Gezine/CivSwitch

Claims below include README evidence. A matching quote or worker agreement does not establish that a claim is correct. Category majority among 2 workers. Version 1.

CivSwitch is a toolchain that exploits a chat XSS vulnerability in Civilization 7 to achieve userland code execution on Nintendo Switch.

XSS toolchain for the Switch 1 edition of Civilization 7.

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

It provides a toolchain for researchers and users to execute arbitrary JavaScript payloads on Nintendo Switch consoles by exploiting a chat XSS vulnerability in Civilization 7.

XSS toolchain for the Switch 1 edition of Civilization 7.

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

It uses a Raspberry Pi Pico as a USB HID keyboard to type a chat XSS payload into the game, which then loads a Remote JS Loader and a persistent boot trigger.

PicoSwitch — clean, compilable Pico firmware (RP2040 + RP2350) that types a chat-XSS payload into the Switch (USB HID macro).

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Exploits the Civilization 7 game cartridge to achieve userland code execution on Nintendo Switch.

XSS toolchain for the Switch 1 edition of Civilization 7.

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Creates a persistent boot trigger in the game's savedata that executes the payload on every console boot.

installer-creator — given any JavaScript payload, produces the boot-persistent installer (XSTRIG.Civ7Save trigger written to savedata)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Uses a compression and encoding pipeline to transport the payload through the game's chat system.

Ships with compress.js (chat transport: terser -> deflateRaw -> base-25 chunked img/onerror lines with censor armor).

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Provides a Python script to send arbitrary JavaScript files to the running Remote JS Loader.

python send_js.py [port] file.js

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

The Pico firmware is derived from the Pico-Switch-Controller project.

The PicoSwitch firmware is based on Pico-Switch-Controller by Element2424

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

PicoSwitch is clean, compilable Pico firmware that types a chat-XSS payload into the Switch via USB HID macro

PicoSwitch — clean, compilable Pico firmware (RP2040 + RP2350) that types a chat-XSS payload into the Switch (USB HID macro)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Default payload is the Remote JS Loader bootstrap including the exploit core and TCP loader

Default payload = the Remote JS Loader bootstrap (exploit core + TCP loader)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Ships with compress.js for chat transport using terser, deflateRaw, and base-25 chunked img/onerror lines with censor armor

Ships with compress.js (chat transport: terser -> deflateRaw -> base-25 chunked img/onerror lines with censor armor)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

installer-creator produces the boot-persistent installer by writing the XSTRIG.Civ7Save trigger to savedata given any JavaScript payload

installer-creator — given any JavaScript payload, produces the boot-persistent installer (XSTRIG.Civ7Save trigger written to savedata)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

From every boot, the payload runs from savedata when loading a game, and the loader port stays up surviving console sleep and wake

From then on, every boot: main menu -> Load Game -> the payload runs from savedata (and if the payload is the loader, :9026 is up at boot — and survives console sleep/wake)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

send_js.py sends any payload to a running loader and prints the log output the console streams back

send_js.py at the root sends any payload to a running loader

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Only the 1.0.0 version of the game in physical cartridge is supported

Only the 1.0.0 version of the game in physical cartridge is supported

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Every switch 1/2 firmware 20.x.x and up to current version 23.0.1 should work

Every switch 1/2 firmware 20.x.x and up to current version (23.0.1) should work

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Limitation: Requires Nintendo Switch firmware version 20.x.x or higher.

Every switch 1/2 firmware 20.x.x and up to current version (23.0.1) should work.

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Limitation: Requires blocking Nintendo servers using 90DNS to prevent interference.

Connect to Internet using 90DNS to block Nintendo servers.

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Limitation: Only the 1.0.0 version of the game in physical cartridge is supported

Only the 1.0.0 version of the game in physical cartridge is supported

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Limitation: Build instructions are provided for Ubuntu 24.04

On Ubuntu 24.04

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Limitation: Users must connect to the Internet using 90DNS to block Nintendo servers

Connect to Internet using 90DNS to block Nintendo servers

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

Limitation: The Pico types the chat XSS which takes approximately 87 lines and 15 minutes

The Pico types the chat XSS (~87 lines, ~15 min)

Quote matched the README or GitHub description at extraction. Same claim and quote from 1 worker(s). Interpretation not reviewed by a maintainer.

embedded · other