Interpret UInt64 dateData in .NET DateTime structure?

Question

In looking at a DateTime struct in the debugger via SOS.dll, I see...

  0:096> !DumpVC 000007feed1ddff8  000000028036d890 
  Name:        System.DateTime
  MethodTable: 000007feed1ddff8
  EEClass:     000007feecbed6b0
  Size:        24(0x18) bytes
  File:          C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.  dll
  Fields:
                MT    Field   Offset                 Type VT     Attr            Value Name
  000007feed1e1158  40000d6        0        System.UInt64  1 instance 5246421159766325152 dateData

How can interpret "5246421159766325152" as a DateTime? Is there a way I can create a DateTime from this value to get the human-readable version?

Excruciation

Answer 1

DateTime.FromBinary(5246421159766325152)

Demagogic

I do this so often I use a powershell one-liner to get a quick answer: [System.DateTime]::FromBinary(5246421159766325152) – Mozellamozelle

Note that the DateTime value is a UInt64 (ulong). DateTime.FromBinary takes an Int64 (long). This means that you can get a value that doesn't work directly with DateTime.FromBinary. I saw this value in one dump: 9859146799984130527 – Loblolly

Answer 2

!Psscor2.PrintDateTime OBJADDR or !sosex.mdt System.DateTime DATAADDR.

Wanitawanneeickel

Answer 3

If the Int64 value is in between DateTime.MinValue.Ticks and DateTime.MaxValue.Ticks, then you can call the overloaded constructor for a DateTime taking an Int64.

Your particular value falls outside of this range though. As @Boo mentioned, you can use the static DateTime.FromBinary method.

Isham

Answer 4

Here you can find a simple way to look at it WinDBG itself using a script, you can then run it as simple as:

0:000> $$>a<e:\Scripts\DumpDate.txt 0000003692816498 

http://blogs.msdn.com/b/carlosag/archive/2014/10/23/how-to-display-a-datetime-in-windbg-using-sos.aspx

Stopper

Answer 5

Rip out The UTC flags and print it in human readable format straight from windbg commandline (subtract 1600 years from result)

!filetime 0n5246421159766325152 & 0x3fffffffffffffff

5/25/3612 09:12:13.893 (unknown)

Delamination