From ReactOS

BRUSH as found on Windows XP

typedef _BRUSHATTR
{
    UINT AttrFlags;
    COLORREF lbColor;
} BRUSHATTR, *PBRUSHATTR;

typedef _BRUSH
{
    BASEOBJECT baseobj;       // 0x000 ulShareCount = 6
    ULONG      ulStyle;       // 0x010
    HBITMAP    hbmPattern;    // 0x014 01050078 
    HBITMAP    hbmClient;     // 0x018 01050077 invalid handle
    FLONG      flAttrs;       // 0x01c 00020043 
    ULONG      ulBrushUnique; // 0x020 0000002e ?
    PBRUSHATTR pbrushattr;    // 0x024 e16293c8
    BRUSHATTR  brushattr;     // 0x028
    DWORD      unk030;        // 0x030 00000000
    ULONG      unk034;        // 0x034 00000000 ?
    BOOL       bCacheGrabbed; // 0x038 00000001 ?
    COLORREF   crBack;        // 0x03c 00d8e9ec
    COLORREF   crFore;        // 0x040 00ffffff
    ULONG      ulPalTime;     // 0x044 00000004 ?
    ULONG      ulSurfTime;    // 0x048 00000008 ?
    PVOID      pvRBrush       // 0x04c e16146b0 -> 'Gdbr' (ulRealisation in gdikdx)
    PPDEVOBJ   ppdev;         // 0x050 e1d17008 -> 'GDev'
    DWORD      unk054;        // 0x054 ffffffff 
    LONG       lWidth;        // 0x058 00000000  Width is measured in LONG device coordinates
                              //                 for a cosmetic wide line.
                              // NtGdiExtCreatePen ulWidth
    FLOATL     eWidth;        // 0x05c 00000000  Width is measured in FLOAT world coordinates
                              //                 for a geometric wide line.
    ULONG      ulPenStyle;    // 0x060
    DWORD     *pStyle;        // 0x064 -> 'Gsty' Pointer to an array of FLOAT_LONG elements
                              // Allocated copy of pulStyle.
    DWORD      dwStyleCount;  // 0x068           Specifies the number of entries in the style
                              //                 array pointed to by the pstyle member.
    BYTE       jJoin;         // 0x06c 00        join styles for geometric wide lines
    BYTE       jEndCap;       //       00        end cap style for a geometric wide line
    WORD       unk06e;        // 0x06e 0100
    INT        iBrushStyle;   // 0x070 8a27f1f0 ???
    PREGION    prgn;          // 0x074 e1610008 -> 'Gla4'
    DWORD      unk078;        // 0x078 00020210 
    DWORD      unk07c;        // 0x07c 7153624f
    LIST_ENTRY ListHead;      // 0x080
} BRUSH, *PBRUSH;

Fields

hbmClient

For pattern brushes, this is the handle of the bitmap that was used to create the brush. For DIB brushes, it is a user mode pointer to the packed DIB.

ulStyle

Hatch style for hatch brushes

flAttrs

Flags. See EBRUSHOBJ for a list of flAttrs flags.