CVE-2016-3857

Credit(for exp): [email protected] (IceSwordLab),
Credit(for vuln): Chiachih Wu (@chiachih_wu)、Yuan-Tsung Lo ([email protected]) 和 Xuxian Jiang

Exploit

Just for Nexus 7(2013) LMY48T, if you want to run it on other version, some symbols address should be changed
root@flo:/ # getprop ro.build.fingerprint
google/razor/flo:5.1.1/LMY48T/2237560:user/release-keys

EXP

Reference