Windows Filetime

Hey all,

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Thanks

···

--
Posted via http://www.ruby-forum.com/.

Stuart Clarke wrote:

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Google "ruby windows timestamp" (without the quotes)

The first hit is code.

The third google hit contains this link:

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

"site:www.ruby-forum.com active directory timestamp"

···

--
Posted via http://www.ruby-forum.com/\.

It looks like Win32::Registry.wtime2time() (RDoc Documentation
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

···

On Sep 17, 10:19 am, Brian Candler <b.cand...@pobox.com> wrote:

Stuart Clarke wrote:
> I have done some Googling and have yet to find a solution to a problem I
> have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
> These values are commonly found in the registry and I have yet to find a
> library in Ruby to deal with them and convert them to a valid date?

> Any suggestions?

Google "ruby windows timestamp" (without the quotes)

The first hit is code.

The third google hit contains this link:FILETIME (minwinbase.h) - Win32 apps | Microsoft Learn

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

"site:www.ruby-forum.comactive directory timestamp"
--
Posted viahttp://www.ruby-forum.com/.

The first hit is code.

The third google hit contains this link:
http://msdn.microsoft.com/en-us/library/ms724284(VS.85).aspx

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

"site:www.ruby-forum.com active directory timestamp"

Thanks, I had the documentation, but the ruby link is new on me. Thanks
a lot.

···

--
Posted via http://www.ruby-forum.com/\.

Chris Hulan wrote:

The first hit is code.
Posted viahttp://www.ruby-forum.com/.

It looks like Win32::Registry.wtime2time() (RDoc Documentation
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

When I try the following however it works:

require 'date'

highpart = 29513297
lowpart = 1857145088
intLogonTime = highpart * (2**32) + lowpart
intLogonFloat = intLogonTime.to_f / (60 * 10000000 * 1440).to_f
last_logon = intLogonFloat

base = DateTime.new(1601,1,1,0,0,0)
base += intLogonFloat

p base.to_s

Any ideas?

···

On Sep 17, 10:19�am, Brian Candler <b.cand...@pobox.com> wrote:

--
Posted via http://www.ruby-forum.com/\.

Stuart Clarke wrote:

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the *exact* exception message
you saw.

···

--
Posted via http://www.ruby-forum.com/\.

Brian Candler wrote:

Stuart Clarke wrote:

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the *exact* exception message
you saw.

Apologies, I meant to copy it in. Please see below.

C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in `at': bignum too big
to convert into `long' (RangeError)
  from C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in `wtime2time'
  from test.rb:3:in `<main>'

Sorry again, my bad. Thanks in advance.

···

--
Posted via http://www.ruby-forum.com/\.