Tutorial  Updated

Using "smashhax" with Linux

If you can use the browser, I suggest that you use the new browserhax (up to 11.0.0-33!) in the meantime.

Try out Ubuntu 15.04: http://old-releases.ubuntu.com/releases/15.04/

This requires a New 3DS. The demo version doesn't work and is patched. If you have 1.1.3 or newer delete/disable the update data.

officially called smashbroshax sometimes smashax
Here is a new tool I call smashbroshax-helper. It is a graphical interface for the exploit which simplifies most of the process of broadcasting the packet. It requires almost no setup outside of creating a bootable Linux USB/DVD.

Important notes:
  • This does not work on Fedora or Red Hat-based distributions because aircrack-ng needs to be compiled on it (and I can't figure out how to install the needed things).
  • Don't use a virtual machine!
  • This probably will never work on Old 3DS.
Download smashbroshax-helper beta

It is recommended that you use a live Ubuntu 15.04 image. Versions 15.10+ have issues. http://old-releases.ubuntu.com/releases/15.04/
  1. Create a bootable USB/DVD with a Linux distribution (there are various guides online).
  2. If possible, get a second USB/SD card/storage device, download and save the above .zip to it.
    • Don't extract the contents of it to the USB device, as it might cause problems. Just save the .zip file to it.
    • If you can't do this, you'll have to connect to the Internet while in Linux to download it.
    • If using a bootable USB, make sure you can use two ports at a time. Don't take out the Linux USB while it is being used!
  3. Restart your computer and run the bootable USB/DVD you created.
  4. Extract the contents of the .zip to the Desktop.
  5. Open the smashbroshax-helper folder and double click "smashbroshax.sh".
  6. Follow the on-screen prompts.
  7. If everything goes well, you should now have homebrew!
Video demonstration, from boot to shutdown:

from https://gbatemp.net/threads/tutorial-using-smashhax-with-linux.397194/page-9#post-5842512


If you would like the full tutorial, involving terminal usage and compiling:
To reverse the changes to your wireless interface and remove issues connecting to networks after, rebooting your system or changing it to "Managed" instead of "monitor" should fix it. How to do that is in the second to last section.



@Cydget made a script that condenses most of this into a script. I have not tried it myself yet but it seems to work for others.
So, I made a little script for this. If anybody wants it, then unzip this file and read the readme. And yes, I like to pipe things. http://www.mediafire.com/download/oulnubnzkk9g3i0/smashhaxEZ.zip

