安全研究人员开发了名为 ns2jb 的软件越狱工具，成功破解 Nintendo Switch 21。这是该主机首次被越狱2，标志着模组、模拟器和自制程序使用的局面正式开启2。
该越狱工具的破解链条复杂且多层次1。研究人员首先利用 WebKit 浏览器的漏洞通过自定义 Wi-Fi 捕获门户网站实现初始代码执行1，随后在 SmileBASIC 游戏解释器中发现 32 位整数溢出漏洞——当计算 position + count 时会发生溢出，尽管在检查时能够通过1。进一步地，他们通过 fs 系统模块中的缓冲区溢出漏洞实现任意读写能力：当路径包含"/..\"时，系统仅分配 0x301 字节缓冲区但接收更大的数据1。通过将 SmileBASIC 连接对象的保存进程 ID 设置为 1，研究人员获得了完整权限1，最终通过替换 IPC 句柄后的 ExeFS 对象绕过加载器的加密检查，实现以任意系统模块权限执行代码1。
越狱使用者可以通过这一工具运行自制程序、创建游戏模组、使用模拟器并备份存档1。该越狱需要进行一次 25 美元的电子商店购买以获得 SmileBASIC2。已知的应用包括《马里奥赛车》世界模组2。
Security researchers have developed a software jailbreak for the Nintendo Switch 2, known as ns2jb, marking the first successful breach of the console's security architecture.1 The exploit chain leverages multiple vulnerabilities across different system components to achieve arbitrary code execution with elevated privileges.1
The jailbreak begins with a WebKit n-day vulnerability accessed through a custom Wi-Fi captive portal to establish initial code execution.1 From there, researchers identified a 32-bit integer overflow flaw in the SmileBASIC interpreter, where the position and count parameters can wrap around during the security check but overflow during calculation.1 A subsequent buffer overflow vulnerability in the file system module is then exploited—when file paths contain '/..', the system allocates only 0x301 bytes but receives larger data, enabling arbitrary read and write access.1 By manipulating SmileBASIC connection objects to set the saved process ID to 1, attackers gain FullPermission access.1 The jailbreak culminates in bypassing the loader's encryption verification by replacing IPC handles and ExeFS objects, allowing arbitrary code to run with the privileges of any system module.1
The successful jailbreak requires a one-time $25 eShop purchase and has already enabled modifications, emulation, and homebrew applications.2 Known applications include custom mods for Mario Kart.2
评论
还没有评论，欢迎留下第一条。