If you can use the browser, I suggest that you use the new browserhax (up to 11.0.0-33!) in the meantime.

Try out Ubuntu 15.04: http://old-releases.ubuntu.com/releases/15.04/

This requires a New 3DS. The demo version doesn't work and is patched. If you have 1.1.3 or newer delete/disable the update data.
officially called smashbroshax sometimes smashax
Here is a new tool I call smashbroshax-helper. It is a graphical interface for the exploit which simplifies most of the process of broadcasting the packet. It requires almost no setup outside of creating a bootable Linux USB/DVD.

Important notes:

• This does not work on Fedora or Red Hat-based distributions because aircrack-ng needs to be compiled on it (and I can't figure out how to install the needed things).
  
• Don't use a virtual machine!
• This probably will never work on Old 3DS.

Download smashbroshax-helper beta

It is recommended that you use a live Ubuntu 15.04 image. Versions 15.10+ have issues. http://old-releases.ubuntu.com/releases/15.04/

1. Create a bootable USB/DVD with a Linux distribution (there are various guides online).
2. If possible, get a second USB/SD card/storage device, download and save the above .zip to it.
   • Don't extract the contents of it to the USB device, as it might cause problems. Just save the .zip file to it.
   • If you can't do this, you'll have to connect to the Internet while in Linux to download it.
   • If using a bootable USB, make sure you can use two ports at a time. Don't take out the Linux USB while it is being used!
3. Restart your computer and run the bootable USB/DVD you created.
4. Extract the contents of the .zip to the Desktop.
5. Open the smashbroshax-helper folder and double click "smashbroshax.sh".
6. Follow the on-screen prompts.
7. If everything goes well, you should now have homebrew!

Video demonstration, from boot to shutdown:

from https://gbatemp.net/threads/tutorial-using-smashhax-with-linux.397194/page-9#post-5842512

---

If you would like the full tutorial, involving terminal usage and compiling:

Spoiler: Everything

To reverse the changes to your wireless interface and remove issues connecting to networks after, rebooting your system or changing it to "Managed" instead of "monitor" should fix it. How to do that is in the second to last section.

---

@Cydget made a script that condenses most of this into a script. I have not tried it myself yet but it seems to work for others.

Spoiler

So, I made a little script for this. If anybody wants it, then unzip this file and read the readme. And yes, I like to pipe things. http://www.mediafire.com/download/oulnubnzkk9g3i0/smashhaxEZ.zip

---

Requirements

• Any Linux distribution should do (this has only been tested with Debian-based distributions). Windows and OS X users should wait or find a method for now, sorry!
  • Please do not use Linux in a virtual machine, it likely won't give direct access to your wireless card. Dual boot or use a live USB/disk.
  • The recommended distro to use is Ubuntu 15.04 (link to Ubuntu MATE 15.04).
• A Wi-Fi-capable wireless card.
• Super Smash Bros. for Nintendo 3DS Full or Demo.
• New 3DS. This does not work on Old 3DS.
• Patience. The hax is sort-of unreliable so your game will most likely crash a few times.
• Recommended: Another device to access the internet (phone, tablet, computer, console).

Preparing

• Install these packages using your package manager. For example, "apt-get" for Debian-based distributions (including Ubuntu).

  openssl libssl-dev libnl-genl-3-200 libnl-genl-3-dev libnl-3-200 libnl-3-dev pkg-config

• Find your wireless card's interface by opening a terminal and using the command "ip link". It would be something like wlan0 or wlp3s0.

  ian@ian-VPCEG34FX:~/Desktop/aircrack-ng-1.2-rc2/src$ ip link
  1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default 
      link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
      link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
  3: wlan0: <NO-CARRIER,BROADCAST,ALLMULTI,PROMISC,NOTRAILERS,UP,LOWER_UP> mtu 1500 qdisc mq state DORMANT mode DORMANT group default qlen 1000
      link/ieee802.11/radiotap xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff

• You probably already have it, but get the homebrew starter kit and place it on your SD card.
• Download the smashhax .pcap files from the releases section of the smashbroshax repository.
• Determine the .pcap file to use. This should be straightforward using the file names.

