Hi! Sorry for the delay here,,,
This is what we know to be correct sofar. The "Book" section 3.4 GdiTableCell structure is not necessarily correct.
typedef struct _GDI_TABLE_ENTRY { PVOID KernelData; SHORT Count:15; Count number of refs. SHORT Lock:1; Does set if locked by process. It also explains why the count shows 1 -> 3 most of the time. SHORT ProcessId; Process Id is here. SHORT nUpper; should match the upper half of the handle. CHAR ObjectType; example-> 0x0401, // not all memdc, dc =1, etc,,, CHAR Flags; --> 0x04 is here, set if memdc, sometimes~. PVOID UserData; } GDI_TABLE_ENTRY, *PGDI_TABLE_ENTRY;
Thanks, James