Windows Installation - Where I can change the modification date

[© KEiGHT]

So, which file should be modified in my build, I don't get the idea what are you talking about to be modified !?

I want to modify the date 11/21/2010 with present day time

:please:

Edited June 17, 2014 by bphlpt

[bphlpt]

I haven't done it, but look here, then read the rest of the thread to see how to calculate exactly what to put there.

 

Cheers and Regards

[© KEiGHT]

what file? I don't understand for what should I look in Install.wim or boot.wim ?

where to find these lines ?

<CREATIONTIME>

<HIGHPART>0x01CB88D1</HIGHPART>

<LOWPART>0xDB7CCA61</LOWPART>

</CREATIONTIME>

This site gives me this values for the present day

Epoch timestamp: 1402988167 (DWORD=0x539fe687)

Timestamp in milliseconds: 1402988167000(QWORD=0x146a89c7f58)

Human time (your time zone): 17.06.2014, 09:56:07

Human time (GMT): Tue, 17 Jun 2014 06:56:07 GMT

so , this is the right value for the present day 0x539FF9A8 , according to that site ,what should I do now ???

<CREATIONTIME>

<HIGHPART>?????????</HIGHPART>

<LOWPART>??????????</LOWPART>

</CREATIONTIME>

(what should i put here ???)

lol, I found it but how should I modify it with hex-editor?

INDEX = 1 or INDEX = 2 ?

Epoch timestamp: 1402995814

Timestamp in milliseconds: 1402995814000

Human time (your time zone): 17.06.2014, 12:03:34

Human time (GMT): Tue, 17 Jun 2014 09:03:34 GMT

how to convert for high and low part this one ? :doh:

you mean Date/Time to Integer8?

(remove .txt from attached file)

Usage (from CMD)

cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM"

result:

Integer8 value: 130468194000000000 (decimal output)

-> use calc.exe (programmer mode) to convert to hex (QWORD)

-> 1CF842195DB5400

highpart:01CF8421

lowpart:95DB5400

validation: w32tm /ntte 0x1CF842195DB5400

151004 20:30:00.0000000 - 6/9/2014 10:30:00 PM

Please, ca you explain , how this script works ?

I can't figure it how to modify inside of him !

my results are:

C:\Windows\System32>w32tm /ntte 0x31d84f678af

16238 13:15:41.0000000 - 17.06.1645 16:15:41 <<< lol

beside this line : Wscript.Echo "cscript DateToInteger8.vbs ""6/17/2014 4:20:58 PM"""

what should I do next ?

Thank you !

Edited June 17, 2014 by bphlpt

[bphlpt]

1 ) Take the DateToIntegr8.vbs script above, (just delete the .txt part of the name) and save it wherever you want, say C:\time.
2 ) Then open a command prompt in that directory.
3 ) Enter the following command: cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM", where the date and time are that of your local time zone
4 ) Use calc.exe (programmer mode) to convert to hex (QWORD) - Enter the output from DateToInteger8, which will be a decimal value, in the calculator in decimal mode, then switch modes to hex to see the hex value you need.
5 ) @KEiGHT, in his local time zone got: 1CF842195DB5400
6 ) You can validate that the value you have is correct by entering in the command prompt: w32tm /ntte 0x1CF842195DB5400
7 ) @KEiGHT, in his local time zone got: 151004 20:30:00.0000000 - 6/9/2014 10:30:00 PM
8 ) Zero pad the value from the calculator to get 16 digits: 01CF842195DB5400
9 ) The leftmost 8 digits will be the highpart (01CF8421) and the rightmost 8 digits will be the lowpart (95DB5400).

I'm not sure if the date displayed in the OS version selection window is that of your local time zone or GMT, so you might have to adjust the values you enter above slightly, but since the output from w32tm includes GMT you should be able to figure out what you need to change.

 

So you found the .xml file where you need to enter this revised value?  Where is it?

 

Cheers and Regards

[© KEiGHT]

I've opened boot.wim with hex-editor ,, those lines are at the bottom/ pres key END !

 

I know to do all the rest of the stuff, All I need is that command, isn't work what ever command I make ! I don't know why !?

 

are you sure cuz that command is correct from cmd?

 

Enter the following command: cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM",

 

this is the correct command !

 

C:\Windows\System32>C:\Temp\DateToInteger8.vbs "06/17/2014 17:10:00"

 

 

C:\Windows\System32>C:\Temp\DateToInteger8.vbs "06/17/2014 17:10:00"

C:\Windows\System32>w32tm /ntte 0x1cf8a35d34d6c00

151012 14:10:00.0000000 - 17.06.2014 17:10:00

 

Thanks :dancing:

[abbodi1406]

Open install.wim file with hex editior
 
then search for hex value:

3C 00 43 00 52 00 45 00 41 00 54 00 49 00 4F 00 4E 00

if you got the first result before at the end of file, then skip to next result because this first result will be for winre.wim file

now you replace the text values manually replacing each character

or better, prepare the new value by adding dot (.) after each character so you can easily paste it instead of the current value

0.1.C.F.8.4.2.1.9.5.D.B.5.4.0.0.

repeat the operation for each index (each search result)

[bphlpt]

are you sure cuz that command is correct from cmd?

