[RESOLVED] Reading FILETIME account created time?

[shadypalm88]

I'm trying to read the FILETIME's from the System profile fields that tells you when your account was created, last login, and last logout, but I'm getting the wrong results.  What's wrong here?

Code Select Expand

Private Declare Function FileTimeToSystemTime Lib "kernel32" _
   (lpFileTime As Filetime, lpSystemTime As SystemTime) As Boolean

Private Type Filetime
   dwLowDateTime As Long
   dwHighDateTime As Long
End Type

Private Type SystemTime
   wYear As Integer
   wMonth As Integer
   wDayOfWeek As Integer
   wDay As Integer
   wHour As Integer
   wMinute As Integer
   wSecond As Integer
   wMilliseconds As Integer
End Type

<..snip..>

Private Function StringToFiletime(T As String) As Filetime
   Dim Frag() As String, FT As Filetime
   Frag = Split(T, " ")
   'If value too big for VB's signed long, make it "unsigned"
   If Val(Frag(0)) > 2147483647 Then
       FT.dwHighDateTime = Val(Frag(0)) - 2147483648#
   Else
       FT.dwHighDateTime = Frag(0)
   End If
   If UBound(Frag) > 0 Then
       If Val(Frag(0)) > 2147483647 Then
           FT.dwLowDateTime = Val(Frag(0)) - 2147483648#
       Else
           FT.dwLowDateTime = Frag(0)
       End If
   End If
   StringToFiletime = FT
End Function

Private Function ProcessSystemTime(T As SystemTime) As String
   Select Case T.wDayOfWeek
       Case 0: ProcessSystemTime = "Sunday, "
       Case 1: ProcessSystemTime = "Monday, "
       Case 2: ProcessSystemTime = "Tuesday, "
       Case 3: ProcessSystemTime = "Wednesday, "
       Case 4: ProcessSystemTime = "Thursday, "
       Case 5: ProcessSystemTime = "Friday, "
       Case 6: ProcessSystemTime = "Saturday, "
   End Select
   Select Case T.wMonth
       Case 1: ProcessSystemTime = ProcessSystemTime & "January"
       Case 2: ProcessSystemTime = ProcessSystemTime & "February"
       Case 3: ProcessSystemTime = ProcessSystemTime & "March"
       Case 4: ProcessSystemTime = ProcessSystemTime & "April"
       Case 5: ProcessSystemTime = ProcessSystemTime & "May"
       Case 6: ProcessSystemTime = ProcessSystemTime & "June"
       Case 7: ProcessSystemTime = ProcessSystemTime & "July"
       Case 8: ProcessSystemTime = ProcessSystemTime & "August"
       Case 9: ProcessSystemTime = ProcessSystemTime & "September"
       Case 10: ProcessSystemTime = ProcessSystemTime & "October"
       Case 11: ProcessSystemTime = ProcessSystemTime & "November"
       Case 12: ProcessSystemTime = ProcessSystemTime & "December"
   End Select
   ProcessSystemTime = ProcessSystemTime & " " & T.wDay & ", " & T.wYear & " "
   Dim ap$
   If T.wHour > 12 Then
       T.wHour = T.wHour - 12
       ap = "PM"
   Else
       ap = "AM"
   End If
   ProcessSystemTime = ProcessSystemTime & T.wHour & ":" & T.wMinute & ":" & T.wSecond & _
       " " & ap
End Function

[Maddox]

What kind of "wrong results" are you getting?

[MyndFyre]

Do you have to perhaps specify that lpFileTime and lpSystemTime are ByRef?

(Again, not a VB programmer).