  The built beacon-hax pcaps are located under "pcap_out/". In the filenames, "vXYZ" means game-version "vX.Y.Z". Full-game filenames for USA include "gameusa", while the other regions filenames include "gameother".

• Get the "Otherapp payload" from the Homebrew Launcher site and save it to "smashpayload.bin" at the root of your SD card.
  
• Download and extract aircrack-ng's latest release source.
• Save aireplay-ng.patch from the smashbroshax repository in the folder "aircrack-ng-1.2-rc2".

Compiling aircrack-ng/aireplay-ng

• Open a terminal and go to the "aircrack-ng-1.2-rc2" folder.
• Use the command "patch src/aireplay-ng.c < aireplay-ng.patch". If you get the following then it has succeeded.

  patching file src/aireplay-ng.c
  Hunk #1 succeeded at 560 (offset 1 line).
  Hunk #2 succeeded at 573 (offset 1 line).

• Run "make" and wait. The program should be compiled with the patch now. If you get the following as the last line then it has succeeded.

  make[1]: Leaving directory '/path/to/aircrack-ng-1.2-rc2/src'

The moment of truth

• Run these 3 terminal commands in order, using the wireless interface (from "ip link") you found earlier.
  
  sudo ifconfig wireless_interface down
  sudo iwconfig wireless_interface mode monitor
  sudo ifconfig wireless_interface up
  sudo iwconfig wireless_interface channel 6​
  (the last line was suggested by @difool. and might make the payload trigger faster)
• Enter the "src" folder in your terminal.
• Run the following command to start broadcasting the packet: "sudo ./aireplay-ng --interactive -r /path/to/smashbros_version_beaconhax.pcap -h 59:ee:3f:2a:37:e0 -x 10 wireless_interface"
  Use the .pcap file and wireless interface you found out earlier.
• On the 3DS system, start the game, then choose Smash and Group. Wait for the magic to happen.

Encountering errors? Something confusing?

• Does running aireplay-ng end with "End of file"? You might be running your installed version of aircrack-ng. Don't forget the ./ for "sudo ./aireplay-ng ..."!
• Please tell me the distribution you are using and the error you've encountered. This will help me fix your issue faster.
• If you don't get something, don't hesitate to point it out! I want to help anyone I can.
• Did you spot an inaccuracy or mistake I made? It would be great if you can tell me that too.
• This was before the Otherapp payload selector was added to the HBL site. This is kept here for legacy reasons or something.
  Spoiler

  • Determine what file you need to get from the Homebrew Launcher Payload section:
    
    Spoiler: Homebrew Launcher Payload

    With the release builds, the hax loads the payload from SD "/smashpayload.bin". This should contain the hb-launcher(https://smealum.github.io/3ds/) otherapp payload. Until there's a proper otherapp payload selector on the hb-launcher site, the payload can be downloaded from the following URL(see also https://github.com/smealum/sploit_installer):
    

    • "https://smealum.github.io/ninjhax2/Pvl9iD2Im5/otherapp/{PAYLOADNAME}.bin" Where {PAYLOADNAME} is: "FIRMVER_REGION_MENUVER_MSETVER".

    FIRMVER values(without quotes):
    

    • "POST5" = non-New3DS
    • "N3DS" = New3DS

    REGION values(without quotes):
    

    • "U" = USA
    • "E" = EUR
    • "J" = JPN

    MENUVER values(without quotes):
    

    • "11272": Non-JPN, system-version v9.0.
    • "12288": System-version v9.2.
    • "13330": System-version v9.3.
    • "14336": System-version v9.4.
    • "15360": System-version v9.5.
    • "16404": System-version v9.6.
    • "17415": System-version v9.7.
    • "20480_usa": USA, system-versions v9.9-v10.0.
    • "19456": Non-USA, system-versions v9.8-v10.0.

