将十六进制时间戳转换为可读的日期和时间

Question

I'm trying to understand how a binary file (.olk Outlook office 2016 for MAC) works. I'm using a hex editor do this. I understand most of the file, however I am stuck with this timestamp problem. I am 100% sure that a part of this hex is the actual timestamp:

'00 00 00 5F BF 35 BE 41'

On screen, it outputs: 23 Jan 2017 10:04:39

'00 00 00 5F BF 35 BE 41' value is 4737282954089201664 according to little endian

'00 00 00 5F BF 35 BE 41' value is 411229863489 according to big endian

If i edit(modify) hex value 00 00 00 5F BF 35 BE 41 than i get Date and time which is 1 Jan 2001 05:30:00

Answer 1

Your time stamp looks like a 64-bit floating point value stored little endian.

The number of seconds since 00:00:00 UTC on 1 January 2001 as I write this is 511696145.577641, and the hex representation of that 64-bit double is 41be7fdd1193e048. Given your sample date was in Jan that seems about right.

Addendum after Comments

Reading your question the main issue appeared to be determining how the time stamp was being stored. My hypothesis was that it was a standard Mac/Cocoa floating point time interval. I tested that hypothesis using the following code:

union { double d; int64_t i; } di;
di.d = [[NSDate new] timeIntervalSinceReferenceDate];
NSLog(@"%f | %llx", di.d, di.i);

The union is an easy way to access the bits of a floating point value, and timeIntervalSinceReferenceDate gives the time in seconds since the Mac OS X/Cocoa epoch. This produced (when initially run) the values shown above. I'd proved my hypothesis.

If you wish to go the other way using the same technique you can use:

union { double d; int64_t i; } di;
di.i = 0x41BE35BF5F000000;
NSDate *stamp = [NSDate dateWithTimeIntervalSinceReferenceDate:di.d];
NSLog(@"%llx -> %@", di.i, stamp);

and this produces:

41be35bf5f000000 -> 2017-01-23 04:34:39 +0000

(This differs from the time you have, it looks like you are displaying the times as local in India while the above is displaying in UTC.)

If you wish to manipulate the time stamp in C(++), rather than Objective-C(++) or Swift and Cocoa, you can use the standard C library functions as long as you take into account the different epochs. Your time stamp is based on an epoch 1 Jan 2001, "Unix" time starts at 1 Jan 1970. To interpret your time stamp as a Unix time offset you must add the Unix time offset for 1 Jan 2001 00:00 UTC to it first, you can generate that value using the C routines.

If you are reading the bytes for your value out of a buffer you can just cast the buffer address to a double * and indirect, as the Intel cpu supports misaligned access, eg something like:

double timeOffset = *(double *)&buf[Time_STAMP_OFFSET];

However for robust code you should use something like memcpy() to copy the bytes into the double variable, which will survive changing to a CPU which doesn't support misaligned access. You might also wish to add a call to a library function to convert little-endian to host byte order, to be robust against CPU endianness.

HTH

Answer 2

Building on CRD's good (and upvoted) answer, and your comment concerning 1 Jan 2001 05:30:00, and assuming that you meant when you modify the hex value, it is to all zeroes, and using this free, open-source date library :

#include "date.h"
#include <cstdint>
#include <iostream>
#include <sstream>
#include <string>

int
main()
{
    std::string s = {'\x0', '\x0', '\x0', '\x5f', '\xbf', '\x35', '\xbe', '\x41'};
    std::istringstream file{s};
    union
    {
        double d;
        unsigned char b[8];
    };
    for (auto& c : b)
        file >> c;
    using namespace std::chrono;
    using namespace date;
    constexpr auto epoch = sys_days{jan/1/2001} + 5h + 30min;
    sys_seconds datetime = epoch + seconds{static_cast<std::int64_t>(d)};
    std::cout << datetime << '\n';
}

Output:

2017-01-23 10:04:39

Explanation:

This field is the binary representation of a double on macOS (and Windows). I have faked a file containing this field in the variable file above. To read it into a double I'm using a not-quite standard trick of the union of a double and array of unsigned char , reading into the array, and then using the double .

This double is the number of seconds since 2001-01-01 05:30:00. The date library is first used to form a std::chrono::time_point epoch with this value. Then the double is cast to a 64bit signed integral type, and that is further converted to std::chrono::seconds , and then added to the epoch to form a new std::chrono::time_point which has seconds precision and corresponds to the value you report. This date library has a streaming operator for this std::chrono::time_point for easy viewing.

If you would rather write your own calendrical computations, this date library is based on the algorithms found here .

If you would like to break datetime into integral field types representing year, month, day, etc.:

sys_days sd = floor<days>(datetime);
year_month_day ymd = sd;
auto tod = make_time(datetime - sd);
int y = int{ymd.year()};        // 2017
int m = unsigned{ymd.month()};  // 1
int d = unsigned{ymd.day()};    // 23
int h = tod.hours().count();    // 10
int M = tod.minutes().count();  // 4
int s = tod.seconds().count();  // 39