RegTimeDecoder.vbs

'Registry time decoder by Alex Dragokas ver.2.3

const QT = """"

Dim UnixTime, UTCTime, bRestart, sKeyArg

Set oFSO   = CreateObject("Scripting.FileSystemObject")
Set oShell = CreateObject("WScript.Shell")

cHost64 = oShell.ExpandEnvironmentStrings("%SystemRoot%") & "\sysnative\cscript.exe" 'çàùèòà îò çàïóñêà èç-ïîä Wow64
cHost32 = oShell.ExpandEnvironmentStrings("%SystemRoot%") & "\system32\cscript.exe"

' Çàïóùåí ëè èç êîíñîëè
vbHost = oFSO.GetBaseName(Wscript.FullName)
if strcomp(vbHost, "cscript", 1) <> 0 then
	On Error resume next
    oShell.Run QT & cHost64 & QT & " //nologo " & QT & WScript.ScriptFullName & QT, 1, false
	if err.number <> 0 then
	    oShell.Run QT & cHost32 & QT & " //nologo " & QT & WScript.ScriptFullName & QT, 1, false		
	end if
    WScript.Quit
end if

'sKey = inputBox("Ââåäèòå ïóòü ê ïàðàìåòðó ðååñòðà â ôîðìàòå Óëåé\Êëþ÷\Ïàðàìåòð, ëèáî ââåäèòå ñûðîå 16-ðè÷íîå çíà÷åíèå")

WScript.Echo ("--------------------------------------------")
WScript.Echo ("   Registry time decoder by Alex Dragokas   ")
WScript.Echo ("--------------------------------------------" & vbcrlf)

WScript.Echo("Ââåäèòå ïóòü ê ïàðàìåòðó ðååñòðà â ôîðìàòå Óëåé\Êëþ÷\Ïàðàìåòð," & vbcrlf & "íàáîð áàéò ñ çàïÿòîé èëè áåç, ëèáî 16-ðè÷íîå çíà÷åíèå ñ ïðåôèêñîì 0x")
WScript.Echo("Äëÿ çàâåðøåíèÿ ñêðèïòà íàæìèòå Ctrl + C.")
WScript.Echo("")
WScript.Echo("Ïðèìåðû:")
WScript.Echo("")
WScript.Echo("1. Unix-Time (4 byte)")
WScript.Echo("58b69de3 - [Hex]")
WScript.Echo("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate - [Reg]")
WScript.Echo("")
WScript.Echo("2. FILETIME (8 byte)")
WScript.Echo("0x01c694c5a38c8000 - [Hex]")
WScript.Echo("00,80,8c,a3,c5,94,c6,01 - [Binary Hex]")
WScript.Echo("")
WScript.Echo("3. SYSTEMTIME (16 bytes)")
WScript.Echo("e0,07,04,00,03,00,14,00,06,00,2b,00,3a,00,33,01 - [Binary Hex]")

if WScript.Arguments.Count <> 0 then sKeyArg = UnQuote(WScript.Arguments(0))

bRestart = true

do while bRestart
	Call Main
loop

Sub Main()

	do

	  b16byte = false
	  b8byte = false
	  b4byte = false
	  bRegBased = false
	  bHexValue = false
	  bRestart = false
	  bHasComma = false

	  if sKeyArg <> "" then ' åñëè ïðåîáðàçîâàíèå çàïðîøåíî ÷åðåç àðãóìåíò çàïóñêà ñêðèïòà
		sKey = sKeyArg
		sKeyArg = ""
		WScript.Echo vbcrlf & ">>> " & sKey
	  else
		WScript.StdOut.Write vbcrlf & ">>> "
		sKey = WScript.StdIn.ReadLine()
	  end if

	  sKey = NormalizeRegPath(Trim(sKey))

	  WScript.Echo("")

	  if instr(sKey, "\") = 0 then 'value based
		if instr(1, sKey, ",") then bHasComma = true
		sKey = replace(sKey, ",", "")
		sKey = replace(sKey, " ", "")

		if StrComp(Left(sKey,2),"0x",1) = 0 then 'just 16h number (not a byte data)
			bHexValue = true
			sKey = mid(sKey, 3)
		end if

		if Len(sKey) = 0 then 
			WScript.Echo ("Ââåä¸í ïóñòîé èëè íåêîððåêòíûé ïàðàìåòð!")
			bRestart = true
			exit do
		end if

