Determining Build Date the hard way

blog
21

Ok, i is not the time, it’s 128.
Not sure of the relevance of 128 though.

22

Hello Kim,

The Exe file format dates back to the early 80s (before Windows) to an operating system called DOS. That OS did not anticipate Windows or even later versions of DOS with long file names. subsequent versions had to be compatible with programs written for the earlier DOS version. For this reason the exe file format has evolved and includes sections that are fixed and only make sense for a 16 bit DOS application.
The first offset (60 or 3Ch) is an offset to an offset to the Windows file header.
This web URL will explain the file format in general terms http://support.microsoft.com/kb/65122

Kevin

23

Hello Kim,

The Exe file format dates back to the early 80s (before Windows) to an operating system called DOS. That OS did not anticipate Windows or even later versions of DOS with long file names. subsequent versions had to be compatible with programs written for the earlier DOS version. For this reason the exe file format has evolved and includes sections that are fixed and only make sense for a 16 bit DOS application.
The first offset (60 or 3Ch) is an offset to an offset to the Windows file header.
This web URL will explain the file format in general terms http://support.microsoft.com/kb/65122

Kevin

24

Thanks Jeff,
It’s hard to believe in this day and age that this is the best way to do things in .Net but it seems to still be the valid option.

25

Thanks for this code. It helped me a lot!!! Regards, me

26

A caveat not mentioned in this topic is that the JIT compiler will change the timestamp in the PE Header. Only use this approach for assemblies you don’t control the compilation of, or for assemblies that you want the JITTED date/time for. For those you control the compilation of or do not desire the JITTED date/time for, embed the date in a resource inside the assembly. See the following stack-overflow link for details:

27

This needs to be updated. It gives random results now when building on Windows 10 with C# 7.3 and targeting .NET 4.5.2. I’m not sure what changed, but this solution is no longer working.

1 Like
28

May be because of Deterministic builds in roslyn?

Also, found a bit better way - read IMAGE_DOS_HEADER and use e_lfanew (File address of new exe header) to compute real exe header offset, than read TimeStamp: ReadingPortableExecutable_PE_header.cs

2 Likes