NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

FvContainer.exe

bd3fa80956cafa3eb6db3acc440145ee90d24abf96cd53ba02b6eb17542e5788

Identity

Property Value
Architecture AMD64
Source size 1,279,088 bytes
Preferred image base 0x140000000
Entry RVA 0x6c050
Imports / exports 198 / 1
Exception/unwind ranges 4,168
Executable raw bytes 874,496

Physical paths:

Decompilation coverage

Complete with errors: 7,342 successful reconstructions, 2 failures, 7,344 attempted entries, 7,344 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 874,496 874,419 yes / no / yes 6.4125
.rdata 0xd7000 875520 190,464 190,310 yes / no / no 5.4496
.data 0x106000 1065984 10,240 23,080 yes / yes / no 2.9182
.pdata 0x10c000 1076224 50,176 50,016 yes / no / no 6.0748
.didat 0x119000 1126400 512 48 yes / yes / no 0.3506
_RDATA 0x11a000 1126912 512 384 yes / no / no 3.1904
.rsrc 0x11b000 1127424 137,728 137,232 yes / no / no 4.7049
.reloc 0x13d000 1265152 3,584 3,160 yes / no / no 5.1259

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview