On the Nintendo Wii U we were able to do this. Check out "GX2 unchecked memory read/write": http://wiiubrew.org/wiki/Wii_U_System_Flaws. Same issue with "gspwn" on the Nintendo 3DS: https://www.3dbrew.org/wiki/3DS_System_Flaws
239 karma · joined September 26, 2013
Original paper (which I actually read when it first came out earlier this year): http://www.cs.binghamton.edu/~dima/micro16.pdf
First PoC for leaking ASLR based on timing side-channel attack: https://github.com/felixwilhelm/mario_baslr
The only issue I had was with my Oculus Rift, but I suspect I could have fixed it by getting a dedicated USB PCI card to passthrough. Anyways, for AAA games it worked wonderfully with very near native speeds.