A new exploit for the Nintendo Switch 2 uses the Switch 1 edition of Sid Meier’s Civilization VII as an entry point.
The toolchain, known as CivSwitch, was developed by hacker Gezine and uses a cross-site scripting (XSS) vulnerability in the game’s multiplayer chat functionality to execute JavaScript payloads. The exploit relies on the Switch 1 edition of Civilization VII running on the Nintendo Switch 2 via backward compatibility.
CivSwitch consists of two main components i.e. PicoSwitch and installer-creator. PicoSwitch is firmware for Raspberry Pi Pico boards based on the RP2040 and RP2350 microcontrollers. It acts as a USB keyboard, automatically typing an approximately 87-line chat payload into the game’s multiplayer lobby. This process takes around 15 minutes and launches a Remote JavaScript Loader on the console, which listens for incoming payloads over TCP port 9026.
The second component, installer-creator, allows users to install a persistent boot trigger by uploading a specially prepared save file. Once installed, the payload can automatically execute whenever the console boots and the user selects Load Game from the main menu. The Remote JavaScript Loader can also remain available after the console enters sleep mode and wakes up once again.
It’s worth noting that CivSwitch supports only version 1.0.0 of the physical cartridge release of Civilization VII. The toolchain is designed to work with Nintendo Switch 1 and 2 firmware versions 20.x.x and above, up to version 23.0.1. Testing has been conducted on an original Switch running firmware 22.5.0 and a Switch 2 running firmware 20.4.0 and 23.0.1. The project also includes a Python utility, send_js.py, which allows users to transmit custom JavaScript files to a running loader and receive console log output.
The exploit was originally performed via SmileBASIC 4. This led to Nintendo removing the Switch 1 game from the eShop in order to block access. The jailbreak, known as ns2jb, was shared by security researcher Sammy Hajhamid for Nintendo Switch 2 firmware version 23.0.1.
