C# 将十六进制字符串转换为日期时间的困难

我试图将通过不同应用程序提供的一些十六进制字符串转换为正确的DateTime值，但是无论我怎么做，该值总是错误的。十六进制字符串来自多个系统的注册表项，在读取时由不同的应用程序转换为十六进制

以下是我尝试过的代码：

$shutdownkey = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Windows\' -Name ShutdownTime

$bitconverted = [DateTime]::FromFileTime([System.BitConverter]::ToInt64($shutdownkey.ShutdownTime, 0))

$hextime = "C11E6DF46024D101"

$test = [DateTime]::FromFileTime([Convert]::ToInt64($hextime, 16))

因此，当我使用自己的关机键时，前两行正常工作，但当我使用后两行或以下任何一行时：

C9520B970A69D101

0A44A6EA3300D101

C11E6DF46024D101

它要么失败，要么给我一个不可能的时间戳。但是，如果我使用类似的工具，它会成功地将其转换为解码格式“Windows:64位十六进制值-Little Endian”。从我在几个地方读到的内容来看，.NET使用小尾端，所以这不应该是编码的问题，但我怀疑是这样

---

有人能帮我解决这个转换问题吗？为什么我不能弄明白这一点，这让我很烦恼。

endianness是向后的。时代应该倒转。例如：

C9520B970A69D101 should be 01D1690A970B52C9 
[DateTime]::FromFileTime(0x01D1690A970B52C9) gives (Tuesday, February 16, 2016 4:37:17 PM)

---

endianness是向后的。时代应该倒转。例如：

C9520B970A69D101 should be 01D1690A970B52C9 
[DateTime]::FromFileTime(0x01D1690A970B52C9) gives (Tuesday, February 16, 2016 4:37:17 PM)

从 大卫·布拉班特评论

$regKey = Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows
$shutDown = $regKey.ShutdownTime
$Int64Value = [System.BitConverter]::ToInt64($shutDown, 0)
$date = [DateTime]::FromFileTime($Int64Value)

$date

还有我的分机

并非所有注册表项都直接转换为DateTime。有些数组是复合数组

压缩函数

function GetRegDate ($path, $key){
    function GVl ($ar){
        return [uint32]('0x'+(($ar|ForEach-Object ToString X2) -join ''))
    }
    $ar=Get-ItemPropertyValue $path $key
    [array]::reverse($ar)
    $time = New-Object DateTime (GVl $ar[14..15]),(GVl $ar[12..13]),(GVl $ar[8..9]),(GVl $ar[6..7]),(GVl $ar[4..5]),(GVl $ar[2..3]),(GVl $ar[0..1])
    return $time
}
$path='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{6CB1FEAE-02B2-4922-8D81-331219215E21}'
$key='DateLastConnected'
$DateLastConnected=GetRegDate $path $key
Get-Date $DateLastConnected -Format "ddd, dd.MM.yyyy HH:mm:ss,fff"

原函数

# http://cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html
$path='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{6CB1FEAE-02B2-4922-8D81-331219215E21}'
$key='DateLastConnected'
$dateArr=Get-ItemPropertyValue $path $key
[array]::reverse($dateArr)

$chank = '0x'+(($dateArr[0..1]|ForEach-Object ToString X2) -join '')
$mSeconds = [uint32]$chank

$chank = '0x'+(($dateArr[2..3]|ForEach-Object ToString X2) -join '')
$Seconds = [uint32]$chank

$chank = '0x'+(($dateArr[4..5]|ForEach-Object ToString X2) -join '')
$minutes = [uint32]$chank

$chank = '0x'+(($dateArr[6..7]|ForEach-Object ToString X2) -join '')
$hour = [uint32]$chank

$chank = '0x'+(($dateArr[8..9]|ForEach-Object ToString X2) -join '')
$date = [uint32]$chank

$chank = '0x'+(($dateArr[10..11]|ForEach-Object ToString X2) -join '')
$Weekday =[uint32]$chank
$WeekdayLong = (Get-UICulture).DateTimeFormat.GetDayName([uint32]$Weekday)

