zoogie / smilehax-iie

Primary 3DS userland sploit for Smilebasic 3.6.0 EUR/USA (latest version). 3.3.2 JPN support via app downgrade from > 3.3.2. Works on 11.17.0-50.

smilehax-IIe

Intro

This is a new primary exploit for 3DS Smilebasic 3.6.0 USA/EUR (& 3.3.2 JPN). USA/EUR are currently the latest appversion, while JPN can be downgraded from 3.6.3->3.5.0 to 3.3.2.

Directions

Directions are provided in the Release archive.
You do need a USA, EUR, or JPN 3DS/2DS and an eshop download of Smilebasic to get started.

Exploit

Utf-16 characters can be assigned to subscripted TIME$/DATE$ interpreter sysvars which results in write-only access to all of DATA and some BSS in userland.
TIME$[0]/DATE$[0] actually point to somewhere in rodata, and an overly large subscript can be used to write well past it and into the aforementioned areas.

Q&A

Q: IIe?
A: This is a reference to the legendary Apple IIe, one of the BASIC enabled 80's era PCs that inspired Smilebasic/Petit Computer's invention. It's also a reference to the first Smilehax by plutoo, of course.

Q: JPN support?
A: Yes, it's supported now. Instructions are in the Release.

Q: Why is the JPN app version and hack method different from the West?
A: The vuln used here was actually fixed on JPN SB version 3.6.2 (and documented on the dev's JPN site!), so we need to delete/rename the update file and run the vuln on base app version 3.3.2.
Since 3.3.2 doesn't have DirectSdmc support (which was introduced on 3.6.0 to enable in-app screenshots) we have to download the rop payload via HTTP instead of loading it from the SD card. This is basically (ha) how the first smilehax operated.

Q: Will this work on JPN WiiU since it's latest version 3.6.0 too?
A: Maybe, but I doubt it. The 3ds version allows for about 1.5 MBs of overflowed access - I doubt that would be enough to reach critical areas on the system. Not sure though, go ahead and find out yourself although I doubt I'd want to mess with it.

Q: Switch?
A: Not a chance.

Q: You released an exploit for petit computer not long ago, are these two sploits related?
A: Sort of! Smilehax IIe actually was developed first and the idea of checking official app changelogs for vulns inspired finding petit-compwner's vuln as well.

Thanks

• Yellows8 for 3ds ropkit
• Plutoo for the http download template used in smilehax here
• Everyone (most prolific 3ds dev ever)

smilehax-iie's Issues

Red screen when trying to launch an homebrew

So the issue is: I'm unable to launch any homebrew using the homebrew launcher, i'm using Luma3DS 10.2.1 3GX Loader Edition, and the Rosalina (2.2.0) homebrew launcher. I also tried to use the 1.1.0 homebrew launcher, and i still can't launch anything. When i try to launch a homebrew, i get a red screen for something like 2sec and then i go back to the homebrew launcher. Is it because of my CFW, or my homebrew launcher ? (also i can't go back to the home menu)