parsing faulting module timestamp

Question

Does anyone know how to parse the timestamp from a windows crash event? For example, how do I convert 0x55f7fcbe to a human readable time stamp?

Faulting application name: EXCEL.EXE, version: 15.0.4763.1000, time stamp: 0x55f7fcbe
Faulting module name: EXCEL.EXE, version: 15.0.4763.1000, time stamp: 0x55f7fcbe
Exception code: 0xc0000005
Fault offset: 0x000000000010a2a4
Faulting process id: 0x26a0
Faulting application start time: 0x01d12e98fb593cfc
Faulting application path: C:\Program Files\Microsoft Office\Office15\EXCEL.EXE
Faulting module path: C:\Program Files\Microsoft Office\Office15\EXCEL.EXE
Report Id: 1cecf154-9a91-11e5-93ee-3417eba4258b

score 0 · Answer 1 · edited May 23 '17 at 12:30

0

Thats a Unix style time_t timestamp. Check it out on: http://www.epochconverter.com/

The date you posted is

GMT: Tue, 15 Sep 2015 11:10:54 GMT

You can find some details about the format on this post Analyzing a crash in Windows: what does the error message tell us?

edited May 23 '17 at 12:30

Community

1
1

answered Dec 04 '15 at 22:55

Adam Tuliper

29,982
4
53
71

Thanks but the funny thing is that I know the crash happened on Dec 4, 2015... not sure what I'm missing. – fatdragon Dec 05 '15 at 23:48
The faulting application start time looks correct though. 0x01d12e98fb593cfc is translated to 2015-12-04 12:37:55 GMT. – fatdragon Dec 05 '15 at 23:53
I may have erroneously grabbed the excel.exe time stamp, dbl check with the url above – Adam Tuliper Dec 05 '15 at 23:55
Oh ya, that's it. The date you posted is the excel.exe time stamp :) – Adam Tuliper Dec 05 '15 at 23:56
Oh I see. So 0x55f7fcbe is the timestamp for the Excel.exe program and has nothing to do with the crash itself. – fatdragon Dec 05 '15 at 23:59
That is correct although if you look on the event log you may find the crash time – Adam Tuliper Dec 06 '15 at 00:04

score 0 · Answer 2 · answered Apr 12 '18 at 04:53

Thanks for the info. The following c# code converts Faulting application start time to a date time:

Int64 time = Int64.Parse(args[0], System.Globalization.NumberStyles.HexNumber);
time = time / 10000;

DateTime dt = new DateTime(1600, 1, 1);
dt = dt.AddMilliseconds(time);
Console.WriteLine($"{args[0]} converted to universal time is 
{dt.ToString("s")}");
dt = dt.ToLocalTime();
Console.WriteLine($"{args[0]} converted to local time is 
{dt.ToString("s")}");

parsing faulting module timestamp

2 Answers2