Techwiki:Win32k/FONTHASH

HASHBUCKET pool tag = 'Ghab', FONTHASH = 'Ghas'

typedef struct _HASHBUCKET
{
  struct _HASHBUCKET * pbktCollision; // 000
  PFELINK *    ppfelEnumHead;         // 004 -> 'Glnk'
  PFELINK *    ppfelEnumTail;         // 008
  ULONG        cTrueType;             // 00c
  FLONG        fl;                    // 014
  struct _HASHBUCKET * pbktPrev;      // 018
  struct _HASHBUCKET * pbktNext;      // 01c
  ULONG        ulTime;                // 020
  union                               // 024
  {
    WCHAR             wcCapName[x];   // = "SYSTEM"
    UNIVERSAL_FONT_ID ufi;
  } u;
} HASHBUCKET, *PHASHBUCKET;

typedef enum _FONT_HASH_TYPE
{
    FHT_FAMILY = 1,
    FHT_FACE = ?,
    FHT_UFI = ?,
} FONT_HASH_TYPE;

typedef struct
{
  DWORD id;               // 000 := 0x48534148 = 'HASH'
  FONT_HASH_TYPE fht;     // 004
  ULONG cBuckets;         // 008
  ULONG cUsed;            // 00c
  ULONG cCollisions;      // 010
  HASHBUCKET * pbktFirst; // 014
  HASHBUCKET * pbktLast;  // 018
  HASHBUCKET * apbkt[];   // 01c
} FONTHASH, *PFONTHASH;

Refrences:

• gdikdx