Requirements
  • Any Linux distribution should do (this has only been tested with Debian-based distributions). Windows and OS X users should wait or find a method for now, sorry!
    • Please do not use Linux in a virtual machine, it likely won't give direct access to your wireless card. Dual boot or use a live USB/disk.
    • The recommended distro to use is Ubuntu 15.04 (link to Ubuntu MATE 15.04).
  • A Wi-Fi-capable wireless card.
  • Super Smash Bros. for Nintendo 3DS Full or Demo.
  • New 3DS. This does not work on Old 3DS.
  • Patience. The hax is sort-of unreliable so your game will most likely crash a few times.
  • Recommended: Another device to access the internet (phone, tablet, computer, console).
Preparing
  • Install these packages using your package manager. For example, "apt-get" for Debian-based distributions (including Ubuntu).
    Code:
    openssl libssl-dev libnl-genl-3-200 libnl-genl-3-dev libnl-3-200 libnl-3-dev pkg-config
  • Find your wireless card's interface by opening a terminal and using the command "ip link". It would be something like wlan0 or wlp3s0.
    Code:
    ian@ian-VPCEG34FX:~/Desktop/aircrack-ng-1.2-rc2/src$ ip link
    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default 
        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
        link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    3: wlan0: <NO-CARRIER,BROADCAST,ALLMULTI,PROMISC,NOTRAILERS,UP,LOWER_UP> mtu 1500 qdisc mq state DORMANT mode DORMANT group default qlen 1000
        link/ieee802.11/radiotap xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
  • You probably already have it, but get the homebrew starter kit and place it on your SD card.
  • Download the smashhax .pcap files from the releases section of the smashbroshax repository.
  • Determine the .pcap file to use. This should be straightforward using the file names.
    The built beacon-hax pcaps are located under "pcap_out/". In the filenames, "vXYZ" means game-version "vX.Y.Z". Full-game filenames for USA include "gameusa", while the other regions filenames include "gameother".
  • Get the "Otherapp payload" from the Homebrew Launcher site and save it to "smashpayload.bin" at the root of your SD card.
  • Download and extract aircrack-ng's latest release source.
  • Save aireplay-ng.patch from the smashbroshax repository in the folder "aircrack-ng-1.2-rc2".
Compiling aircrack-ng/aireplay-ng
  • Open a terminal and go to the "aircrack-ng-1.2-rc2" folder.
  • Use the command "patch src/aireplay-ng.c < aireplay-ng.patch". If you get the following then it has succeeded.
    Code:
    patching file src/aireplay-ng.c
    Hunk #1 succeeded at 560 (offset 1 line).
    Hunk #2 succeeded at 573 (offset 1 line).
  • Run "make" and wait. The program should be compiled with the patch now. If you get the following as the last line then it has succeeded.
    Code:
    make[1]: Leaving directory '/path/to/aircrack-ng-1.2-rc2/src'
The moment of truth
  • Run these 3 terminal commands in order, using the wireless interface (from "ip link") you found earlier.
    sudo ifconfig wireless_interface down
    sudo iwconfig wireless_interface mode monitor
    sudo ifconfig wireless_interface up
    sudo iwconfig wireless_interface channel 6​
    (the last line was suggested by @difool. and might make the payload trigger faster)
  • Enter the "src" folder in your terminal.
  • Run the following command to start broadcasting the packet: "sudo ./aireplay-ng --interactive -r /path/to/smashbros_version_beaconhax.pcap -h 59:ee:3f:2a:37:e0 -x 10 wireless_interface"
    Use the .pcap file and wireless interface you found out earlier.
  • On the 3DS system, start the game, then choose Smash and Group. Wait for the magic to happen.
Encountering errors? Something confusing?
  • Does running aireplay-ng end with "End of file"? You might be running your installed version of aircrack-ng. Don't forget the ./ for "sudo ./aireplay-ng ..."!
  • Please tell me the distribution you are using and the error you've encountered. This will help me fix your issue faster.
  • If you don't get something, don't hesitate to point it out! I want to help anyone I can.
  • Did you spot an inaccuracy or mistake I made? It would be great if you can tell me that too.
  • This was before the Otherapp payload selector was added to the HBL site. This is kept here for legacy reasons or something.
    • Determine what file you need to get from the Homebrew Launcher Payload section:
      With the release builds, the hax loads the payload from SD "/smashpayload.bin". This should contain the hb-launcher(https://smealum.github.io/3ds/) otherapp payload. Until there's a proper otherapp payload selector on the hb-launcher site, the payload can be downloaded from the following URL(see also https://github.com/smealum/sploit_installer):
      FIRMVER values(without quotes):
      • "POST5" = non-New3DS
      • "N3DS" = New3DS
      REGION values(without quotes):
      • "U" = USA
      • "E" = EUR
      • "J" = JPN
      MENUVER values(without quotes):
      • "11272": Non-JPN, system-version v9.0.
      • "12288": System-version v9.2.
      • "13330": System-version v9.3.
      • "14336": System-version v9.4.
      • "15360": System-version v9.5.
      • "16404": System-version v9.6.
      • "17415": System-version v9.7.
      • "20480_usa": USA, system-versions v9.9-v10.0.
      • "19456": Non-USA, system-versions v9.8-v10.0.
      MSETVER values(without quotes):
      • "8203": System-versions below v9.6.
      • "9221": System-versions starting with v9.6.
      For example, the payload URL for New3DS USA 9.9.0-X - 10.0.0-X is:https://smealum.github.io/ninjhax2/Pvl9iD2Im5/otherapp/N3DS_U_20480_usa_9221.bin
      The end result is a file named "smashpayload.bin" at the root of your SD card.

You are allowed to reproduce/reprint this tutorial, as long as a link back to this page (https://gbatemp.net/threads/tutorial-using-smashhax-with-linux.397194/) is included.
 
Last edited by ihaveahax,

Lyomak

Well-Known Member
Member
Joined
Jun 24, 2009
Messages
436
Trophies
1
Age
39
Location
Bogotá
Website
twitch.tv
XP
389
Country
Colombia
The aircrack seems to work fine on my dad's laptop, but I get this error everytime and I tried a lot with the infinite demo. I give up then, I shouldn't have updated and I won't buy a game just to get a hax working. Thanks everyone for your help. :(
 

Attachments

  • DSC_0044.JPG
    DSC_0044.JPG
    1.7 MB · Views: 617

Cydget

Well-Known Member
Member
Joined
Oct 1, 2015
Messages
493
Trophies
0
Age
27
XP
260
Country
United States
The aircrack seems to work fine on my dad's laptop, but I get this error everytime and I tried a lot with the infinite demo. I give up then, I shouldn't have updated and I won't buy a game just to get a hax working. Thanks everyone for your help. :(
The smash demo does not have access to the SD card, so It wont load the smashpayload.bin The work around yellows8 made was to have it so you compile the pcap yourself and have it point to the payload online.
 

Lyomak

Well-Known Member
Member
Joined
Jun 24, 2009
Messages
436
Trophies
1
Age
39
Location
Bogotá
Website
twitch.tv
XP
389
Country
Colombia
The smash demo does not have access to the SD card, so It wont load the smashpayload.bin The work around yellows8 made was to have it so you compile the pcap yourself and have it point to the payload online.

