r/switch2hacks • u/Velocifyer • 10d ago
Hacking News It appears that Gezine's hack requires a specific game.
45
58
u/SOVEREIGNBOSS 10d ago
Wasn’t Gezine a famous cracker from ps5 scene. Did he shift to Nintendo.
Yall got lucky
60
u/Velocifyer 10d ago
He did shift to Nintendo, after selling his PS5 exploits to sony
22
14
u/kickbut101 10d ago
depending on how big those exploits were that seems like a pretty poor payout from Sony. Especially when considering how other big companies payout for bug bounties (which in effect is what this is)
6
u/PanicObvious8862 10d ago
He might have negotiated higher behind the scenes. Hell that might have effectively paid him to stop working on future exploits
5
u/DavidinCT 9d ago
Dude, not sure about you but, if you had the skill, and could hack, an extra $20K woudl be nice in anyone's pocket.
4
2
u/Sau-Baer 6d ago
The amount of work and time put into this whole thing is probably not gonna make the 20k be that big
Good Dayjob level of pay without any future security by being employed - I'd say that's quite low
1
u/ExactHuckleberry1662 13h ago
How are you both snubbing making 20k in a day not a month not a year, not a week, a day
17
u/Salt-Tie-5318 10d ago
He said he is not intended to release anything forever
He is doing this for fun only6
u/Silver-Challenge-633 9d ago
then hes not an ally if hes just going to report it back to nintendo like he did with sony and the ps5
1
u/UltimateWaluigi 10d ago
Based and hobby-pilled
2
u/JoyconDrift_69 5d ago
Counterargument: they reported the exploits they found on the PS5 to Sony, at least reportedly. No way to tell he won't do the same for the Switch 2.
16
u/Particular-Plant-461 8d ago edited 8d ago
I got downvoted to fuck after saying the switch 2 is going to be another 3DS cubic ninja exploit. History repeats itself, Switch1/DS has an uncatchable hardware exploit leaving it cracked wide open very early, Switch2/3DS has higher levels of security but its Achilles heel is within a poorly developed game.
5
u/pofehof 5d ago
but its Achilles heel is within a poorly developed game.
Can't really say that since this is still a nothingburger at the moment. It's pretty unrealistic to think that there will be a software hack for the Switch 2 when there has been none for the Switch 1 (and yes, people would like one for the Switch 1 if they have a patched console).
10
u/OGSlickMahogany 9d ago
Decoding a switch 2 game will be huge for early emulator development, I know he doesn’t care about it, but if we can get the groundwork running on a dumped switch 2 game, we will be that much farther ahead.
16
u/Clean-Supermarket-80 10d ago
I think I know which one it is, it uses a QR code in an important way, which is how code is injected in.
4
u/qwouw 9d ago
So i looked into it, and i believe thats not the case. I think he used qr code in a way to transfer files to his pc instead. So he displayed a sequence of codes which then on his pc he translated into files. Could be wrong.
1
1
u/msthe_student 5d ago
Could be something simpler, like basic colors, depending on how much code he's able to execute
1
u/ExactHuckleberry1662 13h ago
Except he said explicitly he used HDMI capture card to dump the files as patterned images
5
u/Velocifyer 10d ago
Could it be "Tomodachi Life: Living the Dream"?
21
u/Redditisreal1 10d ago
Theres no way there’ll ever be an exploit on a first party nintendo title. It’d be hilarious but insanely unlikely
37
u/Ghennon 10d ago
You mean ever again right? lol, Twilight Princess had a save exploit and was the main game used to hack the Wii lol.
Even Nintendo first party software had exploits, Wii letter menu, DSi and 3DS album, there was others but I can't remember rn
3
u/Redditisreal1 10d ago
Yeah i mostly meant for current/upcoming games on switch 2. Theres no way nintendo’ll leave an exploit on a game they specifically make themselves now that they’re so invested in fighting homebrew
8
u/Velocifyer 10d ago
There was KartLANPPwn for Mario Kart 8 Deluxe, although it required another homebrewed system.
2
u/qwouw 9d ago
What do you mean by uses QR code ? As switch has no native camera, does it have qr scanning capability or ?
3
u/Specialist-Stuff-221 9d ago
im in the reswitched discord he did it on the latest firmware 23.0 he has two systems
1
u/msthe_student 5d ago
I think /u/Clean-Supermarket-80 is assuming that the Switch 2 is taking a block of userspace memory, displaying it as a QR code, and then going on to the next block
1
-1
u/sam100090 10d ago
If I had to guess, it’d probably be Mario kart home circuit
1
u/Clean-Supermarket-80 10d ago
i thought it was this one, i just tried to buy one to poke around and I was told this game is only digital, no physical games for it. so maybe its not this one?
1
u/doesntaffrayed 7d ago
Why would it being a digital only game exclude it?
3
u/Clean-Supermarket-80 7d ago
because if you have a switch 2 offline waiting for a hack some day, most likely you dont have that game purchased and downloaded. And you cannot buy it used or second hand because its download only which would require an update.
-1
u/No-Island-6126 10d ago
so which one is it
1
u/Clean-Supermarket-80 9d ago
we dont know yet unless he tells us, but when he does make it public... that mf is going to be hundreds
5
u/GingerlyRough 10d ago
It's the same for X360 BadUpdate. Need Rockband or Tony Hawk for the hack to go through.
5
u/C0D10X 9d ago
Which is not needed anymore thanks to BadAvatar.
Now the Xbox boots in seconds.
3
u/GingerlyRough 9d ago
Ohhhh snap. I gotta update my bad update lol
2
u/C0D10X 9d ago
Yeah make sure to use BadAvatar 1.3 and also use XeUnshackle Max.
https://github.com/bibarub/Xbox360BadUpdate/releases/tag/avatar-v1.3-beta
https://github.com/klofi/XeUnshackle-Max/releases
1.3. makes sure you have like 99% success rate and with that XeUnshackle Max you can disable the chain Video and skip the screen from XeUnshackle.
With this you can boot automatically within seconds. I also never had a failed boot with 1.3.
2
u/GingerlyRough 9d ago
YOU'RE NOT MY MOM DON'T TELL ME WHAT TO DO!
But thanks for the tip, I'll definitely check it out before I boot up the ol'360 again.
2
u/Velocifyer 9d ago
Also a proper jailbreak for nearly all Xbox 360s (it was patched by microsoft in a later **motherboard** revision) is coming out in mid october, according to the original creater of badupdate.
1
u/GingerlyRough 9d ago
Oh snap! That's wicked! A friend if mine has a winchester model I'm definitely sending him down the rabbit hole. I've got the corona model but I've been looking for a smaller project before attempting to solder my 360 lol
2
u/Velocifyer 9d ago
The only models that it doesn't work with happen to be Winchester and Corona. https://github.com/grimdoomer/ETA-When
1
u/GingerlyRough 9d ago
Aweh dangit. Ah well. BadUpdate/Avatar works and I don't play 360 often enough to worry about it being permanent.
10
u/KoopsterShell 10d ago
Why won't he tell us the game
35
u/Velocifyer 10d ago
To avoid nintendo patching it, to hopefully build a large install base of users who own the game. (as afterwards, it will be scalped and sold for $2000 on eBay)
12
6
u/Wilipro0317 9d ago
He has no intention of telling the game but also no intention to release anything, so, we must take it only as a curiosity
10
u/West-Psychology-6299 10d ago
Its not important. Nothing here says the system is vulnerable. He dumped a switch 2 game. That's all he's talking about here.
4
u/Luchux01 10d ago
Because the guy got sick of the hacking community back in the PS5 side and apparently refuses to release anything these days
-2
u/KoopsterShell 10d ago
So what the fuck is this going to be of use if he won't tell???? How will we know what game is this
6
u/Remarkable-Llama616 10d ago
It means nothing really. If he says the games name, people will buy it, and then blame him for saying it's just a nothingburger task he performed. The hacking community is insanely toxic and aggressive if you drop too much of a carrot in front of them.
5
u/KoopsterShell 10d ago
But this is not a carrot this is potentially a microscope to study the molecules of the switch 2. How else will we make discoveries on how game processes work
4
u/the_axemurmurer 9d ago
It might not seem like a carrot, but many people in the hacking community are foaming at the mouth for any excuse to jump down the throat of people involved in research.
8
u/Remarkable-Llama616 10d ago
You're proving my point. This is why big names like Tahlreth quit the scene. The neediness is insane unless if you're planning on assisting with the research.
4
u/KoopsterShell 10d ago
No. I'm not a researcher, but I want this to be in the hands of someone who isn't Nintendo's pet and will share valuable info to aid jailbreaking
5
u/AggressiveAstronaut6 10d ago
Best thing he can do right now is keep it close to his chest until he can figure out something interesting to do with it.
