NR runtimes 310.8 and 310.9.16: static analysis (full technical)

Back to the report · ControlMask how-to · Noisy-domain NR feasibility

Written by Claude Opus 5.5 (Claude Code, high effort) on behalf of GrimsVerk, who skimmed it. The research, the test-build code changes, the measurements and this text are Claude's work.

Files: nvngx_dlssnr.dll 310.8.0.0 (CL 38718415, 165,840,496 bytes, SHA-256 4b8d19bc3eff58a084f5eca7489c921501c203450169fb82ff4f649a4482ba05) and 310.9.16.0 (CL 39025366, 266,424,944 bytes, SHA-256 2bc19bc09a7b89dd44f73e2ac0108fcc586e2154bdd0830f242f4f040e28789f).

Method:

• PE inventory with pefile; strings (ASCII and UTF-16) diffed between versions.
• Resource and weight-container parsing.
• CUDA fatbins unpacked (zstd) to PTX and SASS ELF.
• Full Ghidra 12.1.4 auto-analysis and decompile of both DLLs, image base 0x180000000.

"Seen in game" means the runtime's own NGX log confirmed it in The Witcher 3. The log was switched on with the __NGX_LOG_LEVEL environment variable, set in-process by the research build.

About line numbers. "l.NNNN" refers to a full decompile export (every function, Ghidra 12.1.4 default analysis, in address order). They only help if you make the same export. Function names and addresses (FUN_18xxxxxxx) are the stable reference: they are identical in any Ghidra project of the same file with the same base.

1. Summary

• Exactly two models exist, and only 310.9.16 has both:
  • CC_Control_History_Blend_Quantize_With_Teacher_honest_tench_2026_07_04_22_30_weights ("honest tench"), resource WEIGHTS_HT, 147,695,410 bytes;
  • hnet-crazy-cuckoo-small-fp8 ("crazy cuckoo small"), resource WEIGHTS_CC_SMALL_FP8, 113,893,343 bytes.
• WEIGHTS_HT is byte-identical in both DLLs. The ~100 MB growth of 310.9.16 is the new small model.
• Presets:
  • 310.8 registers one preset (1 = honest tench); every value falls back to it, so Preset has no effect in 310.8.
  • 310.9.16 registers preset 1 (honest tench) and preset 2 (crazy cuckoo). 0/auto and every unknown value fall back to preset 2 (seen in game: "preset 0 is not available in this DLL build; falling back to shipping default preset 2 ('hnet-crazy-cuckoo-small-fp8')").
• hnet-almond-eagle-11m is not a third model. It is the string the on-screen indicator draws in place of hnet-crazy-cuckoo-small-fp8 (strcmp + swap in FUN_18001c120). Nothing else references it.
• No hidden presets, styles, models, weight files or debug views exist in either file. The weight registry, the descriptor list and the style tables were all read directly.
• Style is 0/1/2 in both versions; values ≥ 3 clamp to 2. Style is a network input and a colour grade applied to the result (section 4).
• New in 310.9.16: DLSSNR.MaskBlendMode (0-3). It only has an effect with a supplied DLSSNR.ControlMask and AutoMask on.
• 310.9.16 dropped Ada (RTX 40): CreateFeature only accepts arch 0x1B0, and only sm_120 code ships. 310.8 accepts 0x190 and 0x1B0 and ships sm_89 SASS.
• Both versions run both models in FP8. 310.8 also ships FP16 kernels, but they are unused.
• Parameters with no effect in either version:
  • Depth / DepthInverted: the network's depth slot is hard-wired to null.
  • BidirectionalDistortionField: sets a telemetry bit only.
  • ScalingRatio / PerfQualityValue: never used for anything.
  • Intensity above 1: clamped.
• A runtime-side reduced-resolution path with guided upsample exists, but it is dead code: its scale is fixed at 1.0. Downscaling must stay app-side.

2. PE inventory

Resources (type 10 = RCDATA):

CUDA fatbins (magic 50 ED 55 BA). Payloads are zstd-compressed. 310.8: each fatbin has sm_89 SASS + sm_120 PTX + sm_120 SASS. 310.9.16: sm_120 PTX + sm_120 SASS only. File offsets:

• 310.8: 0xdf0e0 0x4a2220 0x6fe100 0x94cb60 0xbd0990 0xdd4bc0 0x10e2a40 0x1121b90 0x1123af0 0x1126590 0x11293b0 0x112bd00 0x112e3f0 0x112fd90 0x113d3c0
• 310.9.16: 0x10e6d0 0x1dbed0 0x263ec0 0x2df920 0x36ed70 0x3d8990 0x45d280 0x46f140 0x4710a0 0x473b40 0x476960 0x4792b0 0x47b9a0 0x47d340 0x48a970
  • The fused pre/post-block kernels are in the fatbin at 0x10e6d0; cg2r_post_process_kernel is in the one at 0x47d340.

