1

I am trying to decode this hex timestamp:

5A24 B103 73AE --> 02/26/2018 15:45:44 
5A24 FC03 83BC --> 02/26/2018 17:00:48
5A24 FE03 93E3 --> 02/26/2018 17:02:58

Data is coming from an old controller serial protocol. The proprietary software shows the "controller time in hex" and converts it in the value showed.

How do you approach this problem?

| improve this question | |
  • all the protocol is little endian – fparaggio Feb 26 '18 at 14:32
  • 1
    My advice is to gather more examples. For example, your value could be the number of seconds that passed since a fixed point in time 3.143 million years ago. Or, the same but in milliseconds – then the zero point would be 2:27:08 at May 15, 1124 BC (which was a Saturday). – usr2564301 Feb 26 '18 at 14:59
  • 1
    Please try to post questions which have clear answers, not ask for vague "advice". Provide as much info as you can (e.g. where the data is coming from and why you think the listed date is correct). – Igor Skochinsky♦ Feb 26 '18 at 15:08
  • I am quite a newbie. I try to learn fast, thank you very much for your comments. Please check my editing, hope it replies your questions. – fparaggio Feb 26 '18 at 15:14
  • How old is this "old" device? There does not seem to be enough bits left of the first jumping value (which therefore must be 'minutes') to indicate a timespan longer than a handful of years. So how does it know we live in 2018? Do you need to reset or update it once a year? – usr2564301 Feb 26 '18 at 16:00
5
import sys
import os

if(len(sys.argv) != 2):     
    sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0]))

if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )):
    sys.exit("0x prefixed hexinput must be in range 0x0000 to 0xffff padded to 4 digits")

indate = int(sys.argv[1],16)

year   =  str(((indate & 0xfe00) >> 9) + 2000)
month  =  str((indate & 0x01e0) >> 5)
day    =  str((indate & 0x001f) >> 0)
sep    =  "/"

print "The date is in MSDOS DATE FORMAT"
print "y2k-fixed year9to15 bits month 5t08bits and day 0to5 bits"
print (day+sep+month+sep+year)

0x245a as input

:\>python msdosdate.py 0x245a
The date is in MSDOS DATE FORMAT
y2k-fixed year9to15 bits month 5t08bits and day 0to5 bits
26/2/2018

Edited a complete script that takes all the three short ints

:>cat makedatetime.py
import sys
if(len(sys.argv) != 4):
    sys.exit("usage python thisscript.py 1337 dead d00d")
for i in range(1,4,1):
    if(len(sys.argv[i]) != 4):
        sys.exit("enter unsigned short integer of type 'H' in hex \n"
                "like dead d00d 1337 babe etc duly padded to 4 digits")
indate      = int(sys.argv[1],16)
inminute    = int(sys.argv[2],16)
inseconds   = int(sys.argv[3],16)
year        = str(((indate &0xfe00) >> 9)+2000)
month       = str(((indate &0x01e0) >> 5)+0000)
day         = str(((indate &0x001f) >> 0)+0000)
hours       = str(inminute/60)
minutes     = str(inminute%60)
seconds     = str(inseconds/1000)
millisecs   = str(inseconds%1000)


print(month+"/"+day+"/"+year+" "+hours+":"+minutes+":"+seconds+":"+millisecs)
:>python makedatetime.py 245A 03B1 AE73
2/26/2018 15:45:44:659

:>python makedatetime.py 245A 03FC BC83
2/26/2018 17:0:48:259

:>python makedatetime.py 245A 03FE E393
2/26/2018 17:2:58:259
| improve this answer | |
  • Very well spotted, but what about the time? Is it in ye olde DOS format as well? – usr2564301 Feb 26 '18 at 19:42
  • This is great! Thank you. It would be great to learn how you approached this problem. Any guidelines? I see the second and third blocks as INT16 Little Endian minutes and milliseconds – fparaggio Feb 26 '18 at 19:51
  • Thank you very much! tomorrow I'll post the next day data for double checking! However very well spotted, than you again! – fparaggio Feb 26 '18 at 20:05
  • 1
    @usr2564301 it is not in that format it is total minutes from 0 to now() i edited a calculation in the answer – blabb Feb 26 '18 at 20:14
  • @fparaggio this is the format used in zip headers but in zip headers it isnt y2k fixed so base year will be 1980 – blabb Feb 26 '18 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.