0

The point is I am trying to extract this CTime what was compressed with CArchive into QDateTime using QDataStream. I know that it is not the same, but which is why I am trying to read the raw data out. I have no control over no using CTime CArchive, so ill have to roll with that. I am looking to see how the CTime is being written when using write of CArchive. I am looking for some similar explanations to this https://stackoverflow.com/a/8933769/21282829 .

I am using this as a reference " https://learn.microsoft.com/en-us/cpp/mfc/tn002-persistent-object-data-format?view=msvc-170" and can see that 0x8000 means it is using wOldClassTag.

I did reverse engineer and the time I need is 5d960a1b (although not quite, but maybe could be because of the time zone stuff)

0x0a    0x00    0x00    0x80    0x1b    0x0a    0x96    0x5d

My question is where can I find a description on how CArchive compress the CTime data. I know that 3rd and 4th is 0x00 0x80 is the wOldClassTag, 0x96 0x5d probably date, and 0x1b 0x0a being time. What about the next 4 bytes 0x0a 0x00? does it mean anything?

I tried reading through this Microsoft TN002: Persistent Object Data Format, but it doesnt go to over any detail on how CTime is being serialized. Thank you in advance!

0nePunchMan
  • 13
  • 1

1 Answers1

2

Don't you have any information about how the archive was originally stored? Normally you will have to apply the read (>>) operators in the same order.

The relevant source-code files are arccore.cpp, timecore.cpp and afx.inl.

In your case my take is that the archive contains 12 bytes for the object, and this because MFC does some tricks in order to accommodate both 32- and 64-bit times. Check the code of CArchive& AFXAPI operator <<. Looks like the first four bytes are that INT_MIN + 10 prefix, which means that a __time64_t (8 bytes) value follows.

Constantine Georgiou
  • 2,412
  • 1
  • 13
  • 17
  • The only infomation i have is that the CArchive write was store with this "ar << m_Time" (CArchive). I will surely look this up just because I cannot do the same with ar >> m_Time (QDataStream) – 0nePunchMan Mar 02 '23 at 14:31
  • @0nePunchMan That sounds odd. `CArchive` and `QDataStream` do not share an implementation. Just because you're using the same syntax doesn't magically make the operator overloads agree on an implementation. What are you really trying to do here? – IInspectable Mar 03 '23 at 08:35
  • @IInspectable, sorry, I was not being cleared enough. My point is I want to extract the date and time from the serialized CTime (packaged using CArchive). yes, i, at the time, suspected that. I tried it anyways, and it was giving me junk value. So i read the raw data out into char[50 (random# here)] to get the hex value out. which is what you saw up above. That was then i realized that i have to know how carchive package their stuff in order to extract the right information from CTime. – 0nePunchMan Mar 03 '23 at 14:15
  • You have to do the same job I did for `CArchive` (checking the code), but for `QDataStream` this time. If my guesses above are correct, you have to read a uint32 value, and if it's not 0x800A return an error or throw an exception, otherwise read a __time64_t value (or an int64 and cast it to __time64_t), then create the desired object out of it if you want. – Constantine Georgiou Mar 03 '23 at 18:39