Sorry for this, I don't have any clue for that. I barely managed to use ubuntu with all that stuff, how can I do that?
 

Cydget

Well-Known Member
Member
Joined
Oct 1, 2015
Messages
493
Trophies
0
Age
27
XP
260
Country
United States
Sorry for this, I don't have any clue for that. I barely managed to use ubuntu with all that stuff, how can I do that?
Im still working on it myself. Once I get it down, Ill make a tutorial or another script to make it easier for others.

EDIT: So, it seems that im not the only one having trouble with the compiled demo pcap. We will probably need to wait until yellows8 updated the git or smea updates the payload. Im not sure witch one is causing the problem.
 
Last edited by Cydget,

difool.

New Member
Newbie
Joined
Jul 22, 2010
Messages
4
Trophies
0
XP
121
Country
France
I have a "New10.2.0.28EU" 3DS.
Smashhax don't work for me with the original cartridge "version 1.1.0"
After apply the last update, work great every times.
 

Lyomak

Well-Known Member
Member
Joined
Jun 24, 2009
Messages
436
Trophies
1
Age
39
Location
Bogotá
Website
twitch.tv
XP
389
Country
Colombia
I got for a day a Smash Bros cart thanks to a friend and it worked flawlessly with v 1.1.2!!! I used:

  • New 3DS XL with fw. 10.2.0-28 U
  • Super Smash Bros cart, with 1.1.2. update.
  • Mac Pro (Early 2008) OSX Yosemite, with VMware Fusion and Ubuntu 15.10 installed on a Virtual Image.
  • This wireless USB Antenna: TP-Link TL-WN722N. After some research looking for modern usb sticks compatible with aircrack-ng, I found that this one has the Atheros AR9271 chipset, one of those that work with that tool and is cheap. You can get it on http://www.amazon.com/TP-LINK-TL-WN722N-Wireless-Adapter-External/dp/B002SZEOLG

When I get home, I'll test it on Windows 10 and install IronHax and OoThax in the process, but I think that I won't have trouble with it. Also, when the demo pcap gets updated, I'll test it gladly.

EDIT 1: Tested on Windows 10, VMware Workstation 12, same usb wifi antenna. It worked without any problems.
 
Last edited by Lyomak,

Favna

#PCMasterRace
Member
Joined
Sep 12, 2009
Messages
864
Trophies
1
Website
twitter.com
XP
822
Country
Netherlands
About that demo pcap - Cydget and myself (mainly Cydget till now) have been cracking at it and we DID get it to load the ropbin (that screen where on top it says *hax 2.5 blahblah smealum blahblah), however, afterwards it just gives this: (in a spoiler because it's a huge image)

a7ee411f118620a7622243c1b112c434.jpg
 

Qbe Root

Member
Newcomer
Joined
Nov 2, 2015
Messages
5
Trophies
0
Age
28
XP
42
Country
France
Is there any way to pull off this hax with another MAC address? Aireplay will only use my interface’s MAC address, and I can’t set it to something invalid…
 

ihaveahax

Well-Known Member
OP
Member
Joined
Apr 20, 2015
Messages
6,069
Trophies
2
XP
7,805
Country
United States
Is there any way to pull off this hax with another MAC address? Aireplay will only use my interface’s MAC address, and I can’t set it to something invalid…
this is why you're supposed to download the aircrack source, apply the .patch, build it, and use the built version. I explain it in the tutorial. if something is not making sense then feel free to ask.
 

Qbe Root

Member
Newcomer
Joined
Nov 2, 2015
Messages
5
Trophies
0
Age
28
XP
42
Country
France
That’s exactly what I’ve done, but the patched aireplay won’t let me specify another address…

Capture du 2015-11-05 20:45:09.png
 

ihaveahax

Well-Known Member
OP
Member
Joined
Apr 20, 2015
Messages
6,069
Trophies
2
XP
7,805
Country
United States
That’s exactly what I’ve done, but the patched aireplay won’t let me specify another address…

righto, two things
  • you can't use the prebuilt demo .pcap since the SSB4 demo doesn't have SD card access. if you want to get aireplay-ng working first, that's fine.
  • if you would like, I can give you my compiled version to see what the actual problem may be
 

Qbe Root

Member
Newcomer
Joined
Nov 2, 2015
Messages
5
Trophies
0
Age
28
XP
42
Country
France
This is a .pcap I built with PAYLOADURL, so it should work. ;-) I’d like your compiled version, though, thanks!
 

