I'm trying to read the FILETIME's from the System profile fields that tells you when your account was created, last login, and last logout, but I'm getting the wrong results. What's wrong here?Private Declare Function FileTimeToSystemTime Lib "kernel32" _
(lpFileTime As Filetime, lpSystemTime As SystemTime) As Boolean
Private Type Filetime
dwLowDateTime As Long
dwHighDateTime As Long
End Type
Private Type SystemTime
wYear As Integer
wMonth As Integer
wDayOfWeek As Integer
wDay As Integer
wHour As Integer
wMinute As Integer
wSecond As Integer
wMilliseconds As Integer
End Type
<..snip..>
Private Function StringToFiletime(T As String) As Filetime
Dim Frag() As String, FT As Filetime
Frag = Split(T, " ")
'If value too big for VB's signed long, make it "unsigned"
If Val(Frag(0)) > 2147483647 Then
FT.dwHighDateTime = Val(Frag(0)) - 2147483648#
Else
FT.dwHighDateTime = Frag(0)
End If
If UBound(Frag) > 0 Then
If Val(Frag(0)) > 2147483647 Then
FT.dwLowDateTime = Val(Frag(0)) - 2147483648#
Else
FT.dwLowDateTime = Frag(0)
End If
End If
StringToFiletime = FT
End Function
Private Function ProcessSystemTime(T As SystemTime) As String
Select Case T.wDayOfWeek
Case 0: ProcessSystemTime = "Sunday, "
Case 1: ProcessSystemTime = "Monday, "
Case 2: ProcessSystemTime = "Tuesday, "
Case 3: ProcessSystemTime = "Wednesday, "
Case 4: ProcessSystemTime = "Thursday, "
Case 5: ProcessSystemTime = "Friday, "
Case 6: ProcessSystemTime = "Saturday, "
End Select
Select Case T.wMonth
Case 1: ProcessSystemTime = ProcessSystemTime & "January"
Case 2: ProcessSystemTime = ProcessSystemTime & "February"
Case 3: ProcessSystemTime = ProcessSystemTime & "March"
Case 4: ProcessSystemTime = ProcessSystemTime & "April"
Case 5: ProcessSystemTime = ProcessSystemTime & "May"
Case 6: ProcessSystemTime = ProcessSystemTime & "June"
Case 7: ProcessSystemTime = ProcessSystemTime & "July"
Case 8: ProcessSystemTime = ProcessSystemTime & "August"
Case 9: ProcessSystemTime = ProcessSystemTime & "September"
Case 10: ProcessSystemTime = ProcessSystemTime & "October"
Case 11: ProcessSystemTime = ProcessSystemTime & "November"
Case 12: ProcessSystemTime = ProcessSystemTime & "December"
End Select
ProcessSystemTime = ProcessSystemTime & " " & T.wDay & ", " & T.wYear & " "
Dim ap$
If T.wHour > 12 Then
T.wHour = T.wHour - 12
ap = "PM"
Else
ap = "AM"
End If
ProcessSystemTime = ProcessSystemTime & T.wHour & ":" & T.wMinute & ":" & T.wSecond & _
" " & ap
End Function
What kind of "wrong results" are you getting?
Do you have to perhaps specify that lpFileTime and lpSystemTime are ByRef?
(Again, not a VB programmer).
The conversions from an unsigned value in a string to a signed value in a long are wrong. They should be:
if val(string) < 2^31 then dword = val(string) else dword = val(string) - 2^32
edit: did put it in code tags after all
Still not giving proper results. Here's what StealthBot says: [6:48:44 PM] Account Created: 5/22/2001, 14:34:10 (Battle.net time)
[6:48:44 PM] Last Logon: 5/4/2004, 23:48:47 (Battle.net time)
[6:48:44 PM] Last Logoff: 5/4/2004, 23:46:40 (Battle.net time)
and my bot:[6:49:24 PM] Recieved account statistics.
[6:49:24 PM] Account Created Filetime: 29635122 1873721440
[6:49:24 PM] Account Created: Tuesday, May 4, 2004 11:49:27 PM
[6:49:24 PM] Last Logged In: Tuesday, May 4, 2004 11:49:22 PM
[6:49:24 PM] Last Logged Out: Tuesday, March 17, 1648 3:04:53 PM
Updated String -> Filetime Code:Private Function StringToFiletime(T As String) As Filetime
Dim Frag() As String, FT As Filetime
Frag = Split(T, " ")
If Val(Frag(0)) < 2 ^ 31 Then
FT.dwHighDateTime = Val(Frag(0))
Else
FT.dwHighDateTime = Val(Frag(0)) - 2 ^ 32
End If
If UBound(Frag) > 0 Then
If Val(Frag(1)) < 2 ^ 31 Then
FT.dwLowDateTime = Val(Frag(1))
Else
FT.dwLowDateTime = Val(Frag(1)) - 2 ^ 32
End If
End If
StringToFiletime = FT
End Function
Quote from: shadypalm88 on May 04, 2004, 07:00 PM
[6:49:24 PM] Recieved account statistics.
[6:49:24 PM] Account Created Filetime: 29635122 1873721440
[6:49:24 PM] Account Created: Tuesday, May 4, 2004 11:49:27 PM
[6:49:24 PM] Last Logged In: Tuesday, May 4, 2004 11:49:22 PM
[6:49:24 PM] Last Logged Out: Tuesday, March 17, 1648 3:04:53 PM
Looks like you're parsing the wrong data.
"29635122 1873721440" is probably created,
"Tuesday, May 4, 2004 11:49:27 PM" logged in and
"Tuesday, May 4, 2004 11:49:22 PM" logged out.
Your debug output "steals" one of the filetimes?
Quote from: shadypalm88 on May 04, 2004, 12:37 AM
...
Private Function ProcessSystemTime(T As SystemTime) As String
Select Case T.wDayOfWeek
Case 0: ProcessSystemTime = "Sunday, "
Case 1: ProcessSystemTime = "Monday, "
Case 2: ProcessSystemTime = "Tuesday, "
Case 3: ProcessSystemTime = "Wednesday, "
Case 4: ProcessSystemTime = "Thursday, "
Case 5: ProcessSystemTime = "Friday, "
Case 6: ProcessSystemTime = "Saturday, "
End Select
Select Case T.wMonth
Case 1: ProcessSystemTime = ProcessSystemTime & "January"
Case 2: ProcessSystemTime = ProcessSystemTime & "February"
Case 3: ProcessSystemTime = ProcessSystemTime & "March"
Case 4: ProcessSystemTime = ProcessSystemTime & "April"
Case 5: ProcessSystemTime = ProcessSystemTime & "May"
Case 6: ProcessSystemTime = ProcessSystemTime & "June"
Case 7: ProcessSystemTime = ProcessSystemTime & "July"
Case 8: ProcessSystemTime = ProcessSystemTime & "August"
Case 9: ProcessSystemTime = ProcessSystemTime & "September"
Case 10: ProcessSystemTime = ProcessSystemTime & "October"
Case 11: ProcessSystemTime = ProcessSystemTime & "November"
Case 12: ProcessSystemTime = ProcessSystemTime & "December"
End Select
...
There are functions such as MonthName(), WeekdayName(), ect, to return those values for you
Thanks. There was a problem with my packet parser that was causing the first filetime to start 2 bytes too late.
Quote from: shadypalm88 on May 04, 2004, 08:25 PM
Thanks. There was a problem with my packet parser that was causing the first filetime to start 2 bytes too late.
That's pretty amazing, to get results so near to Stealth's and find out that there was a fundamental flaw in the
beginning of your packet parsing.
Are you sure it wasn't offsetting something somewhere?