NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NvOAWrapperCache.exe

0d26ce0ad86cfa671425fe7de2b762c62e148597092fe0edcf5ff84a584fdbb9

Identity

Property Value
Architecture AMD64
Source size 428,656 bytes
Preferred image base 0x140000000
Entry RVA 0xd6c0
Imports / exports 102 / 0
Exception/unwind ranges 830
Executable raw bytes 174,080

Physical paths:

Decompilation coverage

Complete: 970 successful reconstructions, 0 failures, 970 attempted entries, 970 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 174,080 173,628 yes / no / yes 6.4733
.rdata 0x2c000 175104 73,216 72,744 yes / no / no 4.8762
.data 0x3e000 248320 5,120 30,072 yes / yes / no 3.0477
.pdata 0x46000 253440 10,240 9,960 yes / no / no 5.2956
_RDATA 0x49000 263680 1,024 640 yes / no / no 3.1979
.rsrc 0x4a000 264704 151,040 150,680 yes / no / no 6.4532
.reloc 0x6f000 415744 2,560 2,500 yes / no / no 5.382

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview