Can anyone post here algorithms that convert PE EXE TimeStamp (DWORD, seconds since 1.1.1970) to an ordinary date (DD/MM/YYYY)?
Posted on 2002-07-26 06:55:49 by IIS
Give a try by yourself, it is only basic maths...
I think there is an API call to do this... check MSDN...
Posted on 2002-07-26 07:30:48 by JCP
i've written something to convert the return value of GetTickCount (milliseconds) to hours, minutes and seconds, it's a long time ago, don't blame me for bad coding :tongue:

invoke GetTickCount ;|> get the time in milliseconds that windows is running
xor edx,edx ;|> now we have to extract the hours minutes and seconds
mov ecx,3600000 ;|> to get the hours we must first divide the milliseconds
div ecx ;|> by 3600000 (1000*60*60)
mov stunden,eax ;|> move the result in the hours variable
mov eax,edx ;|> the remainder of the division is the minutes
xor edx,edx ;|> set edx to zero for the next division
mov ecx,60000 ;|> to extract the seconds from the minutes we must divide
div ecx ;|> them by 60000 (1000*60)
mov minuten,eax ;|> we save the minutes in our minutes variable
mov eax,edx ;|> move the remainder (seconds) to eax
xor edx,edx ;|> set edx again to zero for the next division
mov ecx,1000 ;|> to extract the seconds from the milliseconds we
div ecx ;|> have to divide the value by 1000
mov sekunden,eax ;|> save the seconds in our seconds variable

your problem is similar to this. as readiosys said, it's simple maths.

Posted on 2002-07-26 09:05:19 by NOP-erator
The timestamp is in seconds, so you just have to do some simple division to convert it to an actual date. Of course you can also use C-lib functions.
Posted on 2002-07-26 12:21:35 by comrade
Extracting minutes, hours and total days is OK. But there's a problem extracting month, year, and day (simple d/m/y) because of leap years.. :( And that's not a trivial problem as division by number of seconds in year.
Posted on 2002-07-27 02:51:43 by IIS
if it helps you, you can find out, if a given year is a leapo year or not:

leap year: (year%4==0 && year/100!=0) || (year/400==0)

Posted on 2002-07-27 11:22:53 by phueghy

You could try loading a SYSTEMTIME structure with midnight 01 Jan 1970
Then run SystemTimeToFileTime with this SYSTEMTIME
This will give you a 64 bit FILETIME structure for 01 Jan 1970,
the number of 100-nanosecond intervals since January 1, 1601
Multiply the PE EXE timestamp by 10,000,000 to convert to 100-nanoseconds
Add this number to the FILETIME structure above
Then run FileTimeToSystemTime with this FILETIME
This should give you a SYSTEMTIME structure with the info you want.

Not pretty or fast, but it might work

If you code this and it works, share it with us!


systemtimetofiletime for 1 Jan 1970
multiply exe timestamp by 10,000,000
add product to step 1
Posted on 2002-07-29 01:34:31 by farrier
farrier, thank you, but.. The problem is that I need to make a date decoder for using in an OS-independent way, because the code's gonna be called under Windows, Unix, Linux, etc.
There may be some way to generate something like tables for each month&year since 1970 (maybe even until 2038, the max date Timestamp may handle). But it seems a bit heavy for solving such a problem.
Posted on 2002-07-29 01:38:44 by IIS

Over a year ago The Svin requested a replacement for FileTImeToSystemTime. I converted an old routine from many years ago and sent it to him. Never received an opinion from him. Maybe he completed the task and has an open alternative. Anyway, attached is the result of my efforts.

Again, this deals with the win filetime structure which is based on 01 January 1601 and counts in 0.1 microseconds so you will have to adjust/change the calculations. But the date/leap year calculations work for any valid dates--01 january 1601 - Thursday 14 September 30828 02:48:05.477

Bitrake posted an improved algo for the day of the week calculation.

Posted on 2002-07-30 05:19:50 by farrier
so i used f0dder's example few days ago that tested if a file was pe and modified it to read out the timestamp and convert that to readable form. the code stores year, month, day and seconds that are still remaining (i was too lazy to calculate hours and minutes too) in DWORD variables called jahr, monat, tage.
i tested it but if you encounter errors, let me know.

Hope that helps. The conversion routine doesn't use API's so it should be OS independent ;)
Posted on 2002-07-30 08:58:00 by phueghy