内核时间操作APIs

最新推荐文章于 2025-12-10 11:53:15 发布

原创最新推荐文章于 2025-12-10 11:53:15 发布 · 1.8k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#date #integer #less #system #file

Pass the system time to this func after called KeQuerySystemTime()

BOOLEAN FileTimeToDosDateTime(PLARGE_INTEGER Current_time,
        // pointer to 64-bit file time
        PSHORT pFatDate,
        // pointer to variable for MS-DOS date
        PSHORT pFatTime
        // pointer to variable for MS-DOS time
        )
{
TIME_FIELDS TimeFields;
SHORT Date;
SHORT Time;
SHORT YearOffset;

RtlTimeToTimeFields(lpFileTime,&TimeFields);
//Initialize to 0
Date = 0;

//bits 0-4 should be Day
Date |= (TimeFields.Day & 0x001f);

//Bits 5-8 Month
Date |= ((TimeFields.Month << 5) & 0x01E0);

if(TimeFields.Year < 1601)
{
DbgPrint("/nFileTimeToDaosTime: year less than 1601");
return FALSE;
}

//Year is offset from 1980.
if(TimeFields.Year <= 1980)
YearOffset = 1980 - TimeFields.Year;
else
YearOffset = TimeFields.Year - 1980;

//Bits 9-15 Year offset
Date |= ((YearOffset << 9) & 0xFE00);
*pFatDate = Date;
// DbgPrint("/nFileTimeToDosTime : DosTime 0x%x",*pFatDate);

//Initialize tine to 0
Time = 0;
//Bits 0-4 Seconds / 2
Time |= (TimeFields.Second & 0x001F) / 2;

//bits 5 - 10 Minute
Time |= ((TimeFields.Minute << 5) & 0x07E0);

//bits 11-15 Hour
Time |= ((TimeFields.Hour << 11 ) & 0xF800);
*pFatTime = Time;
// DbgPrint("/nFileTimeToDosTime : DosTime 0x%x",*pFatTime);
return TRUE;
}