NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

DisplayDriverExt.dll

417edc653f0ea0ac8be0e58a1f1c3fc17772ae9ed8c24e3ddab5200c74c33347

Identity

Property Value
Architecture x86
Source size 1,962,728 bytes
Preferred image base 0x10000000
Entry RVA 0xe2ee0
Imports / exports 267 / 5
Exception/unwind ranges 0
Executable raw bytes 1,307,648

Physical paths:

Decompilation coverage

Complete with errors: 4,238 successful reconstructions, 8 failures, 4,246 attempted entries, 4,246 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 1,307,648 1,307,404 yes / no / yes 6.5222
.rdata 0x141000 1308672 415,744 415,602 yes / no / no 4.8425
.data 0x1a7000 1724416 97,280 102,228 yes / yes / no 4.8848
.fptable 0x1c0000 1821696 512 128 yes / yes / no 0.0
.rsrc 0x1c1000 1822208 17,408 17,312 yes / no / no 4.7683
.reloc 0x1c6000 1839616 102,912 102,612 yes / no / no 6.5762

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va false
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview