If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
I work with Claude to port games to DOS and build new Classic Macintosh apps [1][2][3] using real hardware.
For a while I was doing the SDcard swap thing; but realized with a usb4vc[4] (hands), a vga/hdmi usb capture dongle (eyes/ears), an old Wemo switch (on/off/reboot) and ftp/appleshare (files/logs) I could have Claude do it all for me.
Claude made me vcctrl[5] that ties all of it together, including an mcp, skills and a webkvm.
I'm working on a IoT device at work and have been the "hands in the lab" for my agent this week. It's been a really weird experience. Making changes to the update/recovery process, so I have to validate several permutations of fault injection (i.e.: abrupt power loss during update step X while on starting version Y).
I would love to give it unattended "hands". I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug. X and Y are relatively small, and I expect this validation to be too costly to do at a regular cadence in CI. I can trivially use a MCCI USB-C switch for the power though.
Tips would be appreciated if anyone here has thoughts.
I built a little harness for an x86 SBC for Claude to do osdev a few months ago.
Janky setup with two ESPs for the serial terminal and to control a servo taped to some microswitches to power cycle the board.
It worked very well, allowing Claude to spend all day and night debugging quirks with the NIC until it was able to get the driver working.
So, I think giving your IoT device some "hands" is probably worth it. For SD card automation, you can find "wireless SD cards" on Amazon/AliExpress that have a microcontroller pretending to be sd card, eg FYSETC SD-Wifi.
> I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug
Heres the thing. You only have to build the automation once. While it will only take you seconds at most to pull a card, you gotta sit around and be ready for the card to be pulled.
For your problem I see 2 quick things that came to minq very quickly that could do SD card pulling for you.
1) shove a level shifter in between the SD card and device under test and have a micro enable/disable the level shifter when you want to pull/unpull. ( you can even get multiplexer IC that will do the same thing as the level shifter as acting as a switch for the SD card lines, but would allow you to connect the SD card to a 2nd device (the testing pc) to allow you to write/read data from the card when its "pulled" from the DUT.
2) 3D print a jig that will insert/remove the SD card and use a cheap RC servo to handle the movement - again using a mirco to control the servo. gives a more real world test of pulling the SD card. but only gives the the ability to pull/insert. Still required manual effort if you need to read/write to the SD card
Once you have build the jig, you can reuse the jig on the next project, so while it will take some time to do/setup it could save you time later down the road.
Edit: As for the code driving the ICs or Servo, I'm presuming you already know embedded programing, but even so, a simple Arduino sketch will be able to handle it for you, fuck ton of example code already exists for it, and can be easily controlled over USB.
To add on to this for the SD card, you can buy an “SD card extender” that has an SD card on one end and a slot on the other, with a cable in between. Something like that might make it physically easier to get in between the signals by modifying the cable. Nice big wires on this one: https://a.co/d/0cPVVsLE
So far most of my automation has been optical (tweaking display output to show correctly under a lens with odd optical characteristics, hard to simulate computationally), so pointing cameras at the device and letting the LLM iterate and tune display output has been useful.
As with any automation, it all depends on scale. Setting up a harness to repeatedly mess with microSD cards seems way more prone to failure (and false positives) than just doing it yourself, but if you're testing thousands of devices, would probably be worthwhile.
The Switch 1 sold about 150m units, the Steam Deck’s sold 6m.
Internet nerds like us aren’t really Nintendo’s target market, I don’t think. Installing emulators or jailbreaking a system isn’t something most of their customer base would have the want or need to do, IMO.
Even some of us internet nerds are Nintendo fans who wouldn't go anywhere near emulating. Apart from any of the moral concerns, it's just such a worse experience: I want to use a touch screen, a portable device, a proper gamepad, etc. Nintendo has built up quite a considerable amount of goodwill since the 1980s, and the reward for that is a pretty loyal customer base.
So true. It's dangerous to form world views based on "What HN thinks". This is the best community on the Internet IMHO but were a very tiny slice of the population. "Real people" tend to not behave like us.
More likely to happen via recompilation, if anything. Game ports via recompilation have been taking off in the last month or so, all the way up to systems as recent as the PS5 and Switch 1. It has far less overhead than emulation.
Totally, convenience always wins. I think this is more of a hardware sales issue for Nintendo though — if what I understand is true, I'd bet that we see Switch 2 games running on other systems before we see a CFW/decrypt-encrypt stack for running pirated games on the Switch 2 itself.
I have no desire to buy Nintendo's hardware as I don't want to play their games badly enough to buy a dedicated console and deal with their practices. I have however enjoyed the last two Zelda titles on my PC where I was able to play them with performance and quality mods. Once it was just another application the barrier of entry was low enough to get my interest. If the games were available as actual PC titles I would have gladly paid for them
You can pay for them if you appreciate the effort that went into making the game. Nothing to stop you buying the Switch cart and playing an emulated version.
have you ever played first party titles on the switch?
the level of polish and stability on the open world zeldas is astonishing, i never experienced anything like that in third party AA/AAA games form the last 15 years or so, playing on the switch or on the pc.