    MSETVER values(without quotes):
    

    • "8203": System-versions below v9.6.
    • "9221": System-versions starting with v9.6.

    For example, the payload URL for New3DS USA 9.9.0-X - 10.0.0-X is:https://smealum.github.io/ninjhax2/Pvl9iD2Im5/otherapp/N3DS_U_20480_usa_9221.bin
    The end result is a file named "smashpayload.bin" at the root of your SD card.

You are allowed to reproduce/reprint this tutorial, as long as a link back to this page (https://gbatemp.net/threads/tutorial-using-smashhax-with-linux.397194/) is included.

 

[snaky90]

Hi !
I'm using this method but does not work for me on 10.3.0-28E
I followed step by step this tutorial but when I use the smash - > group the game crashes and closes and I get an error message "The program needs to close... "
I used the starter kit and otherapp payload for 10.3.0-28E renamed to smashpayload.bin
Why did not it work? Thanks !

 

[ihaveahax]

Hi !
I'm using this method but does not work for me on 10.3.0-28E
I followed step by step this tutorial but when I use the smash - > group the game crashes and closes and I get an error message "The program needs to close... "
I used the starter kit and otherapp payload for 10.3.0-28E renamed to smashpayload.bin
Why did not it work? Thanks !

your firmware doesn't really matter as long as it's 9.0+. what version of SSB4 are you using?

 

[Sinori]

I have some problem, when I try to boot up Linux with my USB Drive, I have this error http://imgur.com/zNcB9Q0 . ihaveamac and Zeephos helped me via youtube comment, but I still get the same error.

Edit : I tried by using a virtual machine, but apprently it doesn't give direct access to your wireless card. Basically, I can't install the hack :/

 

[snaky90]

your firmware doesn't really matter as long as it's 9.0+. what version of SSB4 are you using?

SSB4 1.1.2 physical cartridge

 

[Jackson O'Sullivan]

how exactly do I burn an ubuntu image to a cd/dvd or SD card?
the only experience I have with Linux is my rasperry pi...

--------------------- MERGED ---------------------------

how exactly do I burn an ubuntu image to a cd/dvd or SD card?
the only experience I have with Linux is my rasperry pi...

actually a USB drive would be optimal.

 

[Jackson O'Sullivan]

i got through most of the process, but the terminal stops at 73 packets sent...

 

[ihaveahax]

according to yellows8, the 1.1.3 update released today (with things like Cloud) has patched the exploit. if you update, you can still use the hax without deleting and redownloading the update data if you follow the instructions from the 3ds_smashbroshax repository:

This can't be completely blocked with the main app without a system-update: even if an app-update would fix it, one could just rename/whatever the update-title directory on SD card to force the system to not use the update-title(the directory name could be restored to the original later when not using this hax). One could also do this if the currently installed update-title version is not supported, or when the latest version of the update-title isn't supported(where the currently installed version isn't supported).
The above mentioned directory is at the following SD card location: "/Nintendo 3DS/{ID0}/{ID1}/title/0004000e/{TIDHigh}". Where TIDHigh for the update-title is one of the following:

• USA: 000edf00
• EUR: 000ee000
• JPN: 000b8b00

 

[Jackson O'Sullivan]

i got through most of the process, but the terminal stops at 73 packets sent...

does anyone have an idea on how to fix this? is this a common problem?

 

[ilovstuddy]

I've tried to run the program, but it also stopped sending packets at 73 for me too... I'm using Ubuntu Mate and is running it on a bootable usb (mentioning this just in case it actually affects something). And also, my Smash Bros (Jap) is at version 1.0.1, so which option should I choose when running the program: 1.0.0 or 1.0.4 for Jap/EU?

 

[TehB]

When setting wlan0 to monitor mode the error message:

Error for wireless request "Set Mode" (8B06) :
    SET failed on device wlan0 ; Invalid argument.

