NVIDIA software reverse engineering

Static-analysis corpus of NVIDIA App 11.0.9.585, NvContainer, FrameView SDK and the whole C:\Program Files\NVIDIA Corporation tree. 131 PE images, 1,180,302 decompiled functions, 14 recovered Protocol Buffers schemas.

View on GitHub

NvXDCore.dll

fca581fcb45d60136a6907be06c50a9efa3dfbc682c01acb0bdb977a777dab52

Identity

Property Value
Architecture AMD64
Source size 1,317,488 bytes
Preferred image base 0x180000000
Entry RVA 0x76450
Imports / exports 224 / 1
Exception/unwind ranges 3,144
Executable raw bytes 900,608

Physical paths:

Decompilation coverage

Complete with errors: 5,479 successful reconstructions, 1 failures, 5,480 attempted entries, 5,480 reported discovered entries.

Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.

Sections

Section RVA Raw offset Raw bytes Virtual bytes R / W / X Entropy
.text 0x1000 1024 900,608 900,604 yes / no / yes 6.4418
.rdata 0xdd000 901632 294,912 294,594 yes / no / no 4.9296
.data 0x125000 1196544 58,880 97,492 yes / yes / no 4.9924
.pdata 0x13d000 1255424 37,888 37,728 yes / no / no 5.9567
.didat 0x147000 1293312 512 64 yes / yes / no 0.4909
.rsrc 0x148000 1293824 4,096 3,812 yes / no / no 5.0991
.reloc 0x149000 1297920 9,216 9,036 yes / no / no 5.4215

PE mitigation flags

Flag Present
dynamic_base true
high_entropy_va true
nx_compat true
guard_cf_flag true
no_seh false
appcontainer false
force_integrity false

Evidence

Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.

Module catalog ยท Research overview