将Filetime Hex转换为Decimal的问题理解结果 [英] Problem understanding result of Converting Filetime Hex to Decimal

问题描述

通过关于分析index.dat文件的报告，我跟着他们如何找到文件时间日期/时间戳。

我的情况下的十六进制字节是2E 8B B4 71 0E D3 CD 01然后你应该反转字节01 CD D3 0E 71 B4 8B 2E。

将它们转换为十进制然后你可以从文件时间转换为正常日期/时间如果你正在做很长的路。 insted使用API​​函数。



使用内置计算器，字节转换为129992023254272814十进制，然后通过文件时间运行到日期时间转换器我。我得到12/5/2012 11:32:05 AM，这与我在文件中列出的另一个工具一致。

最后写入时间：12/5/2012 11:32:05 AM



问题出现的地方是当我尝试使用相同的方法时，您可以手动执行十六进制到十进制的转换，如此处所列http://www.webelfin.com/webelfindesign/hexdec.html [ ^ ]。此类函数的输出返回的内容大于内置计算器的输出。



使用下面函数的应用程序将反向十六进制字符串作为输入。验证输入字符串。然后查找十六进制值然后将这些值存储在集合中。然后传递给函数做x *（16 ^ n）工作。然后将它放入一个集合然后将它们一起添加到窗口然后将结果输出到窗口。



解决大计算问题后出现的科学记数法是什么我最终得到了

 私人 功能 ConvToDec（ ByVal  ipStr 作为列表（ Of   Int64 ））
 
  Dim 输出< span class =code-keyword> As   String  
  Dim  idx < span class =code-keyword> As  整数 
  Dim  strbldr < span class =code-keyword> As  新 StringBuilder 
  Dim  strb ldr2 作为 新 StringBuilder 
 
 idx = ipStr.Count  -   1   需要为coll diff添加 
 
  Dim  fincoll 作为 新集合
 对于 每个 elm 在 ipStr 
 
  Dim  nstr  As  长 =（elm * Math.Pow（ 16 ，idx））
 
 fincoll.Add（nstr）
 
 idx = idx  -   1  
 下一页 
 
 ' 在coll中添加项目以获得最终输出 
  Dim  finalString  As   String  
  Dim  nindex  As  整数 
 nindex = fincoll.Count 
  Dim  nstr2  As  长 
 对于 每个 itm 作为 长 在 fincoll 
 
 nstr2 = nstr2 + itm 
 
 finalString = nstr2 
 strbldr2.Append（itm&  ）
 nindex = nindex  -   1  
 下一步 
 
输出= nstr2& vbNewLine& vbNewLine& strbldr2.ToString 
 
 返回输出
 结束 功能 

这是输出：

 01CDD30E71B48B2E< ----输入十六进制字符串
 
 0 1 12 13 13 3 0 14 7 1 11 4 8 11 2 14<  - ----转换位
 
 129992023254272814< ----使用计算器转换
 
 2079872372068360000< ---数字流量总结为excell 
 
 
 2079872372068365024< ------应用产出总和
 
 0 
 1152921504606846976< -----返回计算出的数字。 
 864691128455135232 
 58546795155816448 
 3659174697238528 
 52776558133248 
 0 
 962072674304 
 30064771072 
 268435456 
 184549376 
 4194304 
 524288 
 45056 
 512 
 224 

我想我的问题是，是我没有看到这个功能的问题，或者它是否证明以大转换计算这种方式不是使用该功能的最佳方式？



更新：

当然我发布后我意识到问题所在。

如上所述，我必须为从0或1开始的Collection差异添加-1。输出现在与计算器一致。我只尝试了1个字节后才发现。我一直在使用一半或全部用于我的测试。

解决方案

问题上面的代码已经更正，现在正确回归与内置计算器相同。所以它可以使用。



问题是这条线需要在计数器数量上加-1，所以它在正确的位置开始/结束计数。

 idx = ipStr.Count  -  1 

上面的错误结果留待显示差异。



以下是简单修复的结果。

 01CDD30E71B48B2E< ---输入十六进制字符串
 
 0 1 12 13 13 3 0 14 7 1 11 4 8 11 2 14<  - 查找价值
 
 129992023254272814< ---计算器输出
 
 129992023254272814< ---应用的当前输出
以下结果总和。 
 
 0 
 72057594037927936<  - 新结果从查找计算值
 54043195528445952 
 3659174697238528 
 228698418577408 
 3298534883328 
 0 
 60129542144 
 1879048192 
 16777216 
 11534336 
 262144 
 32768 
 2816 
 32 
 14 

