NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NvPluginWatchdog.dll

92fc33f9a2d3add07058ec5fd470b6653609fd59067c50020d4c6f02b797ad5d

Identity

Property Value
Architecture AMD64
Source size 1,268,848 bytes
Preferred image base 0x180000000
Entry RVA 0x6efc0
Imports / exports 190 / 1
Exception/unwind ranges 4,244
Executable raw bytes 988,160

Physical paths:

Decompilation coverage

Complete with errors: 7,723 successful reconstructions, 2 failures, 7,725 attempted entries, 7,725 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 988,160 988,108 yes / no / yes 6.4772
.rdata 0xf3000 989184 200,192 199,806 yes / no / no 5.3514
.data 0x124000 1189376 10,752 23,404 yes / yes / no 3.6873
.pdata 0x12a000 1200128 51,200 50,928 yes / no / no 6.0949
_RDATA 0x137000 1251328 1,024 640 yes / no / no 3.2037
.rsrc 0x138000 1252352 1,536 1,360 yes / no / no 4.4441
.reloc 0x139000 1253888 4,608 4,152 yes / no / no 5.2379

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview