NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NvAccount.dll

473c1ea63f0a9a923303f7a03315eb285ad48326fd1f23f3e67685bb464dbe44

Identity

Property Value
Architecture AMD64
Source size 2,857,584 bytes
Preferred image base 0x180000000
Entry RVA 0x1ae0
Imports / exports 398 / 1
Exception/unwind ranges 6,982
Executable raw bytes 2,312,192

Physical paths:

Decompilation coverage

Complete with errors: 14,752 successful reconstructions, 5 failures, 14,757 attempted entries, 14,757 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 2,312,192 2,312,049 yes / no / yes 5.1791
.rdata 0x236000 2313216 361,984 361,600 yes / no / no 4.9896
.data 0x28f000 2675200 28,160 34,441 yes / yes / no 4.1028
.pdata 0x298000 2703360 92,672 92,460 yes / no / no 5.8727
.idata 0x2af000 2796032 28,672 28,165 yes / no / no 4.3507
.gfids 0x2b6000 2824704 7,168 6,772 yes / no / no 3.4553
.giats 0x2b8000 2831872 512 280 yes / no / no 0.2365
.tls 0x2b9000 2832384 1,024 777 yes / yes / no 0.0112
.00cfg 0x2ba000 2833408 512 373 yes / no / no 0.4193
.rsrc 0x2bb000 2833920 1,536 1,494 yes / no / no 4.0532
.reloc 0x2bc000 2835456 11,776 11,513 yes / no / no 2.4177

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Extracted native interfaces

Name Command Notification Description
GetEULAAccepted True False Returns true if a particular EULA version was accepted by the user. EULA versions are considered to be equal if the full EULA texts are also equal.
SetEULAAccepted True False Marks EULA version as accepted.
OnLogin True False UI sends notifications to NvAccount on user login by calling this method
OnLogout True False UI sends notifications to NvAccount on user logout by calling this method
GetUserAccount True False Returns logged in user: ids, consent. This command may return stale consent information if localization overrides are not available and a web call is needed to refresh consent.
GetIdToken True False Returns id token for currently logged in user. The token will be valid for at least 1 minute. This command may return an error if localization overrides are not available and a web call is needed to refresh consent.
RefreshConsent True False Forces user consent refresh. Return an error if the user is not logged in. This command may return an error if localization overrides are not available.
GetUserId True False Returns user id for sending telemetry.
UserIdChangedNotification True False This notification is broadcasted when user id changes.
UserConsentChangedNotification True False This notification is broadcasted when user-level consent changes.
GetPrivacySettings True False Returns product-wide privacy settings state for UI to display
SetPrivacySettings True False Sets product-wide privacy settings. Setting privacy settings to ‘none’ will cause API to return error.
GetPrivacySettingsConsentInformation True False Returns device-level consent flags corresponding to product-wide privacy settings. The intended consumer of this information is the UI telemetry library. Individual telemetry senders are not expected to need this information
PrivacySettingsConsentInformationChangedNotification True False This notification is broadcasted when device-level consent flags change.
PrivacySettingsChangedNotification True False This notification is broadcasted when privacy settings change.
GetUserAccountAndDeviceConsent True False Returns device-level and user-level consent flags. The intended consumer of this information is the telemetry library in IGO. User context will be present only when the user is logged in.

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog · Research overview