I am using an DWA-130 USB wireless card from Dlink.

 

[Spazoidfreke]

Anyone get this working on 1.1.3 or 1.0.1? Tried about everything and the game still crashes to the main menu.
New 3DS XL 10.3.0.28u

 

[Ketchup901]

Using Ubuntu 15.04 Live CD, WiFi card Broadcom BCM43228, after the script opens a terminal emulator window, this is what it says:

ioctl(SIOCSIWMODE) failed: Operation not supported

ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead.  Make
sure RFMON is enabled: run 'airmon-ng start wlan0 <#>'
Sysfs injection support was not found either.

-------------------
Press any key to continue...

When trying to do it manually, it says something about the operation not being supported when I try to execute the iwconfig command. I didn't save the exact error message.
Also running this command that it tells me to run doesn't work because I don't have aircrack-ng installed, and when I try to install it, it says:

ubuntu-mate@ubuntu-mate:~$ sudo apt-get install aircrack-ng
Reading package lists... Done
Building dependency tree   
Reading state information... Done
The following package was automatically installed and is no longer required:
  linux-image-generic
Use 'apt-get autoremove' to remove it.
The following extra packages will be installed:
  ieee-data
The following NEW packages will be installed:
  aircrack-ng ieee-data
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,233 kB of archives.
After this operation, 5,914 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
WARNING: The following packages cannot be authenticated!
  aircrack-ng ieee-data
Install these packages without verification? [y/N] y
Err http://archive.ubuntu.com/ubuntu/ vivid/universe aircrack-ng amd64 1:1.2-0~beta3-4
  Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]
Err http://archive.ubuntu.com/ubuntu/ vivid/main ieee-data all 20141019.1
  Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]
E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/universe/a/aircrack-ng/aircrack-ng_1.2-0~beta3-4_amd64.deb  Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]

E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/i/ieee-data/ieee-data_20141019.1_all.deb  Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
ubuntu-mate@ubuntu-mate:~$

--------------------- MERGED ---------------------------

Using Ubuntu 15.04 Live CD, WiFi card Broadcom BCM43228, after the script opens a terminal emulator window, this is what it says:

ioctl(SIOCSIWMODE) failed: Operation not supported

ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make
sure RFMON is enabled: run 'airmon-ng start wlan0 <#>'
Sysfs injection support was not found either.

-------------------
Press any key to continue...

When trying to do it manually, it says something about the operation not being supported when I try to execute the iwconfig command. I didn't save the exact error message.
Also running this command that it tells me to run doesn't work because I don't have aircrack-ng installed, and when I try to install it, it says:

ubuntu-mate@ubuntu-mate:~$ sudo apt-get install aircrack-ng
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
linux-image-generic
Use 'apt-get autoremove' to remove it.
The following extra packages will be installed:
ieee-data
The following NEW packages will be installed:
aircrack-ng ieee-data
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,233 kB of archives.
After this operation, 5,914 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
WARNING: The following packages cannot be authenticated!
aircrack-ng ieee-data
Install these packages without verification? [y/N] y
Err http://archive.ubuntu.com/ubuntu/ vivid/universe aircrack-ng amd64 1:1.2-0~beta3-4
Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]
Err http://archive.ubuntu.com/ubuntu/ vivid/main ieee-data all 20141019.1
Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]
E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/universe/a/aircrack-ng/aircrack-ng_1.2-0~beta3-4_amd64.deb Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]

E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/i/ieee-data/ieee-data_20141019.1_all.deb Cannot initiate the connection to archive.ubuntu.com:80 (91.189.92.201). - connect (101: Network is unreachable) [IP: 91.189.92.201 80]

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
ubuntu-mate@ubuntu-mate:~$

 

[DarkJesus]

Are there any pcap files for using smashhax on the EU estore downloaded version 1.0.1?

 

[Argonitious]

I'm having the same issue as snaky90. I've been able to use the hack up until the update came out. I even tried to downgrade to 1.1.0 by removing the update files, but was still met with the same issue. Is there an extra step that the repository hasn't mentioned?

Hi !
I'm using this method but does not work for me on 10.3.0-28E
I followed step by step this tutorial but when I use the smash - > group the game crashes and closes and I get an error message "The program needs to close... "
I used the starter kit and otherapp payload for 10.3.0-28E renamed to smashpayload.bin
Why did not it work? Thanks !

 

[ihaveahax]

I'm having the same issue as snaky90. I've been able to use the hack up until the update came out. I even tried to downgrade to 1.1.0 by removing the update files, but was still met with the same issue. Is there an extra step that the repository hasn't mentioned?

do you mean 1.0.1?

people are requesting it as well; https://github.com/yellows8/3ds_smashbroshax/issues/8

anyway I suggest using the new browserhax in the mean time.

 

[Argonitious]

I forgot to mention that I'm using the US version of the New 3DS. For some reason, my hard copy of the game seems to be 1.1.0.

I didn't even know that a new browserhax was out. Thanks for the tip there!

 

[majinspyda]

having a hard time launching the exploit. I have Linux on a bootable usb and physical copy of ssb version 1.04 and follow the prompts but when I go to group the game crashes back to main menu

is anyone having the same issue or does anyone know of a workaround

by the way im using N3ds firm 10.0.0-27 U (cant launch browserhax cause browser asks me to update and DNS doesn't work for me)

 

[Ketchup901]

having a hard time launching the exploit. I have Linux on a bootable usb and physical copy of ssb version 1.04 and follow the prompts but when I go to group the game crashes back to main menu

is anyone having the same issue or does anyone know of a workaround

by the way im using N3ds firm 10.0.0-27 U (cant launch browserhax cause browser asks me to update and DNS doesn't work for me)

DNS isn't working for me either... I have tried like 5 different ones (that work on my computer) but they don't work on the 3DS.
Do you really need a DNS to update your firmware though?

 

[Aniodia]

So after a lot of trial and error with browserhax not working, I'm attempting this. I'm on an n3ds 9.9.0-25U (which is really weird, as I thought it was -26U), and actually got ubuntu working on my desktop with zero hassle. Following the helper, I've found my wireless card is a wlan0 type, and I initially got a reaction when I chose US 1.0.4 for my version. However, my 3ds errored out to the home menu, and I haven't gotten it to work since.

I'm using base sm4sh, no updates, no nothing. In fact, every time I boot up smash, it asks if I want to update, I cancel, it then asks if I want to continue anyway, I do, and it gives me one more prompt asking about streetpass. I believe I'm before 1.0.5, as I don't have the amiibo choice under the Games & More menu, but I'm unsure as to exactly what option I should be choosing for the smash version, and I think that's throwing things off.

Can someone help?

Edit: after catching some sleep and coming in with a fresh outlook (and making sure everything was perfect), got it to work first try. Thanks!

 

[Aboshi]

I am having the same issue on 1.1.0 physical cartridge where the exploit triggers than you get an error at the main menu saying the system needs to reboot.
It's extremely frustrating

N3DS used for testing bought a week ago (black came with 9.9 fw)
Now for testing purposes I have used the smashbroshax on my system thats already exploited.
Firmware's I have tested 10.6U. 9.2U, 9.9U, 10.3U, 10.5U all with the same end result!


Crash to main menu reboot console.

So for my other test, load a cia copy of super smash bros on 10.6 (emunand)
selected 1.0.0 payload because there is nothing on the screen indicating otherwise.
The exploit triggered flawlessly and booted me right into HBL

This leads me to believe 1 of 2 things for the physical cartridge.
1. The game cart itself has the exploit patched even on 1.1.0(I just bought it at a local target 2 days ago)
2. the payload (pcap) is non working.

I just posted it on yellow8's git hopefully he can chime in if were lucky.