Question

I am pretty stumped on a few hex values that become these values. I’ve been playing around with the values for a bit and I can’t figure it out. Perhaps someone here can give me a clue as to how these values show up as hex or vise versa. When I got these values they were in reverse order hex. I ordered them from left to right to make things simpler (I am 99% sure these values should be reverse order since other values I got were reverse order).

• 6C C4 F0 00 should become 1/1/2000 in Date/Time format.
• 6C C4 F0 38 should also be 1/1/2000 but I am not sure how this is the case.
• FF FF FE 38 should be -2.
• 00 FF FF FF should be 0.
• FF 00 00 00 should be -1.

If anyone can help me out with this, I would humbly appreciate it! Thank you!

The raw data:

00F0C46C38F0C46C38FEFFFFFFFDFFFF

The raw data is in reverse order hex in sets of 4 bytes.

• 00F0C46C, should be a date/time format of 1/1/2000
• 38F0C46C, should be a date/time format of 1/1/2000
• 38FEFFFF, should be -2
• FFFDFFFF, should be -3

I know the structure is correct because the program is working and creating a table correctly, there are just some values in each column that are handled differently.

Thank you!

Answer 1

You have your byte order wrong. The first byte seems to be dead space or otherwise occupied, and I’m betting you left FF off the end of what you showed us.

Split into words:

00  F0C46C38 F0C46C38 FEFFFFFF FDFFFF

Now, reverse the byte order on the first two words and you get:

0x386CC4F0 = 946652400

Which is

$ date -ur 946652400
Fri Dec 31 15:00:00 UTC 1999

So midnight 1/1/2000 in the UTC+9 time zone. Too close to be a coincidence, I’m guessing you or wherever you got that data from is in that time zone.

Now, the next two words in proper byte order:

FFFFFFFE
FFFFFFFD

Guess what? Two’s complement representation of -2 and -3.