PTX entry points: 310.8 has 231 (FP16 + FP8 variants); 310.9.16 has 120 (FP8 only, plus cc_cb_clear, cg2r_copy_kernel, cg2r_post_process_kernel, and the cuda_capture_*/cuda_font_kernel NGX helpers). Every 310.9.16 kernel name also exists in 310.8. No ONNX, TensorRT plans, LZ4 or DXBC were found. There is one SPIR-V blob in each (NGX helper).

Weights container format (both resources): u64 total size, then per tensor u64 name length, name, u64 record length, [u64 record length, u64 data length, u32 flag, data, 20-byte trailer: u64 0, u64 1, u32 element count]. Tensors are named blockN.layerM.layer, plus one blockN.layer0.blend_scale (2 bytes). Element counts equal data length / 2.

3. The two models

• Architecture. U-Net-style encoder/decoder: conv + windowed-attention (Swin, 1/2/4/8 heads at 32-256 ch) stages, split 16-head Swin at 512 ch, a 1024-ch ViT bottleneck, and a mirrored decoder. "Small" keeps the bottleneck and cuts the repeated blocks per stage.
• Quantisation. The honest tench weights already look FP8-quantised (few distinct byte values in the large matrices). That fits "Quantize_With_Teacher": quantisation-aware training, no quantisation at load time.
• Precision. Both runtimes append _fp8 to every kernel name and set activation dtype 2 for both models (310.9.16 FUN_1800572f0; 310.8 FUN_180032e20).
• Memory. The work pool is set by the runtime, not the model: 310.9.16 needs about 527 MB at 4K for either model, 310.8 needs 728 MB. By working scale, 310.8 / 310.9.16:

• The same weights give the same picture. Preset 1 in 310.9.16 and 310.8 are the same weights. The pre-block parameter block differs only by the new 8-byte MaskBlendMode field (264 → 272 bytes); post-process and blend kernels have identical parameter layouts. In game, the two pictures differ only by the noise floor in all five scenes.

Registry entry layout (310.9.16; 310.8 is the same minus 8 bytes):

4. Every parameter the runtime reads

"Create" = read in CreateFeature (310.9.16 FUN_180017b20, 310.8 FUN_180017e20). "Eval" = read by the per-evaluation parser (310.9.16 FUN_18001a020, 310.8 FUN_180019f30). "v0.3.8" = what OptiScaler-NR v0.3.8 sends.

Evaluate parser struct P (310.9.16, 0x160 bytes):

Network input, 16 channels per pixel (same layout in both versions)

Built by the pre-block parameter setup (310.9.16 FUN_1800834b0, called via FUN_1800620c0 → FUN_180083ee0; pre-block PTX in the fatbin at 0x10e6d0, ~l.130-610 of the PTX):

Pre-block kernel parameters (272 bytes in 310.9.16, 264 in 310.8):

The network output is a residual: x = enc(Color) + k·net, decoded as clamp(x·8 + 0.5, 0, 1), then blended with the warped history by a learned sigmoid weight (post-block PTX, ~l.13895-14125).

The final blend has two paths:

• Fused into the last network kernel: ..._simple_blend (no mask), ..._control_mask, plus ..._full_rect variants when the rect is the whole texture. Picked by FUN_18001d2e0, rect test in FUN_18001d660. Used when the grade is the identity and there is no UI correction.
• cg2r_post_process_kernel: dispatched by FUN_18001ca00 with 376 bytes of parameters. It handles the grade, UI correction, and the (dead) guided upsample.

5. Hidden and debug switches (complete list)

6. Runtime-side reduced resolution and guided upsample (dead code)

310.9.16 contains a complete reduced-resolution path (local_816, l.19225-19268 and 19819-19923):

• the network runs at floor(W·s + 0.5) × floor(H·s + 0.5);
• the full-resolution Color/Backbuffer is kept as the high source (copied to dlssnr_guided_high_source_scratch, RGBA16F, if it aliases the output);
• in cg2r_post_process_kernel, a 17×17×12-byte transferTile per 16×16 tile carries low-resolution deltas in Oklab (log-L ratio clamped ±2 and faded below L = 0.1, plus Δa/Δb), upsampled bilinearly onto the high source. That is the same idea as OptiScaler-NR's guided residual enlargement (Transfer 5), in Oklab and not edge-aware.

It is unreachable. P+0x124 is only written at parser initialisation (1.0, l.20203, disassembly 0x18001a12e) and clamped, so P+0x120 is always 0. DLSSNR.ScalingRatio is only written by the callback (l.14441) and never read. 310.8 ships the same transferTile code but also hard-wires the network size.

