The "unpatchable" exploit that makes every current Nintendo Switch hackable


Recommended Posts

A newly published "exploit chain" for Nvidia Tegra X1-based systems seems to describe an apparently unpatchable method for running arbitrary code on all currently available Nintendo Switch consoles.  Hardware hacker Katherine Temkin and the hacking team at ReSwitched released an extensive outline of what they're calling the Fusée Gelée coldboot vulnerability earlier today, alongside a proof-of-concept payload that can be used on the Switch.

 

"Fusée Gelée isn't a perfect, 'holy grail' exploit—though in some cases it can be pretty damned close," Temkin writes in an accompanying FAQ.

 

The exploit, as outlined, makes use of a vulnerability inherent in the Tegra X1's USB recovery mode, circumventing the lock-out operations that would usually protect the chip's crucial bootROM. By sending a bad "length" argument to an improperly coded USB control procedure at the right point, the user can force the system to "request up to 65,535 bytes per control request." That data easily overflows a crucial direct memory access (DMA) buffer in the bootROM, in turn allowing data to be copied into the protected application stack and giving the attacker the ability to run arbitrary code.

 

On the Switch, the hardest part of the exploit seems to be forcing the system into USB recovery mode. To do this without opening the system requires shorting out a certain pin on the right Joy-Con connector (the bit on the side of the system where the Joy-Con clicks into place). The hacking team at Fail0verflow tweeted a picture of a small plug-in device that can apparently provide this short-out easily, and the team joked that a simple piece of wire from the hardware store can do so today. Temkin also tweeted a picture suggesting that simply exposing and bending the pin in question would also work.

 

 

 

 

 

Full article@ Ars Technica

Hopefully this doesn't kill software releases and sales à la NDS / PSP :/ Nintendo has been working on a new SoC for a few months now though; presumably because they were notified of the exploit, so if you want one of these exploit capable Switches buy one soon.

  • 3 weeks later...

I assume this has been blown wide open now? I'm seeing entire switch rom library dumps happening on private torrent sites. Not that I've looked into what's happening as this progresses much at the moment.

  • 2 weeks later...
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Can't get a pic of the physical server as it's in a DC, but what i'm running on it is doable. All for my own use except one VM used by a friend to run her site and other things.
    • Immediately using a VPN that makes me appear to be in the EU.
    • That’s not how it works here. Another article will be created instead.
    • Free WinX DVD Ripper Platinum license (normally $69.95) offer ends today by Steven Parker Claim your full license (valued at $69.95) for free before the offer expires on July 25th, 2025. Grab your free licensed copy of WinX DVD Ripper Platinum (for Windows) or MacX DVD Ripper Pro (for macOS) and start backing up and digitizing your DVD collection today. Whether you’ve built a DVD library over the past decades or just want to preserve a few treasured discs, WinX DVD Ripper Platinum makes it easy to convert your physical DVDs into digital files — protecting them from scratches, damage, or loss. With just a few clicks, you can watch your favorite DVD movies on your smartphone, tablet, laptop, smart TV, or store them on an external drive or NAS for easy access anytime. This exclusive giveaway is available only for TradePub users! Get a free license for WinX DVD Ripper Platinum V8.22.2 (Windows) or MacX DVD Ripper Pro V6.8.2 (macOS) — no cost, no catch. Take this opportunity to preserve your movie collection and enjoy timeless classics wherever you go this holiday season. Main Features: Convert DVD to MP4, ISO, FLV, AVI, MOV, MP3, TV, NAS, computer, game console, iPhone, iPad, Android, etc. Supports any DVDs, including homemade DVDs, newly released DVDs, old DVDs, 99-title DVDs, non-standard DVDs, regional DVDs, workout DVDs, movie/TV Series DVDs, damaged DVDs, badly structured DVDs, etc. 1:1 DVD backup. Copy entire DVDs to ISO or VIDEO_TS folders to create complete backups, preserving the menu, movies, extras, and all other content without any changes. Fast DVD Ripping: Supports hardware acceleration, multi-core CPUs, and hyper-threading technology for quick conversions. Ripping a 2-hour DVD to MP4 (H.264/HEVC) can be completed in as little as 5 minutes. High-Quality Output: Use "Yadif Double Frames" De-interlacing Engine and High Quality Engine to ensure the good quality of the output video/audio. Edit DVD: cut, merge, crop video, add subtitle, and adjust parameters. This free license offer ends today, July 25, 2025! Download WinX DVD Ripper Platinum (worth $69.95) for free Offered by Digiarty, view other free resources The below offers are also available for free in exchange for your (work) email: Exclusive Giveaway - Get WinX DVD Ripper Platinum ($69.95 Value) FREE – Expires 7/25 Alice and Bob Learn Secure Coding ($30 Value) FREE – Expires 7/30 Building Agentic AI Systems: Create intelligent, autonomous AI agents that can reason, plan, and adapt ($38.99 Value) FREE – Expires 7/30 Aiarty Video Enhancer for PC & Mac ($49.5 Value) Free – Expires 7/31 The Ultimate Linux Newbie Guide – Featured Free content Python Notes for Professionals – Featured Free content Learn Linux in 5 Days – Featured Free content Quick Reference Guide for Cybersecurity – Featured Free content We post these because we earn commission on each lead so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. Other ways to support Neowin The above deal not doing it for you, but still want to help? Check out the links below. Check out our partner software in the Neowin Store Buy a T-shirt at Neowin's Threadsquad Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: An account at Neowin Deals is required to participate in any deals powered by our affiliate, StackCommerce. For a full description of StackCommerce's privacy guidelines, go here. Neowin benefits from shared revenue of each sale made through the branded deals site.
  • Recent Achievements

    • Very Popular
      d4l3d earned a badge
      Very Popular
    • Dedicated
      Stephen Leibowitz earned a badge
      Dedicated
    • Dedicated
      Snake Doc earned a badge
      Dedicated
    • One Month Later
      Philsl earned a badge
      One Month Later
    • One Month Later
      armandointerior640 earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      627
    2. 2
      ATLien_0
      236
    3. 3
      Xenon
      162
    4. 4
      neufuse
      123
    5. 5
      +FloatingFatMan
      122
  • Tell a friend

    Love Neowin? Tell a friend!