According to wikipedia, they sold over 23 million units of the switch 2 and over 155 million of the switch. Not that I agree with their aggressive practices but it clearly works. That's a lot more than the Steam Deck btw.
Aren't Nintendo's lawyers second to none (maybe other than Disney)? Or do we think we're in a situation where the legality of it is moot? My gut is that we will see a response from Nintendo.
I actually love watching this from a distance. It's very OG cyberpunk.
They have successfully deplatformed emulator projects from the larger project hosting providers like Github. But they have not stopped them. The real emulator projects have just circled the wagons and started self-hosting their build and dist infrastructure, running independent Forgejo instances, etc. There's still more churn in the community because of the risk profile, and now because of LLMs. But it's settling down and there are a couple stable Switch 1 projects. And actually, their recent DMCA carpet bombing removed a lot of the unsafe forks of emulators on places like Github. Likely leading to more people being directed to the real ones.
I'm working on a custom app for a camera that has a terrible Android app, and I'm working on a similar harness: AI is building both the 3D model and the parts list (basically, a Raspberry Pi, a webcam, and a few servos).
DroidDeck (https://github.com/The412Banner/DroidDeck, and things like GameNative) have been huge for Android. Compatibility is fantastic, and you can run most games >3 years old at respectable frame rates on Snapdragon 8 Gen 3 handhelds.
I'm sure if this leads to a full CFW environment people will port it over.
Ah, you're right! Depends on their generosity, but I'd imagine piracy and running exclusives on non-Nintendo hardware is more of a risk to their business than a bootROM exploit.
Who gets the bounty money in that case? By the looks of the article, Codex did all of the work actually finding a bug. Shouldn't the money go to OpenAI?
I don't understand, how are people using codex for this sort of research? Whenever I try to do bug bounty, research, etc it locks down and I have the "blue" tier access/daylight whatever it's called.
For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
no shortage of answers to this question but the common/short explanation is
- it says codex but not what model, it could have been an abliterated model or something more open to this sorta thing
- convince the model youre not doing the thing youre doing (a bunch of ways to go about this, some short and some long)
its probably possible to convince any model to do any thing if youre clever enough about your approach, kinda just the way this stuff works. General intelligence = infinite ways to direct it.
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
I don't know. I feel like the blog reads as very human written and enjoyable overall. Also what's 2 weeks of real work (in tandem with an agent) compared to a few hours for the blog?
Layoffs "because of AI" (plus cheap money drying up and offshoring) versus individuals hacking devices and software, and making dummy copies of paid software that are "good enough" for most users. I wonder if that might be an early sign of a turning point in the IT economic cycle, where companies will need to invest more in security services and specialists with extra knowledge who know where and how to make the most of AI before their rivals do.
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.
Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.
I wonder if the SD Express will be taken advantage of in the switch 2 homebrew scene which seems inevitable now.
SD Express is PCIe express after all (also a possible attack vector in itself, see DaMAgeCard). With nvidia drivers for Ampere already on board maybe someone will get an RTX 3090 running on a switch 2.
GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.
And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.
yes at least with GKC I immediately know that game is not playable offline instead of needing to go to https://www.doesitplay.org and hope that someone already documented the game I am looking at, which is the case with PS5
Game key cards are cheaper to make because normal cartridges with the full game cost a fortune right now. And guess why? AI data centers buying up all the memory chips.
On the physical games part, Nintendo still puts their own games on full cartridges, so I don't think they're the ones that deserve the backlash here.
> Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
How's that? Can't you buy & resell them on the used market? That seems like the only thing a physical cartridge gets you, and not shipping the outdated-on-day-one bits on the cart saves some money, too. Seems like win-win?
- You can't download the game without internet, including re-downloading because you had to free up space
- You can't download the game after they have retired their servers (or if their servers are down / having issues)
- The game ends up taking a lot more storage space as updates are usually tiny when compared to the base game. For reference, the Switch 1 version of Zelda Tears Of the Kingdom takes 16 GB while the latest update takes only 500 MB.
I think most of that is true for games shipped on cart, too. Games often ship broken or missing features which are patched in at launch. Official physical media has not been a reliable method for future accessibility for at least a decade now. It's way past time to start using other methods of preservation.
I believe that is largely true even if they shipped a game on the cart. Many games ship broken, and they also change many times over the course of their life. I don't think official media can be considered any part of a future accessibility strategy for at least a decade now. Game keycards don't change that fact in any way.
I do agree, in the world of day one patches its not a given having the full, actually playable game on the cart itself isn't a given. We're already largely at the point where game discs and carts are really just license keys, this is just saving some money on the storage.
