Jump to content
Sign in to follow this  
Cartman586

Windows Installation - Where I can change the modification date

Recommended Posts

It actually shows the creation date. I've been experimenting with this today but everytime it saved, it just reverted itself again :(

Share this post


Link to post
Share on other sites

Try Attribute Changer -> http://www.petges.lu/home/
 
If doesn't work this way, you have to edit the PE_Header or the .xml entry

<LASTMODIFICATIONTIME><HIGHPART>0x01CF6C3D</HIGHPART><LOWPART>0x3FF13CBB</LOWPART></LASTMODIFICATIONTIME>

example:

0x538A7B10 = June, 1st 2014 01:00:00 AM

Edited by nonspin

Share this post


Link to post
Share on other sites

The normal or the official way will be by applying then re-capturing the image (recommended to use vhd to easily delete it later)

XJDTfSV.png
 
but you can do it manually by changing the CREATIONTIME of index's xml entry

    <CREATIONTIME>      <HIGHPART>0x01CF7F87</HIGHPART>      <LOWPART>0xD084E5D3</LOWPART>    </CREATIONTIME>

eE1wH5D.png

Share this post


Link to post
Share on other sites

File boot.wim

01CF7F87 wich date format is this ?

unix time ? how its calculated ?

 

there is also multiple positions of creation time !!!

Edited by gorgone

Share this post


Link to post
Share on other sites

You put eh HIGHPART and LOWPART together to make HIGHPARTLOWPART and then convert it to decimal and then some other crap which i'm sure you can google.

Share this post


Link to post
Share on other sites

CreationTime is not what you want to edit and expect any results. LastModified or LastModificationTime

is the entry that gets displayed.

Maybe it's just me, but why would you even want to edit it ? It is the one visible information that tells you how old

the image is you are about to install.

Share this post


Link to post
Share on other sites

I think what they are trying to modify is the dates shown like in the images posted by abbodi1406 in this post - http://www.wincert.net/forum/topic/12319-windows-installation-where-i-can-change-the-modification-date/?p=108636, where you are selecting which image to install.  I can see the value of this when you begin to do an install if the date shown is the date the install source image was created.  In other words, if you created one install source in Dec 2013, and another one in June 2014, it would be helpful if those respective creation dates were shown, rather than the RTM date of Win 7 SP1 of 2010 being shown for both install sources such as is shown in the OP of this thread.  The creation date of the modified install source is what really tells you how old the image is you are about to install, not the original RTM date, isn't it?  Or did I misunderstand what you meant?

 

Cheers and Regards

Share this post


Link to post
Share on other sites

In that case, why don't you include the ImageSource date in the title (Operating System) ?

.. Or better yet, in the description field displaying after you hightlight the item.

It's also the most promising to actually being editable since the extraction and modifying of the dates isn't that easy.

Then you would have both types of information visible and not confuse anyone - including yourself.

 

Editing the modification date to something only you know the means to isn't of much help or value.

In a perfect world, you would edit the resources of setup and display both items - date created and date modified.

Edited by nonspin

Share this post


Link to post
Share on other sites

CreationTime is not what you want to edit and expect any results. LastModified or LastModificationTime

is the entry that gets displayed.

Maybe it's just me, but why would you even want to edit it ? It is the one visible information that tells you how old

the image is you are about to install.

 

No, CreationTime is the date that get shown on the install screen when you choose between Editions

and as i said, it represent the date when the image (index) was captured for the first time as new

probaply, but when someone update that image with latest updates, tweaks.. etc, he would want the image to have new date :)

Share this post


Link to post
Share on other sites

 

probaply, but when someone update that image with latest updates, tweaks.. etc, he would want the image to have new date :)

Whenever i add updates it reflects that in showing the date i added them. Hence "date modified"

Share this post


Link to post
Share on other sites

ahh, now it makes sense here. Thing is, that i never had issues with the displayed date, because i always apply

a custom boot layer to get my USB3 to work properly. Therefore it never showed the wrong date in the setup.

