Trying to decode Date time encoding - examples listed

Question

I have a problem that's been getting the better of me for months now. I have an application that I'm trying to make additions to. In order to do so I need to decode the file structure and be able to emulate it. I have decoded everything except the date/time field.

I believe that the hex 11 at the beginning denotes that the following is a date/time entry and so is not part of the date time. Further, the following 8 bytes are the date time and the date/time they each produce is given. What I don't know is how the conversion is done.

I believe the source code that produced the file was written in Delphi if that helps.

Below are 7 examples:

HEX Value                     Date Time Produced
--------------------------    ------------------
11 a2 97 78 0a dd 3e e4 40    07/07/2013 09:46:50 PM
11 5c 6c 32 0b dd 3e e4 40    07/07/2013 09:46:58 PM
11 67 b1 76 e0 dd 3e e4 40    07/07/2013 10:24:27 PM
11 38 a7 e1 55 bc 42 e4 40    08/07/2013 09:15:05 PM
11 d9 4e e4 58 bc 42 e4 40    08/07/2013 09:15:37 PM
11 d2 2a f9 13 49 89 dc 40    01/01/1980 03:24:15 AM
11 d4 fb 78 63 c5 42 e4 40    08/08/2013 04:02:29 AM
11 e5 01 c9 62 c5 42 e4 40    08/08/2013 04:02:21 AM

Answer 1

Effectively these strings looks like the Hex representation for the Delphi TDatetime type which is an alias for the Double type (8 bytes), Where the integral part of the TDateTime value is the number of days that have passed since 12/30/1899 and the fractional part of the TDateTime value is fraction of a 24 hour day that has elapsed.

in Delphi you can parse such values using the HexToBin function like so

{$APPTYPE CONSOLE}

uses
  System.Classes,
  System.SysUtils;

function Decode(const HexStr: AnsiString) : TDateTime;
begin
   Assert(Length(HexStr)=16, 'Lenght must be 16');
   HexToBin(PAnsiChar(HexStr), @Result, SizeOf(TDateTime));
end;


begin
  try
     Writeln(DateTimeToStr(Decode('a297780add3ee440')));
     Writeln(DateTimeToStr(Decode('5c6c320bdd3ee440')));
     Writeln(DateTimeToStr(Decode('67b176e0dd3ee440')));
     Writeln(DateTimeToStr(Decode('38a7e155bc42e440')));
     Writeln(DateTimeToStr(Decode('d94ee458bc42e440')));
     Writeln(DateTimeToStr(Decode('d22af9134989dc40')));
     Writeln(DateTimeToStr(Decode('d4fb7863c542e440')));
     Writeln(DateTimeToStr(Decode('e501c962c542e440')));
  except
    on E: Exception do
      Writeln(E.ClassName, ': ', E.Message);
  end;
  ReadLn;
end.

This will return

07-07-2013 21:46:50
07-07-2013 21:46:58
07-07-2013 22:24:27
07-08-2013 21:15:05
07-08-2013 21:15:37
01-01-1980 3:24:15
08-08-2013 4:02:29
08-08-2013 4:02:21