Found a userland exploit in Gravity Circuit on Nintendo Switch (title 01008D9019128000, v1.0). It's a save data exploit, same class as balatro-switch-rce by Luminger. Huge thanks to them, this project is heavily based on their work. Gravity Circuit runs on the LÖVE game engine (LuaJIT + PhysFS). When the game mounts the save directory before its own files, any Lua file you put in the save shadows the original. So you drop a custom main.lua in the save and it runs instead of the game's. This isn't specific to Gravity Circuit, it's how LÖVE handles saves, so other LÖVE games on Switch are probably vulnerable too. Already confirmed the same trick works on Kingdom Rush on PC, Switch adaptation still in progress. What we have right now is a proof of concept with network services running in userland: RPC on port 9026, a Lua REPL you can connect to over the network FTP on port 5000 to browse the game's filesystem Native SDK calls (nn::socket, nn::nifm) through a JankFFI gadget chain, no dlsym The save has to be placed using JKSV on a modded console for now, no FS support yet. Should also work on Switch 2 since the vulnerability is in the game's runtime, not the firmware. I just haven't been able to test it because I don't have access to one. FS support would open the door to homebrew that can access stuff outside the game (save editors, dumping, modding, SD card access, etc). If anyone wants to pick this up and push it further, contributions are welcome. Source and instructions: https://github.com/figurophobia/GravCirc-Switch-rce   submitted by   /u/DavidEstrenhido [link]   [comments]