 

Enter the following command: cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM",

 

this is the correct command !

 

C:\Windows\System32>C:\Temp\DateToInteger8.vbs "06/17/2014 17:10:00"

 

It all depends on WHERE you are when you open the command prompt:   (or what the value of your %PATH% is set to.)

 

2 ) Then open a command prompt in that directory.

3 ) Enter the following command: cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM", where the date and time are that of your local time zone

ie, C:\Temp>cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM"

 

But your suggestion of including the full path to the script is more foolproof.  Thanks.

 

I'm glad you got it working.

 

EDIT:  I think this might be a useful option for Liam to include in Win Toolkit, assuming there are no problems caused by it.  Automating the process would be a lot easier for the average user. 

Cheers and Regards

[© KEiGHT]

Open install.wim file with hex editior

 

then search for hex value:

3C 00 43 00 52 00 45 00 41 00 54 00 49 00 4F 00 4E 00

if you got the first result before at the end of file, then skip to next result because this first result will be for winre.wim file

now you replace the text values manually replacing each character

or better, prepare the new value by adding dot (.) after each character so you can easily paste it instead of the current value

0.1.C.F.8.4.2.1.9.5.D.B.5.4.0.0.

repeat the operation for each index (each search result)

install.wim ? I found those in boot.wim ! how is that ? install.wim has nothing to do with that

 

After I change it manually I need to save it somehow or ?

I've change it but nothing is changed, the same date is shown !

Edited June 17, 2014 by © KEiGHT

[© KEiGHT]

Finally , I made it work ! yupyyyy ! :dancing:

 

Thank you abbodi1406 and bphlpt :owned:

 

 

Edited June 18, 2014 by © KEiGHT

[nonspin]

You could skip all the tasks converting times. Simply copy whatever is inside <LASTMODIFICATIONTIME> and replace it with whatever is inside <CREATIONTIME>

 

for example:

copy the part in red to notedpad

 

<LASTMODIFICATIONTIME>

<HIGHPART>0x01CF83B1</HIGHPART><LOWPART>0xE5F87098</LOWPART>

</LASTMODIFICATIONTIME>

 

paste it to:

<CREATIONTIME>

<HIGHPART>0x01CF83B1</HIGHPART><LOWPART>0xE5F87098</LOWPART>

</CREATIONTIME>

 

This would also reflect the REAL time it was modified and not the value you have generated

Edited June 17, 2014 by nonspin

[bphlpt]

Congratulations © KEiGHT!  But there still seems to be some figuring out needed, since the original format of the date is MM/DD/YYYY, from looking at the images from abbodi1406, and the format you ended up with in the image above is DD.MM.YYYY, unless that is the format you always see and it is dependent on some local date setting of your machine?  Just curious and trying to get it perfect.
 
Cheers and Regards

[© KEiGHT]

it's install.wim NOT boot. wim as someone suggested around here !

 

Regarding your question, is my settings from local area (Romania) with dots, not slashes as you can see in post #55 !

All you need TO DO is modify <CREATIONTIME>...<CREATIONTIME> and I hope Liam will make a special tab in WinToolkit for this change

 

when you are on fresh install, will look like that (click SHOW);

 

 

 

 

Look when you install a fresh copy on it's original state language ENGLISH (US)

 

 

 

Cheers and best regards ! :welcome6ld:

Edited June 18, 2014 by © KEiGHT

[nonspin]

Congratulations © KEiGHT!  But there still seems to be some figuring out needed, since the original format of the date is MM/DD/YYYY, from looking at the images from abbodi1406, and the format you ended up with in the image above is DD.MM.YYYY, unless that is the format you always see and it is dependent on some local date setting of your machine?  Just curious and trying to get it perfect.

 

Cheers and Regards

 

The original format is <Highpart> & <Lowpart>

From there - w32time - will convert it to whatever Location/Region is set.

Each Location/Region has a defaul Format according to the Language.

 

for example:

 

Location: UK

Default Format: English (United Kingdom)

Short Date: dd/MM/yyyy

 

Location: JP

Default Format: Japanese (Japan)

Short Date: yyyy/MM/dd

[Viktor Pavlov Valkov]

I want to share with you what i found here:

 

http://www.betaarchive.com/forum/viewtopic.php?f=62&t=32298

 

Converter for the date and time:

 

http://lab.windowswiki.info/whtc/

Edited April 17, 2015 by Viktor Pavlov Valkov

[kirk]

Just mount to folder and capture folder save as new wim

[boston]

On 21.06.2015 at 02:30, kirk said:

Sadece klasöre bağlanın ve klasör yakalayın yeni wim olarak kaydedin

a little more explanatory.