diff --git a/RECmd/Program.cs b/RECmd/Program.cs index 00bc4ae..994c3d6 100644 --- a/RECmd/Program.cs +++ b/RECmd/Program.cs @@ -2361,6 +2361,33 @@ private static BatchCsvOut BuildBatchCsvOut(RegistryKey regKey, Key key, string } break; + case Key.BinConvert.DateTimeTicks: + try + { + var dticks = BitConverter.ToInt64(regVal.ValueDataRaw, 0); + var dtVal = new DateTime(dticks, DateTimeKind.Utc); + rebOut.ValueData = dtVal.ToUniversalTime().ToString(dt); + } + catch (Exception) + { + Log.Warning("Error converting to DateTime.Ticks. Using bytes instead!"); + rebOut.ValueData = regVal.ValueData; + } + + break; + case Key.BinConvert.OLE: + try + { + var ft = DateTime.FromOADate(BitConverter.ToDouble(regVal.ValueDataRaw, 0)); + rebOut.ValueData = ft.ToString(dt); + } + catch (Exception) + { + Log.Warning("Error converting to OLE Automation Date OLE2.0. Using bytes instead!"); + rebOut.ValueData = regVal.ValueData; + } + + break; default: rebOut.ValueData = regVal.ValueData; break; @@ -2426,6 +2453,36 @@ private static BatchCsvOut BuildBatchCsvOut(RegistryKey regKey, Key key, string rebOut.ValueData = regVal.ValueData; } + break; + + case Key.BinConvert.DateTimeTicks: + try + { + var dticks = BitConverter.ToInt64(regVal.ValueDataRaw, 0); + var dtVal = new DateTime(dticks, DateTimeKind.Utc); + + rebOut.ValueData = dtVal.ToUniversalTime().ToString(dt); + } + catch (Exception) + { + Log.Warning("Error converting to DateTime.Ticks. Using bytes instead!"); + rebOut.ValueData = regVal.ValueData; + } + + break; + + case Key.BinConvert.OLE: + try + { + var ft = DateTime.FromOADate(BitConverter.ToDouble(regVal.ValueDataRaw, 0)); + rebOut.ValueData = ft.ToString(dt); + } + catch (Exception) + { + Log.Warning("Error converting to OLE Automation Date OLE2.0. Using bytes instead!"); + rebOut.ValueData = regVal.ValueData; + } + break; } } diff --git a/RECmd/ReBatch.cs b/RECmd/ReBatch.cs index 6776876..5d2aff9 100644 --- a/RECmd/ReBatch.cs +++ b/RECmd/ReBatch.cs @@ -30,7 +30,9 @@ public enum BinConvert [Description("IPv4 address")] Ip = 2, [Description("DWord to Epoch")] Epoch = 3, [Description("Binary to SID")] Sid = 4, - [Description("128 bit Windows SYSTEMTIME")] Systemtime = 5 + [Description("128 bit Windows SYSTEMTIME")] Systemtime = 5, + [Description("DateTime.Ticks")] DateTimeTicks = 6, + [Description("OLE Automation Date OLE2.0")] OLE = 7 } public enum HiveType_