NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

DisplayDriverExt.dll

3003a80c9e45d37ac4b345a0a3cb10d5f8ecd6b5f02ed68e8ff69b622bf57334

Identity

Property Value
Architecture x86
Source size 1,956,072 bytes
Preferred image base 0x10000000
Entry RVA 0xe27e0
Imports / exports 257 / 5
Exception/unwind ranges 0
Executable raw bytes 1,287,168

Physical paths:

Decompilation coverage

Complete with errors: 4,360 successful reconstructions, 8 failures, 4,368 attempted entries, 4,368 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 1,287,168 1,286,824 yes / no / yes 6.5341
.rdata 0x13c000 1288192 429,056 428,678 yes / no / no 4.877
.data 0x1a5000 1717248 96,256 101,836 yes / yes / no 4.8492
.rsrc 0x1be000 1813504 17,408 17,312 yes / no / no 4.7702
.reloc 0x1c3000 1830912 104,960 104,860 yes / no / no 6.5808

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va false
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview