ExeInfo plugin: how to see the timestamp for an EXE/DLL?

dantesoft · Post by *dantesoft » 2016-05-31, 15:08 UTC

I'm using François GANNIER's exeinfo content plugin and fileinfo Lister extension.

Is there any way to see the compilation timestamp for an EXE/DLL?

For example by loading it from the IMAGE_DEBUG_TYPE_CODEVIEW section.

Dalai · Post by *Dalai » 2016-05-31, 15:17 UTC

Well, if you're already using FileInfo, you can find the requested info on the "Image File Header" tab, section "FILE HEADER". To be able to view the info in custom columns, you can use the exeformat (or rather exeformat_64) plugin, using the field IMAGE_FILE_HEADER > TimeDateStamp.

Regards
Dalai

dantesoft · Post by *dantesoft » 2016-06-01, 05:06 UTC

Dalai wrote:Well, if you're already using FileInfo, you can find the requested info on the "Image File Header" tab, section "FILE HEADER".

Thanks, I hadn’t looked carefully there because I expected all timestamps to appear on the first tab.

Dalai wrote:To be able to view the info in custom columns, you can use the exeformat (or rather exeformat_64) plugin, using the field IMAGE_FILE_HEADER > TimeDateStamp.

Many thanks, this worked! (I’d tried the older version linked from the official list.)

Specifically I've now added:

Code: Select all

built [=exeformat.IMAGE_FILE_HEADER.TimeDateStamp]