Gerhard Gappmeier wrote:
is there a simple way to handle windows FILETIME?
Use the routine dissect_nt_64bit_time(), declared in
<epan/dissectors/packet-windows-common.h>
What is FT_ABSOLUTE_TIME and FT_RELATIVE_TIME for?
FT_ABSOLUTE_TIME is for time values that represent a date and time, such
as a FILETIME; FT_RELATIVE_TIME is for time values that represent an
amount of time since some unspecified point (e.g., "5 minutes from now").
Declare an FT_ABSOLUTE_TIME field and pass its hf_ value as the last
argument to dissect_nt_64bit_time().
