diff --git a/reactos/win32ss/gdi/ntgdi/brush.c b/reactos/win32ss/gdi/ntgdi/brush.c
index 486fb4331eb..7b2fde287f6 100644
--- a/reactos/win32ss/gdi/ntgdi/brush.c
+++ b/reactos/win32ss/gdi/ntgdi/brush.c
@@ -11,19 +11,80 @@
 #define NDEBUG
 #include <debug.h>
 
-#define GDIOBJATTRFREE 170
-
-typedef struct _GDI_OBJ_ATTR_FREELIST
+static
+VOID
+BRUSH_vInit(
+    PBRUSH pbr)
 {
-  LIST_ENTRY Entry;
-  DWORD nEntries;
-  PVOID AttrList[GDIOBJATTRFREE];
-} GDI_OBJ_ATTR_FREELIST, *PGDI_OBJ_ATTR_FREELIST;
+    /* Start with kmode brush attribute */
+    pbr->pBrushAttr = &pbr->BrushAttr;
+}
 
-typedef struct _GDI_OBJ_ATTR_ENTRY
+static
+PBRUSH
+BRUSH_AllocBrushWithHandle(
+    VOID)
 {
-  RGN_ATTR Attr[GDIOBJATTRFREE];
-} GDI_OBJ_ATTR_ENTRY, *PGDI_OBJ_ATTR_ENTRY;
+    PBRUSH pbr;
+
+    pbr = (PBRUSH)GDIOBJ_AllocObjWithHandle(GDILoObjType_LO_BRUSH_TYPE, sizeof(BRUSH));
+    if (pbr == NULL)
+    {
+        return NULL;
+    }
+
+    BRUSH_vInit(pbr);
+    return pbr;
+}
+
+static
+BOOL
+BRUSH_bAllocBrushAttr(PBRUSH pbr)
+{
+    PPROCESSINFO ppi;
+    BRUSH_ATTR *pBrushAttr;
+    NT_ASSERT(pbr->pBrushAttr == &pbr->BrushAttr);
+
+    ppi = PsGetCurrentProcessWin32Process();
+    NT_ASSERT(ppi);
+
+    pBrushAttr = GdiPoolAllocate(ppi->pPoolBrushAttr);
+    if (!pBrushAttr)
+    {
+        DPRINT1("Could not allocate brush attr\n");
+        return FALSE;
+    }
+
+    /* Copy the content from the kernel mode dc attr */
+    pbr->pBrushAttr = pBrushAttr;
+    *pbr->pBrushAttr = pbr->BrushAttr;
+
+    /* Set the object attribute in the handle table */
+    GDIOBJ_vSetObjectAttr(&pbr->BaseObject, pBrushAttr);
+
+    DPRINT("BRUSH_bAllocBrushAttr: pbr=%p, pbr->pdcattr=%p\n", pbr, pbr->pBrushAttr);
+    return TRUE;
+}
+
+static
+VOID
+BRUSH_vFreeBrushAttr(PBRUSH pbr)
+{
+    PPROCESSINFO ppi;
+
+    if (pbr->pBrushAttr == &pbr->BrushAttr) return;
+
+    /* Reset the object attribute in the handle table */
+    GDIOBJ_vSetObjectAttr(&pbr->BaseObject, NULL);
+
+    /* Free memory from the process gdi pool */
+    ppi = PsGetCurrentProcessWin32Process();
+    ASSERT(ppi);
+    GdiPoolFree(ppi->pPoolBrushAttr, pbr->pBrushAttr);
+
+    /* Reset to kmode brush attribute */
+    pbr->pBrushAttr = &pbr->BrushAttr;
+}
 
 BOOL
 FASTCALL
@@ -34,16 +95,20 @@ IntGdiSetBrushOwner(PBRUSH pbr, ULONG ulOwner)
 
     if ((ulOwner == GDI_OBJ_HMGR_PUBLIC) || ulOwner == GDI_OBJ_HMGR_NONE)
     {
+        /* Free user mode attribute, if any */
+        BRUSH_vFreeBrushAttr(pbr);
+
         // Deny user access to User Data.
         GDIOBJ_vSetObjectAttr(&pbr->BaseObject, NULL);
-        // FIXME: deallocate brush attr
     }
 
     if (ulOwner == GDI_OBJ_HMGR_POWNED)
     {
+        /* Allocate a user mode attribute */
+        BRUSH_bAllocBrushAttr(pbr);
+
         // Allow user access to User Data.
         GDIOBJ_vSetObjectAttr(&pbr->BaseObject, pbr->pBrushAttr);
-        // FIXME: Allocate brush attr
     }
 