$chank = '0x'+(($dateArr[12..13]|ForEach-Object ToString X2) -join '')
$Month = [uint32]$chank
$LongMonth = (Get-UICulture).DateTimeFormat.GetMonthName([uint32]$Month)

$chank = '0x'+(($dateArr[14..15]|ForEach-Object ToString X2) -join '')
$Year = [uint32]$chank

$time = New-Object DateTime $Year, $Month, $date, $hour, $minutes, $Seconds, $mSeconds
Get-Date $time -Format "ddd, dd.MM.yyyy HH:mm:ss,fff"

从 大卫·布拉班特评论

$regKey = Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows
$shutDown = $regKey.ShutdownTime
$Int64Value = [System.BitConverter]::ToInt64($shutDown, 0)
$date = [DateTime]::FromFileTime($Int64Value)

$date

还有我的分机

并非所有注册表项都直接转换为DateTime。有些数组是复合数组

压缩函数

function GetRegDate ($path, $key){
    function GVl ($ar){
        return [uint32]('0x'+(($ar|ForEach-Object ToString X2) -join ''))
    }
    $ar=Get-ItemPropertyValue $path $key
    [array]::reverse($ar)
    $time = New-Object DateTime (GVl $ar[14..15]),(GVl $ar[12..13]),(GVl $ar[8..9]),(GVl $ar[6..7]),(GVl $ar[4..5]),(GVl $ar[2..3]),(GVl $ar[0..1])
    return $time
}
$path='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{6CB1FEAE-02B2-4922-8D81-331219215E21}'
$key='DateLastConnected'
$DateLastConnected=GetRegDate $path $key
Get-Date $DateLastConnected -Format "ddd, dd.MM.yyyy HH:mm:ss,fff"

原函数

# http://cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html
$path='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{6CB1FEAE-02B2-4922-8D81-331219215E21}'
$key='DateLastConnected'
$dateArr=Get-ItemPropertyValue $path $key
[array]::reverse($dateArr)

$chank = '0x'+(($dateArr[0..1]|ForEach-Object ToString X2) -join '')
$mSeconds = [uint32]$chank

$chank = '0x'+(($dateArr[2..3]|ForEach-Object ToString X2) -join '')
$Seconds = [uint32]$chank

$chank = '0x'+(($dateArr[4..5]|ForEach-Object ToString X2) -join '')
$minutes = [uint32]$chank

$chank = '0x'+(($dateArr[6..7]|ForEach-Object ToString X2) -join '')
$hour = [uint32]$chank

$chank = '0x'+(($dateArr[8..9]|ForEach-Object ToString X2) -join '')
$date = [uint32]$chank

$chank = '0x'+(($dateArr[10..11]|ForEach-Object ToString X2) -join '')
$Weekday =[uint32]$chank
$WeekdayLong = (Get-UICulture).DateTimeFormat.GetDayName([uint32]$Weekday)

$chank = '0x'+(($dateArr[12..13]|ForEach-Object ToString X2) -join '')
$Month = [uint32]$chank
$LongMonth = (Get-UICulture).DateTimeFormat.GetMonthName([uint32]$Month)

$chank = '0x'+(($dateArr[14..15]|ForEach-Object ToString X2) -join '')
$Year = [uint32]$chank

$time = New-Object DateTime $Year, $Month, $date, $hour, $minutes, $Seconds, $mSeconds
Get-Date $time -Format "ddd, dd.MM.yyyy HH:mm:ss,fff"

---

在powershell中如何翻转这个十六进制数？是否存在从/到编码的转换？通常，附加问题应作为新问题发布。也就是说，您可以使用[System.BitConverter]类将

Uint64

转换为字节数组，反转数组（

[array]：：reverse

），然后将反转后的数组转换回

Uint64

。这正是我要查找的信息。安东尼的回答和我的回答是一样的，谢谢你们！在powershell中如何翻转这个十六进制数？是否存在从/到编码的转换？通常，附加问题应作为新问题发布。也就是说，您可以使用[System.BitConverter]类将

Uint64

转换为字节数组，反转数组（

[array]：：reverse

），然后将反转后的数组转换回

Uint64

。这正是我要查找的信息。安东尼的回答和我的回答是一样的，谢谢你们！