NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

DesktopNotification.dll

77b6a40c31dbe8319aa91cfd7921bbdea1b0a247d61986b12ed6efc53cb94089

Identity

Property Value
Architecture AMD64
Source size 2,174,576 bytes
Preferred image base 0x180000000
Entry RVA 0x1960
Imports / exports 385 / 2
Exception/unwind ranges 6,060
Executable raw bytes 1,737,216

Physical paths:

Decompilation coverage

Complete with errors: 11,457 successful reconstructions, 4 failures, 11,461 attempted entries, 11,461 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 1,737,216 1,736,769 yes / no / yes 5.0363
.rdata 0x1aa000 1738240 266,752 266,664 yes / no / no 4.7695
.data 0x1ec000 2004992 25,600 33,921 yes / yes / no 4.1701
.pdata 0x1f5000 2030592 80,384 80,292 yes / no / no 5.8418
.idata 0x209000 2110976 34,304 34,292 yes / no / no 3.9737
.gfids 0x212000 2145280 5,632 5,200 yes / no / no 3.2828
.giats 0x214000 2150912 512 280 yes / no / no 0.2287
.tls 0x215000 2151424 1,024 777 yes / yes / no 0.0112
.00cfg 0x216000 2152448 512 373 yes / no / no 0.4319
.rsrc 0x217000 2152960 2,048 1,554 yes / no / no 3.338
.reloc 0x218000 2155008 9,216 8,752 yes / no / no 2.3234

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Extracted native interfaces

Name Command Notification Description
ShowDesktopNotification True False Shows an OS-native desktop notification
ClearDesktopNotification True False Clears a desktop notification, either hiding the popup or removing it from OS Notification Center
IsValidDesktopNotification True False Checks if a desktop notification is currently visible or saved in the OS notification center
DesktopNotificationsAllowed True False Checks if a desktop notification is currently visible or saved in the OS notification center
DesktopNotificationActivated True False Sent when the desktop notification or one of its action buttons were clicked
DesktopNotificationDismissed True False Sent when the desktop notification was dismissed or cleared

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview