Exploiting MS16-098 RGNOBJ Integer Overflow on Windows 8.1 x64 bit by abusing GDI objects

This is a step-by-step technical walkthrough of exploiting an integer overflow in win32k!bFill (MS16-098) on Windows 8.1 x64: the author reverses the patch, demonstrates how to trigger and control the overflow via GDI Path/PolylineTo calls, performs kernel pool feng shui, abuses Bitmap objects for arbitrary kernel read/write, and uses that primitive to replace the current process token with SYSTEM; exploit code and details are provided and the vulnerability is identified as patched (MS16-098).