But it sure was nice when you had the whole game sitting there, without having to rely on some download server still being around. I'm able to go grab a used GameBoy game off the shelf at the used game store, stick it in an old GameBoy, and outside of some games with batteries in them (repairable fwiw) it just works. This has been great for my little kids, as I trust them a lot more with a cheap GBA SP than I do the Switch when going out places. Way more pocketable, way less fragile, and the replacement cost (and repairability) is a lot better.
If I grabbed an old Switch off the shelf in 30 years, popped in a game key card, would I actually be able to play anything? Probably not. There's a good chance most of this Switch 2 will be useless in 30 years time.
options for switch1, ps5, xbox: Disc or code in box.
options for switch 2: Full game on cartridge, switch 2 edition (including switch 1 support), Game Key Card (half physical), Code in the box.
I don't see why should nintendo be blamed for providing more options. if anythng you should blame the publishers for chosing "Code in the box" (looking at you diablo) when GKC would do. or GKC when full cartridge would do.
The chances of getting banned for this are extremely high. The Switch 2 has plenty of mechanisms to detect tampering. Even if you were completely offline during the process and then reset the Switch afterward, there are logs. People have already been banned for using the MIG Switch to play backups of Switch 1 games on the Switch 2.
I wonder if this would be a reason to sue in the EU ? IIRC you can even replace the firmware without voiding the warranty, unless the manufacturer can prove the firmware cause the issue.
Here I guess you could just RMA the device or even sue Nintendo for retaliating after you just used the device you bought ?
they dont need to brick the machine - they can simply ban your online account, which they can use EULA to make you agree to before getting that account. You lose your games if the game requires online verification (which implies an account). This way, you won't be able to play your games purchased, even if it's a physical copy - you can only play games that don't have verification like this (i dont own a switch, so i dont know if this is actually true).
The law has superiority over the EULA, they could probably get away with disabling online multiplayer with concerns of cheating but I don't see any legal basis on how they could take away purchased games. That would go against any consumer right laws.
I jailbroke my Switch 1 the day I bought it, was banned from Nintendo Online the next day. The only games I bought were physical. I was told this would happen, so it wasn’t an issue at all.
I’ve told my friends if you plan on playing online on it, definitely don’t jailbreak.
IIRC the current approach makes your switch dual boot the unmodified firmware and the custom firmware with online capabilities disabled, so you could still play online and avoid bans.
But I wouldn’t trust that with an expensive account-bound digital library.
never go online and even if you reset the console afterwards , assume the console will get banned when connect to the internet as they know to look for markers of customer firmware.
Switch 1 hacks bypass this by copying ofw from flash onto the microSD card and patching it there to my crude understanding, so that unsigned code never touches the firmware on the system memory.
Something like this definitely will be needed again for the Switch 2 so I'd only do this if you don't care about being banned.
In my experience, you can often get around this by trying again. I've had prompts that were rejected, but as soon as I started a new session, it worked.
PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
Looking forward to the eventual full jailbreak. Maybe sooner rather than later with all of the advanced AIs of today.
Nintendo recently banned my Switch 2 from accessing online services. This effectively turns it into a fancy brick, since you can't install any digital games or updates - only games on physical cartridges will work (without possibility of installing updates). This is despite both the console and all games being purchased legitimately. The only weird part is me being in Ukraine where there is no official Nintendo presence, and so I had to use US eShop (with PayPal and prepaid digital codes). Nintendo support is extremely unhelpful, they just say that "unauthorized transaction detected" or something like that, without offering any human review/appeal path.
It's one thing to reject a transaction in the eShop, it's another thing to permanently ban console for that. What a shit company with shit business practices. 0/10, would not recommend, would not touch anything Nintendo-related ever again without a jailbreak.
Ive only bought 1 thing recently from Nintendo within the last year: a Switch Pro controller.
Why the controller? Cause Switch emulators. They work wonderfully. I dont have to pay a cent for games. I can download the games and their updates. And there's quite a few Switch emulators.
Im not going to pay a company to automate my own abuse.
I agree with Gabe Newell, that piracy shows a severe service delivery option. And in the case of Nintendo, they have no problem destroying your hardware on a perceived "back action on your owned hardware". Of course, hacking laws dont apply to companies. And Switch does braindead things like "not permitting to back up save data or back up digitally purchased games"...
So yeah, in cases of Nintendo, I acquire appropriately. They have proved themselves to be an absolute horrible actor here. Fuck'em.
this seems like the right level of human/agent collaboration to me. there's so much that codex can automate and giving it more tools is definitely super high leverage.
Might be a bit offtopic, but I really like that it feels like a real human wrote this blog post. I'm reading way too many blog posts, along with GitHub PRs and Issues, that just seem AI generated.
This style of writing is just nice
A lot of software in the pre-ai era has relied on how intensely tedious it would be to crack as their primary sense of security, and it certainly seems like systems built in that way are going to be much more vulnerable now.
