A Balatro save file opens a homebrew entry point on Switch and Switch 2, with no kernel access or CFW
Luminger has published a proof of concept that abuses how Balatro's engine loads files. The game boots a custom launcher with a Lua console and FTP, all inside its own process.
It comes down to load order
Balatro runs on the LÖVE engine, which mounts save data ahead of the game's own files. A save carrying the right Lua files replaces the originals, so the title boots a launcher instead of the card game. balatro-switch-rce needs no cartridge modification or title update.
The launcher offers a network Lua console on port 9026, FTP for its own files on ports 5000 and 5001, and native calls from Lua. Those services have no password or encryption, which the author says is deliberate.
The catch
You need the physical Balatro cartridge for Switch, tested on revisions 1.0.1f and 1.0.1o, and an already hacked Switch with JKSV to restore the prepared save. The target console doesn't need CFW. On Switch 2 the save arrives through Nintendo's official data transfer and the game runs in compatibility mode; the native Switch 2 edition won't work.
What it doesn't do
Everything happens inside the game's process, with no kernel or system module access. The README says it doesn't load backups and can't run commercial games. Restoring the save deletes your existing Balatro save, and there's no way out from inside the app if something breaks, so you'd have to restore again with a save manager.
The author warns that using it may violate Nintendo's terms and can get a console banned.
The repository is GPL-3.0, and its latest change, from November 6, expands native calls.
