That's already explained in the original blog post

http://googleprojectzero.blogspot.com/2015/03/exploiting-dra...