views:

70

answers:

2

What do the the numbers after the "+" at the end of the lines in a stack trace represent?

Function   Source 
ntdll!KiFastSystemCallRet    
ntdll!ZwRemoveIoCompletion+c    
kernel32!GetQueuedCompletionStatus+29    
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33    
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24    
w3tp!THREAD_MANAGER::ThreadManagerThread+39    
kernel32!BaseThreadStart+34

here they are +c +29 +33 +24 +39 +34

+3  A: 

Offset inside the function. Eg. on frame 3 the return address is: the address of the kernel32!GetQueuedCompletionStatus symbol + 29 bytes.

Remus Rusanu
+3  A: 

They are offsets, in hexadecimal, from the start of the named subroutine. For example

kernel32!BaseThreadStart+34

is 52 (34 hex) bytes into the routine BaseThreadStart in the kernel32 module.

I. J. Kennedy