7. GPU architecture and precision

8. Key functions (Ghidra names, image base 0x180000000)

Useful constants (310.9.16):

Appendix A: 310.9.16 parameter trace (line numbers = full decompile export)

Line numbers refer to the full 310.9.16 decompile export unless noted. "PTX" = cg2r_post_process_kernel (fatbin at file offset 0x47d340); "pre/post PTX" = the fused pre/post-block kernels (fatbin at file offset 0x10e6d0); PTX line numbers count from the start of that PTX text. CERTAIN = seen in code/data; LIKELY = inferred.

Corrections

• FUN_1800176c0 is called (state, mgr, &P) (l.19403); the first arg is the per-feature state (featureNode+8). Offsets +0x170.. are relative to that state. It does not compare Intensity. CERTAIN.
• P is 0x160 bytes; P+0x128..+0x15c = 14-float colour-grade vector; P+0x11c never written. CERTAIN.

Q1 Style

• Read unclamped into P+0xec (l.20519-20525); EvaluateFeature clamps with an unsigned compare against the descriptor style count = 3 (registry entry +0x2c): Style >= 3 -> 2 (negative also -> 2) (l.19388-19394; FUN_18001f640 l.24188; again FUN_180021df0 l.26376-26385). CERTAIN.
• Network input: Style/128 -> pre-block kernel param +184 -> constant input channel 10 (l.26414 -> FUN_1800620c0 l.75030 -> FUN_180083ee0 -> FUN_1800834b0 l.99528; pre PTX l.80-82,168). Both registry entries enable it (+0x28 = 1). CERTAIN.
• Also selects a colour grade: FUN_18001d8a0 (l.22743) looks up the style in 8 slots per registry entry; FUN_18001d6d0 (l.22679) writes value x clamp(LocalToneStrength,0,1) into P+0x128..; applied in cg2r_post_process_kernel. Data (CERTAIN):
  • Style 0: no grade
  • Style 1: exposure -0.1 EV, contrast -0.25 (flatter), saturation -10 %
  • Style 2: saturation -15 %
  • slots 3-8 empty; nothing hidden selectable.
• Grade engine has 14 controls (params +316..+371, host l.22327-22334; order from PTX l.720-1372): black point, white point, temperature, tint, exposure 2^v, contrast (smoothstep S-curve), 5-band per-channel tone curve, gamma c^(2^-v), HSL saturation x(1+v), saturation curve s^(2^-v). The styles use only three. Not reachable through parameters.
• An active grade forces the post-process pass (output clamped [0,1], alpha 1, fused blend off). A Style change resets temporal history.

Q2 Strengths

Pre-block params (FUN_1800834b0, 272 B): 0 Color; 8 previous network output (history); 16 MVec; 24 Depth = always 0 (literal, l.26416); 32 ControlMask; 40 MaskBlendMode; 164/168 MVecScale / MVec size; 172 DepthInverted; 176 LocalTone (raw); 180 LocalStructure (raw); 184 Style/128; 188/192 effective skin / effective structure; 196 = 15 (registry +0x24); 200 registry +0x21; 204 0.0625; 208 frame counter (noise seed). CERTAIN.

Input channels per pixel (pre PTX l.130-610), CERTAIN: | ch | content | |---|---| | 0-2 | Gaussian noise (Box-Muller, seeded by x, y, frame) | | 3 | 1.0 | | 4-6 | colour, encoded (c-0.5)0.125 | | 7-9 | history: Catmull-Rom at uv + mvscale/size; copy of colour if no MVec / no valid history / Reset | | 10 | Style/128 | | 11 | Tone x mask.g | | 12 | AutoMask on: 1.0; off: structure x mask.b | | 13 | skin (or structure if skin < 0); -1 when AutoMask off | | 14 | structure; -1 when AutoMask off | | 15 | 0 |

• Tone/structure are conditioning inputs (not a frequency split), not clamped. CERTAIN.
• MaskBlendMode acts only with ControlMask + AutoMask on + mode != 0: m = mask.b x structure into ch 13/14: 1 average, 2 min, 3 max. CERTAIN.
• Output is a residual: x = enc(Color) + knet, decoded clamp(x8+0.5,0,1), blended with history by a learned sigmoid weight (post PTX l.13895-14125). Math CERTAIN, meaning LIKELY.
• Intensity is never a network input. Blend only when Intensity < 1, ControlMask, grade, or UICorrection with UI (l.19478). Intensity > 1 does nothing.
  • Fused blend in the last network kernel (FUN_18001d2e0 l.22490): _simple_blend (no mask), _control_mask (mask), _full_rect variants when the rect is the whole texture (FUN_18001d660). Needs identity grade and no UICorrection+UI. out = sat(orig + sat(I [x mask.r])*(net-orig)). CERTAIN.
  • cg2r_post_process_kernel (FUN_18001ca00 l.21961): out = sat(orig + sat(Imask.r(1-uiAlpha))*(graded-base)) (PTX l.1375-2095). CERTAIN.
  • => Intensity is effectively [0,1], a plain lerp. ControlMask: r = intensity, g = tone, b = structure, a unused.