I remember having to buy GTA Liberty City Stories to jailbreak the PSP. Then there was the infamous Cubic Ninja jailbreak which caused the game to become worth hundreds of dollars.
Almost every console jailbreak required the use of a specific game, going all the way back to the original Xbox. PS1 and 2 required a specific disc or swapping in a legit disc. Even the NES required a real game cart alongside your third party carts.
It turns out that opening locks is a hell of a lot easier when you have a key.
Console hacking has been like that for a very long time. But usually after the first exploits are found and hackers can start playing with things, many more follow. Though Nintendo has been stripping down the OS every new console so there’s less interesting stuff to exploit outside of games.
Imagine an open console, that sells games anyway, because they are fairly priced and convenient. The console producer doesn't have to spend money to harden security, secure processors and can focus on performance instead.
And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
Basically, since it wasn’t possible to extract the files from Switch 2 games, fans who wanted to listen to the Mario Kart World soundtrack outside of the game would record the audio output from their console and exploit glitches in-game to prevent sound effects from playing and phase-cancel overlapped recordings of the same song with each recording being interrupted in different parts to isolate the music then crossfade the remaining segments into the complete track.
Incredible all around.
If this is true decrypted `fs` r/w, I wouldn't be surprised if we start seeing Switch 2 game dumps appear in a few hours. Given the world of recomps/decomps we now live in, that would mean console exclusives playable on arbitrary hardware (a worst-case scenario for Nintendo). We've already seen things like Tears of the Kingdom running at 60fps natively on an iPhone.
Giving LLMs arms and eyes via KVM (or webcam) is a very strong paradigm for this sort of hardware work, as it allows things to be parallelised and run 24/7. Highly recommend people play with this more (to less nefarious ends!) when working on firmware/hardware for external devices.
Worth noting too that this would have easily fetched >$50k via Nintendo's HackerOne (https://hackerone.com/nintendo).
I work with Claude to port games to DOS and build new Classic Macintosh apps [1][2][3] using real hardware.
For a while I was doing the SDcard swap thing; but realized with a usb4vc[4] (hands), a vga/hdmi usb capture dongle (eyes/ears), an old Wemo switch (on/off/reboot) and ftp/appleshare (files/logs) I could have Claude do it all for me.
Claude made me vcctrl[5] that ties all of it together, including an mcp, skills and a webkvm.
1. https://github.com/ecliptik/doskutsu
2. https://github.com/ecliptik/flynn
3. https://github.com/ecliptik/talkip
4. https://github.com/dekuNukem/USB4VC
5. https://github.com/ecliptik/vcctrl
Wow cool! Do you think it’s possible to port classic Mac games to modern MacOS now (thinking Dark Castle, Ancient Art of War at Sea)?
Dark Castle in particular has already been released for modern platforms, PC and Mac:
https://www.ludit.games/
Awesome. And by the original game designer, no less!
I'm working on a IoT device at work and have been the "hands in the lab" for my agent this week. It's been a really weird experience. Making changes to the update/recovery process, so I have to validate several permutations of fault injection (i.e.: abrupt power loss during update step X while on starting version Y).
I would love to give it unattended "hands". I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug. X and Y are relatively small, and I expect this validation to be too costly to do at a regular cadence in CI. I can trivially use a MCCI USB-C switch for the power though.
Tips would be appreciated if anyone here has thoughts.
I built a little harness for an x86 SBC for Claude to do osdev a few months ago.
Janky setup with two ESPs for the serial terminal and to control a servo taped to some microswitches to power cycle the board.
It worked very well, allowing Claude to spend all day and night debugging quirks with the NIC until it was able to get the driver working.
So, I think giving your IoT device some "hands" is probably worth it. For SD card automation, you can find "wireless SD cards" on Amazon/AliExpress that have a microcontroller pretending to be sd card, eg FYSETC SD-Wifi.
> I just thought it was more time efficient to do it manually rather than spend days trying to figure out how to automate SD card pull/plug
Heres the thing. You only have to build the automation once. While it will only take you seconds at most to pull a card, you gotta sit around and be ready for the card to be pulled.
For your problem I see 2 quick things that came to minq very quickly that could do SD card pulling for you.
1) shove a level shifter in between the SD card and device under test and have a micro enable/disable the level shifter when you want to pull/unpull. ( you can even get multiplexer IC that will do the same thing as the level shifter as acting as a switch for the SD card lines, but would allow you to connect the SD card to a 2nd device (the testing pc) to allow you to write/read data from the card when its "pulled" from the DUT.
2) 3D print a jig that will insert/remove the SD card and use a cheap RC servo to handle the movement - again using a mirco to control the servo. gives a more real world test of pulling the SD card. but only gives the the ability to pull/insert. Still required manual effort if you need to read/write to the SD card
Once you have build the jig, you can reuse the jig on the next project, so while it will take some time to do/setup it could save you time later down the road.
