Simple Class to Convert Reg_binary Time to a Datetime Object in C#

Simple Class to Convert Reg_binary Time to a Datetime Object in C#


Defining the problem

As part of my ongoing project to create a console to manage System Center EndPoint Protection without System Center Configuration Manager, I needed a way to convert times that were stored in the registry as reg_binary values.

For instance, the keys will have data such as 0D 6C A4 4B 37 C5 CE 01

Registry Keys of interest

These values are stored in the following keys under "HKEY_Local_Machine\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates":

ASSignatureApplied
AVSignatureApplied
LastFallbackTime
NISSignatureApplied
SignaturesLastUpdated

I needed a method to convert these values to a human readable form, so I created the following class:

Code

using System;
namespace SCEPConsole
{
    class SCEPDateTimeConverter
    {
        public DateTime ConvertBinaryDateTime(Byte[] bytes)
        {
            long filedate = (((((((
            (long)bytes[7] * 256 +
            (long)bytes[6]) * 256 +
            (long)bytes[5]) * 256 +
            (long)bytes[4]) * 256 +
            (long)bytes[3]) * 256 +
            (long)bytes[2]) * 256 +
            (long)bytes[1]) * 256 +
            (long)bytes[0]);
            DateTime returnDate = DateTime.FromFileTime(filedate);
            return returnDate;
        }
    }
}

Calling the code


I call it like this:

SCEPDateTimeConverter myDateTimeObject = new  SCEPDateTimeConverter();
RegistryKey regKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, server, RegistryView.Registry64);
RegistryKey key = regKey.OpenSubKey(@"SOFTWARE\Microsoft\Microsoft Antimalware");
RegistryKey Updates = key.OpenSubKey("Signature Updates");
if (Updates.GetValue("NISSignatureApplied") != null)
{
    byte[] NISSignatureAppliedbytes = (byte[])Updates.GetValue("NISSignatureApplied");
    strNISSignatureApplied = myDateTimeObject.ConvertBinaryDateTime(NISSignatureAppliedbytes).ToString();
}

Output

When the data in NISSignatureApplied is the previous example (0D 6C A4 4B 37 C5 CE 01), strNISSignatureApplied will contain 10/9/2013 3:34:12 PM


See also



Sort by: Published Date | Most Recent | Most Useful
Comments
  • I suggest to use Code button instead because right now this code is impossible to copy. Also, please add output as what does your code produce (may be an image)

  • Naomi,

    I cannot find a code button.

    When I created the article, I used the "Format Code Block" - is that what you are referring to?

    Karl

  • Yes Karl, That's the button :-)

    i think that Naomi meant that you should not use "Display Line Numbers" so the code will get a one block format, and you should chose the right language (C#). it's look like you chose "empty" or "Markup" as the language so the results did not get the colors and format like a C# code.

  • Perhaps the code is easier to view now?

Page 1 of 1 (4 items)