WinDbg 调用堆栈十六进制偏移量

WinDbg callstack hexadecimal offset

函数名后面的十六进制值(带+)代表什么?

00 012ff668 7795aa24 ntdll_778f0000!LdrInitShimEngineDynamic+0x726
01 012ff8a0 77956e84 ntdll_778f0000!WinSqmSetDWORD64+0x14e4
02 012ff8f4 77956cd0 ntdll_778f0000!LdrInitializeThunk+0x1c4
03 012ff8fc 00000000 ntdll_778f0000!LdrInitializeThunk+0x10

这些数字indicate offset from the nearest resolved function entry. The higher number WinSqmSetDWORD64+0x14e4 indicates you have symbol loading issues and Windbg used the export table获取函数名并根据从导出table.

获得的函数名生成大偏移量