CVE-2016-2435

• Credit: [email protected] (IceSwordLab)

Exploit

• Just for Nexus 9 MMB29R, if you want to run on other version, some symbol address should be changed
• shell@flounder:/ $ getprop ro.build.fingerprint
• google/volantis/flounder:6.0.1/MMB29R/2482564:user/release-keys

• EXP

Reference

• Android
• zimperium