Security researchers and console modders extracted internal game directories from Deltarune, the beta build of The Duskbloods, and Mario Kart World on Saturday (24) using the newly released ns2jb software jailbreak for the Nintendo Switch 2. Responding directly to the security breach, Nintendo delisted the programming application SmileBASIC 4 from its digital eShop across North America, Europe, and Japan to cut off the entry point used by the exploit.
Reports detailing the extraction of raw game files, a technical procedure known in the modding community as dumping, spread across social media networks over the weekend. “The first Nintendo Switch 2 ROMs are officially being extracted, starting with Deltarune (Chapters 1 to 4)! A leak from the Underminers Discord reveals that PC mouse controls are mapped to simulate both Joy-Cons in Mike’s minigames. The datamining scene is taking off!”, stated the Project Lightning account.
Sammy Hajhamid chains integer overflow in SmileBASIC 4 on system version 23.0.1
Security researcher Sammy Hajhamid, known online by the handle pepsipu, engineered the ns2jb tool with assistance from OpenAI’s Codex artificial intelligence platform. To automate the discovery process, Hajhamid connected a first-generation Switch and a Nintendo Switch 2 to two JetKVM remote management devices alongside a Bluetooth-operated physical switch that pressed the power button whenever the hardware crashed, allowing the AI agents to test code continuously. The resulting method targets system firmware version 23.0.1 by triggering a 32-bit integer overflow in array management within SmileBASIC 4 (version 4.4.9)—a roughly $25 programming application originally released for the first Switch that runs on the newer console via backward compatibility—before chaining it with a buffer overflow in the console’s filesystem service.
Exploiting this software vulnerability allows users to execute arbitrary native code with the permissions of standard system modules, back up game save files, and run custom modifications on retail titles without opening the console shell to solder a physical modchip. During the initial public demonstrations of the flaw in Mario Kart World, which circulated on Thursday (22), modders injected external character models directly into the racing roster, including Sonic, Hatsune Miku, Cinnamoroll, Peter Griffin, and Red from the Angry Birds franchise.
Internal assets uncovered in Deltarune, The Duskbloods, and Mario Kart World
Beyond allowing custom racers on the track, directory access granted by the ns2jb tool enabled dataminers to inspect internal folders across three commercial titles available on the Nintendo Switch 2 hardware:
- Deltarune (Chapters 1 to 4): extraction of internal role-playing game assets and discovery of computer mouse input configurations mapped to simulate dual Joy-Con controllers during minigames featuring the character Mike.
- The Duskbloods: circulation of screenshots showing file analysis from the beta test version of the title developed by studio FromSoftware.
- Mario Kart World: identification of a previously unseen three-dimensional character model of Princess Peach stored inside the racing game’s internal directories.
Userland restrictions keep the jailbreak tethered and prevent piracy
While the vulnerability enables directory inspection and visual modding, the ns2jb exploit faces technical walls that prevent software piracy or complete administrative control over the hardware. Unlike the original Nintendo Switch, which saw community developers build comprehensive custom firmware packages such as Atmosphère and required hardware interventions or soldered modchips on later motherboard revisions, the current Switch 2 method operates strictly through software while remaining confined to userland privileges.
Because of this confinement, the tool functions as a tethered jailbreak, meaning all modifications reside solely in volatile memory and are wiped every time the console powers down or reboots, forcing the owner to re-run the exploit sequence at each startup. Furthermore, ns2jb does not breach the operating system kernel or expose Nintendo’s hardware encryption keys, making it impossible to install permanent custom firmware or boot the extracted game dumps on computer emulators.
eShop takedown, researcher communications, and WebKit browser testing
Pulling SmileBASIC 4 from regional eShop storefronts marked the Japanese manufacturer’s first public countermeasure to halt the spread of the jailbreak among console owners, prompting users to warn against updating firmware just to seek alternative download routes. Behind the scenes, security researcher Gezine, recognized for disclosing PlayStation 5 vulnerabilities as well as a separate userland flaw for Switch consoles in July, reported receiving an official email from Nintendo shortly after the exploit gained traction.
As of Monday, October 26, 2026, the specific wording of Nintendo’s message to Gezine and whether the correspondence contained cease-and-desist demands or legal threats remain undisclosed. Independent verification regarding the full scope and authenticity of the files linked to The Duskbloods beta and the Princess Peach 3D model is also pending. While compatibility between ns2jb and future firmware patches remains uncertain, security researchers are conducting early-stage investigations into a potential vulnerability within the console’s WebKit browser engine, an avenue that would bypass the need for the delisted eShop application.
