In this 2-part “Everyday Ghidra” series post, we’ll walk through creating custom Ghidra data types by parsing C header files. In Everyday Ghidra

Everyday Ghidra: Ghidra Data Types— When to Create Custom GDTs — Part 1

submited by

Style Pass

2024-11-12 20:30:04

In this 2-part “Everyday Ghidra” series post, we’ll walk through creating custom Ghidra data types by parsing C header files. In Everyday Ghidra: Symbols (part 1), we explored various sources Ghidra uses to generate symbols, including public headers from sources like the Windows Software Development Kit (SDK). This time, we will show you how to leverage those headers in Ghidra to build new data types. Leveraging the actual data types used to compile the Windows binaries makes reversing them much easier.

In this post, we’ll define Ghidra Data Types (GDTs) and discuss when you need to create your own custom GDTs. In part 2, we’ll dive into an efficient process to build your own GDT files, filling in the gaps when Ghidra’s default GDTs fall short. This multi-part guide will shed some light on Ghidra’s GDTs and teach you how to create them from Windows header files with Ghidra.

You might wonder, “What is a GDT?” or “When do I need one?”. Before defining a GDT, let’s first tackle the concept of data types. Ghidra uses data types to interpret bytes in memory. By applying well-defined data types, Ghidra can structure, label, and visually represent the program’s bytes in a way that enhances our understanding of the program.