Truxton parse time

Parses a string containing a date time value. When Truxton exploits data, it encounters timestamps in a wide variety of formats. This is the function that is used to parse all of those different ways we have seen time represented in data.

Syntax

int64_t truxton_parse_time( char const * time_string );

Parameters

time_string

The string representation of a date time.

Return value

A non-zero value containing FILETIME ticks on success, zero on failure.

Sample

These are just a few of the different formats of time it can parse.

void test_time_parser( void )
{
   int64_t ticks = truxton_parse_time( "2021-07-29 21:52:53 UTC" );

   if ( ticks != 132720691730000000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "20160220T164500" );

   if ( ticks != 131004603000000000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "2017:8:31:10:43:32:65516" );

   if ( ticks != 131486498120000000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "[T01CFC6371F583890]" );

   if ( ticks != 130540854268410000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "FILETIME=[EED06480:01C54DD3]" );

   if ( ticks != 127593737090000000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "Nov 27, 2018, 6:33:41 PM EST" );

   if ( ticks != 131878172210000000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "4/30/05 22:28:29,001" );

   if ( ticks != 127593737090010000 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }

   ticks = truxton_parse_time( "20210426125724.47063Z" );

   if ( ticks != 132639154444706300 )
   {
      printf( "truxton_parse_time() FAILED!\n" );
   }
}