Taking two snapshots of virtual memory before and after creating a GDI object, compare them, you can find the hidden treasure, a read-only view of the undocumented GDI handle table (address 0x00450000).

A hex-decimal view of the GDI handle table: 16-bytes per GDI object

HANDLES.EXE: Decoding the contents of GDI handle table

FOSTERER.EXE: Hosting GDI kernel debugger extension to explore GDI internal data structure on a single machine