacts with Nintendo's operating system, investigate how individual components work, and potentially build tools for modifying games or inspecting their data. This goes way beyond running a little piece of custom code inside SmileBASIC, and it's why the original Mario Kart World modifications were such an important demonstration.

Modifying the file system module could expose decrypted game assets

Another technical detail I found particularly interesting came from a developer in the GBAtemp discussion. They explained that Nintendo's file system module normally checks whether an application is allowed to mount another game's RomFS, which is where a game's read only assets are stored. If a researcher can modify the file system module itself, those checks could potentially be bypassed.

That would allow the console to provide decrypted game assets through its own file system services. Instead of looking at encrypted packages nobody can understand, developers could potentially inspect actual game resources and executable code. That's a huge step for reverse engineering, modding and understanding how Switch 2 software works, and it helps explain why we're suddenly hearing about game file extraction.

File system access does not mean encryption keys or kernel access

There is a very important limit here. hexkyz specifically says that file system access does not give researchers Nintendo's encryption keys, and it does not automatically give them kernel access. So when somebody online says the Switch 2 is now completely unlocked, or that full Atmosphère custom firmware is basically finished, that's not what the evidence supports.

In fact, hexkyz says compromising the file system module doesn't necessarily make exploiting the kernel any easier. It's already one of the most powerful components researchers can control within userland, but getting above that level is a separate challenge. The access is much more powerful than many people realize, but we still don't have a confirmed public Switch 2 kernel exploit from this research.

The flaw isn't exclusive to SmileBASIC, and other entry points are being researched

Because the vulnerability exists in the file system service itself, it's not exclusive to SmileBASIC. SmileBASIC is just the entry point used in the publicly released NS2JB exploit chain. hexkyz explains that other suitable entry points could theoretically reach the same vulnerability, whether that's a Switch 1 game, a Switch 2 game or potentially even a browser. Somebody still has to find or build those entry points, so you can't launch any random game and expect the exploit to work. But it means the file system weakness is more broadly relevant than one programming application.

That leads into another development. One developer has been demonstrating research involving games built with the Atmosphere visual novel engine, and people in the community have identified several potentially compatible game demos. What's interesting about this approach is the possibility of triggering code through modified game save data, potentially making the entry process more convenient than the current SmileBASIC setup. Some people are already discussing moving modified saves from a hacked original Switch over to the Switch 2.

To be very clear, the complete method and its exact requirements have not been independently established through a finished public release that everybody can reproduce. A game using the Atmosphere engine doesn't mean buying it today guarantees you a jailbreak later. Please don't start spending money or updating your console based on speculation.

This is also separate from another researcher's work on a possible entry point involving a physical game cartridge. He hasn't publicly revealed the exact game or released that exploit chain. If that approach eventually works, it could provide another way into the console without depending on SmileBASIC being available on the eShop. For now, it's still research, not something you can install.

Doom is already running on the Switch 2 through homebrew

On a more fun note, somebody has already got Doom running on the Switch 2 through a homebrew demonstration. A developer posted his own version of the original Doom running on Nintendo's latest console. If something has a screen, somebody will get Doom running on it, and I love that this is one of the first things people are trying.

The developer has also hinted that he's gone further than what was shown in the initial demonstration. Until there's a public technical explanation or a reproducible release, I'm not going to treat that as proof of some secret new jailbreak. For now, it's an interesting demonstration of what people are experimenting with only a couple of days after NS2JB became public.

A homebrew launcher's source code, SDK and FTP tool are now public

The homebrew launcher I covered before has received a major update. The developer who demonstrated that homebrew style menu has now published the project on GitHub. The repository includes source code, SDK documentation and even a Hello World example, so other developers can start building their own applications.

The SDK already supports some surprisingly interesting features, including controller input, motion controls, touchscreen integration and even the Joy-Con 2's mouse functionality. It also documents vibration controls, limited NFC functionality and communication over the network. This is no longer somebody showing a nice looking menu. There's real code other developers can inspect and experiment with.

There's an important catch. This launcher is not a conventional native Switch homebrew loader. It uses SmileBASIC and runs application logic through GPU compute shaders, with a computer helping provide the application environment. It doesn't let you take old Switch homebrew applications and run them directly on the Switch 2, and it's not custom firmware. Still, it's a creative way of building a homebrew environment with the tools currently available.