Edit: As for the code driving the ICs or Servo, I'm presuming you already know embedded programing, but even so, a simple Arduino sketch will be able to handle it for you, fuck ton of example code already exists for it, and can be easily controlled over USB.
To add on to this for the SD card, you can buy an “SD card extender” that has an SD card on one end and a slot on the other, with a cable in between. Something like that might make it physically easier to get in between the signals by modifying the cable. Nice big wires on this one: https://a.co/d/0cPVVsLE
Sounds interesting!
So far most of my automation has been optical (tweaking display output to show correctly under a lens with odd optical characteristics, hard to simulate computationally), so pointing cameras at the device and letting the LLM iterate and tune display output has been useful.
As with any automation, it all depends on scale. Setting up a harness to repeatedly mess with microSD cards seems way more prone to failure (and false positives) than just doing it yourself, but if you're testing thousands of devices, would probably be worthwhile.
There is hardware available for SD card automation; see the USB-SD-Mux by Linux Automation GmbH / Pengutronix. https://linux-automation.com/en/products/usb-sd-mux-fast.htm...
Automation wins, every single time.
Tears of the kingdom on phone? Where’s that demo haha
Short term the argument that 'piracy exists yet doesn't affect steam sales' holds true.
Long term when someone makes emulating Switch 2 on your Steam Deck a 1-click install I'm not so sure.
The Switch 1 sold about 150m units, the Steam Deck’s sold 6m.
Internet nerds like us aren’t really Nintendo’s target market, I don’t think. Installing emulators or jailbreaking a system isn’t something most of their customer base would have the want or need to do, IMO.
Even some of us internet nerds are Nintendo fans who wouldn't go anywhere near emulating. Apart from any of the moral concerns, it's just such a worse experience: I want to use a touch screen, a portable device, a proper gamepad, etc. Nintendo has built up quite a considerable amount of goodwill since the 1980s, and the reward for that is a pretty loyal customer base.
> I want to use a touch screen, a portable device, a proper gamepad, etc.
For what it's worth: you can use your ordinary Switch controllers on any PC just fine.
Same thing with GTA 6.
A tiny fraction of people might decide to go through hoops to pirate, but most will either play the normal way or do something else.
I had a thread disagreeing with me when i brought that up.
So true. It's dangerous to form world views based on "What HN thinks". This is the best community on the Internet IMHO but were a very tiny slice of the population. "Real people" tend to not behave like us.
all it takes is 1 TikTok trend
Very unlikely to happen via emulation, there's Switch 1 games that the Steam Deck struggles to run already.
More likely to happen via recompilation, if anything. Game ports via recompilation have been taking off in the last month or so, all the way up to systems as recent as the PS5 and Switch 1. It has far less overhead than emulation.
What about putting Steam on your Switch 2?
Totally, convenience always wins. I think this is more of a hardware sales issue for Nintendo though — if what I understand is true, I'd bet that we see Switch 2 games running on other systems before we see a CFW/decrypt-encrypt stack for running pirated games on the Switch 2 itself.
I have no desire to buy Nintendo's hardware as I don't want to play their games badly enough to buy a dedicated console and deal with their practices. I have however enjoyed the last two Zelda titles on my PC where I was able to play them with performance and quality mods. Once it was just another application the barrier of entry was low enough to get my interest. If the games were available as actual PC titles I would have gladly paid for them
You can pay for them if you appreciate the effort that went into making the game. Nothing to stop you buying the Switch cart and playing an emulated version.
Would people still go to such lengths if Nintendo just released their games for the hardware people actually have, like the SteamDeck & PC ?
Still seems rather self-enflicted pain for Intendo due to still pushing locked-down consoles in 2026.
have you ever played first party titles on the switch?
the level of polish and stability on the open world zeldas is astonishing, i never experienced anything like that in third party AA/AAA games form the last 15 years or so, playing on the switch or on the pc.
According to wikipedia, they sold over 23 million units of the switch 2 and over 155 million of the switch. Not that I agree with their aggressive practices but it clearly works. That's a lot more than the Steam Deck btw.
Aren't Nintendo's lawyers second to none (maybe other than Disney)? Or do we think we're in a situation where the legality of it is moot? My gut is that we will see a response from Nintendo.
"You can't stop the signal, Mal."
I actually love watching this from a distance. It's very OG cyberpunk.
They have successfully deplatformed emulator projects from the larger project hosting providers like Github. But they have not stopped them. The real emulator projects have just circled the wagons and started self-hosting their build and dist infrastructure, running independent Forgejo instances, etc. There's still more churn in the community because of the risk profile, and now because of LLMs. But it's settling down and there are a couple stable Switch 1 projects. And actually, their recent DMCA carpet bombing removed a lot of the unsafe forks of emulators on places like Github. Likely leading to more people being directed to the real ones.