     GDIOBJ_vSetObjectOwner(&pbr->BaseObject, ulOwner);
@@ -64,56 +129,6 @@ GreSetBrushOwner(HBRUSH hBrush, ULONG ulOwner)
     return Ret;
 }
 
-BOOL
-NTAPI
-BRUSH_bAllocBrushAttr(PBRUSH pbr)
-{
-    PPROCESSINFO ppi;
-    BRUSH_ATTR *pBrushAttr;
-
-    ppi = PsGetCurrentProcessWin32Process();
-    ASSERT(ppi);
-
-    pBrushAttr = GdiPoolAllocate(ppi->pPoolDcAttr);
-    if (!pBrushAttr)
-    {
-        DPRINT1("Could not allocate brush attr\n");
-        return FALSE;
-    }
-
-    /* Copy the content from the kernel mode dc attr */
-    pbr->pBrushAttr = pBrushAttr;
-    *pbr->pBrushAttr = pbr->BrushAttr;
-
-    /* Set the object attribute in the handle table */
-    GDIOBJ_vSetObjectAttr(&pbr->BaseObject, pBrushAttr);
-
-    DPRINT("BRUSH_bAllocBrushAttr: pbr=%p, pbr->pdcattr=%p\n", pbr, pbr->pBrushAttr);
-    return TRUE;
-}
-
-
-VOID
-NTAPI
-BRUSH_vFreeBrushAttr(PBRUSH pbr)
-{
-#if 0
-    PPROCESSINFO ppi;
-
-    if (pbrush->pBrushAttr == &pbrush->BrushAttr) return;
-
-    /* Reset the object attribute in the handle table */
-    GDIOBJ_vSetObjectAttr(&pbr->BaseObject, NULL);
-
-    /* Free memory from the process gdi pool */
-    ppi = PsGetCurrentProcessWin32Process();
-    ASSERT(ppi);
-    GdiPoolFree(ppi->pPoolBrushAttr, pbr->pBrushAttr);
-#endif
-    /* Reset to kmode brush attribute */
-    pbr->pBrushAttr = &pbr->BrushAttr;
-}
-
 VOID
 NTAPI
 BRUSH_vCleanup(PVOID ObjectBody)
diff --git a/reactos/win32ss/gdi/ntgdi/brush.h b/reactos/win32ss/gdi/ntgdi/brush.h
index fe6cf34082c..68685216036 100644
--- a/reactos/win32ss/gdi/ntgdi/brush.h
+++ b/reactos/win32ss/gdi/ntgdi/brush.h
@@ -32,12 +32,12 @@ typedef struct _BRUSH
    ULONG ulPalTime;
    ULONG ulSurfTime;
    PVOID ulRealization;
-   ULONG Unknown4C[3];
+   //ULONG Unknown4C[3];
    POINT ptPenWidth;
    ULONG ulPenStyle;
    DWORD *pStyle;
    ULONG dwStyleCount;
-   ULONG Unknown6C;
+   //ULONG Unknown6C;
 } BRUSH, *PBRUSH;
 
 typedef struct _EBRUSHOBJ
@@ -86,8 +86,6 @@ typedef struct _EBRUSHOBJ
 #define BR_CACHED_ENGINE    0x00040000
 #define BR_CACHED_IS_SOLID  0x80000000
 
-#define  BRUSH_AllocBrush() ((PBRUSH) GDIOBJ_AllocObj(GDIObjType_BRUSH_TYPE))
-#define  BRUSH_AllocBrushWithHandle() ((PBRUSH) GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_BRUSH, sizeof(BRUSH)))
 #define  BRUSH_FreeBrush(pBrush) GDIOBJ_FreeObj((POBJ)pBrush, GDIObjType_BRUSH_TYPE)
 #define  BRUSH_FreeBrushByHandle(hBrush) GDIOBJ_FreeObjByHandle((HGDIOBJ)hBrush, GDI_OBJECT_TYPE_BRUSH)
 #define  BRUSH_ShareLockBrush(hBrush) ((PBRUSH)GDIOBJ_ShareLockObj((HGDIOBJ)hBrush, GDI_OBJECT_TYPE_BRUSH))
diff --git a/reactos/win32ss/gdi/ntgdi/color.h b/reactos/win32ss/gdi/ntgdi/color.h
index bde20c2455f..9922b738c73 100644
--- a/reactos/win32ss/gdi/ntgdi/color.h
+++ b/reactos/win32ss/gdi/ntgdi/color.h
@@ -1,8 +1,5 @@
 #pragma once
 
