1. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    If you can use the browser, I suggest that you use the new browserhax (up to 11.0.0-33!) in the meantime.

    Try out Ubuntu 15.04: http://old-releases.ubuntu.com/releases/15.04/

    This requires a New 3DS. The demo version doesn't work and is patched. If you have 1.1.3 or newer delete/disable the update data.

    officially called smashbroshax sometimes smashax
    Here is a new tool I call smashbroshax-helper. It is a graphical interface for the exploit which simplifies most of the process of broadcasting the packet. It requires almost no setup outside of creating a bootable Linux USB/DVD.

    Important notes:
    • This does not work on Fedora or Red Hat-based distributions because aircrack-ng needs to be compiled on it (and I can't figure out how to install the needed things).
    • Don't use a virtual machine!
    • This probably will never work on Old 3DS.
    Download smashbroshax-helper beta

    It is recommended that you use a live Ubuntu 15.04 image. Versions 15.10+ have issues. http://old-releases.ubuntu.com/releases/15.04/
    1. Create a bootable USB/DVD with a Linux distribution (there are various guides online).
    2. If possible, get a second USB/SD card/storage device, download and save the above .zip to it.
      • Don't extract the contents of it to the USB device, as it might cause problems. Just save the .zip file to it.
      • If you can't do this, you'll have to connect to the Internet while in Linux to download it.
      • If using a bootable USB, make sure you can use two ports at a time. Don't take out the Linux USB while it is being used!
    3. Restart your computer and run the bootable USB/DVD you created.
    4. Extract the contents of the .zip to the Desktop.
    5. Open the smashbroshax-helper folder and double click "smashbroshax.sh".
    6. Follow the on-screen prompts.
    7. If everything goes well, you should now have homebrew!
    Video demonstration, from boot to shutdown:

    from https://gbatemp.net/threads/tutorial-using-smashhax-with-linux.397194/page-9#post-5842512


    If you would like the full tutorial, involving terminal usage and compiling:
    To reverse the changes to your wireless interface and remove issues connecting to networks after, rebooting your system or changing it to "Managed" instead of "monitor" should fix it. How to do that is in the second to last section.



    @Cydget made a script that condenses most of this into a script. I have not tried it myself yet but it seems to work for others.

    Requirements
    • Any Linux distribution should do (this has only been tested with Debian-based distributions). Windows and OS X users should wait or find a method for now, sorry!
      • Please do not use Linux in a virtual machine, it likely won't give direct access to your wireless card. Dual boot or use a live USB/disk.
      • The recommended distro to use is Ubuntu 15.04 (link to Ubuntu MATE 15.04).
    • A Wi-Fi-capable wireless card.
    • Super Smash Bros. for Nintendo 3DS Full or Demo.
    • New 3DS. This does not work on Old 3DS.
    • Patience. The hax is sort-of unreliable so your game will most likely crash a few times.
    • Recommended: Another device to access the internet (phone, tablet, computer, console).
    Preparing
    • Install these packages using your package manager. For example, "apt-get" for Debian-based distributions (including Ubuntu).
      Code:
      openssl libssl-dev libnl-genl-3-200 libnl-genl-3-dev libnl-3-200 libnl-3-dev pkg-config
    • Find your wireless card's interface by opening a terminal and using the command "ip link". It would be something like wlan0 or wlp3s0.
      Code:
      [email protected]:~/Desktop/aircrack-ng-1.2-rc2/src$ ip link
      1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default 
          link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
      2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
          link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
      3: wlan0: <NO-CARRIER,BROADCAST,ALLMULTI,PROMISC,NOTRAILERS,UP,LOWER_UP> mtu 1500 qdisc mq state DORMANT mode DORMANT group default qlen 1000
          link/ieee802.11/radiotap xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    • You probably already have it, but get the homebrew starter kit and place it on your SD card.
    • Download the smashhax .pcap files from the releases section of the smashbroshax repository.
    • Determine the .pcap file to use. This should be straightforward using the file names.
    • Get the "Otherapp payload" from the Homebrew Launcher site and save it to "smashpayload.bin" at the root of your SD card.
    • Download and extract aircrack-ng's latest release source.
    • Save aireplay-ng.patch from the smashbroshax repository in the folder "aircrack-ng-1.2-rc2".
    Compiling aircrack-ng/aireplay-ng
    • Open a terminal and go to the "aircrack-ng-1.2-rc2" folder.
    • Use the command "patch src/aireplay-ng.c < aireplay-ng.patch". If you get the following then it has succeeded.
      Code:
      patching file src/aireplay-ng.c
      Hunk #1 succeeded at 560 (offset 1 line).
      Hunk #2 succeeded at 573 (offset 1 line).
    • Run "make" and wait. The program should be compiled with the patch now. If you get the following as the last line then it has succeeded.
      Code:
      make[1]: Leaving directory '/path/to/aircrack-ng-1.2-rc2/src'
    The moment of truth
    • Run these 3 terminal commands in order, using the wireless interface (from "ip link") you found earlier.
      sudo ifconfig wireless_interface down
      sudo iwconfig wireless_interface mode monitor
      sudo ifconfig wireless_interface up
      sudo iwconfig wireless_interface channel 6​
      (the last line was suggested by @difool. and might make the payload trigger faster)
    • Enter the "src" folder in your terminal.
    • Run the following command to start broadcasting the packet: "sudo ./aireplay-ng --interactive -r /path/to/smashbros_version_beaconhax.pcap -h 59:ee:3f:2a:37:e0 -x 10 wireless_interface"
      Use the .pcap file and wireless interface you found out earlier.
    • On the 3DS system, start the game, then choose Smash and Group. Wait for the magic to happen.
    Encountering errors? Something confusing?
    • Does running aireplay-ng end with "End of file"? You might be running your installed version of aircrack-ng. Don't forget the ./ for "sudo ./aireplay-ng ..."!
    • Please tell me the distribution you are using and the error you've encountered. This will help me fix your issue faster.
    • If you don't get something, don't hesitate to point it out! I want to help anyone I can.
    • Did you spot an inaccuracy or mistake I made? It would be great if you can tell me that too.
    • This was before the Otherapp payload selector was added to the HBL site. This is kept here for legacy reasons or something.
      • Determine what file you need to get from the Homebrew Launcher Payload section:
        With the release builds, the hax loads the payload from SD "/smashpayload.bin". This should contain the hb-launcher(https://smealum.github.io/3ds/) otherapp payload. Until there's a proper otherapp payload selector on the hb-launcher site, the payload can be downloaded from the following URL(see also https://github.com/smealum/sploit_installer):
        FIRMVER values(without quotes):
        • "POST5" = non-New3DS
        • "N3DS" = New3DS
        REGION values(without quotes):
        • "U" = USA
        • "E" = EUR
        • "J" = JPN
        MENUVER values(without quotes):
        • "11272": Non-JPN, system-version v9.0.
        • "12288": System-version v9.2.
        • "13330": System-version v9.3.
        • "14336": System-version v9.4.
        • "15360": System-version v9.5.
        • "16404": System-version v9.6.
        • "17415": System-version v9.7.
        • "20480_usa": USA, system-versions v9.9-v10.0.
        • "19456": Non-USA, system-versions v9.8-v10.0.
        MSETVER values(without quotes):
        • "8203": System-versions below v9.6.
        • "9221": System-versions starting with v9.6.
        For example, the payload URL for New3DS USA 9.9.0-X - 10.0.0-X is:https://smealum.github.io/ninjhax2/Pvl9iD2Im5/otherapp/N3DS_U_20480_usa_9221.bin
        The end result is a file named "smashpayload.bin" at the root of your SD card.
    You are allowed to reproduce/reprint this tutorial, as long as a link back to this page (https://gbatemp.net/threads/tutorial-using-smashhax-with-linux.397194/) is included.
     
    Last edited by ihaveamac, Jul 28, 2016
  2. DerpyEagle

    DerpyEagle Member
    Newcomer

    Joined:
    Jul 4, 2015
    Messages:
    14
    Country:
    Canada
    Hi; I'm having an issue getting this to work.
    Having followed all of the steps and confirmed that I have the correct versions for the payload and the exploit, I ran aireplay-ng and began sending packets. After a little while, the top screen of my 3DS was filled with garbage and the screens turned off moments later, indicating that the payload was delivered. However, instead of launching into the homebrew launcher, the system rebooted without an error message. This has happened almost every time I have tried the exploit, as smash crashed twice

    I compiled aireplay-ng on a x64 Ubuntu GNOME 15.04 system. I'm on a USA Old 3DS with fw 9.9.0-26U, using POST5_U_20480_usa_9221.bin and smashbros_gameusav110_beaconhax.pcap

    Any advice?
     
  3. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    Unfortunately this doesn't seem to work on Old 3DS. :( Sorry
    If you really want to try, repeat it a few times.

    I'll be sure to make this more clear.
     
  4. DerpyEagle

    DerpyEagle Member
    Newcomer

    Joined:
    Jul 4, 2015
    Messages:
    14
    Country:
    Canada
    Well, it was worth a try. Thanks!
     
  5. VinsCool

    VinsCool Persona Secretiva Felineus
    Moderator

    Joined:
    Jan 7, 2014
    Messages:
    14,059
    Country:
    Canada
    Gosh this sure is complicated.

    Thanks for the tutorial :)
     
  6. LinkKenedy

    LinkKenedy Advanced Member
    Newcomer

    Joined:
    Feb 14, 2015
    Messages:
    67
    Country:
    France
    Why not working for old?
     
  7. Vappy

    Vappy GBAtemp Advanced Maniac
    Member

    Joined:
    May 23, 2012
    Messages:
    1,507
    Country:
  8. LinkKenedy

    LinkKenedy Advanced Member
    Newcomer

    Joined:
    Feb 14, 2015
    Messages:
    67
    Country:
    France
  9. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    Nothing positive unfortunately.

    https://github.com/yellows8/3ds_smashbroshax/commit/7684bbb656f1dd8c0efaee656bed47e73f4bad66
     
  10. LinkKenedy

    LinkKenedy Advanced Member
    Newcomer

    Joined:
    Feb 14, 2015
    Messages:
    67
    Country:
    France
    mmm.... ty

    [​IMG]
     
    zoogie likes this.
  11. ashinnblunts

    ashinnblunts GBAtemp Regular
    Member

    Joined:
    Jun 25, 2012
    Messages:
    119
    Country:
    United States
    So this won't work on 8.1?

    Need something to run homebrew that doesn't need the browser, like ninjhax.
     
  12. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    This is a Ninjhax 2-based exploit, which only works on 9.0 and higher.

    I'm going to assume by that number, that you have a Japanese New 3DS. Try taking a look at this: https://gbatemp.net/threads/new-8-1j-to-9-0j-method-beta-looking-for-testers.397268/ You do need Cubic Ninja still though.
     
  13. ashinnblunts

    ashinnblunts GBAtemp Regular
    Member

    Joined:
    Jun 25, 2012
    Messages:
    119
    Country:
    United States
  14. gudenau

    gudenau Largely ignored
    Member

    Joined:
    Jul 7, 2010
    Messages:
    3,656
    Country:
    United States
    If I figure out how to make a Raspberry Pi image I will make one for this.
     
  15. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    What wireless card/adapter/thing are you using?
     
  16. Favna

    Favna #PCMasterRace
    Member

    Joined:
    Sep 12, 2009
    Messages:
    863
    Country:
    Netherlands
    Been trying this for a bit now but everytime i start sending the packet it never exceeds 9 pps, be it if I put 10 or 11 (as seen in your video) in the command. Furthermore it also gets stuck on sending 93 packets and even after 10 minutes my New3DS is still searching.

    New3DS Firmware 10.2.0-28
    Smash bros version: EU Demo
    Pcap: smashbros_eurdemo_beaconhax.pcap
    Linux distro: Ubuntu 15.04
    Wireless interface: wlan0

    Any ideas what might be the cause?

    Update: So by setting the "10" value to 20 it does change to 19 pps, but it still gets stuck at 93 packets.
     
    Last edited by Favna, Oct 21, 2015
  17. cultopi

    cultopi GBAtemp Regular
    Member

    Joined:
    Jul 18, 2015
    Messages:
    278
    Country:
    United States
    Using Netgear N300 WNA3100 with broadcom bcm43231chipset, it gave me 8B06 error (can't change to monitor mode). Any idea?
     
  18. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    This is really strange. I want to say it could be your wireless card, but I'm not sure. :/
    I'm afraid I can't help you with specific wireless adapters, but you could look up "8B06" and get a few things like "12.04 - I cannot change the wlan0 mode. Why? - Ask Ubuntu"
     
    Last edited by ihaveamac, Oct 22, 2015
  19. cultopi

    cultopi GBAtemp Regular
    Member

    Joined:
    Jul 18, 2015
    Messages:
    278
    Country:
    United States
    What wireless adapter did you use for smashhax ?
     
  20. ihaveamac

    OP ihaveamac GBAtemp Guru
    Member

    Joined:
    Apr 20, 2015
    Messages:
    5,922
    Country:
    United States
    This what you want?
    Code:
    Network controller: Intel Corporation Centrino Wireless-N 1000 [Condor Peak]
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - [Tutorial], smashhax, Using