Share this post


Link to post
Share on other sites

Highpart/Lowpart explanation:

 

Highpart: Date

Lowpart: Time

 

convert/verify: w32tm

example:

<CREATIONTIME><HIGHPART>0x01CB88D1</HIGHPART><LOWPART>0xDB7CCA61</LOWPART></CREATIONTIME>

syntax: w32tm /ntte 0xHIGHPARTLOWPART

 

Open DOS-Box: (Win+R) CMD

w32tm /ntte 0x01CB88D1DB7CCA61

149707 16:42:02.2122081 - 11/20/2010 6:42:02 PM

Share this post


Link to post
Share on other sites

Apparently w32tm /ntte displays its results taking into account the local time zone, since for me the time displayed for the above command is 12:42:02 PM instead of 6:42:02 PM.
 
Cheers and Regards

Share this post


Link to post
Share on other sites


w32tm /ntte 0x1CF83BD00A67400
151004 08:30:00.0000000 - 6/9/2014 10:30:00 AM

 

151004 08:30:00. <- GMT

...

6/9/2014 10:30:00 AM <- relative to GMT (system setting > GMT+2)

Share this post


Link to post
Share on other sites

For me:
 
w32tm /ntte 0x1CF83BD00A67400
151004 08:30:00.0000000 - 6/9/2014 4:30:00 AM
 
151004 08:30:00. <- GMT
...
6/9/2014 4:30:00 AM <- relative to GMT (system setting > UTC-05:00 Eastern time Zone and Daylight Savings Time is in effect )
 
Is there a switch in w32tm that converts in the other direction?  ie human readable local or GMT to highpart/lowpart?  Looking only very briefly I didn't see one.  Or maybe a different command?  Just curious.
 
EDIT: I did find a discussion here, which includes a PowerShell script here, which looks like it does the job, so maybe there is not an easier way?
 
For convenience the PowerShell script:

# PSDateToInteger8.ps1# PowerShell script demonstrating how to convert a datetime value to the# corresponding Integer8 (64-bit) value. The Integer8 value is the# number of 100-nanosecond intervals (ticks) since 12:00 AM January 1,# 1601, in Coordinated Univeral Time (UTC).## ----------------------------------------------------------------------# Copyright (c) 2011 Richard L. Mueller# Hilltop Lab web site - [url=http://www.rlmueller.net/]http://www.rlmueller.net[/url]# Version 1.0 - March 19, 2011## You have a royalty-free right to use, modify, reproduce, and# distribute this script file in any way you find useful, provided that# you agree that the copyright owner above has no warranty, obligations,# or liability for such use.# Read Datetime value from command line or prompt for value.Param ($strDate)If ($strDate -eq $Null){$strDate = Read-Host "Date (Local Time)"}# Convert string to datetime.$Date = [DateTime]"$strDate"# Correct for daylight savings.If ($Date.IsDaylightSavingTime){$Date = $Date.AddHours(-1)}# Convert the datetime value, in UTC, into the number of ticks since# 12:00 AM January 1, 1601.$Value = ($Date.ToUniversalTime()).Ticks - ([DateTime]"January 1, 1601").Ticks$Value

 
Cheers and Regards

Share this post


Link to post
Share on other sites

you mean Date/Time to Integer8?

(remove .txt from attached file)

 

Usage (from CMD)

cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM"

 

result:

Integer8 value: 130468194000000000 (decimal output)

-> use calc.exe (programmer mode) to convert to hex (QWORD)

-> 1CF842195DB5400

 

highpart:01CF8421

lowpart:95DB5400

 

validation: w32tm /ntte 0x1CF842195DB5400

151004 20:30:00.0000000 - 6/9/2014 10:30:00 PM

DateToInteger8.vbs.txt

Edited by nonspin

Share this post


Link to post
Share on other sites

Thanks!   :)

Your solution is obviously from the same guy, of course. LOL  Just his VBS version of his PowerShell solution.
 
Cheers and Regards

Share this post


Link to post
Share on other sites

By the way, I haven't had a chance to debug it further, but the PowerShell version, which is invoked from a CMD box with: ( assuming it is run from the folder where PSDateToInteger8.ps1 is located )

powershell "& .\PSDateToInteger8.ps1 ""06/09/2014 10:30:00 PM"""

seems to have an issue properly detecting whether Daylight Savings Time is in place(?), because when you try to "validate" the results using w32tm it is off by an hour.  The .VBS version works correctly.

 

Actually I'm not sure which of the functions is correct, but at least the .VBS is consistent with w32tm.  And if you comment out the "Correct for daylight savings." section in the code of the PowerShell version then it gives the same results as the .VBS version.

 

Cheers and Regards

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...