{"id":16203,"date":"2009-10-30T07:00:00","date_gmt":"2009-10-30T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2009\/10\/30\/what-is-the-format-for-firstinstalldatetime-on-windows-95\/"},"modified":"2021-10-06T06:39:46","modified_gmt":"2021-10-06T13:39:46","slug":"20091030-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20091030-00\/?p=16203","title":{"rendered":"What is the format for FirstInstallDateTime on Windows 95?"},"content":{"rendered":"

Public Service Announcement: Daylight Saving Time ends in most parts of the United States this weekend.<\/p>\n

Windows\u00a098\/98\/Me recorded the date and time at which Setup was run in the registry under HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion<\/code> as a binary value named FirstInstallDateTime<\/code>. What is the format of this data?<\/p>\n

Take the binary value and treat it as a 32-bit little-endian value. The format of the value is basically DOS date\/time format<\/a>, except that the seconds are always 0 or 1 (usually 1), due to a programming error.<\/p>\n

Exercise: What error would result in the seconds always being 0 or 1 (usually 1)?<\/p>\n

Update<\/b>: MrZebra guessed that the code did a logical OR instead of a bitwise OR:<\/p>\n

wSeconds = actualSeconds || 0;\r\n<\/pre>\n
But it’s not clear why anybody would be writing actualSeconds | 0<\/code> in the first place.<\/p>\n
Felix Kasza observed that the “seconds” field is the number of 2-second intervals, and guessed that somebody used the wrong arithmetic operator:<\/p>\n
wSeconds = actualSeconds % 2; \/\/ should be \"actualSeconds \/ 2\"\r\n<\/pre>\n
That would explain why the value is always 0 or 1, but not why 1 predominates. The above mistake would result in the values 0 and 1 being used about evenly.<\/p>\n
Falcon guessed that somebody wrote<\/p>\n
wSeconds = actualSeconds && 0x3F; \/\/ should be \"actualSeconds & 0x3F\"\r\n<\/pre>\n
While this matches the “0 or 1, usually 1” results, it’s not clear why somebody would be taking the actual seconds and logical-AND’ing it with 0x3F<\/code> in the first place. The actual seconds is already in the range 0 to 59. There’s no need to mask out the high bits; they are already zero.<\/p>\n
Falcon tried again, and got the correct answer this time:<\/p>\n
wSeconds = actualSeconds > 1; \/\/ should be \"actualSeconds >> 1\"\r\n<\/pre>\n
The code wanted to divide the number of seconds by 2 by using the right-shift operator, but forgetting to double the greater-than sign resulted in it being an arithmetic comparison, and the number of seconds is greater than one 96% of the time.<\/p>\n","protected":false},"excerpt":{"rendered":"
It tries to be DOS date\/time format but misses.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2,108],"class_list":["post-16203","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history","tag-time"],"acf":[],"blog_post_summary":"
It tries to be DOS date\/time format but misses.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/16203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=16203"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/16203\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=16203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=16203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=16203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}