Windows Filetime

Ruby
1

Hey all,

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Thanks

2

Stuart C. wrote:

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Google “ruby windows timestamp” (without the quotes)

The first hit is code.

The third google hit contains this link:

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

“site:www.ruby-forum.com active directory timestamp”

3

The first hit is code.

The third google hit contains this link:
FILETIME (minwinbase.h) - Win32 apps | Microsoft Learn

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

“site:www.ruby-forum.com active directory timestamp”

Thanks, I had the documentation, but the ruby link is new on me. Thanks
a lot.

4

On Sep 17, 10:19 am, Brian C. [email protected] wrote:

The first hit is code.
Posted viahttp://www.ruby-forum.com/.
It looks like Win32::Registry.wtime2time() (RDoc Documentation
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

5

Stuart C. wrote:

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the exact exception message
you saw.

6

Chris H. wrote:

On Sep 17, 10:19�am, Brian C. [email protected] wrote:

The first hit is code.
Posted viahttp://www.ruby-forum.com/.
It looks like Win32::Registry.wtime2time() (RDoc Documentation
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

When I try the following however it works:

require ‘date’

highpart = 29513297
lowpart = 1857145088
intLogonTime = highpart * (2**32) + lowpart
intLogonFloat = intLogonTime.to_f / (60 * 10000000 * 1440).to_f
last_logon = intLogonFloat

base = DateTime.new(1601,1,1,0,0,0)
base += intLogonFloat

p base.to_s

Any ideas?

7

Brian C. wrote:

Stuart C. wrote:

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the exact exception message
you saw.

Apologies, I meant to copy it in. Please see below.

C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in at': bignum too big to convert intolong’ (RangeError)
from C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in wtime2time' from test.rb:3:in’

Sorry again, my bad. Thanks in advance.