3
u/epicwizardshit 10d ago
If he names the game it’ll get removed from shops or patched immediately
0
u/KoopsterShell 9d ago
You better be right about this! And that gezine better not hold on important info so that nothing is jailbroken and EMULATED
3
u/msthe_student 5d ago
gezine better not hold on important info so that nothing is jailbroken and EMULATED
... or what
2
u/msthe_student 5d ago
How else will we make discoveries on how game processes work
- Start with understanding how it works on Switch 2
- Add stuff like PAC (which is publicly documented) to your understanding
3
u/dangaming255 6d ago
ninjhax 2 pottential? hope this goes somewhere, genuinely interesting, even as someone who doesnt understand the technical stuff
20
u/FernandoRocker 10d ago
And as always, I was right. It's a nothingburger.
23
18
u/530cruising 10d ago
One day you’ll be wrong.
-11
u/FernandoRocker 10d ago
When?
4
u/DesignerMorning1451 10d ago
Probably now. This guy has most likely done what you said would never happen. You can't even bring yourself to explicitly deny it anymore
-2
u/FernandoRocker 10d ago
That's what a nothingburger means.
2
u/DesignerMorning1451 10d ago
We both know it's over. You were wrong.
-1
u/FernandoRocker 10d ago
I will return here in a year and laugh at you (well, you will probably delete your comment).
u/RemindMeBot 1 year
1
u/RemindMeBot 10d ago edited 9d ago
I will be messaging you in 1 year on 2027-09-22 23:40:46 UTC to remind you of this link
1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback 1
-8
u/Salsalord1 10d ago
They’ll give a day, and when that time comes and goes with nothing, they’ll move the goalposts.
People were saying Switch 2 would be hacked within a year of release, and now that it’s past that, they’re saying it’ll be another year.
Like clockwork with these guys.
1
u/IQueliciuous 10d ago
Switch 2 won't be hacked in a year. Not because its difficult but because 99% of what can be done with homebrew can be done with PC handhelds. They killed motivation to hack switch 2.
Switch 1 hacking scene was motivated because switch 1 was a very powerful handheld with no alternatives. Now there are lots of alternatives to switch 2
0
u/Salsalord1 10d ago
I can taste the extreme levels of cope.
5
u/IQueliciuous 10d ago
Its not cope. Its a fact. Why else would someone go through all the hoops when its cheaper to buy a rog ally/steam deck used for emulators and etc.
2
u/Salsalord1 10d ago
To play Nintendo games that currently can’t be emulated.
4
u/IQueliciuous 10d ago
And there aren't enough to motivate people. Switch 2 has strong third party line up but first party line up is pretty weak compared to Switch 1's first year.
-4
u/Salsalord1 10d ago
There’s not enough to motivate people that’s why there’s an entire subreddit dedicated to it that we’re currently talking on right now? Did I get that right?
→ More replies (0)15
u/Velocifyer 10d ago
How do you even manage to be the first to reply?
Also this isn't a "nothingburger", as it will allow them to find and exploit any potential diffrences in Switch 2 HOS compared to Switch HOS.
3
u/ALIIERTx 10d ago
it curently is a nothingburger. there is nothing to see just "trust me bro" words... like allways
8
0
1
u/msthe_student 4d ago
it will allow them to find and exploit any potential diffrences in Switch 2 HOS compared to Switch HOS.
A game process being able to read executables other than what belongs to it seems unlikely, because it doesn't need to do that to work and it increases what an exploited game can do. It might be able to read some libraries though.
1
2
u/FORUMICS 9d ago
this is valid proof of a userland exploit. from this exploit he would be able to poke around to see what other layers are there. the original ps3 hack by geohot allowed reading values at memory locations. it was also a nothingburger until the location of the masterkeys were found. then all of a sudden reading values at memory locations became the whole exploit chain
1
1
u/TrippinDipplin_5260 10d ago
If the Pentagon can be hacked into than the Switch 2 can be hacked into 😮💨
1
u/ImAmalox 10d ago
The ability to dump the files of a game, even if it is this one specific game, is pretty huge. You are expecting too much.
1
3
u/LimitOpposite 10d ago edited 9d ago
Is there any possibility that the game uses Artemis or Ren’py*? I think there’s an exploit or something going on the ps4/5 scene.
