I am reversing a file with no documentation.

I identified chunks of data (8 bytes); on the left is what is expected (hours, minutes, seconds, 1/60 of second) and on the right, the raw bytes.

// 00:00:00:00 0000000000000000
// 00:15:43:59 412BA7EAD70A3D71
// 01:11:48:00 414F8D834C49BA5E
// 02:02:59:20 415B06219B020C4A
// 02:14:36:27 415D93ADB570A3D7
// 02:30:29:59 416088CF8A45A1CB

I could not find how the time positions were encoded.

I tried (c#) new TimeSpan(BitConverter.ToInt64(x)) where x is the whole 64 bits, with x normal and reversed; and BitConverter.ToInt16(x) where x is a 16 bits.

The original software is written in c++ I believe.

Any clue ?

  • Read these 8-byte chunks as "double" floating-point numbers.
    – ESkri
    Commented Nov 1, 2023 at 8:22
  • @ESkri Thanks, that's almost it, if the double is considered as milliseconds. Any idea about the difference with the reference ? eg., 00:15:06.2294200 (calculated) v 00:15:43:59 (reference)
    – Soleil
    Commented Nov 1, 2023 at 11:36


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.