Forest Global Training Partners

Cyber Risks · Cisco Talos

Ghidra data type archive for Windows driver functions

Summary: Cisco Talos released a Ghidra data type archive (.gdt) file on GitHub containing definitions for Windows driver functions and data types that its analysts created while reverse-engineering malicious drivers, because Ghidra does not natively include most Windows driver definitions and some are undocumented by Microsoft. Talos describes the archive as a supplement to existing data type archives, not a replacement, and says it will grow as analysts add new definitions.

Bottom line: Analysts reverse-engineering malicious Windows drivers otherwise have to hand-build definitions for functions Microsoft leaves undocumented, which slows the work of understanding a driver's behavior.

Read the original at Cisco Talos ↗

Topics
Malware
Mentions
CVE-2026-20127
Related