问题
what does the hexadecimal value (with the +) behind the function name stands for ?
00 012ff668 7795aa24 ntdll_778f0000!LdrInitShimEngineDynamic+0x726
01 012ff8a0 77956e84 ntdll_778f0000!WinSqmSetDWORD64+0x14e4
02 012ff8f4 77956cd0 ntdll_778f0000!LdrInitializeThunk+0x1c4
03 012ff8fc 00000000 ntdll_778f0000!LdrInitializeThunk+0x10
回答1:
These numbers indicate offset from the nearest resolved function entry. The higher number WinSqmSetDWORD64+0x14e4 indicates you have symbol loading issues and Windbg used the export table to get the function name and generated the large offset based on the function names it got from the export table.
来源：https://stackoverflow.com/questions/40565162/windbg-callstack-hexadecimal-offset