Convert Hex Value to Date from Binary Reg Key

[RobT]

Hi,

I am trying to get a date value from the registry that is stored in hex in a
binary reg key. The key looks like this.

[HKEY_LOCAL_MACHINE\SOFTWARE\intel\landesk\virusprotect6\currentversion]
"PatternFileDate"=hex:23,02,19,00,00,00,00,00

When I use WMI to query to the binary registry value it returns an array of
bytes that looks like this:

- arrValues {...} Array of Variant
(0) 35 Byte
(1) 2 Byte
(2) 25 Byte
(3) 0 Byte
(4) 0 Byte
(5) 0 Byte
(6) 0 Byte
(7) 0 Byte

What do I do with they array now? How can I get the date from this array?

Thanks,
Rob

[Al Dunbar [MS-MVP]]

"RobT" <r_tesoriero@hotmail.com.(donotspam)> wrote in message
news:36319489-D2C0-484E-880C-5B665A1B24B4@microsoft.com...
> Hi,
>
> I am trying to get a date value from the registry that is stored in hex in
a
> binary reg key. The key looks like this.
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\intel\landesk\virusprotect6\currentversion]
> "PatternFileDate"=hex:23,02,19,00,00,00,00,00
>
> When I use WMI to query to the binary registry value it returns an array
of
> bytes that looks like this:
>
> - arrValues {...} Array of Variant
> (0) 35 Byte
> (1) 2 Byte
> (2) 25 Byte
> (3) 0 Byte
> (4) 0 Byte
> (5) 0 Byte
> (6) 0 Byte
> (7) 0 Byte
>
> What do I do with they array now? How can I get the date from this array?

Good question. Do you know what date this value actually represents (i.e. is
it displayed in human readable form by the software)? My quess would be Feb
25, 2005 (2005 = 1970 + 35), but without knowing anything else about it that
is only a guess.

/Al

[RobT]

Thanks for that, makes more sense now.

The only thing is that the month is one off. The app (symantec AV) displays
that date as 3/25/2005, but we read that as 2/25/2005 I've checked a number
of servers now and the date is always one off.

I have fixed it in my code by just adding 1 to the month each time, but i'd
still liek to know why it's a month out.

Any ideas?

"Al Dunbar [MS-MVP]" wrote:

>
> "RobT" <r_tesoriero@hotmail.com.(donotspam)> wrote in message
> news:36319489-D2C0-484E-880C-5B665A1B24B4@microsoft.com...
> > Hi,
> >
> > I am trying to get a date value from the registry that is stored in hex in
> a
> > binary reg key. The key looks like this.
> >
> > [HKEY_LOCAL_MACHINE\SOFTWARE\intel\landesk\virusprotect6\currentversion]
> > "PatternFileDate"=hex:23,02,19,00,00,00,00,00
> >
> > When I use WMI to query to the binary registry value it returns an array
> of
> > bytes that looks like this:
> >
> > - arrValues {...} Array of Variant
> > (0) 35 Byte
> > (1) 2 Byte
> > (2) 25 Byte
> > (3) 0 Byte
> > (4) 0 Byte
> > (5) 0 Byte
> > (6) 0 Byte
> > (7) 0 Byte
> >
> > What do I do with they array now? How can I get the date from this array?
>
> Good question. Do you know what date this value actually represents (i.e. is
> it displayed in human readable form by the software)? My quess would be Feb
> 25, 2005 (2005 = 1970 + 35), but without knowing anything else about it that
> is only a guess.
>
> /Al
>
>
>

[Gerry Hickman]

Hi RobT,

> that date as 3/25/2005, but we read that as 2/25/2005

> I have fixed it in my code by just adding 1 to the month each time, but i'd
> still liek to know why it's a month out.

As far as I know, this is "normal" for dates. JScript handles them in a
similar way. The JScript docs have some nice examples of date handling.

--
Gerry Hickman (London UK)

[Al Dunbar [MS-MVP]]

"RobT" <r_tesoriero@hotmail.com.(donotspam)> wrote in message
news:001D0039-8951-45F2-B9CB-2E20445FEDFD@microsoft.com...
> Thanks for that, makes more sense now.
>
> The only thing is that the month is one off. The app (symantec AV)
displays
> that date as 3/25/2005, but we read that as 2/25/2005 I've checked a
number
> of servers now and the date is always one off.
>
> I have fixed it in my code by just adding 1 to the month each time, but
i'd
> still liek to know why it's a month out.
>
> Any ideas?

Yeah, odd that it is out by a month, but not by a day or a year. Looks like
the month is given as a number from 0 to 11. Why Symantec decided that, I'll
never know. If it is some sort of standard, I still don't know, but will
just have to bow to the inevitable.

/Al

> "Al Dunbar [MS-MVP]" wrote:
>
> >
> > "RobT" <r_tesoriero@hotmail.com.(donotspam)> wrote in message
> > news:36319489-D2C0-484E-880C-5B665A1B24B4@microsoft.com...
> > > Hi,
> > >
> > > I am trying to get a date value from the registry that is stored in
hex in
> > a
> > > binary reg key. The key looks like this.
> > >
> > >
[HKEY_LOCAL_MACHINE\SOFTWARE\intel\landesk\virusprotect6\currentversion]
> > > "PatternFileDate"=hex:23,02,19,00,00,00,00,00
> > >
> > > When I use WMI to query to the binary registry value it returns an
array
> > of
> > > bytes that looks like this:
> > >
> > > - arrValues {...} Array of Variant
> > > (0) 35 Byte
> > > (1) 2 Byte
> > > (2) 25 Byte
> > > (3) 0 Byte
> > > (4) 0 Byte
> > > (5) 0 Byte
> > > (6) 0 Byte
> > > (7) 0 Byte
> > >
> > > What do I do with they array now? How can I get the date from this
array?
> >
> > Good question. Do you know what date this value actually represents
(i.e. is
> > it displayed in human readable form by the software)? My quess would be
Feb
> > 25, 2005 (2005 = 1970 + 35), but without knowing anything else about it
that
> > is only a guess.
> >
> > /Al
> >
> >
> >