HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
time_util.cpp
Go to the documentation of this file.
1#include "time_util.h"
2#include <codecvt>
3#include <locale>
4#include <string>
5#include <sstream>
6
7#include <iostream>
8#include <iomanip>
9#include <ctime>
10#include <cmath>
11
12std::wstring util::strtime(const time_t t)
13{
14 struct tm time_info;
15 if (localtime_s(&time_info, &t) == 0) {
16 std::wstringstream str;
17 str << std::put_time(&time_info, L"%c");
18 std::wstring result = str.str();
19 return result;
20 }
21 return L"";
22}
23
24// snippet from: https://www.frenk.com/2009/12/convert-filetime-to-unix-timestamp/
25LONGLONG util::FileTime_to_POSIX(FILETIME ft)
26{
27 // takes the last modified date
28 LARGE_INTEGER date, adjust;
29 date.HighPart = ft.dwHighDateTime;
30 date.LowPart = ft.dwLowDateTime;
31
32 // 100-nanoseconds = milliseconds * 10000
33 adjust.QuadPart = 11644473600000 * 10000;
34
35 // removes the diff between 1970 and 1601
36 date.QuadPart -= adjust.QuadPart;
37
38 // converts back from 100-nanoseconds to seconds
39 return date.QuadPart / 10000000;
40}
41
42LONGLONG util::process_start_time(DWORD processID)
43{
44 HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processID);
45 if (!hProcess) {
46 return INVALID_TIME;
47 }
48
49 FILETIME creationTime = { 0 };
50 FILETIME exitTime = { 0 };
51 FILETIME kernelTime = { 0 };
52 FILETIME userTime = { 0 };
53
54 BOOL isOk = GetProcessTimes(
55 hProcess,
56 &creationTime, &exitTime, &kernelTime, &userTime
57 );
58 CloseHandle(hProcess);
59 if (!isOk) return INVALID_TIME;
60
61 return util::FileTime_to_POSIX(creationTime);
62}
LONGLONG process_start_time(DWORD processID)
Definition time_util.cpp:42
LONGLONG FileTime_to_POSIX(FILETIME ft)
Definition time_util.cpp:25
std::wstring strtime(const time_t t)
Definition time_util.cpp:12
#define INVALID_TIME
Definition time_util.h:7