The point is I am trying to extract this CTime what was compressed with CArchive into QDateTime using QDataStream. I know that it is not the same, but which is why I am trying to read the raw data out. I have no control over no using CTime CArchive, so ill have to roll with that. I am looking to see how the CTime is being written when using write of CArchive. I am looking for some similar explanations to this https://stackoverflow.com/a/8933769/21282829 .
I am using this as a reference " https://learn.microsoft.com/en-us/cpp/mfc/tn002-persistent-object-data-format?view=msvc-170" and can see that 0x8000 means it is using wOldClassTag.
I did reverse engineer and the time I need is 5d960a1b (although not quite, but maybe could be because of the time zone stuff)
0x0a 0x00 0x00 0x80 0x1b 0x0a 0x96 0x5d
My question is where can I find a description on how CArchive compress the CTime data. I know that 3rd and 4th is 0x00 0x80 is the wOldClassTag, 0x96 0x5d probably date, and 0x1b 0x0a being time. What about the next 4 bytes 0x0a 0x00? does it mean anything?
I tried reading through this Microsoft TN002: Persistent Object Data Format, but it doesnt go to over any detail on how CTime is being serialized. Thank you in advance!
Don't you have any information about how the archive was originally stored? Normally you will have to apply the read (>>) operators in the same order.
The relevant source-code files are arccore.cpp, timecore.cpp and afx.inl.
In your case my take is that the archive contains 12 bytes for the object, and this because MFC does some tricks in order to accommodate both 32- and 64-bit times. Check the code of CArchive& AFXAPI operator <<. Looks like the first four bytes are that INT_MIN + 10 prefix, which means that a __time64_t (8 bytes) value follows.