Hi!
Sorry for the delay here,,,
This is what we know to be correct sofar. The "Book" section 3.4
GdiTableCell structure is not necessarily correct.
typedef struct _GDI_TABLE_ENTRY
{
PVOID KernelData;
SHORT Count:15; Count number of refs.
SHORT Lock:1; Does set if locked by process. It also
explains why the count shows 1 -> 3 most of the time.
SHORT ProcessId; Process Id is here.
SHORT nUpper; should match the upper half of the handle.
CHAR ObjectType; example-> 0x0401, // not all memdc, dc =1, etc,,,
CHAR Flags; --> 0x04 is here, set if memdc, sometimes~.
PVOID UserData;
} GDI_TABLE_ENTRY, *PGDI_TABLE_ENTRY;
Thanks,
James