While going thru a report about analyzing the index.dat file I was following along with how they located a "File Time" date/time stamp.
The Hex bytes in my case are 2E 8B B4 71 0E D3 CD 01 then you are supposed to reverse the bytes 01 CD D3 0E 71 B4 8B 2E .
Convert them to decimal then you can convert from file time to a normal Date/Time if you are doing it the long way. Insted of using the API function.

Using the built in calculator the bytes convert to 129992023254272814 decimal then run thru a file time to Date time Converter I made. I get 12/5/2012 11:32:05 AM ,Which Agrees with what another tool I have list in the File.
Last Write Time : 12/5/2012 11:32:05 AM

Where the Problem comes in is when I try to use the same method you would use to do a hex to decimal conversion by hand as listed here http://www.webelfin.com/webelfindesign/hexdec.html[^]. The Output from this type of Function returns a larger amount than what the built in calculator does.

The app that uses the function below takes as input the reversed hex string. Validates the input string. Then does a lookup on the hex values then stores those values in a collection. Then passes off to the function to do the x*(16^n) work. Then puts that in to a collection then adds them together then outputs the result to the window.

After resolving problems with the big calculations coming out as Scientific notation here is what I ended up with

Private Function ConvToDec(ByVal ipStr As List(Of Int64))

    Dim Output As String
    Dim idx As Integer
    Dim strbldr As New StringBuilder
    Dim strbldr2 As New StringBuilder

    idx = ipStr.Count - 1  ' needed to add for coll diff

    Dim fincoll As New Collection
    For Each elm In ipStr

        Dim nstr As Long = (elm * Math.Pow(16, idx))

        fincoll.Add(nstr)

        idx = idx - 1
    Next

    'add item in coll for final output
    Dim finalString As String
    Dim nindex As Integer
    nindex = fincoll.Count
    Dim nstr2 As Long
    For Each itm As Long In fincoll

        nstr2 = nstr2 + itm

        finalString = nstr2
        strbldr2.Append(itm & " ")
        nindex = nindex - 1
    Next

    Output = nstr2 & vbNewLine & vbNewLine & strbldr2.ToString

    Return Output
End Function

And Here Is the Output:

01CDD30E71B48B2E <---- Input Hex string

0 1 12 13 13 3 0 14 7 1 11 4 8 11 2 14 <------ converted bits

129992023254272814 <---- converted using the Calculator

2079872372068360000 <--- Numbers bleow Summed by excell


2079872372068365024  <------ Output Sum From Application 

0 
1152921504606846976  <----- Returned Calculated numbers.
864691128455135232 
58546795155816448 
3659174697238528 
52776558133248 
0 
962072674304 
30064771072 
268435456 
184549376 
4194304 
524288 
45056 
512 
224 

I guess My question is, Is ther a problem with this function that I am not seeing or does it prove that calculating this way for large Conversions is not the best way to use that function ?

Updated:
Of course after I posted I realized where the problem was.
I had to add a -1 as noted above for the Collection difference of starting from 0 or 1. The output now agrees with the calculator. I discovered after trying only 1 byte. I had been using half or all for my test.

解决方案

The Code Above in the question Has been corrected and now correctly retuns the same as the built in calculator.So it can be used.

The problem was this line needed to Add "-1" to the counter count so it was starting/ending the count in the proper place.

idx = ipStr.Count - 1

The incorrect results from above are left to show the difference.

Here are the results below of the simple Fix.

01CDD30E71B48B2E <--- Input Hex String

0 1 12 13 13 3 0 14 7 1 11 4 8 11 2 14 <-- Look up Values

129992023254272814 <--- Output from Calculator

129992023254272814 <--- Current Output from Application
                        Sum of results below.

0 
72057594037927936  <-- New results Calculated from lookup Values
54043195528445952 
3659174697238528 
228698418577408 
3298534883328 
0 
60129542144 
1879048192 
16777216 
11534336 
262144 
32768 
2816 
32 
14 

这篇关于将Filetime Hex转换为Decimal的问题理解结果的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！