Hacking News
We apparently have a game dump of a Switch 2 Commercial game
From what I could deduce from the tweet, despite being only an Userland bug (not a full hack), he has now access to a decrypted game code, and might be able to study it line by line to find how the PAC (Pointer Authentication Codes) is read in each game. This is huge news. What do you guys think of this?
Hi everyone, i am trying to become more up-to-date on the Nintendo Switch 2 hacking developments, keeping track of the Switch 2 hacking timeline from release to present day. I've kind of missed a lot this year though. If you've been keeping track of all the hacking news, please reach out to me! Userland hacks/bugs like in this post, noteworthy developments, anything from the start of the year 2026 to now, if you think it's interesting i want to hear about it. You can contact me through the r/switch2hacks Discord server, just send me a DM. Thanks!
They replied saying that they can dump game files, but don't want to. Honestly I hope they publicise this or someone else finds it so we can get proper music dumps.
If you look at Nintendo's HackerOne page, some reports are marked as "duplicate"; that means Nintendo actually pays out even if two people found the same bug.
The fact that the report got publicly disclosed even though it was a duplicate doesn't mean a reporter got paid out... just take a look of the timeline of the report, you won't see "XXX awarded XXX with a bounty.", which you can see on proper, valid, non-duplicate, disclosed reports.
Nintendo isn't a charity.
i mean tbf the switch 2 is also a pre existing architecture. it's just that all hardware is so obscenely expensive that it isnt really viable for us to get anything,
the switch 2 is afaik the cheapest entry to that architecture atm, unless you can catch a cruise missle since apparantly it's somewhat the same architecture lol,
I heard one of the newer AI models found a bunch of zero day hacks in Microsoft and other programs ; is there conceptually people attempting that now with the switch 2
Not really, those AI analyses work because they have the software to analyse. For Switch 2 we don't even have game dumps (or if we do, it's encrypted dumps, and even AI can't brute-force the level of strong encryption the Switch 2 has) let alone system dumps.
If they haven't managed to do anything with the original Switch (which lacks PAC) over all these years, why do you think they'll manage to do something with the Switch 2? Let me know when the Switch 1 v2 can be hacked without a modchip—that’s when a discussion about hacking the Switch 2 might be worth having. Basically, there's a lot of talk, but they can't even hack the Switch 1 without a modchip, lol. (basically they haven't been able to beat Horizon OS on Switch 1 which is much less secure than the one on Switch 2 lol)
Honestly, even if the switch 2 doesn't get hacked, as a CS student, just seeing the offensive security techniques applied in jailbreaking a console is cool enough
Think of it like this. Gezine made the Switch itself take the game's code (the 1s and 0s) and turn it into a super fast video of flashing colored boxes, kind of like giant, rapid-fire QR codes. The Switch sent this video out through the HDMI cable thinking it was just the game visual output instead of the actual raw code, and the capture card simply recorded it like a normal, but weird-looking, gameplay video. Since gezine made the rules for the colors (for example, knowing that a red pixel means '1' and a blue pixel means '0'), he just ran a program on his PC that watched the recorded video, translated the colors back into 1s and 0s, and rebuilt the game's code piece by piece.
All data in a computer is represented by bits, meaning everything is 1s and 0s, and all formats do are give purpose to these 1s and 0s. So all he did is pass those 1s and 0s in the exact same order through HDMI and wrote it back out on his computer. It's the same as being able to copy a handwritten letter in a foreign language without understanding what it means.
Ah in that case, Gezine seems to have an userland hack through a specific game, and I believe he's only able to access the files of this specific game, though that's pure speculation. By having access to the userland he was able to write a program that could take the contents of the RAM (possibly even just directly accessing the filesystem for this game), and serialize it into this video-compatible format.
That would be huge if true since that game is one of the few that utilises a lot of the features of the switch 2. This would hugely help emulation development.
Yeah but Gezine mentioned that a vulnerability in that specific game let him hack it. So it would be funny if the only rom that could be dumped was welcome tour. So you would end up with an emulator and the only rom is welcome tour. Only speculation anyway but was just a funny idea to me
Ah I did a little digging around, and it seems like he save transferred a vulnerable game to switch 2 to perform this? I did study computer security but this is mind-blowing. I can't fathom how someone just figures out how to write code to extract RAM or game files like that
basicamente funciona assim, todo código no computador tem a sua representação em hexadecimal, digamos assembly x86:
JMP
Short Jump código hexa: EB
(seguido de 1 byte de deslocamento relativo)
Near Jump código hexa: E9
(seguido de 32 bits)
JNZ
Short Jump código hexa: 75
(vai até 127 bytes)
Near Jump código hexa 0F 85
(seguido de 4 bytes de deslocamento relativo)
O que eu quero dizer com isso: não obrigatoriamente eu preciso abrir um executável x86 em um disassembler/debugger/depurador, entendendo bem de hexadecimal eu poderia escrever diretamente no arquivo do disco.
