NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NVIDIA App Permission.exe

d9b3fd4f672a1a90698f83c9123ca3832b0a42cd1a6ba51e903f71a8bfd59ce8

Identity

Property Value
Architecture AMD64
Source size 593,008 bytes
Preferred image base 0x140000000
Entry RVA 0x1ef0
Imports / exports 143 / 0
Exception/unwind ranges 246
Executable raw bytes 82,432

Physical paths:

Decompilation coverage

Complete: 608 successful reconstructions, 0 failures, 608 attempted entries, 608 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 82,432 82,113 yes / no / yes 3.647
.rdata 0x16000 83456 17,408 17,166 yes / no / no 2.6784
.data 0x1b000 100864 2,048 3,673 yes / yes / no 1.9115
.pdata 0x1c000 102912 3,584 3,540 yes / no / no 4.2568
.idata 0x1d000 106496 11,776 11,636 yes / no / no 3.9902
.gfids 0x20000 118272 1,024 524 yes / no / no 0.8042
.00cfg 0x21000 119296 512 373 yes / no / no 0.4238
.rsrc 0x22000 119808 461,312 461,132 yes / no / no 3.064
.reloc 0x93000 581120 1,536 1,170 yes / no / no 0.9306

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview