kevinsikes
15-Jun-2005, 02:30 PM
In addition to the file system timestamp, it would be very helpful to see the link timestamp from the file's PE header, which shows when the .DLL or .EXE was created by the linker. Here is some sample C code to get this information:
#include <windows.h>
#include <time.h>
#include <stdio.h>
#include <DbgHelp.h>
#ifdef _MSC_VER
#pragma comment(lib, "dbghelp.lib")
#endif
void main(int argc, char* argv[])
{
if (argc > 1)
{
HANDLE hFile;
if ((hFile = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
{
HANDLE hMap;
if ((hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, "PEmap")) != NULL)
{
HMODULE hAddress;
if ((hAddress = (HMODULE)MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 4096)) != NULL)
{
time_t t;
if ((t = GetTimestampForLoadedLibrary(hAddress)) != 0)
{
printf("%s link timestamp is %s\n", argv[1], asctime(localtime(&t)));
}
UnmapViewOfFile(hAddress);
}
CloseHandle(hMap);
}
CloseHandle(hFile);
}
}
}
Example output from the sample code:
petime c:\windows\system32\kernel32.dll
c:\windows\system32\kernel32.dll link timestamp is Wed Aug 04 03:56:36 2004
Thanks!
Kevin Sikes
#include <windows.h>
#include <time.h>
#include <stdio.h>
#include <DbgHelp.h>
#ifdef _MSC_VER
#pragma comment(lib, "dbghelp.lib")
#endif
void main(int argc, char* argv[])
{
if (argc > 1)
{
HANDLE hFile;
if ((hFile = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
{
HANDLE hMap;
if ((hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, "PEmap")) != NULL)
{
HMODULE hAddress;
if ((hAddress = (HMODULE)MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 4096)) != NULL)
{
time_t t;
if ((t = GetTimestampForLoadedLibrary(hAddress)) != 0)
{
printf("%s link timestamp is %s\n", argv[1], asctime(localtime(&t)));
}
UnmapViewOfFile(hAddress);
}
CloseHandle(hMap);
}
CloseHandle(hFile);
}
}
}
Example output from the sample code:
petime c:\windows\system32\kernel32.dll
c:\windows\system32\kernel32.dll link timestamp is Wed Aug 04 03:56:36 2004
Thanks!
Kevin Sikes