It's not impossible to navigate, original Switch has a lively "homebrew community".
I'm working on a custom app for a camera that has a terrible Android app, and I'm working on a similar harness: AI is building both the 3D model and the parts list (basically, a Raspberry Pi, a webcam, and a few servos).
How about the other way around? With ARM Proton a thing now, how long until I can run Steam on my Switch 2?
I’m sure it can’t run AAA titles - but those from a few years ago? And even modern indie titles surely?
DroidDeck (https://github.com/The412Banner/DroidDeck, and things like GameNative) have been huge for Android. Compatibility is fantastic, and you can run most games >3 years old at respectable frame rates on Snapdragon 8 Gen 3 handhelds.
I'm sure if this leads to a full CFW environment people will port it over.
> Worth noting too that this would have easily fetched >$50k
More like $30k, no ("system processes allowing piracy")?
Ah, you're right! Depends on their generosity, but I'd imagine piracy and running exclusives on non-Nintendo hardware is more of a risk to their business than a bootROM exploit.
The category they list in the $50k context are PSC exploits, or TSEC coprocessor exploit when executing the secure code that bootROM provides it.
So, presumably, current and future key material compromission like on Switch 1
Who gets the bounty money in that case? By the looks of the article, Codex did all of the work actually finding a bug. Shouldn't the money go to OpenAI?
The person running it obviously. How is that even a real question? Since when did an AI lab have the right to anything a paid user generated?
I don't understand, how are people using codex for this sort of research? Whenever I try to do bug bounty, research, etc it locks down and I have the "blue" tier access/daylight whatever it's called.
For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
no shortage of answers to this question but the common/short explanation is
- it says codex but not what model, it could have been an abliterated model or something more open to this sorta thing
- convince the model youre not doing the thing youre doing (a bunch of ways to go about this, some short and some long)
its probably possible to convince any model to do any thing if youre clever enough about your approach, kinda just the way this stuff works. General intelligence = infinite ways to direct it.
I think "I want to do stuff to hardware I own", without potential for remote anything, is probably a much easier sell.
Putting the obvious discussion about how much the AI matters in comparison to the user (experienced security expert from a few glances at the blog) aside; i think it's really neat how modern tooling (the KVMs, bluetooth light switch flicker, and usb controller support out of the box) enables this level of automation.
I suppose we can let AI write the entire blogpost :)
I don't know. I feel like the blog reads as very human written and enjoyable overall. Also what's 2 weeks of real work (in tandem with an agent) compared to a few hours for the blog?
please point me to an LLM that can write like that without extensive handholding
this was clearly human written
Layoffs "because of AI" (plus cheap money drying up and offshoring) versus individuals hacking devices and software, and making dummy copies of paid software that are "good enough" for most users. I wonder if that might be an early sign of a turning point in the IT economic cycle, where companies will need to invest more in security services and specialists with extra knowledge who know where and how to make the most of AI before their rivals do.
They won’t. Execs have no idea how to deploy AI. At best they think it means they can give a junior dev $20/month and make them a principal.
Existing companies will fold. Hyper AI companies will eat their lunch.
IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
I sure looking forward for more people hopping on the AI hacking trend to bring them down.
They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.
Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.
I wonder if the SD Express will be taken advantage of in the switch 2 homebrew scene which seems inevitable now.
SD Express is PCIe express after all (also a possible attack vector in itself, see DaMAgeCard). With nvidia drivers for Ampere already on board maybe someone will get an RTX 3090 running on a switch 2.
GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.
And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.
yes at least with GKC I immediately know that game is not playable offline instead of needing to go to https://www.doesitplay.org and hope that someone already documented the game I am looking at, which is the case with PS5
Game key cards are cheaper to make because normal cartridges with the full game cost a fortune right now. And guess why? AI data centers buying up all the memory chips.
On the physical games part, Nintendo still puts their own games on full cartridges, so I don't think they're the ones that deserve the backlash here.
> Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.
How's that? Can't you buy & resell them on the used market? That seems like the only thing a physical cartridge gets you, and not shipping the outdated-on-day-one bits on the cart saves some money, too. Seems like win-win?
- You can't download the game without internet, including re-downloading because you had to free up space
- You can't download the game after they have retired their servers (or if their servers are down / having issues)
- The game ends up taking a lot more storage space as updates are usually tiny when compared to the base game. For reference, the Switch 1 version of Zelda Tears Of the Kingdom takes 16 GB while the latest update takes only 500 MB.
I think most of that is true for games shipped on cart, too. Games often ship broken or missing features which are patched in at launch. Official physical media has not been a reliable method for future accessibility for at least a decade now. It's way past time to start using other methods of preservation.
I think the point is that X years from now, when the servers are turned off, you don’t actually have the game.