2
2
5d ago edited 4d ago
[deleted]
0
u/msthe_student 5d ago
This post contains nothing specific enough to go after really
2
5d ago edited 4d ago
[deleted]
0
u/msthe_student 5d ago
No, they said they used a vulnerability in a game
1
4d ago edited 4d ago
[deleted]
1
u/msthe_student 4d ago
Dude. That doesn't really reveal anything Nintendo can go after.
userland bug
That just clarifies it's not a kernel-level or TrustZone bug, and yeah like obviously that's where you'll find the most exploitable (but least privileged) code.
I used HDMI capture card to dump the memory
Well yeah, if you want to get something out of the Switch 2 your options are basically
- Put something "on screen" (which every game has to be able to do), or
- Communicate with the network (which probably has restrictions), or
- Write something to the SD card (which probably has restrictions).
Using an HDMI capture device just means they're putting something on screen (like a QR code) and then having software on the PC convert that video-feed/file back into data (probably either raw binary or a format like ELF). For Nintendo to take advantage of this they'd have to go through every version of every Switch 2 game and then look at every point those games use user-provided data, which isn't really doable.
2
u/Elegant-One-5527 9d ago
Hope they have an "accident". Give them the good ol whistle blower treatment.
1
u/MrPabluu 9d ago
it appears Gezine's vulnerability targets a specific game*
can you all develop a frontal lobe, these vulnerabilities are not full fledged hacks, they are for research
2
u/Velocifyer 8d ago
It is a hack, but it is not yet a jailbreak, as it does not have the tooling yet.
2
u/msthe_student 5d ago
It's not just a matter of tooling. At most we can assume he has the ability to execute code in a game process, but to get control of a Switch there's at least 2 other levels of privilege you need to find vulnerabilities in
0
u/Velocifyer 5d ago
Userland counts as homebrew. It still lets you play custom games and stuff. The main thing that it doesn't let you do is mod games.
1
u/msthe_student 5d ago edited 5d ago
In a modern security system you can have access to read the memory of one process without at the same time having enough access for viable homebrew, nobody is gonna play ROP Doom. Even the Switch 1 security model effectively bans RWX memory in games, and heavily restricts how new executable memory can be created. Investigating how Switch 2 implements PAC is gonna be vital to major progress, and it's both something people have predicted being an issue and something I believe we have seen results of in vulnerability disclosures.
Update: It seems Switch 2 doesn't enforce XOM, which seems a strange choice
1
1
u/No_Supermarket9041 8d ago
It's taking too long like forever to hack Switch 2 like Xbox one and Xbox S|X
1
u/msthe_student 5d ago
A good security system takes time to break. If you think it's taking too long, start breaking it yourself or donate to the people who do
1
u/West-Psychology-6299 10d ago
There's no hack here. They are saying it's the only game they can dump all the files for. I'm sure it can lead to them finding vulnerabilities but there's no sign of that here.
4
u/Velocifyer 10d ago
But they are extracting the data from a switch 2.
0
u/Th3Be4st_ 10d ago
People have been extracting data from a switch 2 since when it's out, just check switch 2 brew wiki. We have a webkit exploit and a lot of exploits based on games (not disclosed). What's special about the gezine one is that it doesn't require a savefile. But we are nowhere near an hack. The security model of the switch firmware considers games as "compromised" by default so they don't have much permissions on the system. To get an hack you need a chain of exploit in a lot of different switch services. When and if Gezine finds something in one of switch services, that's the moment you can get your hopes up, but at the moment, it's nothing new.
1
0
u/WastedMoogle 10d ago
What am i supposed to be looking at here
9
u/CoconutHeadFaceMan 10d ago
Something that might be mildly interesting in the future but means absolutely nothing to us right now
-1
u/Cultural_Neat3124 10d ago
maybe people should check out gbatemp for real fact, this is just a nothing burger. or just stay here and farming copium !
0
u/FerdinandoPH 9d ago
What social network is that?
5
u/Velocifyer 9d ago
XTwitter, but sense I don't want to create an account, I browse it using a proxy. Beware that XTwitter plays whack-a-mole with these proxies. Currently you just replace x.com with xxcancel.com, which redirects you to whatever proxy works now.
0
0
-3
u/WDYKACountCocofang 10d ago
"🙄"
-2
u/WDYKACountCocofang 10d ago
I wonder what he is trying to say w the quotation marks. Theyre written weird
1
-3
u/Male_Inkling 9d ago
You're reading it wrong, it's not "This game opens the doors to an userland bug", it's "This userland bug is only possible with this vulnerable game"
Meaning, this game is the only one that can be dumped.


285
u/christiangg911 10d ago
Close enough, welcome back Cubic Ninja