[Adron]

The conversions from an unsigned value in a string to a signed value in a long are wrong. They should be:

Code Select Expand


if val(string) < 2^31 then dword = val(string) else dword = val(string) - 2^32


edit: did put it in code tags after all

[shadypalm88]

Still not giving proper results.  Here's what StealthBot says:

Code Select Expand

[6:48:44 PM] Account Created: 5/22/2001, 14:34:10 (Battle.net time)
[6:48:44 PM] Last Logon: 5/4/2004, 23:48:47 (Battle.net time)
[6:48:44 PM] Last Logoff: 5/4/2004, 23:46:40 (Battle.net time)
and my bot:

Code Select Expand

[6:49:24 PM] Recieved account statistics.
[6:49:24 PM] Account Created Filetime: 29635122 1873721440
[6:49:24 PM] Account Created: Tuesday, May 4, 2004 11:49:27 PM
[6:49:24 PM] Last Logged In: Tuesday, May 4, 2004 11:49:22 PM
[6:49:24 PM] Last Logged Out: Tuesday, March 17, 1648 3:04:53 PM

Updated String -> Filetime Code:

Code Select Expand

Private Function StringToFiletime(T As String) As Filetime
   Dim Frag() As String, FT As Filetime
   Frag = Split(T, " ")
   If Val(Frag(0)) < 2 ^ 31 Then
       FT.dwHighDateTime = Val(Frag(0))
   Else
       FT.dwHighDateTime = Val(Frag(0)) - 2 ^ 32
   End If
   If UBound(Frag) > 0 Then
       If Val(Frag(1)) < 2 ^ 31 Then
           FT.dwLowDateTime = Val(Frag(1))
       Else
           FT.dwLowDateTime = Val(Frag(1)) - 2 ^ 32
       End If
   End If
   StringToFiletime = FT
End Function

[Adron]

Code Select Expand

[6:49:24 PM] Recieved account statistics.
[6:49:24 PM] Account Created Filetime: 29635122 1873721440
[6:49:24 PM] Account Created: Tuesday, May 4, 2004 11:49:27 PM
[6:49:24 PM] Last Logged In: Tuesday, May 4, 2004 11:49:22 PM
[6:49:24 PM] Last Logged Out: Tuesday, March 17, 1648 3:04:53 PM

Looks like you're parsing the wrong data.

"29635122 1873721440" is probably created,
"Tuesday, May 4, 2004 11:49:27 PM" logged in and
"Tuesday, May 4, 2004 11:49:22 PM" logged out.

Your debug output "steals" one of the filetimes?

[UserLoser.]

...

Code Select Expand


Private Function ProcessSystemTime(T As SystemTime) As String
   Select Case T.wDayOfWeek
       Case 0: ProcessSystemTime = "Sunday, "
       Case 1: ProcessSystemTime = "Monday, "
       Case 2: ProcessSystemTime = "Tuesday, "
       Case 3: ProcessSystemTime = "Wednesday, "
       Case 4: ProcessSystemTime = "Thursday, "
       Case 5: ProcessSystemTime = "Friday, "
       Case 6: ProcessSystemTime = "Saturday, "
   End Select
   Select Case T.wMonth
       Case 1: ProcessSystemTime = ProcessSystemTime & "January"
       Case 2: ProcessSystemTime = ProcessSystemTime & "February"
       Case 3: ProcessSystemTime = ProcessSystemTime & "March"
       Case 4: ProcessSystemTime = ProcessSystemTime & "April"
       Case 5: ProcessSystemTime = ProcessSystemTime & "May"
       Case 6: ProcessSystemTime = ProcessSystemTime & "June"
       Case 7: ProcessSystemTime = ProcessSystemTime & "July"
       Case 8: ProcessSystemTime = ProcessSystemTime & "August"
       Case 9: ProcessSystemTime = ProcessSystemTime & "September"
       Case 10: ProcessSystemTime = ProcessSystemTime & "October"
       Case 11: ProcessSystemTime = ProcessSystemTime & "November"
       Case 12: ProcessSystemTime = ProcessSystemTime & "December"
   End Select
   ...


There are functions such as MonthName(), WeekdayName(), ect, to return those values for you

[shadypalm88]

Thanks.  There was a problem with my packet parser that was causing the first filetime to start 2 bytes too late.

[MyndFyre]

Thanks.  There was a problem with my packet parser that was causing the first filetime to start 2 bytes too late.

That's pretty amazing, to get results so near to Stealth's and find out that there was a fundamental flaw in the beginning of your packet parsing.

Are you sure it wasn't offsetting something somewhere?