There's already an application made for it: the same developer has released an FTP server, so you can connect from your computer using an FTP client and transfer certain files to and from the console. That's cool this early into the scene, but it does not give you access to the entire Switch 2 file system. According to its documentation, you can read and write files in SmileBASIC's save and temporary storage and read files from SmileBASIC's own RomFS. You cannot browse every installed game, download other game saves or manage the whole SD card. A second launcher project from the developer behind the Doom demonstration also has a GitHub repository, but it still says coming soon and in development, so there isn't a finished public version to install yet.

New setup tools make NS2JB easier, not more powerful

Developers are also trying to make the original NS2JB setup easier. There are now tools that can use a compatible Apple silicon Mac as a USB keyboard, and others that let a homebrew enabled original Switch act as a keyboard for the Switch 2, along with community experiments with other hardware. These are very useful, but they're solving the setup problem. They're not separate kernel exploits and don't automatically give the console new permissions.

Nintendo has reportedly contacted a researcher, and one console was reportedly damaged

Things take a more serious turn here. The researcher working on the cartridge entry point posted that he received an email from Nintendo, and the timing has caught people's attention. Before anyone starts saying Nintendo is suing developers or sending cease and desist letters, we need to be careful. He hasn't publicly established what was written in that message. It could be a number of things, and I'm not going to pretend we know more than we do. What we can say is that he has publicly stated Nintendo contacted him, and that's another development worth following.

There's also a worrying report about somebody apparently breaking their Switch 2 while experimenting with a modified version of the exploit. Some people are claiming the console's internal storage was damaged or erased, but I haven't seen enough independent evidence to confirm the exact cause or whether the console is permanently unrecoverable, so I'm not treating it as a proven technical discovery. What it does remind us is that these are experimental tools interacting with important system components. Being able to modify privileged file system behavior doesn't mean it's safe for everybody to test random scripts on their main console, and a console failing to boot does not prove a permanent jailbreak has been achieved.

A permanent jailbreak might theoretically be possible, but don't rush firmware decisions

hexkyz says it might theoretically be possible to make this exploit untethered, meaning it could be triggered without going through the same setup every time you restart the console. One possible direction involves manipulating system save data and getting the exploit to trigger during startup. The problem is that making that memory manipulation work reliably at boot is a completely different challenge, and hexkyz makes it clear it might not even be possible with the current approach. This is a potential research direction, not confirmation that anyone has a permanent jailbreak.

The public NS2JB exploit has been demonstrated on firmware 23.0.1, but that doesn't mean everybody should immediately update to it. hexkyz points out that older firmware may have fewer security mitigations and other vulnerabilities that haven't been publicly disclosed. The researcher working on the cartridge approach has also warned people not to update older consoles solely to obtain SmileBASIC. If you're keeping a Switch 2 on older firmware for future homebrew research, don't make a rushed decision because of a few exciting posts.

Other experienced developers have also started showing interest in investigating the Switch 2, while more community projects, guides and hardware helpers are appearing. That's encouraging, because more people working on a problem can lead to useful discoveries. But an experienced developer announcing interest is not the same as announcing a new exploit. Every release has to be judged by what it demonstrates.

The real progress is turning access into research and working software

After a couple of days, there's a public software only exploit that reaches the powerful file system module, researchers explaining how that access could extract executable code and potentially decrypted game assets, the Deltarune file dump claim, Doom in a homebrew demonstration, public launcher code with an SDK and FTP utility, more entry point research, and Nintendo reportedly contacting one of the developers. That is an incredible amount of activity in a very short time.

We still don't have a confirmed public kernel exploit from NS2JB, a complete Atmosphère release for Switch 2, or an easy permanent jailbreak everyone can install, and the reported Deltarune extraction should not be confused with a publicly verified, complete and playable game dump. Still, I think the most exciting part is that we're finally starting to understand what developers can do with this level of access: not just showing that a jailbreak exists, but turning that access into real research and working software. I definitely want to try some of these tools on my own Switch 2 when there's a practical and reliable way to do it.