NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

nvhda64v.sys

9b6178768f6f4446b3a91c9140d9bc10312c07d6aa94af73559aab462399f766

Identity

Property Value
Architecture AMD64
Source size 134,376 bytes
Preferred image base 0x140000000
Entry RVA 0x13620
Imports / exports 54 / 0
Exception/unwind ranges 346
Executable raw bytes 94,208

Physical paths:

Decompilation coverage

Complete: 385 successful reconstructions, 0 failures, 385 attempted entries, 385 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 31,232 30,990 yes / no / yes 5.9539
CODE 0x9000 32256 13,312 13,103 yes / no / yes 6.1236
.rdata 0xd000 45568 11,264 11,104 yes / no / no 4.864
.data 0x10000 56832 1,024 716 yes / yes / no 1.5583
.pdata 0x11000 57856 4,608 4,152 yes / no / no 4.5931
PAGE 0x13000 62464 47,616 47,114 yes / no / yes 6.0565
INIT 0x1f000 110080 2,048 1,764 yes / no / yes 4.7649
.rsrc 0x20000 112128 1,024 904 yes / no / no 3.0048
.reloc 0x21000 113152 1,024 688 yes / no / no 4.3271

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity true

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview