timestamp 69676572

[fir]

exe files have header and in some field of it there is a timestamp like this (this above is hex afaik)
it is most probably just time of creation of that exe (by asembler/linker/compiler)

does maybe someone know how to translate it to date or yet more likely current date to it ?(i had my own assembler that compiles to exe and i would need to generate put that timestamp of that kind there)

[Bonita Montero]

The timestamp is a time_t-value, i.e. the passed seconds since 1.1.1970.
So we are not off-topic here because this isn't Windows-specific. ;-)

[Öö Tiib]

On Thursday, 28 March 2019 18:49:13 UTC+2, Bonita Montero wrote:
> The timestamp is a time_t-value, i.e. the passed seconds since 1.1.1970.
> So we are not off-topic here because this isn't Windows-specific. ;-)

:-) Whatever timestamp fir posted It is unlikely time_t like you describe.
The 69676572 must be Fri, 17 Mar 1972 10:36:12 GMT and
0x69676572 (a.k.a 1768383858) must be Wed, 14 Jan 2026 09:44:18 GMT
according to that site: http://www.onlineconversion.com/unix_time.htm
Both dates do look too unusual for to be times of creation of some
Windows exe file for obvious reasons.

[Paavo Helde]

On 28.03.2019 18:49, Bonita Montero wrote:
> The timestamp is a time_t-value, i.e. the passed seconds since 1.1.1970.
> So we are not off-topic here because this isn't Windows-specific. ;-)

The TimeDateStamp in the COFF header is documented as "The low 32 bits
of the number of seconds since 00:00 January 1, 1970 (a C run-time
time_t value), that indicates when the file was created."

I do not see the high 32 bits of the time_t value stored anywhere. Maybe
the TimeDateStamp field is meant just as a convenient label for telling
apart different versions of the file?

[Bonita Montero]

> :-) Whatever timestamp fir posted It is unlikely time_t like you describe.

I just checked a PE built by myself and converted the hex-value
given by dumpbin ("5C9CBC41 time date stamp Thu Mar 28 13:21:21
2019") to a decimal value with calc.exe and put it into:
http://www.onlineconversion.com/unix_time.htm
And I got exactly the date and time the EXE was built.

[fir]

ye this timestamp is in fact created by gcc (mingw-tdm)in a program i compiled in 2018 or about..so it should be some meaningfull date of 2018 or something

[fir]

if used to exe build by mingw-tdm it gives

Wed, 14 Jan 2026 09:44:18 GMT

i dont checked in binary but it is from ollydebug who shows it nicer way

its either bug in olly or mingw puts fake timestamp, it seems

[fir]

W dniu czwartek, 28 marca 2019 17:49:13 UTC+1 użytkownik Bonita Montero napisał:
> The timestamp is a time_t-value, i.e. the passed seconds since 1.1.1970.
> So we are not off-topic here because this isn't Windows-specific. ;-)

speaking on pieces of real code in c/c++
is more valueable than speaking on pure language in my opinion (as speaking on language is so called 'big distraction')

this is my opinion but its somewhat well grounded, i think ;<

[James Kuyper]

On 3/28/19 13:25, Paavo Helde wrote:
> On 28.03.2019 18:49, Bonita Montero wrote:
>> The timestamp is a time_t-value, i.e. the passed seconds since 1.1.1970.
>> So we are not off-topic here because this isn't Windows-specific. ;-)
>
> The TimeDateStamp in the COFF header is documented as "The low 32 bits
> of the number of seconds since 00:00 January 1, 1970 (a C run-time
> time_t value), that indicates when the file was created."
>
> I do not see the high 32 bits of the time_t value stored anywhere.

I think they're assuming that you can make a reasonable guess as to what
they are. After all, they're going to remain 0 until 2106-02-07T06:28:16
<https://www.timeanddate.com/date/dateadded.html?m1=01&d1=01&y1=1970&type=add&ay=&am=&aw=&ad=&h1=&i1=&s1=&ah=&ai=&as=4294967296&rec=>

[Robert Wessel]

IIRC, .NET executables do something funky with the TimeDateStamp
field.