Why does the Windows debugger engine show a bunch of hex digits after one of the DLL names?
You’re using the Windows debugger engine, say ntsd or windbg, and some DLLs come with hex digits after their names. What’s up with that?
!GetWidgetName: 00007ffe`7d0e2f50 488bc4 mov rax,rsp 00007ffe`7d0e2f53 48895808 mov qword ptr [rax+8],rbx 00007ffe`7d0e2f57 48896810 mov qword ptr [rax+10h],rbp 00007ffe`7d0e2f5b 48897018 mov qword ptr [rax+18h],rsi 00007ffe`7d0e2f5f 48897820 mov qword ptr [rax+20h],rdi 00007ffe`7d0e2f63 4156 push r14 00007ffe`7d0e2f65 4883ec20 sub rsp,20h 00007ffe`7d0e2f69 33db xor ebx,ebx
If you look more closely, you’ll see the reason:
0:001> lm start end module name 00007ff6`a3b30000 00007ff6`a3c70000(deferred) 00007ffe`75730000 00007ffe`759cb000 COMCTL32 (deferred) 00007ffe`7d0fa000 (deferred) 00007ffe`96110000 00007ffe`962b0000 USER32 (deferred) 00007ffe`962b0000 00007ffe`9636d000 KERNEL32 (deferred) 00007ffe`96380000 00007ffe`966d6000 combase (deferred) ...
There are two modules named
contoso loaded into the same program. The first one gets its name the normal way, since it got there first. The second one sees that its name is already taken, so it generates a unique name by appending the module’s base address.
This name conflict can occur because you have two DLLs with the same name but in different directories. Or it could be a conflict between two modules with the same base name but different extensions. (Sometimes, the debugger disambiguates by appending the extension. I’m not quite sure what the algorithm is.)
Bonus chatter: How did I know this? Did I read the debugger source code? Nope, I just figured it out by direct observation. “Why would the debugger have to add a bunch of extra information to the module name? Maybe because the module name isn’t unique.” It’s like asking, “When Bob goes to some classes, people call him ‘Bob S.’ instead of just Bob. But the other students still go by just their first names.” One thing you might guess is, “Maybe there are two students named Bob in those classes.”