[Android Q&A, Help & Troubleshooting] droidvoider:
update on INIT_OFFSET:

I tried many method to disassemble init but I found one right away that has the offset that is already in trident original. I haven't devoted any time to this but please update here to what you've found so that we can work together.

objdump -hp ./init >o.txt

OUTPUT

load.c values (from trident original, freddierice)

// offset into the init binary
#define INIT_OFFSET (0x401b98 - 0x4001c0 + 0x1c0)

#define RET "\xc0\x03\x5f\xd6"
#define NOP "\x1f\x20\x03\xd5"

./init: file format elf64-little

Program Header:
LOAD off 0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**16
filesz 0x0000000000141730 memsz 0x0000000000141730 flags r-x
LOAD off 0x0000000000142150 vaddr 0x0000000000552150 paddr 0x0000000000552150 align 2**16
filesz 0x0000000000121540 memsz 0x00000000001285c0 flags rw-
NOTE off 0x0000000000000158 vaddr 0x0000000000400158 paddr 0x0000000000400158 align 2**2
filesz 0x0000000000000038 memsz 0x0000000000000038 flags r--
STACK off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4
filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-
RELRO off 0x0000000000142150 vaddr 0x0000000000552150 paddr 0x0000000000552150 align 2**0
filesz 0x0000000000010eb0 memsz 0x0000000000010eb0 flags r--

Sections:
Idx Name Size VMA LMA File off Algn
0 .note.android.ident 00000018 0000000000400158 0000000000400158 00000158 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
1 .note.gnu.build-id 00000020 0000000000400170 0000000000400170 00000170 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .text 000f941c 00000000004001c0 00000000004001c0 000001c0 2**6
CONTENTS, ALLOC, LOAD, READONLY, CODE
3 .rodata 00027358 00000000004f9600 00000000004f9600 000f9600 2**6
CONTENTS, ALLOC, LOAD, READONLY, DATA
4 .eh_frame 00020350 0000000000520958 0000000000520958 00120958 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
5 .gcc_except_table 00000a88 0000000000540ca8 0000000000540ca8 00140ca8 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
6 .preinit_array 00000010 0000000000552150 0000000000552150 00142150 2**3
CONTENTS, ALLOC, LOAD, DATA
7 .init_array 00000060 0000000000552160 0000000000552160 00142160 2**3
CONTENTS, ALLOC, LOAD, DATA
8 .fini_array 00000018 00000000005521c0 00000000005521c0 001421c0 2**3
CONTENTS, ALLOC, LOAD, DATA
9 .data.rel.ro 000107b8 00000000005521e0 00000000005521e0 001421e0 2**4
CONTENTS, ALLOC, LOAD, DATA
10 .got 00000668 0000000000562998 0000000000562998 00152998 2**3
CONTENTS, ALLOC, LOAD, DATA
11 .data 00110690 0000000000563000 0000000000563000 00153000 2**5
CONTENTS, ALLOC, LOAD, DATA
12 .bss 00007080 0000000000673690 0000000000673690 00263690 2**4
ALLOC
13 .comment 00000041 0000000000000000 0000000000000000 00263690 2**0
CONTENTS, READONLY

other ways to disassemble, this outputs stack calls one by one but I didn't look at it too close

/home/droidvoider/Desktop/Android_6.01_r1/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin/aarch64-linux-android-objdump -b binary -m aarch64 -D ./init >init_out.txt
/home/droidvoider/Desktop/Android_6.01_r1/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin/aarch64-linux-android-objdump -b binary -m aarch64 -S /home/droidvoider/Desktop/Android_6.01_r1/external/selinux/libselinux/src/init.c -D ./init >init_out_all.txt

..answering questions:

Q. How do you use dirtycow with the dnsmasq trident root shell?

1. Compile dirtycow, I will link a copy for arm64-v8a android 23.

2. Use adb to push it to /data/local/tmp/ directory: adb push dcow /data/local/tmp/.

3. Open a regular adb shell window, cd /data/local/tmp and chmod 0777 *

4. ./dcow ./dcow /system/bin/screencap

Example of use:

1. copy files you want to patch to /sdcard/

(for example adb push init /sdcard/)

2. screencap /sdcard/init /init

<this will reboot your device instantly and is an example to prove you are live>

dirtycow 64bit android 23 through android 21 (if it runs it runs, don't try every version)

https://mega.nz/#!AMMWAagQ!IiglBSGM0fgQ6r6bCy9VHWOXFAE002ZhEBbqwb5MsAo