NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NvDriverUpdateCheck64.dll

514dcf5234b7ddd5bdd1bca1d07e5062f8217e970a8e8a21e8098fd7dac8b26c

Identity

Property Value
Architecture AMD64
Source size 879,216 bytes
Preferred image base 0x180000000
Entry RVA 0x626e0
Imports / exports 187 / 1
Exception/unwind ranges 2,388
Executable raw bytes 639,488

Physical paths:

Decompilation coverage

Complete: 3,601 successful reconstructions, 0 failures, 3,601 attempted entries, 3,601 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 639,488 639,086 yes / no / yes 6.4505
.rdata 0x9e000 640512 182,272 181,838 yes / no / no 5.1706
.data 0xcb000 822784 10,240 37,168 yes / yes / no 3.8934
.pdata 0xd5000 833024 28,672 28,656 yes / no / no 5.9729
_RDATA 0xdc000 861696 1,024 640 yes / no / no 3.2018
.rsrc 0xdd000 862720 1,536 1,440 yes / no / no 3.9774
.reloc 0xde000 864256 4,608 4,268 yes / no / no 5.3116

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview