NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

MessageBus.dll

64e300997b5796da22ad8baa49e4eb919cdc170157cbe6770279f94508a84650

Identity

Property Value
Architecture AMD64
Source size 7,532,912 bytes
Preferred image base 0x180000000
Entry RVA 0x3ab890
Imports / exports 252 / 12
Exception/unwind ranges 26,579
Executable raw bytes 5,349,888

Physical paths:

Decompilation coverage

Complete with errors: 44,962 successful reconstructions, 18 failures, 44,980 attempted entries, 44,980 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 5,349,888 5,349,852 yes / no / yes 6.5207
.rdata 0x51c000 5350912 1,730,048 1,729,916 yes / no / no 5.3539
.data 0x6c3000 7080960 73,728 101,628 yes / yes / no 4.0006
.pdata 0x6dc000 7154688 318,976 318,948 yes / no / no 6.5035
_RDATA 0x72a000 7473664 512 148 yes / no / no 1.4241
.rsrc 0x72b000 7474176 1,536 1,424 yes / no / no 4.2811
.reloc 0x72c000 7475712 41,472 41,276 yes / no / no 5.4613

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview