NvKVStorage.dll
8b7452fc80c02e6eedf41fd0c4eeb3d4875adea838010a3cb6afa65dc05dad84
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 1,907,312 bytes |
| Preferred image base | 0x180000000 |
| Entry RVA | 0x1800 |
| Imports / exports | 373 / 1 |
| Exception/unwind ranges | 5,326 |
| Executable raw bytes | 1,532,416 |
Physical paths:
NVIDIA App\Plugins\localuser\NvApp\NvKVStorage.dll
Decompilation coverage
Complete: 9,964 successful reconstructions, 0 failures, 9,964 attempted entries, 9,964 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
1,532,416 | 1,532,307 | yes / no / yes | 5.0091 |
.rdata |
0x178000 |
1533440 |
227,840 | 227,730 | yes / no / no | 4.7469 |
.data |
0x1b0000 |
1761280 |
22,016 | 28,089 | yes / yes / no | 4.0743 |
.pdata |
0x1b7000 |
1783296 |
70,656 | 70,596 | yes / no / no | 5.8006 |
.idata |
0x1c9000 |
1853952 |
26,112 | 25,677 | yes / no / no | 4.3321 |
.gfids |
0x1d0000 |
1880064 |
5,120 | 4,740 | yes / no / no | 3.2278 |
.giats |
0x1d2000 |
1885184 |
512 | 280 | yes / no / no | 0.2084 |
.tls |
0x1d3000 |
1885696 |
1,024 | 777 | yes / yes / no | 0.0112 |
.00cfg |
0x1d4000 |
1886720 |
512 | 373 | yes / no / no | 0.4187 |
.rsrc |
0x1d5000 |
1887232 |
1,536 | 1,506 | yes / no / no | 4.0785 |
.reloc |
0x1d6000 |
1888768 |
8,192 | 7,812 | yes / no / no | 2.3669 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Extracted native interfaces
| Name | Command | Notification | Description |
|---|---|---|---|
Write |
True | False | Adds or replaces the data associated with the specific key |
Read |
True | False | Returns the data associated with the key |
Delete |
True | False | Deletes the data associated with the specific key, if it exists |
Notification |
True | False | This notification is broadcasted when something changes in the storage. If value is missing, then it was removed. |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.