Android If you have an arbitrarily written vulnerability, how to turn write permissions into Execute permissions

This topic I think is the test how to carry out the right, the result is this:

1 . Dexclassloader dynamic load application writable dex executable 2. The Java.lang.Runtime.exec method executes an elf file that the application can write to 3. System.load and System.loadlibrary dynamically load applications writable Elf shared objects 4. Native code performs application-writable ELF files using functions such as System, Popen, and so on C8>5. Native code uses Dlopen to load an Elf shared object that the app can write to 6. Using the Multidex mechanism

Taking the 2nd as an example, the answer should mean that the application has a place called the runtime.exec, if the file path is changed to the elf file written by the attacker (because there is write permission), and then the application execution.

Android If there is an arbitrary write vulnerability, how to turn Write permissions to execute permissions