Então em um cenário que você tem uma brecha de um save game e consegue abrir um mini editor hexadecimal já é o caminho para começar a "fuçar", você executa o jogo, o jogo abre, vc modifica algo, você executa o jogo novamente o jogo lê um arquivo do disco, você vai lá e edita novamente, você executa o jogo novamente e agora o arquivo que o jogo abre é o transportador de dados via HDMI, e assim vai indo, a engenharia reversa exige paciência, intuição e persistência (além do estudo e conhecimento sobre o assunto que nunca é 100% - sempre tem algo novo).
Something like QR coded but more avanced and a lot of them. There are some apps that let transfer files from phones this way and store large files as YouTube vídeos
Pretty much. Tell it to do a full dump of the cart and it will. This mainly works better on titles that are Switch 1 compatible from what I've seen so far but there's already floods of backups verified for S2 content including full games and I have managed to backup my copy of Animal Crossing S2 edition and Breathe of the Wild too.
This mainly works better on titles that are Switch 1 compatible from what I've seen so far
I have managed to backup my copy of Animal Crossing S2 edition and Breathe of the Wild too.
Probably because the Switch 2 Edition carts can still be run on Switch 1 systems. Switch 2 only cartridges haven't been dumped as far as I know, but it won't hurt to test it out.
Don't know why you were downvoted for this. This is likely the answer and OP didn't differentiate between Switch 2 games (can't be run on Switch) and Switch 2 Edition games (can be run on Switch).
If this is true, and I'm skeptical, this would be some of the craziest shit that has ever happened. I've never even heard of using an HDMI cable like that.
Think of it like a morse code. I mean not literally, but it's probably in that realm. Certain patterns being flashed, and then converted into code on the computer.
there are some videos on yt and some posts on diffent forums about him and he does make some crazy jailbreaks sometimes, the current blueray ps5 jailbreak for firmware 13.42 was made by him, i recommend reading about jailbreaks he have done
It's crazy how some of these things work like this.
WiiHDMI mods can update their firmware the same way. You can also dump Saturn save files using a homebrew that plays audio, and have a Linux PC listening via line in with a modem package.
You can also dump GameBoy saves and ROMs this way, using a GameBoy Colour, a flash cart, and GameBoy Audio Dumper! I used this to get my GameBoy Camera pics onto my computer, where I could then load the save in an emulator and capture high-quality PNG versions of the photos.
not that crazy with digital video output, little crazier with analog video output. you can cram practically whatever data into digital video you want analog is a lot more iffy (audio passed over 3.5mm is analog for the record)
Being able to dump code doesnt automatically mean It’s decrypted. It’s most likely still encrypted, but being able to dump the data at all is a good first step.
From what I can Tell, he has the decrypted binary, since he extracted It from the CPU registers themselves instead of RAM. In the registers, data can't be encrypted since the CPU needs plain code to be able to read it (it's also why he claims that he can study the PAC codes, If he only had the encrypted code, he wouldn't be able to study anything since it would be unreadable)
Just to set everyone's expectations straight. Even if he could dump full unencrypted game data it couldn't be used for much past datamining. The goal here isn't to dump games, make rips, etc. Here he has simply ripped the executable of a game to see how they are formatted. Basically he's datamining. However even if a full unencrypted game dump surfaced online it can't really be used for much without a full dump of the system firmware for example.
Mind you nobody here is saying that data mining is uncool, just that this doesn’t lead to full unencrypted game dumps on its own. This is a reasonable statement given that users following the scene have taken a WebKit exploit in userland to essentially mean the same thing.
I’m from the PlayStation scene. I’m curious about Nintendo. Would love to play ghost of Tsushima or gta 5 on portable device.
Can anyone explain me this scene a bit?
Gezine made another tweet mentioning that it's a single game that allowed him to do this, he can't do this with every Switch 2 game.
According to the admins of the PKHeX (Pokemon save editor tool) server, this is simply good for research and not much else. This isn't a way to get into a Switch 2, or will help emulation. It's unlikely that there will be anymore exploits other than this.
i think gta (V) may get a release on switch 2 officially though, COD got one recently and the older games have switch ports i dont see it as out of the question
there is still no hack available to end users, and no one knows if there will be one any time soon. gezines hack is more for academic purposes in hopes of leading to something more substantial. its the most substantial news so far in the hacking scene since the switch 2 launched but it still doesn't mean that much on it's own. the switch 2 so far has been extremely well secured against hacks. on switch 2 the only games you can play are from the nintendo eshop or official cartriges. if you want to play those games portable you'll need a pc handheld, or a laptop
Ah guess it’s tighter security than ps5/Ps4
Guess it’s not worth it to buy Nintendo. I never grew up with it so Mario game etc has no value for me. I am more of AAA game enjoyer.
Mahne in future you could play gta5 or watch dogs ok ninetnod it would be so cool.
there is always the chance they could get ports of those games but yeah. depends on if third parties can be bothered. the zelda games are probably the most appealing for the AAA audience, there is some third party stuff like cyberpunk as well.
They are also a way to avoid dumping of physical copies. Both can be true. This could be why Sony is also going digital as some of its physical games have led to exploits being found in the system..
