FrameViewKMD.sys
f768f331ecd2ed3eb121ca28569e8c7c52561c6f8b1c40e8c8f1b2185c200e02
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 22,640 bytes |
| Preferred image base | 0x140000000 |
| Entry RVA | 0x1be0 |
| Imports / exports | 24 / 0 |
| Exception/unwind ranges | 36 |
| Executable raw bytes | 5,632 |
Physical paths:
FrameViewSDK\bin\FrameViewKMD.sys
Decompilation coverage
Complete: 49 successful reconstructions, 0 failures, 49 attempted entries, 49 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
4,608 | 4,237 | yes / no / yes | 5.9078 |
.rdata |
0x3000 |
5632 |
2,048 | 1,888 | yes / no / no | 3.9832 |
.data |
0x4000 |
7680 |
512 | 856 | yes / yes / no | 0.7645 |
.pdata |
0x5000 |
8192 |
512 | 432 | yes / no / no | 3.3829 |
INIT |
0x6000 |
8704 |
1,024 | 868 | yes / no / yes | 4.2567 |
.rsrc |
0x7000 |
9728 |
2,048 | 2,008 | yes / no / no | 3.5194 |
.reloc |
0x8000 |
11776 |
512 | 52 | yes / no / no | 0.6921 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Selected routines
| RVA | Function | Reconstruction |
|---|---|---|
0x1270 |
sub_140001270 |
C text |
0x1288 |
sub_140001288 |
C text |
0x12f8 |
sub_1400012F8 |
C text |
0x1540 |
HandleInformation |
C text |
0x1590 |
sub_140001590 |
C text |
0x1690 |
sub_140001690 |
C text |
0x1704 |
sub_140001704 |
C text |
0x19d0 |
sub_1400019D0 |
C text |
0x1be0 |
DriverEntry |
C text |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.