Abstract:
Nintendo recently released the Switch 2 system firmware 23.5.0 update, which fixes key operating system vulnerabilities previously exploited by crackers, making the software cracking solution implemented for the first time on this new console basically ineffective. In less than three weeks since the cracking method was made public, Nintendo has blocked the relevant loopholes through system updates, dealing a major blow to the Switch 2 homebrew and game modification community.
This crack was originally implemented by developer Sammy Hajhamid (screen name pepsipu) and named ns2jb. Different from the past cracking methods that required dismantling the machine, welding special chips or using hardware modification equipment, this solution is completely based on software vulnerabilities, using SmileBASIC 4, a game on Nintendo Switch 2, as an entry point to break through the original security restrictions of the system.
This vulnerability was first disclosed in late October 2026. The developer used OpenAI's Codex programming tool to assist in analysis and development, and finally realized the execution of native code not authorized by Nintendo on Switch 2. This means users can run homebrew software, back up game saves, analyze game data, and even modify internal game content.
In order to demonstrate the cracking ability, the developers modified "Mario Kart World" and added characters that did not originally exist in the game, including Big-Eared Dog, Peter Griffin, Hatsune Miku, etc. The relevant demonstration video has attracted widespread attention in the game cracking community, and also proves that the software security mechanism of Switch 2 has a breakthrough that can be actually exploited.
However, this cracking solution is not a permanent crack. It is a temporary cracking method that needs to be retriggered. Every time the host is completely shut down, it needs to be activated again through the game entrance. At the same time, Nintendo removed SmileBASIC 4 from the eShop shortly after the cracking news was made public, making it difficult for users who have not purchased the software to obtain the entrance needed to crack it.
This firmware 23.5.0 update further blocks the vulnerability from the system level. Security researcher OatmealDome confirmed on social media that the new version has fixed the operating system vulnerability that the crack relies on. Although the code execution entrance inside games such as SmileBASIC 4 and "Civilization VII" still exists, users can no longer break through from the game running environment to the entire operating system as before.
This means that even if users can still run some custom code in the relevant game, their permissions are limited to the game's own running environment and can no longer access the deeper system functions of the host. The ability to extract game data, system-level modifications, and run homebrew software previously implemented through ns2jb is therefore severely limited.
However, this update does not completely eliminate all possible ways to extract game data from Switch 2. SwitchTools, a member of the cracking community, specifically clarified that 23.5.0 does not introduce new master keys. Therefore, for some games released on traditional physical cartridges, existing technology may still allow the extraction of relevant data.
What is really affected are digital versions of games, game updates and DLC content. This content often requires access to Nintendo's online services and relies on system-level permissions to complete the relevant data extraction. As for the Game-Key Card, since the cartridge itself does not contain complete game data, the extraction method of traditional physical cartridges cannot be simply applied.
Game files that have been extracted before the update will not disappear automatically when the console firmware is upgraded. In other words, Nintendo's fix is mainly to prevent users from continuing to exploit the original vulnerability to gain new system-level access rights, rather than retroactively deleting previously extracted data.
In addition to fixing bugs, 23.5.0 also brings some functional improvements for ordinary users. The new version adds the option to configure accessibility features on first launch and provides underlying support for gifting eShop digital goods between members of a Nintendo Account family group. This digital gift feature is expected to be officially launched via an eShop update on November 17.
It is worth noting that the official update notes released by Nintendo do not directly mention cracking vulnerability fixes, but generally state that system adjustments and stability improvements have been made. This practice is not uncommon when game console manufacturers fix security vulnerabilities and avoid disclosing the technical details of the vulnerability in official update logs.
Judging from the current situation, 23.5.0 is an obvious setback for the Switch 2 cracking community, but it does not mean that new cracking methods will not be possible in the future. As researchers continue to analyze console hardware, operating systems, and gaming software, new vulnerabilities may still be discovered. However, Nintendo's rapid blocking of system-level vulnerabilities also shows that the company is actively strengthening the security protection of new consoles.
For users who wish to use homebrew software, run game modification programs or extract game data, 23.5.0 has changed the previous cracking environment. Hosts that have not yet been upgraded may still retain the original cracking conditions, and after upgrading to the new version, the existing ns2jb solution cannot continue to achieve the original system-level functions.
Comments