I believe that is largely true even if they shipped a game on the cart. Many games ship broken, and they also change many times over the course of their life. I don't think official media can be considered any part of a future accessibility strategy for at least a decade now. Game keycards don't change that fact in any way.
[delayed]
I do agree, in the world of day one patches its not a given having the full, actually playable game on the cart itself isn't a given. We're already largely at the point where game discs and carts are really just license keys, this is just saving some money on the storage.
But it sure was nice when you had the whole game sitting there, without having to rely on some download server still being around. I'm able to go grab a used GameBoy game off the shelf at the used game store, stick it in an old GameBoy, and outside of some games with batteries in them (repairable fwiw) it just works. This has been great for my little kids, as I trust them a lot more with a cheap GBA SP than I do the Switch when going out places. Way more pocketable, way less fragile, and the replacement cost (and repairability) is a lot better.
If I grabbed an old Switch off the shelf in 30 years, popped in a game key card, would I actually be able to play anything? Probably not. There's a good chance most of this Switch 2 will be useless in 30 years time.
options for switch1, ps5, xbox: Disc or code in box.
options for switch 2: Full game on cartridge, switch 2 edition (including switch 1 support), Game Key Card (half physical), Code in the box.
I don't see why should nintendo be blamed for providing more options. if anythng you should blame the publishers for chosing "Code in the box" (looking at you diablo) when GKC would do. or GKC when full cartridge would do.
Well then the cost of physical has to go up. We can guess what your opinion on that is.
The Nintendo cartridges contain the full playable version of the game.
Third party publishers often just put the key on it. So blame them for that
The Switch 2 jailbroken with the help of a Switch Flicker. Really funny.
The flicker in question is switchbot, I have plenty of them I use for.. things.
Teeny tiny teledildonics
Hey, it's not the size that matters, it's how you use it!
If one follows this and jailbreaks their Switch 2, are they in danger of getting their account banned by Nintendo, and their games unaccessible?
The chances of getting banned for this are extremely high. The Switch 2 has plenty of mechanisms to detect tampering. Even if you were completely offline during the process and then reset the Switch afterward, there are logs. People have already been banned for using the MIG Switch to play backups of Switch 1 games on the Switch 2.
I wonder if this would be a reason to sue in the EU ? IIRC you can even replace the firmware without voiding the warranty, unless the manufacturer can prove the firmware cause the issue.
Here I guess you could just RMA the device or even sue Nintendo for retaliating after you just used the device you bought ?
Also, Louis Rossmann, please buy a Switch 2, apply the exploit & go online. Thanks in advance! :D
I also don't think remotely bricking/banning the console is legal in the EU.
they dont need to brick the machine - they can simply ban your online account, which they can use EULA to make you agree to before getting that account. You lose your games if the game requires online verification (which implies an account). This way, you won't be able to play your games purchased, even if it's a physical copy - you can only play games that don't have verification like this (i dont own a switch, so i dont know if this is actually true).
The law has superiority over the EULA, they could probably get away with disabling online multiplayer with concerns of cheating but I don't see any legal basis on how they could take away purchased games. That would go against any consumer right laws.
I jailbroke my Switch 1 the day I bought it, was banned from Nintendo Online the next day. The only games I bought were physical. I was told this would happen, so it wasn’t an issue at all.
I’ve told my friends if you plan on playing online on it, definitely don’t jailbreak.
IIRC the current approach makes your switch dual boot the unmodified firmware and the custom firmware with online capabilities disabled, so you could still play online and avoid bans.
But I wouldn’t trust that with an expensive account-bound digital library.
never go online and even if you reset the console afterwards , assume the console will get banned when connect to the internet as they know to look for markers of customer firmware.
Switch 1 hacks bypass this by copying ofw from flash onto the microSD card and patching it there to my crude understanding, so that unsigned code never touches the firmware on the system memory.
Something like this definitely will be needed again for the Switch 2 so I'd only do this if you don't care about being banned.
EDIT: ofw = OFW = official firmware
No doubt we will soon enough get de-Nintendo’d alternatives that service jb’d devices
(I'm interested in Homebrew, and I'd love to port my self made game dev framework on Switch 2, but I'm afraid of losing everything)
Yes, you will get banned.
Not your account but the Switch. That’s how it works in Switch 1
Definitely a risk.
Yes, this is true of all jailbreaks.
I had assumed Codex would disallow hacking, have I been wrong all this time or are people jail breaking Codex first?
In my experience, you can often get around this by trying again. I've had prompts that were rejected, but as soon as I started a new session, it worked.
I am dumbfounded on why Nintendo still allowed a game that allows to run a full coding language, one that already led to an exploit on the 3DS.
I haven't got the PoC to land successfully on my device yet, but it does seem to be legit.
Does Nintendo et al have teams dedicated to jailbreaking their own consoles first before a jailbreak is found in the wild ?
Do they use AI to review their code for exploits?
