这两天在编写一个读取系统事件日志的程序，其中结构变量EVENTLOGRECORD中成员TimeGenerated和TimeWritten的值为：
The time at which this entry was submitted. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.
即从格林尼治时间1970年1月1日夜里12：00开始的秒数。
Windows系统好像没有直接提供将其转换为对应的年月日、时分秒的API函数。
Google了一下，在
http://www.asmcommunity.net/board/index.php?topic=18369.0找到了donkey网友提供的方法，整理如下：
BaseTimeLow equ 0D53E8000h BaseTimeHigh equ 19DB1DEh StampToLocalDateTime proc dwStamp: dword, lpstLocalTime: dword local stUtcFileTime: FILETIME local stLocalFileTime: FILETIME mov eax, dwStamp mov edx,10000000 mul edx add eax, BaseTimeLow adc edx, BaseTimeHigh mov stUtcFileTime.dwLowDateTime, eax mov stUtcFileTime.dwHighDateTime, edx invoke FileTimeToLocalFileTime, addr stUtcFileTime, addr stLocalFileTime invoke FileTimeToSystemTime, addr stLocalFileTime, lpstLocalTime ret StampToLocalDateTime endp LOCALE_SYSTEM_DEFAULT equ 0 g_szFmtDate db "yyyy-M-d", 0 printDate proc lpstDate: dword local buf[12]: byte invoke GetDateFormat, LOCALE_SYSTEM_DEFAULT, NULL, lpstDate, offset g_szFmtDate, addr buf, sizeof buf m_InsTxt addr buf ret printDate endp ;LOCALE_SYSTEM_DEFAULT equ 0 g_szFmtTime db "H:m:ss", 0 printTime proc lpstTime: dword local buf[9]: byte invoke GetTimeFormat, LOCALE_SYSTEM_DEFAULT, NULL, lpstTime, offset g_szFmtTime, addr buf, sizeof buf m_InsTxt addr buf ret printTime endp g_szFmtDateTime db "%d-%d-%d %d:%d:%d", 0 printDateTime proc lpstDateTime: DWORD local buf[30]: byte pusha mov edi, lpstDateTime movzx eax, (SYSTEMTIME ptr [edi]).wYear movzx ebx, (SYSTEMTIME ptr [edi]).wMonth movzx ecx, (SYSTEMTIME ptr [edi]).wDay movzx edx, (SYSTEMTIME ptr [edi]).wHour movzx esi, (SYSTEMTIME ptr [edi]).wMinute movzx edi, (SYSTEMTIME ptr [edi]).wSecond invoke wsprintf, addr buf, addr g_szFmtDateTime, eax, ebx, ecx,edx, esi, edi popa ret printDateTime endp
