Simple Class to Convert Reg_binary Time to a Datetime Object in C#

Article
1/17/2024

Defining the problem

As part of my ongoing project to create a console to manage System Center EndPoint Protection without System Center Configuration Manager, I needed a way to convert times that were stored in the registry as reg_binary values.

For instance, the keys will have data such as 0D 6C A4 4B 37 C5 CE 01

Registry Keys of interest

These values are stored in the following keys under "HKEY_Local_Machine\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates":

ASSignatureApplied
AVSignatureApplied
LastFallbackTime
NISSignatureApplied
SignaturesLastUpdated

I needed a method to convert these values to a human readable form, so I created the following class:

Code





      using System;
      namespace SCEPConsole
      {  
                    class SCEPDateTimeConverter  
                    {      
                        public DateTime ConvertBinaryDateTime(Byte[] bytes)  
                        {      
                            long filedate = (((((((  
                            (      long      )bytes[7] * 256 +      
                            (      long      )bytes[6]) * 256 +      
                            (      long      )bytes[5]) * 256 +      
                            (      long      )bytes[4]) * 256 +      
                            (      long      )bytes[3]) * 256 +      
                            (      long      )bytes[2]) * 256 +      
                            (      long      )bytes[1]) * 256 +      
                            (      long      )bytes[0]);      
                            DateTime returnDate = DateTime.FromFileTime(filedate);      
                            return returnDate;  
                        }      
                    }      
      }

Calling the code

I call it like this:

SCEPDateTimeConverter myDateTimeObject = new   SCEPDateTimeConverter();
RegistryKey regKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, server, RegistryView.Registry64);
RegistryKey key = regKey.OpenSubKey(@"SOFTWARE\Microsoft\Microsoft Antimalware");
RegistryKey Updates = key.OpenSubKey("Signature Updates");
if (Updates.GetValue("NISSignatureApplied") != null)
{
    byte[] NISSignatureAppliedbytes = (byte[])Updates.GetValue("NISSignatureApplied");
    strNISSignatureApplied = myDateTimeObject.ConvertBinaryDateTime(NISSignatureAppliedbytes).ToString();
}

Output

When the data in NISSignatureApplied is the previous example (0D 6C A4 4B 37 C5 CE 01), strNISSignatureApplied will contain 10/9/2013 3:34:12 PM

Share via