Gallery.dll

5361a2c1993c80499cd6448b5f476d29a2ffee18ce20b4979ea00bcaeba32098

Identity

Property	Value
Architecture	AMD64
Source size	3,320,944 bytes
Preferred image base	`0x180000000`
Entry RVA	`0x1ba0`
Imports / exports	445 / 1
Exception/unwind ranges	7,331
Executable raw bytes	2,628,608

Physical paths:

NVIDIA App\CEF\plugins\NVIDIA Overlay\Gallery.dll

Decompilation coverage

Complete with errors: 15,679 successful reconstructions, 4 failures, 15,683 attempted entries, 15,683 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section	RVA	Raw offset	Raw bytes	Virtual bytes	R / W / X	Entropy
`.text`	`0x1000`	`1024`	2,628,608	2,628,137	yes / no / yes	5.2362
`.rdata`	`0x283000`	`2629632`	505,856	505,841	yes / no / no	5.3865
`.data`	`0x2ff000`	`3135488`	25,088	32,761	yes / yes / no	3.9698
`.pdata`	`0x307000`	`3160576`	97,280	97,068	yes / no / no	5.8976
`.idata`	`0x31f000`	`3257856`	30,208	29,982	yes / no / no	4.2624
`.gfids`	`0x327000`	`3288064`	6,144	5,740	yes / no / no	3.4393
`.giats`	`0x329000`	`3294208`	512	280	yes / no / no	0.2365
`.tls`	`0x32a000`	`3294720`	1,024	777	yes / yes / no	0.0112
`.00cfg`	`0x32b000`	`3295744`	512	373	yes / no / no	0.4238
`.rsrc`	`0x32c000`	`3296256`	1,536	1,482	yes / no / no	4.0252
`.reloc`	`0x32d000`	`3297792`	12,800	12,516	yes / no / no	2.1334

PE mitigation flags

Flag	Present
dynamic_base	true
high_entropy_va	true
nx_compat	true
guard_cf_flag	true
no_seh	false
appcontainer	false
force_integrity	false

Extracted native interfaces

Name	Command	Notification	Description
`GalleryNotifications`	True	False
`MontageNotification`	True	False	Notification triggers when montage being created and progress updated.
`PathChangeNotification`	True	False	Notification triggers when the Gallery path changes
`TempFolderChangeNotification`	True	False	Notification triggers when the Temporary Folder path changes
`GalleryCapStateChangeNotification`	True	False	Notification triggers when Gallery cap is enabled/disabled
`GalleryUpdatedNotification`	True	False	Notification triggers when UGC is added/deleted from Gallery
`GetFolderListing`	True	False
`GetAppStats`	True	False
`GetAppUGC`	True	False
`RemoveGalleryItem`	True	False
`EnumerateDrives`	True	False
`GetFileMetadata`	True	False
`GetEventData`	True	False
`GetThumbnail`	True	False
`GetFolderCRC`	True	False
`GetImageFileDimensions`	True	False
`CopyFile`	True	False	Copies a specified file. Only works for files with NV metadata to prevent rogue usage
`MoveFile`	True	False	Moves a specified file. Only works for files with NV metadata to prevent rogue usage
`IsDirectoryWriteable`	True	False
`GetSettings`	True	False	Gets Gallery settings
`SetSettings`	True	False	Sets one or more Gallery settings
`GetDriveInfo`	True	False	Gets information about a physical drive
`CancelPathUpdate`	True	False	Cancels gallery path update and restores to old path
`GetRecentUGC`	True	False
`CheckDiskSpace`	True	False	Check if Disk space is running low
`EnqueuePendingHighlight`	True	False	Add the HL to tracker
`OpenHighlightsGroupSummary`	True	False	Open IGO with HL from the groups’ specified
`GetHighlightsCount`	True	False	Get count of HLs
`DeleteGroupHighlights`	True	False	Delete group highlights
`WriteEncryptedBitmap`	True	False	Write encrypted string to bmp
`TranscodeMediaFile`	True	False
`CreateMontage`	True	False	Creates a video montage as directed by the script
`CreateMontageFromRecipe`	True	False	Creates a video montage script from a list of videos and EDGE logs
`CancelMontage`	True	False	Stops the montage that is in progress.
`UpdateMontageProgress`	True	False	Updates the progress indicator of the montage that is in progress.
`Trim`	True	False	Requests a video be trimmed
`AddMeme`	True	False
`EngraveMP4`	True	False
`DeletePreview`	True	False	Delete previews on game exit
`PreviewPathInfo`	True	False	Path of all previews
`GetMontageCloudConfig`	True	False	Gets Montage Cloud Configuration
`MigrateHighlightsTracker`	True	False	Migrate Highlights tracker metadata

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog · Research overview

NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.