---
id: 4513
title: "Reverse Engineering the Win32k Type Isolation Mitigation"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/reverse-engineering-the-win32k-type-isolation-mitigation.html"
published_at: "2018-02-01T23:00:00Z"
tags: ["windows", "reverse-engineering", "kernel", "exploit-mitigation", "quarkslab", "win32k"]
phying_url: "https://phying.com/item/4513"
lang: en
---

# Reverse Engineering the Win32k Type Isolation Mitigation

## Summary

How Win32k Type Isolation (Windows 10 1709) splits the memory layout of SURFACE/Bitmap kernel objects to kill popular GDI Bitmap exploitation primitives; a deep, binary-level reconstruction.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2018-02-01T23:00:00Z
- **Original:** https://blog.quarkslab.com/reverse-engineering-the-win32k-type-isolation-mitigation.html
- **Phying News:** https://phying.com/item/4513