USB-C Hub Firmware Patch Lets a $45 Adapter Pass as a Switch 2 Dock

The interesting part of this hack isn't the price tag. It's that a commodity hub with a few off-the-shelf chips can convince a console it's a licensed Nintendo accessory, and the change needed only a sliver of code. A hobbyist going by mkopec took an approximately $45 Cable Matters USB-C hub and turned it into a working Switch 2 dock by modifying its firmware, adding about 540 bytes to a 32 KiB image. The write-up walks through the whole process.

What the stock hub gets wrong

The stock hub charges the Switch 2 without trouble. Power negotiation works, and so does DisplayPort Alt Mode, yet the console shows no picture. Nintendo's dock uses its own proprietary handshake on top of standard USB-C, and a third-party device that skips it gets power but no video. That's the gap mkopec set out to close.

The modder captured traffic from the official dock with a WITRN K2 inline USB Power Delivery sniffer. The official dock advertises two Standard or Vendor IDs, one for DisplayPort and one for Nintendo's own mode. The console enters Nintendo's mode first, configures DisplayPort, and then sends a series of vendor messages. A hub that doesn't answer those messages stays dark.

This is a familiar pattern in consumer hardware. The protocol is standard enough to get power across, but the parts that decide whether the console treats a device as a real dock are closed. Nintendo has said it has no intention of blocking legal third-party dock compatibility, and the proprietary messaging is what separates a working accessory from a charger.

The hub's chip stack

Like most multi-function hubs, the Cable Matters 7-in-1 is a set of specialized chips rather than one custom design. A VL103 handles USB-PD. A VL817 manages the USB ports. An RTD2142 from Realtek converts DisplayPort Multi-Stream Transport to HDMI. XT25F16B flash chips hold the firmware. The VL parts come from VIA Labs, and the stock hub reports VIA's vendor ID, which is the identity the mod had to change.

That layout explains the approach. Because the VL103 controls the USB-PD negotiation, it's the chip that has to answer Nintendo's messages. The modder dumped its firmware with the vli plugin for fwupd, the Linux firmware update tool, and flashed the modified image back over USB through the VL817.

Seven iterations, one missing delay

The work came in seven versions. The first ones answered Nintendo's discovery, mode entry, and echo commands. Later builds raised power delivery to 15 V at 2.8 A, matching the official dock, and changed the reported vendor ID to Nintendo's. At that point the hub looked like the dock in its identity data, and TV mode started working. The final version matched the full command sequence, which removed a pause of about three seconds that the stock approach had introduced.

The result is a reminder that identity checks can be shallower than their designers intend. Two accessory makers told The Verge that the dock check relies on encryption backed by a dedicated chip. This hack suggests that, at least for this path, copied identity data and fixed replies were enough. That doesn't prove there's no cryptographic element elsewhere, but it does narrow what the check actually verifies.

Fixing washed-out HDR

The more technically satisfying part came after TV mode worked. With HDR turned on, the picture over HDMI looked washed out. The modder narrowed the cause to the AVI InfoFrame, the metadata that tells a display which color space the video uses. The hub was signaling BT.709, the standard dynamic range color space, when HDR content needs the wider BT.2020.

The fix was a 108-byte patch to the RTD2142's firmware. The modder flashed it with flashrom over I2C, tunneled through the DisplayPort AUX channel on the same USB-C cable. The patched chip now marks the signal as BT.2020 whenever HDR is active. One third-party dock's firmware contains a debug string reading "switch2 color space patch," which suggests other manufacturers have hit the same bug. HDR through the hub's own DisplayPort output is still washed out, so the fix is specific to the HDMI path.

Where it doesn't work yet

Variable refresh rate is the clearest limit. The stock hub lacks VRR support, but because the patched hub now identifies as the official dock, the console offers VRR. Turning it on froze the DisplayPort picture, and HDMI stayed at 60 Hz. In a separate Linux test, with the hub advertising Adaptive-Sync and an EDID override in place, the screen went black whenever the frame rate varied. The modder left the feature off.

Testing was also incomplete. The USB ports and Ethernet weren't checked rigorously, and the post doesn't say which Switch 2 system version was used. That matters because Nintendo's system update 21.0.0 left some third-party docks charging with no video output. Vendors responded with firmware fixes of their own. The modder's approach relies on reverse-engineering rather than a supported path, and the modder also doesn't understand many of Nintendo's commands. The hub's version replies copy the official dock's, and any unrecognized command still gets the stock reply. That's workable for a single device on a single firmware, but it's a fragile foundation.

The post also shares no code, patch files, or repository. The method is clearly described, but anyone trying to reproduce it would be starting from the write-up and their own sniffer and flashing setup.

What to watch

The most useful takeaway for developers is how little code the core fix needed, and how much of the gap was in identity handling rather than in the video path. For vendors building Switch 2 accessories, the hack points to a practical question: how much of the handshake is actually enforced, and what happens when a system update changes it. For everyone else, it's a sign that the cheap hub on the desk may have more capability than its stock firmware lets on. Whether that capability gets a proper, supported route is the open question.