1

I have two lines of C# I would like to convert to assembly. I've tried to follow this answer (FILETIME to __int64) without getting a satisfying result.

This is the two lines of C#

System.DateTime dt = System.DateTime.Now;
long x = dt.ToFileTime();

And from the other answer (linked above) I've concluded this should be the assembly code that does the same.

local fTime :FILETIME
local ticks :DWORD

invoke GetLocalTime,addr time
invoke SystemTimeToFileTime,addr time,addr fTime

xor eax,eax
xor ebx,ebx

mov eax,fTime.dwLowDateTime
mov ebx,fTime.dwHighDateTime
sal ebx,32
or ebx,eax
mov ticks,ebx

The output of the C# is 1221229007
The output of my asm is 2882329052

The C# and the assembly was run within seconds from each other, so the diffrence shouldn't be THAT big. Should it?

Where am I wrong?

Cœur
  • 37,241
  • 25
  • 195
  • 267
f2lollpll
  • 997
  • 6
  • 15
  • Are you aware that a `FileTime` is a 64-bit quantity? The low 32 bits cycles every 7-8 minutes. – Gabe Jan 23 '12 at 12:50
  • Registers and `DWORD` are 32-bit. You are just making `ebx` zero by that `sal` instruction, and a `FILETIME` won't fit into a `DWORD`. BTW, how come the output of C# code is 1221229007? That is much too small for a `FILETIME`, which is counted in 100-ns units from 1.01.1601! – Anton Tykhyy Jan 23 '12 at 12:50
  • ebx doesn't change when i make the shift. Also, i don't know what "magic" happends in the .Net's .ToFileTime(); method ;) – f2lollpll Jan 23 '12 at 13:44

1 Answers1

-1
invoke GetLocalTime,addr time
invoke SystemTimeToFileTime,addr time,addr fTime

xor eax,eax
xor ebx,ebx

mov eax,fTime.dwLowDateTime
mov ebx,fTime.dwHighDateTime

sal ebx,32 ;shift HighDateTime left 32 bits
add ebx,eax ;add HighDateTime and LowDateTime together

mov edx,ebx ;edx has the ticks?

this seem to work, the or should be an add

found it Here

f2lollpll
  • 997
  • 6
  • 15
  • Shifting a 32-bit register by 32 bits doesn't help you much. You can't hold `FILETIME` (64 bits) in a single x86 register (32 bits) – Djole Jan 23 '12 at 16:35
  • I got it.. I've been told before. Now tell me what I SHOULD do instead of what I shouldn't. Please – f2lollpll Jan 23 '12 at 17:31