Techwiki:Win32k/FONTHASH

HASHBUCKET pool tag = 'Ghab', FONTHASH = 'Ghas'

typedef enum _FONT_HASH_TYPE
{
    FHT_FACE = 0,
    FHT_FAMILY = 1,
    FHT_UFI = 2,
} FONT_HASH_TYPE;

typedef struct _HASHBUCKET
{
    struct _HASHBUCKET * pbktCollision; // 000
    PFELINK *    ppfelEnumHead;         // 004 -> 'Glnk'
    PFELINK *    ppfelEnumTail;         // 008
    ULONG        cTrueType;             // 00c
    FLONG        fl;                    // 014
    struct _HASHBUCKET * pbktPrev;      // 018
    struct _HASHBUCKET * pbktNext;      // 01c
    ULONG        ulTime;                // 020
    union                               // 024
    {
        WCHAR             wcCapName[x];   // = "SYSTEM"
        UNIVERSAL_FONT_ID ufi;
    } u;
} HASHBUCKET, *PHASHBUCKET;

ulTime

A counter that is incremented for each new HASHBUCKET. FONTHASH::pbktFirst has a value of 0, FONTHASH::pbktLast has the highest value.

pbktPrev

Pointer to the previous HASHBUCKET, NULL if this is the first

pbktNext

Pointer to the next HASHBUCKET, NULL if this is the last

wcCapName

String of upcased font name.

typedef struct
{
    DWORD id;               // 000 := 0x48534148 = 'HASH'
    FONT_HASH_TYPE fht;     // 004
    ULONG cBuckets;         // 008
    ULONG cUsed;            // 00c
    ULONG cCollisions;      // 010
    HASHBUCKET * pbktFirst; // 014
    HASHBUCKET * pbktLast;  // 018
    HASHBUCKET * apbkt[];   // 01c
} FONTHASH, *PFONTHASH;

Refrences:

• gdikdx