How to interpret "ln" cmd output (WinDbg)?

Question

I'm trying to find where the app faulted using 'ln' cmd which is normally supposed to help with that. 47a6c6 is the fault offset reported in the logs. I'm just wondering what I have to do with that info about before/after symbol in the code.

0:000> lm
...
0000000000400000 0000000000a5c000   llm   ...
...

0:000> ln 00400000+47a6c6

And I got this:

(000000000078b4a0)   llm!videoCodec+0xef226   |  (00000000009430a0)   llm!videoDevice

Could you please explain what it means exactly? And how am I supposed to work with that?

Solution:

Looks like 47a6c6 was already the final faulted address:

(04-01-23 15:39:27.638) Exception c0000005 in Ctrl(0) at 47a6c6.

start+faulted offset=47a6c6 So, I found the function where the app failed:

0:000>ln 47a6c6

c:*****\llmgroup\llm\digimot.cpp(5705)+0x3 (0000000000478ed0) llm!CtrlThread+0x17f6 | (0000000000480450) llm!CDigiMotion::MemberThreadOpen

0:000>ln llm!CtrlThread+0x17f

c:*****\llmgroup\llm\digimot.cpp(5382)+0x12 (00000000`00478ed0) llm!CtrlThread+0x17f | (0000000000480450) llm!CDigiMotion::MemberThreadOpen

Answer 1

The manual: ln.

1. The nearest symbol (function) before the address 00400000+47a6c6 is videoCodec in the module llm (perhaps llm.dll). The symbol address is 0078b4a0, the requested address is the offset 0xef226 after the symbol videoCodec.
2. The nearest symbol (function) after the address 00400000+47a6c6 is videoDevice in the module llm. The symbol address is 009430a0.
3. The module llm is loaded at the addresses 00400000 to 00a5c000.