Comment by int0x29

You can turn off win32k calls for a process if you don't need gui. You can also run the process with a lower privilege access token to reduce file access and some kernel access.

I'd love to see one to block more kernel calls than just win32k. The best method I've come up with is to create a shared memory buffer to a seperate interface process and then unmount ntdll.dll by marking its pages `page_noaccess`. Thanks to win32 weirdness you can still allocate memory into the process without nt calls from the interface process as VirtualAllocEx, VirtualAlloc2, VirtualProtectEx, VirtualFreeEx, VirtualQueryEx, NtAllocateVirtualMemory, NtFreeVirtualMemory, etc take a process handle as an argument. This kinda requires writing a userspace kernel and your own standard library though.

MS please give me a better method to lock down kernel access beyond nowin32k. Hyperv doesn't work for consumer apps as half the consumer versions of windows don't have it.