CODEWITHSUNDEEP
windowsstack-trace
Greg B
Greg B

Reputation: 14888

What are the numbers on the end of lines in a stacktrace

What do the the numbers after the "+" at the end of the lines in a stack trace represent?

Function   Source 
ntdll!KiFastSystemCallRet    
ntdll!ZwRemoveIoCompletion+c    
kernel32!GetQueuedCompletionStatus+29    
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33    
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24    
w3tp!THREAD_MANAGER::ThreadManagerThread+39    
kernel32!BaseThreadStart+34

here they are +c +29 +33 +24 +39 +34

Upvotes: 0

Views: 230

Answers (2)

I. J. Kennedy
I. J. Kennedy

Reputation: 25819

They are offsets, in hexadecimal, from the start of the named subroutine. For example

kernel32!BaseThreadStart+34

is 52 (34 hex) bytes into the routine BaseThreadStart in the kernel32 module.

Upvotes: 3

Remus Rusanu
Remus Rusanu

Reputation: 294237

Offset inside the function. Eg. on frame 3 the return address is: the address of the kernel32!GetQueuedCompletionStatus symbol + 29 bytes.

Upvotes: 3

Related Questions