Q3 Working scale

• P+0x124 is only written at parser init (1.0) and clamped; P+0x120 always 0. No NGX parameter feeds it. DLSSNR.ScalingRatio is only written by the callback (l.14441), never read. CreateFeature uses W x H at scale 1.0. CERTAIN.
• The downscale + guided path (l.19225-19268, 19819-19923) is dead code. It would run the network at floor(Ws+0.5) x floor(Hs+0.5), use full-res Color/Backbuffer as high source, and in the post-process kernel build a 17x17 transferTile per 16x16 tile of low-res deltas in Oklab (log-L ratio clamped +-2, faded below L = 0.1, plus da/db), upsampled bilinearly onto the high source: like the fork's Transfer=5 in Oklab, not edge-aware.
• Implication: keep downscale + guided enlargement on the app side.

Q4 Inputs

• Required: Color and Output (else skipped, 0xbad00005, l.19116).
• Colour: display-referred [0,1] only; no exposure input, no sRGB/PQ/HDR handling; output clamped [0,1]; alpha always 1. CERTAIN.
• MVec: needed for temporal history with valid history and Reset=0 (l.26151); uv_prev = uv + mv*MVecScale/size.
• Depth: never bound (literal 0) -> DepthInverted no effect. CERTAIN.
• BidirectionalDistortionField: only sets a telemetry bit (l.20074). CERTAIN.
• UICorrection + UI/UIAlpha + Backbuffer: out = Backbuffer + w*(graded(net) - Color), w x (1 - alpha), alpha = UIAlpha.r else UI.a. With UICorrection + Backbuffer but no UI/UIAlpha the network runs on the Backbuffer (l.19471). Without Backbuffer NR is suppressed under UI.
• Enabled=0: copies Backbuffer or Color to Output (l.19423).
• Rects: Color and Output same size (except full-texture Output with a Color subrect inside, l.19141-19211). Network runs at active size. Limits: non-zero sizes, buffer pool < 4 GB; LIKELY no alignment need.

Q5 Hidden switches

• Registry HKLM\SOFTWARE\NVIDIA Corporation\Global\NGXCore: ShowDlssIndicator (only 0x400: full overlay), ShowDlssWeights (non-zero: "weights: ", crazy-cuckoo shown as almond-eagle-11m). FUN_18006ac20 l.81091-81131, drawn FUN_18001c120. CERTAIN.
• Registry NgxCubinDisableResourceCache; env __NGX_SHOW_INDICATOR, __NGX_CUBIN_DISABLE_RESOURCE_CACHE (l.81120-81125).
• Registry LogLevel, EnableConsoleLogging; env __NGX_LOG_LEVEL (l.11377-11394). Registry EnableLogPathOverride, LogPath; env __NGX_ENABLE_OVERRIDE_LOG_PATH, __NGX_LOG_PATH_OVERRIDE (l.5971-5991).
• DLSS.Indicator.Invert.X/Y.Axis only move the overlay.
• SetRuntimeParamsCallback stores a pointer that nothing reads: dead (310.8 PollRuntimeParams gone). CERTAIN.
• No config/weights files, no forced presets, no alternative kernels. cuda_capture_* kernels have no NR caller. CERTAIN.

Q6 Preset 1 in FP8

• FUN_1800602e0 builds both descriptors (templates {4,4,6,8,8} honest_tench, {2,2,2,2,2} crazy-cuckoo, LIKELY per-stage block counts); FUN_1800572f0 appends _fp8 to every kernel name and sets activation dtype 2 for both. 310.8 did the same for honest_tench (FUN_180032e20, line 45667 of the 310.8 export): preset 1 already ran FP8 in 310.8. CERTAIN.
• No quantization at load (bytes copied). WEIGHTS_HT already looks FP8-quantized (few distinct byte values), consistent with "Quantize_With_Teacher" QAT. LIKELY.
• Factory accepts only backbone "CCNetwork" (l.75151). CERTAIN.
• Registry bytes +0x20..+0x2f (same in both): +0x20 = 1 tone/structure inputs (LIKELY), +0x21 = 1 automask path (LIKELY), +0x24 = 15 input layout (LIKELY), +0x28 = 1 style conditioning (LIKELY), +0x2c = 3 style count (CERTAIN).
• 0/auto/unknown preset -> preset 2 (FUN_180023c20 l.27403).

Appendix B: what OptiScaler-NR v0.3.8 does not send, and what the tests showed