Tech Support > Microsoft Windows > Drivers > time stamp in crash dump file
time stamp in crash dump file
Posted by Raj on February 5th, 2004


FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: sfb+1c27f

MODULE_NAME: myDriver

IMAGE_NAME: myDriver.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3fcfd534

STACK_COMMAND: kb

I want to know if there is any useful information like date deductible
from time stamp. I want to get the driver file compiled and build
date(file created date). Hope this is what this field is. I have no
clue to decipher this number. Changed into 1070585140. My driver was
possibly buit in Oct. Is this what most significant '10' tells me in
decimal number.

Thanks.

Posted by Pavel A. on February 5th, 2004



"Raj" <r_konjeti@mailcity.com> wrote in message news:8509fde8.0402051109.52589b03@posting.google.c om...

Yes, sure. The image timestamp is a 32 bit value, probably in FILETIME format.
It is written by linker into the driver file, so it can be used to identify the exact driver version.
It does not change when the driver file is copied, moved, installed etc.
I've made a small program that scans all my archive of drivers and finds one
by the timestamp value.

--PA




Similar Posts