-#ifndef CLR_INVALID
-#define CLR_INVALID         0xffffffff
-#endif
 #define PC_SYS_USED     0x80		/* Palentry is used (both system and logical) */
 #define PC_SYS_RESERVED 0x40		/* System palentry is not to be mapped to */
 #define PC_SYS_MAPPED   0x10		/* Logical palentry is a direct alias for system palentry */
diff --git a/reactos/win32ss/gdi/ntgdi/pen.c b/reactos/win32ss/gdi/ntgdi/pen.c
index 7b845fb95fb..b4ab1017c59 100644
--- a/reactos/win32ss/gdi/ntgdi/pen.c
+++ b/reactos/win32ss/gdi/ntgdi/pen.c
@@ -13,9 +13,52 @@
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
+static
+VOID
+PEN_vInit(
+    PPEN ppen)
+{
+    /* Start with kmode brush attribute */
+    ppen->pBrushAttr = &ppen->BrushAttr;
+}
+
+PBRUSH
+NTAPI
+PEN_AllocPenWithHandle(
+    VOID)
+{
+    PPEN ppen;
+
+    ppen = (PBRUSH)GDIOBJ_AllocObjWithHandle(GDILoObjType_LO_PEN_TYPE, sizeof(PEN));
+    if (ppen == NULL)
+    {
+        return NULL;
+    }
+
+    PEN_vInit(ppen);
+    return ppen;
+}
+
+PBRUSH
+NTAPI
+PEN_AllocExtPenWithHandle(
+    VOID)
+{
+    PPEN ppen;
+
+    ppen = (PBRUSH)GDIOBJ_AllocObjWithHandle(GDILoObjType_LO_EXTPEN_TYPE, sizeof(PEN));
+    if (ppen == NULL)
+    {
+        return NULL;
+    }
+
+    PEN_vInit(ppen);
+    return ppen;
+}
+
 PBRUSH
 FASTCALL
-PEN_ShareLockPen(HGDIOBJ hobj)
+PEN_ShareLockPen(HPEN hobj)
 {
     if ((GDI_HANDLE_GET_TYPE(hobj) != GDILoObjType_LO_PEN_TYPE) &&
         (GDI_HANDLE_GET_TYPE(hobj) != GDILoObjType_LO_EXTPEN_TYPE))
diff --git a/reactos/win32ss/gdi/ntgdi/pen.h b/reactos/win32ss/gdi/ntgdi/pen.h
index dba11663aa3..cfe0f9759b4 100644
--- a/reactos/win32ss/gdi/ntgdi/pen.h
+++ b/reactos/win32ss/gdi/ntgdi/pen.h
@@ -2,24 +2,28 @@
 
 /* Internal interface */
 
-#define PEN_AllocPen() ((HPEN)GDIOBJ_AllocObj(GDIObjType_BRUSH_TYPE))
-#define PEN_AllocPenWithHandle() ((PBRUSH)GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_PEN, sizeof(BRUSH)))
+typedef BRUSH PEN, *PPEN;
 
-#define PEN_FreePen(pBMObj) GDIOBJ_FreeObj((POBJ) pBMObj, GDIObjType_BRUSH_TYPE)
-#define PEN_FreePenByHandle(hBMObj) GDIOBJ_FreeObjByHandle((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_PEN)
+PPEN
+NTAPI
+PEN_AllocPenWithHandle(
+    VOID);
 
-#define PEN_AllocExtPen() ((PBRUSH)GDIOBJ_AllocObj(GDIObjType_BRUSH_TYPE))
-#define PEN_AllocExtPenWithHandle() ((PBRUSH)GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_EXTPEN, sizeof(BRUSH)))
-
-#define PEN_FreeExtPen(pBMObj) GDIOBJ_FreeObj((POBJ) pBMObj, GDIObjType_BRUSH_TYPE)
-#define PEN_FreeExtPenByHandle(hBMObj) GDIOBJ_FreeObjByHandle((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_EXTPEN)
-
-//#define PEN_LockExtPen(hBMObj) ((PBRUSH)GDIOBJ_LockObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_EXTPEN))
+PPEN
+NTAPI
+PEN_AllocExtPenWithHandle(
+    VOID);
 
 #define PEN_UnlockPen(pPenObj) GDIOBJ_vUnlockObject((POBJ)pPenObj)
+#define PEN_ShareUnlockPen(ppen) GDIOBJ_vDereferenceObject((POBJ)ppen)
 
-#define  PEN_ShareUnlockPen(ppen) GDIOBJ_vDereferenceObject((POBJ)ppen)
+PPEN
+FASTCALL
+PEN_ShareLockPen(HPEN hpen);
 
-PBRUSH FASTCALL PEN_ShareLockPen(HGDIOBJ);
-
-INT APIENTRY PEN_GetObject(PBRUSH pPen, INT Count, PLOGPEN Buffer);
+INT
+NTAPI
+PEN_GetObject(
+    _In_ PPEN pPen,
+    _In_ INT Count,
+    _Out_ PLOGPEN Buffer);