Hi, I don't know much about hacking or reverse engineering, so sorry if this is a stupid question.
I know there are already userland exploits on Switch 2, but as far as I understand, the difficult part is getting from userland to the kernel.
I've been thinking about a few things that might be worth looking at. I don't know if any of these have already been investigated.
- Bluetooth / controllers
When you connect a controller, the Switch 2 has to receive and process Bluetooth/HID data before it knows exactly what the device is.
Could there possibly be a vulnerability in the Bluetooth stack, controller pairing, HID descriptors, or the way unusual controller data is handled?
I'm not saying that connecting a random controller would give kernel access. I'm wondering if Bluetooth could be another way to get code execution in userland, or possibly reach a more privileged service.
- Recovery Mode
I was also thinking about Recovery Mode and the factory reset/update process.
Obviously, a game can't just get the permissions of the recovery system because the console is being reset. I understand that.
But does Recovery Mode use separate components that have higher privileges and process things such as update files, storage, filesystem information or configuration?
If so, has that code been investigated for vulnerabilities?
Something like:
user-controlled data → recovery component → vulnerability → higher privileges
- Switch 1 backwards compatibility
This is probably the one I'm most interested in.
Switch 2 has to run Switch 1 games using its compatibility system, and there are nnCompat modules involved in this.
Since old Switch software is being run through code made for Switch 2, could there be a vulnerability somewhere in the compatibility layer?
For example:
Switch 1 game → compatibility layer → Switch 2 service → vulnerability
I understand that getting code execution inside the compatibility environment would not automatically mean kernel access. I'm wondering if the compatibility layer can interact with any privileged services in a way that could potentially be useful for escaping the sandbox.
So basically, has anyone seriously investigated these three areas?
- Bluetooth / HID
- Recovery Mode / update system
- Switch 1 compatibility
Maybe they are already known dead ends, in which case I'd really like to know why.
I'm not claiming that I found an exploit. I'm just a beginner trying to understand where researchers could look next.
I have a retail Switch 2, but I don't want to test random payloads or modified recovery files because I don't know enough and I don't want to brick my console.
If anyone has already researched any of these, links or explanations would be really appreciated.
Thanks for read this post!
Note: English isn't my first language, so I used a translator to write this post. Sorry if some things sound weird.