NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NvBackendAPI64.dll

f2bc30fbadbe0a4559915183aaf62de5b3e4267e231c4291d9b6ac7c2af4f98f

Identity

Property Value
Architecture AMD64
Source size 1,081,968 bytes
Preferred image base 0x180000000
Entry RVA 0x9e990
Imports / exports 162 / 164
Exception/unwind ranges 2,451
Executable raw bytes 855,552

Physical paths:

Decompilation coverage

Complete: 3,441 successful reconstructions, 0 failures, 3,441 attempted entries, 3,441 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 855,552 855,148 yes / no / yes 6.4306
.rdata 0xd2000 856576 167,936 167,878 yes / no / no 5.3164
.data 0xfb000 1024512 10,240 22,988 yes / yes / no 4.0209
.pdata 0x101000 1034752 29,696 29,412 yes / no / no 5.9575
_RDATA 0x109000 1064448 1,024 640 yes / no / no 3.1754
.rsrc 0x10a000 1065472 1,536 1,376 yes / no / no 3.8603
.reloc 0x10b000 1067008 4,608 4,372 yes / no / no 5.3506

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview