TimeDateStamp IMAGE_FILE_HEADER, . , / .
.NET 4.0 :
using System;
using System.IO.MemoryMappedFiles;
using System.Runtime.InteropServices;
using System.IO;
namespace GetPeLinkTime {
class Program {
static void Main (string[] args) {
if (args.Length != 1) {
Console.WriteLine ("Usage:" + Environment.NewLine + " GetPeLinkTime ExePathToExamine");
return;
}
string filePath = args[0];
FileStream file = File.OpenRead (filePath);
using (var mmf = MemoryMappedFile.CreateFromFile (file, null,
file.Length,
MemoryMappedFileAccess.Read,
null, HandleInheritability.None, false)) {
NativeMethods.IMAGE_DOS_HEADER dosHeader = new NativeMethods.IMAGE_DOS_HEADER ();
using (var accessor = mmf.CreateViewAccessor (0,
Marshal.SizeOf (dosHeader),
MemoryMappedFileAccess.Read)) {
accessor.Read<NativeMethods.IMAGE_DOS_HEADER>(0, out dosHeader);
if (dosHeader.e_magic != NativeMethods.IMAGE_DOS_SIGNATURE) {
Console.WriteLine ("The input file is not an Executable file.");
return;
}
}
int signature = 0;
NativeMethods.IMAGE_FILE_HEADER imageFileHeader = new NativeMethods.IMAGE_FILE_HEADER();
using (var accessor = mmf.CreateViewAccessor (dosHeader.e_lfanew,
Marshal.SizeOf (signature) + Marshal.SizeOf (imageFileHeader),
MemoryMappedFileAccess.Read)) {
signature = accessor.ReadInt32 (0);
if (signature != NativeMethods.IMAGE_NT_SIGNATURE) {
Console.WriteLine ("The input file is not a Program Executable file.");
return;
}
accessor.Read<NativeMethods.IMAGE_FILE_HEADER> (Marshal.SizeOf (signature), out imageFileHeader);
}
DateTime origin = new DateTime(1970, 1, 1, 0, 0, 0, 0);
TimeSpan localOffset = TimeZone.CurrentTimeZone.GetUtcOffset (origin);
DateTime originUTC = origin.AddHours(localOffset.Hours);
DateTime linkTime = originUTC.AddSeconds ((double)imageFileHeader.TimeDateStamp);
Console.WriteLine ("Link time of the file '{0}' is: {1}", filePath, linkTime);
}
}
}
internal static class NativeMethods {
internal const int IMAGE_DOS_SIGNATURE = 0x5A4D;
internal const int IMAGE_NT_SIGNATURE = 0x00004550;
[StructLayout (LayoutKind.Sequential)]
internal struct IMAGE_DOS_HEADER {
internal short e_magic;
internal short e_cblp;
internal short e_cp;
internal short e_crlc;
internal short e_cparhdr;
internal short e_minalloc;
internal short e_maxalloc;
internal short e_ss;
internal short e_sp;
internal short e_csum;
internal short e_ip;
internal short e_cs;
internal short e_lfarlc;
internal short e_ovno;
internal short e_res1;
internal short e_res2;
internal short e_res3;
internal short e_res4;
internal short e_oemid;
internal short e_oeminfo;
internal short e_res20;
internal short e_res21;
internal short e_res22;
internal short e_res23;
internal short e_res24;
internal short e_res25;
internal short e_res26;
internal short e_res27;
internal short e_res28;
internal short e_res29;
internal int e_lfanew;
}
[StructLayout (LayoutKind.Sequential)]
internal struct IMAGE_FILE_HEADER {
internal short Machine;
internal short NumberOfSections;
internal int TimeDateStamp;
internal int PointerToSymbolTable;
internal int NumberOfSymbols;
internal short SizeOfOptionalHeader;
internal short Characteristics;
}
}
}