Trinity: PSP Emulator Escape

If you read the slides, you may have noticed the following code snippet:

In essence, UID’s to kernel objects are simply encodings of their kernel addresses. Plugging it together with the previous vulnerability, we can now execute code in MIPS kernel as follows:

Why hack the PSP Emulator anyways? The fuzzer, residing on the MIPS processor, basically chose random commands and random arguments (integers and valid pointers to buffers that also contain random values) and sent them via the Kermit protocol.

Source: theofficialflow.github.io