Qbe Root

Member
Newcomer
Joined
Nov 2, 2015
Messages
5
Trophies
0
Age
28
XP
42
Country
France
Your compiled version doesn’t work any better than mine, but the prebuilt pcap seems to work. It still shows the same warning, but starts sending packets anyway. I’ll build another pcap for the demo or borrow the actual game, then… Thanks a lot for the help!
 
  • Like
Reactions: ihaveahax

Favna

#PCMasterRace
Member
Joined
Sep 12, 2009
Messages
864
Trophies
1
Website
twitter.com
XP
822
Country
Netherlands
For the demo issue follow this issue on yellows8 github started by @Cydget. I'm personally also following it because initially I was trying to figure it out as well.. sorta anyway. As of yesterday I have managed to get oot3dhax installed on my n3ds again with the use of a cartridge of a friend so i'm only following it for the sake of knowing now.

Edit: Derp i forgot the link: https://github.com/yellows8/3ds_smashbroshax/issues/2
 
  • Like
Reactions: Qbe Root

Cydget

Well-Known Member
Member
Joined
Oct 1, 2015
Messages
493
Trophies
0
Age
27
XP
260
Country
United States
Your compiled version doesn’t work any better than mine, but the prebuilt pcap seems to work. It still shows the same warning, but starts sending packets anyway. I’ll build another pcap for the demo or borrow the actual game, then… Thanks a lot for the help!
The reason your compiled pcap doesnt work is because the url you used was too long. Try using something that is only around 25 characters long(including http). Also, the demo does not work even after this because when loading the payload through http something with the cache messes up the loading. Check out there issue on git hub for more info.
 

srick7583

Active Member
Newcomer
Joined
Nov 7, 2015
Messages
29
Trophies
0
Age
34
XP
60
Country
United States
I keep getting this stupid message while trying to use the EZ smashhax. Don't know what to do because I'm not too familiar with Linux, but I'm using Ubuntu 14.04. Just trying to get homebrew back on my 10.2 3ds has been a nightmare
 

Attachments

  • image.png
    image.png
    63.6 KB · Views: 431
Last edited by srick7583,

Destroxz

Member
Newcomer
Joined
Nov 7, 2015
Messages
19
Trophies
0
Age
27
XP
43
Country
I did every step in the smashaxez video, but when I reach the step where I choose my usb adapter it says sysinjection failed try to run airmon-ng start wlan0, and when I run that command and try again I still get the same problem please help! :(

Edit: what I get after I choose my adapter: Error for wireless request ''Set Mode'' (8B06) :
SET failed on device wlan0 ; Invalid argument.

After that it lets me choose the version, I proceed to choose the version and then the following message appears: ioctl (SIOCSIWMODE) failed: Invalid argument ARP linktypeis set to 1 (Ethernet) - expected ARPHRD_IEEE80211, ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make sure RFMON is enabled: run 'airmon-ng start wlan0 <#>' Sysfsinjection support was not found either.

I am using a TP-Link TL-WN725N usb network adapter. I am also using Kali Linux 2.0 64bit on virtualbox.

Edit 2: when I use ifconfig my wlan0 (usb adapter) is detected as ethernet I don't know why.
 
Last edited by Destroxz,

Lyomak

Well-Known Member
Member
Joined
Jun 24, 2009
Messages
436
Trophies
1
Age
39
Location
Bogotá
Website
twitch.tv
XP
389
Country
Colombia
I did every step in the smashaxez video, but when I reach the step where I choose my usb adapter it says sysinjection failed try to run airmon-ng start wlan0, and when I run that command and try again I still get the same problem please help! :(

Edit: what I get after I choose my adapter: Error for wireless request ''Set Mode'' (8B06) :
SET failed on device wlan0 ; Invalid argument.

After that it lets me choose the version, I proceed to choose the version and then the following message appears: ioctl (SIOCSIWMODE) failed: Invalid argument ARP linktypeis set to 1 (Ethernet) - expected ARPHRD_IEEE80211, ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make sure RFMON is enabled: run 'airmon-ng start wlan0 <#>' Sysfsinjection support was not found either.

I am using a TP-Link TL-WN725N usb network adapter. I am also using Kali Linux 2.0 64bit on virtualbox.

Edit 2: when I use ifconfig my wlan0 (usb adapter) is detected as ethernet I don't know why.

When I was looking for usb wifi adapters, I was planning on buying that one until I found in aircrack forums and reddit, that the adapter doesn't support monitor mode and that's a problem getting the beaconhax on.
https://forum.aircrack-ng.org/index.php?topic=641.0
https://www.reddit.com/r/hacking/comments/2rzo86/aircrack_and_tplink_tlwn725n/

I don't know if that's true or not, but I started having doubts of buying that adapter, so I bought the TP-LINK TL-WN722N (which it worked), shown on this list: http://www.wirelesshack.org/top-wardriving-usb-adapters.html
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    SylverReZ @ SylverReZ: @salazarcosplay, Morning