NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

SystemInfo.dll

e67c0fb8991495fc1795486263042c2af7e3ce9c29fd030ebf20a7cf53958cd4

Identity

Property Value
Architecture AMD64
Source size 1,934,448 bytes
Preferred image base 0x180000000
Entry RVA 0x17c0
Imports / exports 415 / 1
Exception/unwind ranges 4,881
Executable raw bytes 1,524,224

Physical paths:

Decompilation coverage

Complete with errors: 9,740 successful reconstructions, 3 failures, 9,743 attempted entries, 9,743 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 1,524,224 1,523,955 yes / no / yes 5.0439
.rdata 0x176000 1525248 269,312 269,012 yes / no / no 5.0645
.data 0x1b8000 1794560 19,968 25,025 yes / yes / no 3.9773
.pdata 0x1bf000 1814528 65,024 64,728 yes / no / no 5.7895
.idata 0x1cf000 1879552 29,184 28,960 yes / no / no 4.178
.gfids 0x1d7000 1908736 4,096 3,960 yes / no / no 3.2631
.giats 0x1d8000 1912832 512 280 yes / no / no 0.2312
.tls 0x1d9000 1913344 1,024 777 yes / yes / no 0.0112
.00cfg 0x1da000 1914368 512 373 yes / no / no 0.4266
.rsrc 0x1db000 1914880 1,536 1,506 yes / no / no 4.0636
.reloc 0x1dc000 1916416 7,680 7,557 yes / no / no 2.2253

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Extracted native interfaces

Name Command Notification Description
GetSystemInfo True False  
GetClientHeadersInfo True False  
GetDeviceId True False  
GetBrowserInfo True False  
GetStreamingSupportInfo True False  
GetNetworkTypeChangedInfo True False  
DNSLookup True False Lookup DNS for the provided hostname

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog · Research overview