Techwiki:Win32k/PALETTE

The PALETTE struct is of variable size. It has the pool tag 'Gh08' or 'Gla8' (allocated from lookaside list, size was in this case found to be 0x220, which would be 115 (0x73) PALETTEENTRYs)

typedef struct _PALETTE
{
    BASEOBJECT      BaseObject;    // 0x00

    FLONG           flPal;         // 0x10
    ULONG           cEntries;      // 0x14
    ULONG           ulTime;        // 0x18
    HDC             hdcHead;       // 0x1c
    HDEVPPAL        hSelected;     // 0x20, 
    ULONG           cRefhpal;      // 0x24
    ULONG           cRefRegular;   // 0x28
    PTRANSLATE      ptransFore;    // 0x2c
    PTRANSLATE      ptransCurrent; // 0x30
    PTRANSLATE      ptransOld;     // 0x34
    ULONG           unk_038;       // 0x38
    PFN             pfnGetNearest; // 0x3c
    PFN             pfnGetMatch;   // 0x40
    ULONG           ulRGBTime;     // 0x44
    PRGB555XL       pRGBXlate;     // 0x48
    PALETTEENTRY    *pFirstColor;  // 0x4c
    struct _PALETTE *ppalThis;     // 0x50
    PALETTEENTRY    apalColors[1]; // 0x54
} PALETTE, *PPALETTE;

Fields

flPal

Flags that describe the palette. Can be a combination of the following values:

typedef enum
{
    PAL_INDEXED         = 0x000001,
    PAL_BITFIELDS       = 0x000002,
    PAL_RGB             = 0x000004,
    PAL_BGR             = 0x000008,
    PAL_CMYK            = 0x000010,
    PAL_DC              = 0x000100,
    PAL_FIXED           = 0x000200,
    PAL_FREE            = 0x000400,
    PAL_MANAGED         = 0x000800,
    PAL_NOSTATIC        = 0x001000,
    PAL_MONOCHROME      = 0x002000,
    PAL_BRUSHHACK       = 0x004000,
    PAL_DIBSECTION      = 0x008000,
    PAL_NOSTATIC256     = 0x010000,
    PAL_HT              = 0x100000,
    PAL_RGB16_555       = 0x200000,
    PAL_RGB16_565       = 0x400000,
    PAL_GAMMACORRECTION = 0x800000,
} PAL_FLAGS;

cEntries

Number of entries in the apalColors array, if PAL_INDEXED. 0 in other cases.

ulTime

A counter that gets incremented with every new palette that is created.

hdcHead

hSelected

HDEV of the DC, same as hdcHead::ppdev

cRefhpal

ptransFore

ptransCurrent

ptransOld

Seem to be always NULL on Windows XP.

pfnGetNearest

Points to win32k!ulIndexedGetNearestFromPalentry

pfnGetMatch

Points to win32k!ulIndexedGetMatchFromPalentry

ulRGBTime

pRGBXlate

pFirstColor

this->apalColors, attention!! Yuan is wrong here

ppalThis

Pointer to the EPALOBJ, attention!! Yuan is wrong here