Switch 2 dock hack: a €40 USB-C hub tricked into acting like Nintendo's

To see what, the author put a USB-PD sniffer (a WITRN K2, which sits in the middle of the cable) on the official dock. The dock introduces itself as a Nintendo device (vendor ID 057E, product 2062). It also announces a Nintendo-specific SVID, 057E, next to DisplayPort, and the console enters Nintendo's mode before DisplayPort's. After DP setup comes a series of vendor messages. Each request starts with 057E0001 plus a command number, and the dock replies with 057E0041, the same command and some data.

The author doesn't know what most of it means. Some replies look like firmware version records.

How the hub was patched

The hub's power controller, a VL103, runs an 8051 microcontroller with 32 KiB of firmware. The author added a handler of about 540 bytes in erased space, plugged into the stock PD stack. It answers Nintendo's messages, and anything it doesn't recognize still gets the stock "Not supported" reply. The version replies are copied from the official dock and don't describe anything real in the hub.

The vendor ID alone wasn't enough: the Switch checks the full identity. One revision also removed a pause of roughly 3 seconds, which came from the console asking for command 02 and waiting after "Not supported". The patch also offers 15 V at 2.8 A, like the dock.

TV mode then worked, but HDR looked pale. The display, RGB range, the hub in general and the PD traffic were ruled out. The likely cause was color space: the DP-to-HDMI converter, an RTD2142, was labeling the picture BT.709 in the HDMI AVI InfoFrame, while the console sends BT.2020. The author dumped that chip's unsigned 2 MiB firmware over DP AUX with flashrom to dig further.

The author says Claude and GPT helped heavily with disassembly and patching, though a safety classifier stopped Claude when it tried to launch Ghidra, so GPT handled the decompiling.