C语言 如何确定TimeDateStamp

w8rqjzmb  于 2023-06-21  发布在  其他
关注(0)|答案(3)|浏览(86)

我正在编写有关Windows PE头的代码。我想确定时间戳值。这是_IMAGE_FILE_HEADER结构

typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine;
    WORD    NumberOfSections;
    DWORD   TimeDateStamp;
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader;
    WORD    Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

此变量的值为TimeDateStamp:0x58e451ac

hmtdttj4

hmtdttj41#

根据MSDN: IMAGE_FILE_HEADER structureIMAGE_FILE_HEADERTimeDateStamp成员是图像的时间戳的低32位。它表示链接器创建映像的时间。该值表示为自通用协调时间1970年1月1日开始以来的秒数。
可以使用以下函数将其转换为FILETIME值:

FILETIME TimeDateStampToFileTime(DWORD timeDateStamp)
{
    ULARGE_INTEGER ftu;
    FILETIME ft;

    ftu.QuadPart = (timeDateStamp + 11644473600ull) * 100000000ull;
    ft.LowPart = ftu.u.LowPart;
    ft.HighPart = ftu.u.Highpart;
    return ft;
}

然后可以使用Windows FileTimeToSystemTime函数将FILETIME转换为分解的SYSTEMTIME结构。

ruarlubt

ruarlubt2#

我找到了这样的解决方案。

time_t TimeX = (time_t)header.TimeDateStamp;
 tm* pGMT = gmtime(&TimeX);
 char* pTime = asctime(pGMT);
bgibtngc

bgibtngc3#

It's very easy to do in BASIC:
Dim ConvertedTimeStamp As Double, DateStg As String
'divide TimeDateStamp by # of seconds in a day,
'then add date value for Jan 1st, 1970
ConvertedTimeStamp = (TimeDateStamp / 86400) + #1/1/1970#
'convert result to readable string
DateStg = Format(ConvertedTimeStamp, "yyyy/mm/dd hh:nn:ss")

相关问题