| View previous topic :: View next topic |
| Author |
Message |
TehBestNewbZ
Expert Cheater
![]() Reputation: 0
Joined: 28 Jul 2006
Posts: 109
|
 Posted: Sat Sep 18, 2010 1:31 pm Post subject: Is this a timestamp? |
 |
|
I'm not sure where to post this, but here goes:
I'm trying to understand how a binary file (.DAT) generally works. I'm using a hex editor do this. I understand most of the file, however I'm stuck with this timestamp problem. I'm 100% sure that a part of this hex is the actual timestamp:
| Code: | | e1 27 17 6f e6 69 c0 00 e1 27 18 65 10 84 ef |
On screen, it outputs: 9/4/2009 5:22
Note: it's DD/MM/YYYY formatted.
I've tried conversions (hex->decimal->timestamp) but no luck so far.. none of the results match the one that I've just posted above.
Any idea? Do I need to swap certain bytes or...? Or are 100% sure that this is the actual timestamp?
Thanks in advance.
EDIT-Let me re-post the timestamp and another one for comparison:
1st timestamp :
0x2d10: 00 00 00 32 00 00 00 01 00 01 10 00 00 00 00 00
0x2d20: 00 e1 27 17 6f e6 69 c0 00 e1 27 18 65 10 84 ef
0x2d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
The string (0x2d2x) outputs 9/4/2009 5:22.
2nd timestamp:
0x2B60: 00 00 00 2f 00 00 00 01 00 01 10 00 00 00 00 00
0x2B70: 00 e1 2b 9e df 79 66 80 00 e1 2b 9f db d9 7b 6e
0x2B80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
The string (0x2b7x) outputs 7/4/2009 22:02.
Now, I'll compare these strings:
00 e1 27 17 6f e6 69 c0 00 e1 27 18 65 10 84 ef
00 e1 2b 9e df 79 66 80 00 e1 2b 9f db d9 7b 6e
All of the timestamps in this file always include two '00 e1'... Hmm.. any idea?
|
|
| Back to top |
|
 |
TehBestNewbZ
Expert Cheater
![]() Reputation: 0
Joined: 28 Jul 2006
Posts: 109
|
| Posted: Sat Sep 18, 2010 9:40 pm Post subject: |
|
|
Ok, looks like there are two timestamps (each 8 bytes) in
Code:
| Code: | | 00 e1 27 17 6f e6 69 c0 00 e1 27 18 65 10 84 ef |
One is 00 e1 27 17 6f e6 69 c0 and another one 00 e1 27 18 65 10 84 ef - Both in the same string.
I convert 00 e1 27 17 6f e6 69 c0 to 63,374,851,375,000,000 in decimal. Does that look like milliseconds to you?
I don't think this huge number can bypass the Jan 1 Year 1970 format :/
The only converters I know use the Jan 1 Year 1970 format.
Is there such a converter that uses the Jan 1 Year 1 format?
I just want to convert it to readable date / time (timestamp).
Anybody wanna help me out? Thanks a lot...
|
|
| Back to top |
|
|
justa_dude
Grandmaster Cheater
 Reputation: 23
Joined: 29 Jun 2010
Posts: 893
|
| Posted: Sun Sep 19, 2010 4:03 am Post subject: |
|
|
| Please describe the steps you took to determine that the field you're looking at is without doubt a timestamp.
|
|
| Back to top |
|
|
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Sun Sep 19, 2010 7:20 am Post subject: |
|
|
| Have you tried searching for different ways to store timestamps? Like for example the Unix time format which is widely used: it's the amount of seconds that has passed since a certain date.
|
|
| Back to top |
|
|
TehBestNewbZ
Expert Cheater
![]() Reputation: 0
Joined: 28 Jul 2006
Posts: 109
|
| Posted: Sun Sep 19, 2010 2:44 pm Post subject: |
|
|
| justa_dude wrote: | | Please describe the steps you took to determine that the field you're looking at is without doubt a timestamp. |
If I remove "00 e1 27 17 6f e6 69 c0" out of the file, the timestamp doesn't display on screen. So, it must be a timestamp.
| Quote: | | Have you tried searching for different ways to store timestamps? Like for example the Unix time format which is widely used: it's the amount of seconds that has passed since a certain date. |
that's the problem... 63,374,851,375,000,000 goes way beyond the Jan 1 Year 1970 numbers...
Does anybody know how to get a Rata Die from 63,374,851,375,000,000 and convert it to a Julian Day Number?
EDIT- My bad, guys. It's not milliseconds, it's microseconds.
Okay, I'll put more timestamps:
00 E1 23 59 C2 13 3D C0
Outputs: 20/2/2009 14:49
Decimal: 63370738175000000
00 E1 23 5A 93 68 1B C0
Outputs: 20/2/2009 15:48
Decimal: 63370741687000000
00 E1 23 5B B8 01 81 00
Outputs: 20/2/2009 17:09
Decimal: 63370746596000000
00 E1 27 12 51 F8 01 80
Outputs: 8/4/2009 23:16
Decimal: 63374829398000000
00 E1 27 16 92 F2 15 00
Outputs: 9/4/2009 4:21
Decimal: 63374847668000000
I've tried a converter Tool (from microseconds to year) using a 64 bit integer, and got a correct result which is 2009. However, I can't find any converter that does the same but from microseconds to timestamp (YYYY MM DD XX:XX:XX) and vice versa.
|
|
| Back to top |
|
|
TehBestNewbZ
Expert Cheater
![]() Reputation: 0
Joined: 28 Jul 2006
Posts: 109
|
| Posted: Sat Oct 02, 2010 1:06 am Post subject: |
|
|
k, got it.
| Code: |
private void button1_Click(object sender, EventArgs e)
{
String dateString = yyyy.Text + dd.Text + MM.Text + hh.Text + Mi.Text + ss.Text;
DateTime timestamp;
if (!DateTime.TryParseExact(dateString, "yyyyddMMHHmmss", null,
DateTimeStyles.None, out timestamp ))
return;
long ticks = timestamp.Ticks;
long microseconds = ticks / 10;
convertedText.Text = microseconds.ToString("X");
} |
Can't believe how simple this is...
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
