NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

CrimsonUtil.dll

74026f7a344f0bc5fca5843e9bd8475d0dd22599b1a88ab0a07b089ff6844949

Identity

Property Value
Architecture AMD64
Source size 2,240,112 bytes
Preferred image base 0x180000000
Entry RVA 0x15c0
Imports / exports 458 / 28
Exception/unwind ranges 6,245
Executable raw bytes 1,758,720

Physical paths:

Decompilation coverage

Complete: 8,831 successful reconstructions, 0 failures, 8,831 attempted entries, 8,831 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 1,758,720 1,758,442 yes / no / yes 5.2728
.rdata 0x1af000 1759744 317,952 317,626 yes / no / no 5.0402
.data 0x1fd000 2077696 12,288 15,777 yes / yes / no 3.2411
.pdata 0x201000 2089984 82,944 82,728 yes / no / no 5.8722
.idata 0x216000 2172928 29,184 28,858 yes / no / no 4.16
.gfids 0x21e000 2202112 12,800 12,568 yes / no / no 3.6703
.giats 0x222000 2214912 512 280 yes / no / no 0.2248
.tls 0x223000 2215424 2,560 2,438 yes / yes / no 0.005
.00cfg 0x224000 2217984 512 373 yes / no / no 0.4266
.rsrc 0x225000 2218496 1,536 1,370 yes / no / no 3.9086
.reloc 0x226000 2220032 9,728 9,572 yes / no / no 2.6536

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview