Hi, I am writing some tools in Perl that extract and report information about Microsoft Windows binary files (.exe and .dll). The Microsoft Windows compiler embeds the date and time that the given .exe or .dll was compiled. This can be a super useful piece of information to have -- given two instances of an .exe binary or a .dll binary you can check to see if the two instances of the same file have the same compile date and time. If the two instances have the same date and time they are probably the same file, if the times/dates differ, then the given source has been re-compiled and the two instances differ in that the source has been recompiled.

So my goal here is to extract the compile date/time from the Microsoft Windows binary (.exe)/(.dll) that the Microsoft Windows compiler embeds in the binary data and I want to do that in Perl. I have tried Win32::File::VersionInfo and I have tried Win32::Exe . Win32::Exe does not work for a .dll because it attempts to load too much system information and thus takes just entirely too long. Win32::File::VersionInfo gets a lot of version information but it does not get the date/time the .dll or .exe was compiled. Here is a hash of information retrieved from Win32::File::VersionInfo . 

x $version_info

0  HASH(0x1bc307c)
   'Date' => 0000000000000000
   'FileVersion' => '6.0.2900.2578'
   'Flags' => HASH(0x1be5560)
      'Debug' => 0
      'InfoInferred' => 0
      'Patched' => 0
      'Prerelease' => 0
      'PrivateBuild' => 0
      'SpecialBuild' => 0
   'Lang' => HASH(0x1bc3070)
      'English (United States)' => HASH(0x1be5578)
         'CompanyName' => 'Microsoft Corporation'
         'FileDescription' => 'Windows Shell Common Dll'
         'FileVersion' => '6.00.2900.2578 (xpsp.041130-1728)'
         'InternalName' => 'SHELL32'
         'LegalCopyright' => '⌐ Microsoft Corporation. All right
+s reserved.'
         'OriginalFilename' => 'SHELL32.DLL'
         'ProductName' => 'Microsoft« Windows« Operating System'
         'ProductVersion' => '6.00.2900.2578'
   'OS' => 'NT/Win32'
   'ProductVersion' => '6.0.2900.2578'
   'Raw' => HASH(0x1bcac54)
      'Date' => 0000000000000000
      'FileVersion' => '000600000B540A12'
      'FlagMask' => '0000003F'
      'Flags' => 00000000
      'OS' => 00040004
      'ProductVersion' => '000600000B540A12'
      'SubType' => 00000000
      'Type' => 00000002
   'Type' => 'DLL'

[download]

I have also tried Win32API::File::Time . This method has a function named GetFileTime . However, the GetFileTime just gets the date/time the file was created within my file system, it does not extract this embeded date/time that the file was compiled.

Does any one know how I can get the embedded date/time that a file was compiled out of a Microsoft Windows .exe or .dll file in Perl? If anyone even knows how this value is encoded/embedded in the .exe or .dll and could describe the algorithm for traversing the binary data and extracting this value, then I would be able to implement this algorithm in Perl myself.

The problem I have been having is that I haven't found any Perl modules where some one has done this already (written a method for getting the embedded compile date/time out of a Microsoft Windows .exe or a Microsoft Windows .dll and I haven't found a description of how this value is embedded so I haven't been able to just write my own algorithm for extracting this information.

Any information would be usful.

Thanks, Sincerely,

Peter Jirak

jira0004@yahoo.com

In reply to Getting compile time out of Windows binary (exe and dll) files by jira0004

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.