WinDbg using known module

Question

I am debugging some Windows APIs and stack trace shows Unloaded_hext.dll. I am not able to find this DLL. Even if there are no symbols, WinDbg outputs this DLL name. Process monitor is unable to find this dll.

Why is 'unloaded' prefixed? Is this done by WinDbg or are there any tricks?

On running the lm command, I could see hext.dll in the unloaded modules section. However, if it is unloaded, then why is it being shown by stack trace?

Answer 1

WinDBG tracks modules even after they have been unloaded to make debugging easier.

Normally, those unloaded modules should not show up in stack traces. If they do, the unload took place while the module was still in use (FreeLibrary does not prevent that). This premature unload is therefore a bug in your code.