解析错误模块时间戳

Question

有谁知道如何解析Windows崩溃事件的时间戳？例如，如何将0x55f7fcbe转换为人类可读的时间戳？

Faulting application name: EXCEL.EXE, version: 15.0.4763.1000, time stamp: 0x55f7fcbe
Faulting module name: EXCEL.EXE, version: 15.0.4763.1000, time stamp: 0x55f7fcbe
Exception code: 0xc0000005
Fault offset: 0x000000000010a2a4
Faulting process id: 0x26a0
Faulting application start time: 0x01d12e98fb593cfc
Faulting application path: C:\Program Files\Microsoft Office\Office15\EXCEL.EXE
Faulting module path: C:\Program Files\Microsoft Office\Office15\EXCEL.EXE
Report Id: 1cecf154-9a91-11e5-93ee-3417eba4258b

Answer 1

这是一个Unix风格的time_t时间戳。 看看： http://www.epochconverter.com/

您发布的日期是

GMT: Tue, 15 Sep 2015 11:10:54 GMT

您可以在此帖Analyzing a crash in Windows: what does the error message tell us?

上找到有关格式的一些详细信息

Answer 2

感谢您的信息。以下c＃代码将Faulting应用程序的开始时间转换为日期时间：

Int64 time = Int64.Parse(args[0], System.Globalization.NumberStyles.HexNumber);
time = time / 10000;

DateTime dt = new DateTime(1600, 1, 1);
dt = dt.AddMilliseconds(time);
Console.WriteLine($"{args[0]} converted to universal time is 
{dt.ToString("s")}");
dt = dt.ToLocalTime();
Console.WriteLine($"{args[0]} converted to local time is 
{dt.ToString("s")}");