540 Bytes of Firmware Turn a $45 USB-C Hub Into a Switch 2 Dock

A hobbyist needed only 540 bytes of added code to make a $45 Cable Matters USB-C hub act as an official Nintendo Switch 2 dock. The modder, writing under the name mkopec, detailed the work in a blog post and confirmed TV mode now works through hardware Nintendo never certified.

The number matters because it measures the actual barrier. The console's dock check is not encryption in any meaningful sense here. Two accessory makers told The Verge the check relies on encryption with a dedicated chip. Copied identity data and fixed replies proved sufficient in this case.

What does the patched firmware actually do?

The modified VL103 replies to Nintendo's vendor messages and returns the same identity as the official dock. The stock hub charged the console without trouble, but it showed no picture, even though it negotiated power and DisplayPort Alt Mode correctly.

The modder captured the official dock's traffic with a WITRN K2 inline USB-PD sniffer and found it advertises two Standard or Vendor IDs: one for DisplayPort, one for Nintendo's own mode. The console enters Nintendo's mode first, then DisplayPort, and only then sends Nintendo's vendor messages.

"Nintendo went in a proprietary direction (as they so often do)," the modder wrote, explaining the motivation: the official dock is bulky, and a patched travel hub is not. The hub "still works normally with my PC and my phone."

The work proceeded incrementally across seven firmware versions:

• Answers to Nintendo's discovery, mode entry, and echo commands
• Power delivery raised to 15 V at 2.8 A, matching the dock
• Reported vendor ID changed to Nintendo's
• Full masquerade as the official dock, enabling TV mode
• A full sequence match that removed a roughly 3-second pause

The target was the VL103 USB-PD controller's firmware, just 32 KiB in total. The modder dumped it with the vli plugin of fwupd, the Linux firmware update tool, and flashed changes over USB through the VL817 hub chip.

What is inside the hub?

The Cable Matters 7-in-1 triple display hub is a collection of separate specialized chips, not a single SoC:

• VL103 USB-PD controller and VL817 USB hub chip, both from VIA Labs
• RTD2142 DisplayPort Multi-Stream Transport chip from Realtek
• XT25F16B flash memory

The stock hub reports VIA's vendor ID. That identity had to change for the mod to work.

Was the HDR bug fixable too?

Yes, with a second patch. HDMI output was washed out with HDR enabled. The modder traced the cause to the hub's AVI InfoFrame signaling BT.709, the standard dynamic range color space, instead of HDR's wider BT.2020. A 108-byte patch to the RTD2142's firmware fixed it, flashed with flashrom over I2C carried on the DisplayPort AUX channel through the same USB-C cable.

One third-party dock's firmware contains a debug string, "switch2 color space patch," which suggests vendors already know about this issue. HDR through the hub's own DisplayPort port remains washed out.

What is still broken or unverified?

Plenty. The hub's firmware has no variable refresh rate support, but because the patched hub identifies as the official dock, the console offers VRR anyway. Turning it on froze the DisplayPort picture; HDMI stayed at 60 Hz. A separate Linux test with Adaptive-Sync advertised and an EDID override in place blacked the screen the moment the frame rate varied. The feature stays off.

The post shares no code, patch files, or repository, even though the method is well explained. The USB ports and Ethernet were not tested rigorously. The post does not say which Switch 2 system version was used. The modder admits not understanding many of Nintendo's commands, so the hub's version replies are verbatim copies of the official dock's, and unrecognized commands still receive the stock reply.

Does Nintendo tolerate this?

The company said last year that it "does not have any intention to hinder or invalidate legal third-party dock compatibility." The record since then is less reassuring. System update 21.0.0 left some third-party docks charging but with no video output, and vendors had to ship updated firmware as a fix.

That is the caveat on every promise this mod makes. A vendor-backed dock gets a patch when Nintendo changes the handshake; this one has a single hobbyist behind it. Would-be modders could find themselves on their own when the next update arrives.