The first Switch 2 jailbreak starts inside SmileBASIC, a Switch 1 game (pepsipu.com)
A 32-bit integer overflow in SmileBASIC's array REMOVE handling gives memory read and write on the Switch 1, where there is no pointer authentication. A path-normalization overflow then reaches the filesystem service.
The exploit is tethered, runs on firmware 23.0.1, and took about two weeks of real work.
Sign in to save