		if Len(sKey) > 32 or not IsHex(sKey) then
			WScript.Echo ("Íåâåðíûé ôîðìàò âõîäÿùèõ äàííûõ! Òðåáóåòñÿ HEX-çíà÷åíèå â âèäå ÷èñëà èëè áèíàðíîé ñòðîêè.")
		elseif len(sKey) > 8 and len(sKey) <= 16 then '8 bytes values (FILETIME)
			b8byte = true
			if bHexValue then
				UTCTime = sKey
			else
				UTCTime = ReverseBytesLine(sKey)
			end if
		elseif len(sKey) <= 8 then '4 bytes value (Unix-time)
			b4byte = true
			UnixTime =  CLng("&H" & sKey)
		else '16 byte values (SYSTEMTIME)
			b16byte = true
			redim Bytes(15)
			For i = 1 to 31 step 2
				if Len(sKey) >= i then
					Bytes((i+1)\2-1) = CLng("&H" & mid(sKey,i,2))
				end if
			Next
		end if
	  else 'registry based
		bRegBased = true
		set oShell = CreateObject("WScript.Shell")
		On Error resume next
		Bytes = oShell.RegRead(sKey)
		If Err.Number <> 0 then
			if Not IsElevated() then
				if msgbox ("Óêàçàííîãî ïàðàìåòðà íåò, íåâåðíûé ôîðìàò ïàðàìåòðà, ëèáî íóæíî çàïóñòèòü ýòîò ñêðèïò îò èìåíè àäìèíèñòðàòîðà!" & vbcrlf & "Çàïóñòèòü îò èìåíè àäìèíà ñåé÷àñ?", vbYesNo or vbExclamation, "Îøèáêà") = vbYes then
					Set oShellApp = CreateObject("Shell.Application")
					oShellApp.ShellExecute cHost32, "//nologo " & QT & WScript.ScriptFullName & QT & " " & QT & sKey & QT, "", "runas", 1
					WScript.Quit
				end if
			else
				WScript.Echo "Óêàçàííûé ïàðàìåòð îòñóòñòâóåò â ðååñòðå èëè íå óäàëîñü ïîëó÷èòü äîñòóï!"
				bRestart = true
				exit do
			end if
		end if
		On Error Goto 0
		if isArray(Bytes) then
			if UBound(Bytes) = 7 then '8-byte value
				b8byte = true
				UTCTime = ""
				for i = 7 to 0 step -1
					UTCTime = UTCTime & right("0" & Hex(Bytes(i)),2)
				next
			elseif UBound(Bytes) = 15 then '16-byte value
				b16byte = true
			else
				WScript.Echo("Íåïîääåðæèâàåìûé òèï ïàðàìåòðà.")
			end if
		else
			if isNumeric(Bytes) then '4-byte value
				b4byte = true
				UnixTime = Bytes
			else
				WScript.Echo("Íåïîääåðæèâàåìûé òèï ïàðàìåòðà.")
			end if
		end if
	  end if

	  if b4byte then call Decode4byte(UnixTime)
	  if b8byte then 
		call Decode8byte(UTCTime)
	    if (not bHexValue) and (not bHasComma) then
			' try also hexed value
			sKeyArg = "0x" & sKey
			bRestart = true
			exit do
		end if
	  end if
	  if b16byte then call Decode16byte(Bytes)

	loop
	
End Sub

'Unix-Time
sub Decode4byte(UnixTime)
	if bRegBased then
		WScript.Echo "REG = " & UnixTime & vbcrlf
	end if
	WScript.Echo (DateAdd("s", UnixTime, #1/1/1970#))
end sub

function IsHexNumber(str)
	if strcomp(left(str, 2), "0x", 1) = 0 then
		IsHexNumber = true
	else
		dim i, codeA, codeF, code
		codeA = asc("A")
		codeF = asc("F")
		for i = 1 to len(str)
			code = asc(ucase(mid(str, i, 1)))
			if code >= codeA and code <= codeF then
				IsHexNumber = true
				exit for
			end if
		next
	end if
end function

'FILETIME
sub Decode8byte(UTCTime)
    'typedef struct _FILETIME {
    '  DWORD dwLowDateTime;
    '  DWORD dwHighDateTime;
    '} FILETIME, *PFILETIME;

    '100 ns. after #1/1/1601#

	if bRegBased then
		WScript.Echo "REG = " & UTCTime & vbcrlf
	else
		WScript.Echo "==> " & UTCTime & vbcrlf
	end if

	Set dateTime = CreateObject("WbemScripting.SWbemDateTime")
	On Error Resume Next
	dateTime.SetFileTime HexToDec(UTCTime), false
	If Err.Number <> 0 then
		WScript.Echo ("Ñëèøêîì áîëüøîå ÷èñëî! Âîçìîæíî, Âû óêàçàëè 16-ðè÷íîå ÷èñëî âìåñòî áàéòîâ." & vbcrlf & "Ïðîáóþ â îáðàòíîì ïîðÿäêå ...")
		UTCTime = ReverseBytesLine(UTCTime)
		WScript.Echo ("==> " & UTCTime)
		Err.Clear
		dateTime.SetFileTime HexToDec(UTCTime), false
		If Err.Number <> 0 then
			WScript.Echo ("Íåóäà÷à!")
			if not IsHexNumber(UTCTime) then
				Err.Clear
				WScript.Echo ("Ïðîâåðÿþ ÷èñëî êàê 10-ðè÷íîå:")
				UnixTime = Clng(UTCTime)
				WScript.Echo ("==> " & Cstr(UnixTime))
				WScript.Echo ""
				Decode4byte
				If Err.Number <> 0 then
					WScript.Echo ("Íåóäà÷à!")
				end if
			end if
		else
			WScript.Echo (vbcrlf & dateTime.GetVarDate)
		end if
	else
		WScript.Echo (dateTime.GetVarDate)
	end if
end sub

'SYSTEMTIME
sub Decode16byte(Bytes)
	'typedef struct _SYSTEMTIME {
	'  WORD wYear;
	'  WORD wMonth;
	'  WORD wDayOfWeek;
	'  WORD wDay;
	'  WORD wHour;
	'  WORD wMinute;
	'  WORD wSecond;
	'  WORD wMilliseconds;
	'} SYSTEMTIME, *PSYSTEMTIME;

	if bRegBased then 'Print reg. info
		strReg = ""
		for i = 0 to Ubound(Bytes)
			strReg = strReg & right("0" & Hex(Bytes(i)),2) & ","
		next
		WScript.Echo "REG = " & left(strReg, len(strReg)-1) & vbcrlf
	end if

	if Ubound(Bytes) >= 1 then wYear = Byte2Word(Bytes(0), Bytes(1))
	if Ubound(Bytes) >= 3 then wMonth = Byte2Word(Bytes(2), Bytes(3))
	if Ubound(Bytes) >= 7 then wDay = Byte2Word(Bytes(6), Bytes(7))
	if Ubound(Bytes) >= 9 then wHour = Byte2Word(Bytes(8), Bytes(9))
	if Ubound(Bytes) >= 11 then wMinute = Byte2Word(Bytes(10), Bytes(11))
	if Ubound(Bytes) >= 13 then wSecond = Byte2Word(Bytes(12), Bytes(13))
	if Ubound(Bytes) >= 15 then wMilliseconds = Byte2Word(Bytes(14), Bytes(15))

	WScript.Echo ( Right("0" & wDay, 2) & "." & _
			   Right("0" & wMonth, 2) & "." & _
			   Right("000" & wYear, 4) & " " & _
			   Right("0" & wHour, 2) & ":" & _
			   Right("0" & wMinute, 2) & ":" & _
			   Right("0" & wSecond, 2))
end sub

function Byte2Word(LoByte, HiByte)
	Byte2Word = HiByte * 256 + LoByte
end function

function IsHex(num)
  tmp = num
  for i = 1 to 16
    tmp = replace(tmp, mid("0123456789ABCDEF",i,1), "", 1, -1, 1)
  next
  if len(tmp) = 0 and len(num) > 0 then IsHex = true
end function

Function HexToDec(strHex)
    size = Len(strHex) - 1
    ret = CDbl(0)
    For i = 0 To size
        ret = ret + CDbl("&H" & Mid(strHex, size - i + 1, 1)) * (CDbl(16) ^ CDbl(i))
    Next
	ret = CStr(ret)
	ret = replace(ret,",","")
	ret = replace(ret,".","")
	pos = instr(1,ret,"e+",1)
	e = mid(ret,pos+2)
	ret = left(ret, pos -1)
	ret = ret & string(e - len(ret) +1, "0")
    HexToDec = ret
End Function

function UnQuote(byval str)
	if left(str,1) = QT then str = mid(str, 2)
	if right(str,1) = QT then str = left(str, len(str)-1)
	UnQuote = str
end function

function ReverseBytesLine(byval sLine) '00808ca3c594c601 => 01c694c5a38c8000
	strRet = ""
	if len(sLine) mod 2 = 1 then sLine = "0" & sLine
	for i = len(sLine) - 1 to 1 step -2
		strRet = strRet & mid(sLine, i, 2)
	next
	ReverseBytesLine = strRet
end function

function NormalizeRegPath(path)
	if StrComp(Left(path, 2), "HK", 1) = 0 then
		NormalizeRegPath = path
	else
		Dim pos
		pos = instr(1, path, "HK", 1)
		if pos <> 0 then 
			NormalizeRegPath = Mid(path, pos)
		else
			NormalizeRegPath = path
		end if
	end if
end function

Function IsElevated()
    On Error Resume Next
    CreateObject("WScript.Shell").RegRead("HKEY_USERS\S-1-5-19\")
    if Err.Number = 0 Then 
        IsElevated = True
    else
        IsElevated = False
    end if
End Function

'Examples:
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate (Unix-Time)
'Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate (Unix-Time)
'HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class \...\ => DriverDateData (FILETIME)
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles \...\ => DateCreated (SYSTEMTIME)

'58b69de3
'00,80,8c,a3,c5,94,c6,01
'e0,07,04,00,03,00,14,00,06,00,2b,00,3a,00,33,01