All Nintendo 1st party games have the full game on the cartridge. 3rd parties also all have the option to use a regular game cartridge and not just a Game Key Card if they wanted to.
İf nintendo sold shit for 15 20 bucks a game no one would be waiting for hacks. 50 usd for games that are available for 5 bucks elsewhere is a damn ripoff. Hope nintendo gets whats comin
What the fuck? I actually used to think something like this was possible because of the HDMI ports having blazing fast speeds yet I never saw anyone use any console's HDMI ports for data transfers… I'm shocked it took this long for it to happen
PLEASE PLEASE DUMP SPLATOON RAIDERS, WE NEED THOSE OST SOUND FILES
What is the name of the game. And I don't trust gezine will make this public as it's a big entry point for people to study switch 2 game processes. Which could facilitate future code injection and it could be blamed on gezine
Random point but why does it say "Twitter Web App" underneath? I thought Elon specifically asked for the device identifier to be removed off Twitter ages ago, partially because he was embarrassed as he was trying to battle with apple from an iphone. Did they bring it back or smthn?
Oh ok that would explain it, I miss when that existed on stock twitter because it was funny to see celebrities who were promoting Samsung have “via twitter for iOS” underneath their post
I hope this leads to something, possibly emulator progress(doubt it) but i cant think of any uses other than ost dumps(cool but not groundbreaking) and piracy(i'l let you keep your own opinion on that)
The point of the dump is to understand how the switch2 authenticates games, and by extension, code. If we can figure out how to sign our own code and execute It as If It was legitimate code, we could escalate privileges and make progress on an actual emulator
He didn't dump from the game cartridge, instead he used a vulnerable game to extract the game running data present in the CPU registers directly, tricking the switch2 into outputing the game instructions as visual input to the screen, which he could then record video of using the capture card and decifer the game code manually based on the colors that appeared on the screen
I would imagine the binary data would have been displayed as raw pixel data (maybe in something like a 1bpp format at a lower resolution to increase the chances of a successful decode), potentially with some error correction as well, before an HDMI capture card captures it and it is decoded back into binary using PC-side software. Rinse and repeat until you have converted the entire binary into raw pixels and decoded it on PC.
If the monochrome pixels were transmitted at something like 4x integer scale on a 4K output to a 4K capture card, that would mean that each binary image would actually be 960x540 and only contain 64,800 bytes of data, so you would have to repeat and automate this process with hundreds or thousands of images to dump even a small code portion with a few dozen megabytes of data. If he was using a 1080p capture card he would pack even less data into the binary images and would have to transmit even more images.
You couldn't just transmit a higher res image or an image using colour because that would decrease decoding success by orders of magnitude, especially since almost all capture cards have chroma subsampling you can't disable, and almost no capture cards will support sending uncompressed frames over USB. All of the capture cards I have used only send video using Motion JPEG
From what I could tell, since It's userland, he couldn't move the code to his PC normally, so he made the capture card read the code and interpret it as "pixel data" via HDMI to then record the screen and convert back to code.
do you know how HDMI video output works? it sends data as image frames, usually as 60 per second (more or less, which creates a constant video output to a monitor, screen or capture card). if OOP isn't lying then they converted a memory dump into image frames, using a capture card to relay them to their PC to record them then converting them into bytes that make a full binary, which they will use for research
Yeah, that makes sense (I might have titled it wrong since I posted the moment I saw his tweet), but at the same time can't he run the executable through a decompiler to see the actual code? That's kinda why I jumped the gun a bit especially since he used the word "dumped" on his tweet
That's what confuses me about his post, since he's talking about examining how the PAC works, I just assumed the binary he has is somehow decrypted, since him dumping the encrypted ram would just be "garbage" data, there would be "nothing" to analyse on PC since it would be unreadable by anything except the switch itself
As far as Gemini can speculate (so take it with a grain of salt), he managed to get the decrypted binary because the extraction was done from the CPU's perspective (cache/registers) rather than reading the encrypted RAM directly. The Switch 2 hardware automatically decrypts the data on-the-fly so the CPU can understand and execute it, and the exploit simply captured this already-decrypted data. Having that decrypted "exe" he can run it through tools like Ghidra to be able to recreate the original source code (without comments of course)
It's like we watch a cat and mouse games right? LoL
When nintendo got announce new update FW and then the new challangers came or we can say intelligence researcher to do the threats? And then who gots the a cold sweats first? LOL HuaHaHaHa
Switch2hack on fire!!!!
•
u/NiftyNovaaa 16d ago
Hi everyone, i am trying to become more up-to-date on the Nintendo Switch 2 hacking developments, keeping track of the Switch 2 hacking timeline from release to present day. I've kind of missed a lot this year though. If you've been keeping track of all the hacking news, please reach out to me! Userland hacks/bugs like in this post, noteworthy developments, anything from the start of the year 2026 to now, if you think it's interesting i want to hear about it. You can contact me through the r/switch2hacks Discord server, just send me a DM. Thanks!