{"id":106205,"date":"2022-01-31T07:00:00","date_gmt":"2022-01-31T15:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=106205"},"modified":"2022-01-31T07:15:46","modified_gmt":"2022-01-31T15:15:46","slug":"20220131-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20220131-00\/?p=106205","title":{"rendered":"Why does the Windows debugger engine show a bunch of hex digits after one of the DLL names?"},"content":{"rendered":"<p>You&#8217;re using the Windows debugger engine, say ntsd or windbg, and some DLLs come with hex digits after their names. What&#8217;s up with that?<\/p>\n<pre><span style=\"border: solid 1px black;\">contoso_7ffe7d0e0000<\/span>!GetWidgetName:\r\n00007ffe`7d0e2f50 488bc4          mov     rax,rsp\r\n00007ffe`7d0e2f53 48895808        mov     qword ptr [rax+8],rbx\r\n00007ffe`7d0e2f57 48896810        mov     qword ptr [rax+10h],rbp\r\n00007ffe`7d0e2f5b 48897018        mov     qword ptr [rax+18h],rsi\r\n00007ffe`7d0e2f5f 48897820        mov     qword ptr [rax+20h],rdi\r\n00007ffe`7d0e2f63 4156            push    r14\r\n00007ffe`7d0e2f65 4883ec20        sub     rsp,20h\r\n00007ffe`7d0e2f69 33db            xor     ebx,ebx\r\n<\/pre>\n<p>If you look more closely, you&#8217;ll see the reason:<\/p>\n<pre>0:001&gt; lm\r\nstart             end                 module name\r\n00007ff6`a3b30000 00007ff6`a3c70000   <span style=\"border: solid 1px black;\">contoso<\/span>     (deferred)\r\n00007ffe`75730000 00007ffe`759cb000   COMCTL32   (deferred)\r\n<span style=\"border: solid 1px black;\">00007ffe`7d0e0000<\/span> 00007ffe`7d0fa000   <span style=\"border: solid 1px black;\">contoso_7ffe7d0e0000<\/span>   (deferred)\r\n00007ffe`96110000 00007ffe`962b0000   USER32     (deferred)\r\n00007ffe`962b0000 00007ffe`9636d000   KERNEL32   (deferred)\r\n00007ffe`96380000 00007ffe`966d6000   combase    (deferred)\r\n...\r\n<\/pre>\n<p>There are two modules named <code>contoso<\/code> loaded into the same program. The first one gets its name the normal way, since it got there first. The second one sees that its name is already taken, so it generates a unique name by appending the module&#8217;s base address.<\/p>\n<p>This name conflict can occur because you have two DLLs with the same name but in different directories. Or it could be a conflict between two modules with the same base name but different extensions. (Sometimes, the debugger disambiguates by appending the extension. I&#8217;m not quite sure what the algorithm is.)<\/p>\n<p><b>Bonus chatter<\/b>: How did I know this? Did I read the debugger source code? Nope, I just figured it out by direct observation. &#8220;Why would the debugger have to add a bunch of extra information to the module name? Maybe because the module name isn&#8217;t unique.&#8221; It&#8217;s like asking, &#8220;When Bob goes to some classes, people call him &#8216;Bob S.&#8217; instead of just Bob. But the other students still go by just their first names.&#8221; One thing you might guess is, &#8220;Maybe there are two students named Bob in those classes.&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s trying to disambiguate name collisions.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-106205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>It&#8217;s trying to disambiguate name collisions.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/106205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=106205"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/106205\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=106205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=106205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=106205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}