PS2 can also be jailbroken with Yabasic, another BASIC interpreter, which was given for free in some consoles in Europe. But typing the exploit isn't very practical compared to other methods (and this exploit was found out later)
Looking forward to the eventual full jailbreak. Maybe sooner rather than later with all of the advanced AIs of today.
Nintendo recently banned my Switch 2 from accessing online services. This effectively turns it into a fancy brick, since you can't install any digital games or updates - only games on physical cartridges will work (without possibility of installing updates). This is despite both the console and all games being purchased legitimately. The only weird part is me being in Ukraine where there is no official Nintendo presence, and so I had to use US eShop (with PayPal and prepaid digital codes). Nintendo support is extremely unhelpful, they just say that "unauthorized transaction detected" or something like that, without offering any human review/appeal path.
It's one thing to reject a transaction in the eShop, it's another thing to permanently ban console for that. What a shit company with shit business practices. 0/10, would not recommend, would not touch anything Nintendo-related ever again without a jailbreak.
This exploit requires an eShop only game.
Ive only bought 1 thing recently from Nintendo within the last year: a Switch Pro controller.
Why the controller? Cause Switch emulators. They work wonderfully. I dont have to pay a cent for games. I can download the games and their updates. And there's quite a few Switch emulators.
Im not going to pay a company to automate my own abuse.
I'm confused. So you just completely pirate all your games?
No. Ive bought games, including recently.
I agree with Gabe Newell, that piracy shows a severe service delivery option. And in the case of Nintendo, they have no problem destroying your hardware on a perceived "back action on your owned hardware". Of course, hacking laws dont apply to companies. And Switch does braindead things like "not permitting to back up save data or back up digitally purchased games"...
So yeah, in cases of Nintendo, I acquire appropriately. They have proved themselves to be an absolute horrible actor here. Fuck'em.
really nice work, and an enjoyable read too
this seems like the right level of human/agent collaboration to me. there's so much that codex can automate and giving it more tools is definitely super high leverage.
Might be a bit offtopic, but I really like that it feels like a real human wrote this blog post. I'm reading way too many blog posts, along with GitHub PRs and Issues, that just seem AI generated. This style of writing is just nice
Just tell me when I can download games and where to get them.
A lot of software in the pre-ai era has relied on how intensely tedious it would be to crack as their primary sense of security, and it certainly seems like systems built in that way are going to be much more vulnerable now.
This is great. I wanted to prototype some couch co-op games and be able to play them on my Switch 2.
What SW is needed for the jailbreak to work? Is it worth trying to buy a used console now?
This works on the latest firmware, until they patch it, you can buy even new consoles that are vulnerable.
written at the top: current 23.01 version (i did get the sw2 on first day because you never know but...)
my bad, skipped the top and was looking at the bottom.
It's unfortunate that this requires a specific $25 game (SmileBASIC 4)
Don't need to buy the game.
Make a JP Nintendo account and download the demo (not available globally) https://store-jp.nintendo.com/item/software/D70010000010547
I did not know that.
I remember having to buy GTA Liberty City Stories to jailbreak the PSP. Then there was the infamous Cubic Ninja jailbreak which caused the game to become worth hundreds of dollars.
Almost every console jailbreak required the use of a specific game, going all the way back to the original Xbox. PS1 and 2 required a specific disc or swapping in a legit disc. Even the NES required a real game cart alongside your third party carts.
It turns out that opening locks is a hell of a lot easier when you have a key.
Console hacking has been like that for a very long time. But usually after the first exploits are found and hackers can start playing with things, many more follow. Though Nintendo has been stripping down the OS every new console so there’s less interesting stuff to exploit outside of games.
This gives visibility to a lot more unencrypted code, so just give it time. More bugs will be found quickly now that the code is inspectable.
> thanks to my friends in Dabney House ...
Cool to see this happened at Caltech :)
Love the power button nubbin doing the hard work
Imagine an open console, that sells games anyway, because they are fairly priced and convenient. The console producer doesn't have to spend money to harden security, secure processors and can focus on performance instead.
Oh wait, is that not the Steam deck?
Reminds me of the Playdate
how do you figure the steam deck "sells" that many "games"?
most of the top steam charts are free to play.
about 1/5th of all active players on Steam are playing Valve's first party titles.
it sells games, yes. but is it selling games the way a switch does? no.
And in the process obsoleting the work of many very dedicated fans who went to great lengths in order to record the Mario Kart World soundtrack (iykyk)
For those who don’t know: https://youtube.com/watch?v=aet8rWKs-A0
Basically, since it wasn’t possible to extract the files from Switch 2 games, fans who wanted to listen to the Mario Kart World soundtrack outside of the game would record the audio output from their console and exploit glitches in-game to prevent sound effects from playing and phase-cancel overlapped recordings of the same song with each recording being interrupted in different parts to isolate the music then crossfade the remaining segments into the complete track.