How to decode some number into timeDate?

问题

This question is sequel of this one.

So any idea how to decode this number 5252235562500 into date and time 19.11.2010 15:43 ? I have more pairs like this and I'm thinking about some script for comparing them to find some patern. Any advice what to check and how to search for patterns ?

EDIT: I added four pairs that I curentlly have.

11.11.2010 16:23 > 5252425372575
16.11.2010 15:30 > 5252922462564
19.11.2010 15:39 > 5252231562511
19.11.2010 15:43 > 5252235562500

回答1:

I think I found the solution. Instead of simply presenting the decoding algorithm I'd like to show you the reasoning.

The answer to the linked question showed that was a barcode in EAN-13 format.

It means the codes have 12 digits and 1 check digit:

11.11.2010 16:23 > 525242537257 5
16.11.2010 15:30 > 525292246256 4
19.11.2010 15:39 > 525223156251 1
19.11.2010 15:43 > 525223556250 0

The check digit can be calculated by

adding the values of the digits in the even-numbered positions: 2, 4, 6 ... (2+2+2+3+2+7=18)
multiplying this result by 3 (18*3=54)
adding the values of the digits in the odd-numbered positions: 1, 3, 5... (5+5+4+5+7+5=31)
summing the two results (54+31=85)
calculating modulo 10 and subtracting it from 10 (5-10=5)

I calculated the check digit for every code, it matched and confirmed the codes were in EAN-13 format.

According to the specification, the first two or three digits of the code could be country codes, so I tried to separate these:

11.11.2010 16:23 > 52 5242537257 5 | 525 242537257 5
16.11.2010 15:30 > 52 5292246256 4 | 525 292246256 4
19.11.2010 15:39 > 52 5223156251 1 | 525 223156251 1
19.11.2010 15:43 > 52 5223556250 0 | 525 223556250 0

The resulting numbers didn't make any sense, because the earlier time had a greater number:
5292246256 or 292246256
than the later time:
5223156251 or 223156251

At this point I suspected the time wasn't stored in binary format. I reorganized the digits and tried to find repeating patterns.
I ended up with this layout:

11.11.2010 16:23 > 52 52 42 53 72 57 5
16.11.2010 15:30 > 52 52 92 24 62 56 4
19.11.2010 15:39 > 52 52 23 15 62 51 1
19.11.2010 15:43 > 52 52 23 55 62 50 0

This is where things got interesting...

Take a look at the 3rd and 4th row, these are the same except the 4th and 6th column.
The 4th column has 15 and 55. Translate it backwards and you get 51 and 55.
The difference of the two is 55 - 51 = 4 just like the difference of minutes 43 - 39 = 4
Subtract the minutes from code values:
55 - 43 = 12
51 - 39 = 12

It seems the 4th column encodes minutes by adding 12 and storing the digits backwards.

Now try to apply this to the 5th column:

11.11.2010 16:23 > 72 > 27
16.11.2010 15:30 > 62 > 26
19.11.2010 15:39 > 62 > 26
19.11.2010 15:43 > 62 > 26

26 - 15 = 11 and 27 - 16 = 11 so the difference for the 5th column is 11.

From then it's easy, the differences for the columns are 15, 14, 13, 12 & 11.
A few quick calculations and you get the encoding scheme:

Digits Meaning Diff.
 2-1    year    15
 4-3    month   14
 6-5    day     13
 8-7    minute  12
10-9    hour    11

Here's a simple code snippet for decoding:

union TimeFormat
{
    unsigned short codearray[5];
    struct
    {
        unsigned short year;
        unsigned short month;
        unsigned short day;
        unsigned short minute;
        unsigned short hour;
    };
};

void DecodeBarcode(char *code, TimeFormat *time)
{
    char buf[3]; // for atoi()
    buf[2] = 0;  // of course it has to be null-terminated

    for (int i = 0, diff = 15; i < 5; ++i, --diff)
    {
        buf[0] = code[i * 2 + 1];
        buf[1] = code[i * 2];
        time->codearray[i] = atoi(buf) - diff;
    }
    time->year += 2000;
}

回答2:

When you're trying to decode a foreign time format, you need two known times. Take the difference between them and see what it equates to - second, milliseconds, days, there aren't too many possibilities. Now that you have the basic time unit, you can work with one of the times and see what the origin time is.

I just had to do this last week. I had two dates:

2009-07-15 15:29:12  1247689752
2009-07-17 08:27:55  1247837275

There are lots of ways to get the difference between two dates. The easiest is probably Excel, which will display the difference in days; in this case 1.70744213. The difference between the two representations is 147523. Multiplying the number of days by the number of seconds in a day (24*60*60) also resulted in 147523, so now I know that the date is the number of seconds elapsed from some starting date.

To get the starting date, I subtract a date from itself. Again this is trivial in Excel: divide the date number by the number of seconds in a day, then subtract. In my case it comes up 1969-12-31 19:00. This seems a little odd, but I realize that my time zone is 5 hours off of UTC in the summer. This tells me that the time value is in UTC, and represents the number of seconds since 1970-01-01.

回答3:

Script like this what you are thinking not make any sense, because you can by hand for example brake this in time X, then probably you will be write program for this in time 25*X and this program will be working based on checking patterns what you are define then this not make sense when you don't have thousands of algorithms this type to brake but vary in some little part.

Give some more pairs then i can tell you more, one pair is to less to know anything.

来源：https://stackoverflow.com/questions/4261684/how-to-decode-some-number-into-timedate

标签

reverse-engineering

decode

decoding