In order to get an actual date and time from the 4 byte TimeDateStamp field of the Coff Header, you need to do a small calculation. As you can see below the calculation is not that hard in .Net (thanks to the TimeZone class). The 4 byte unsigned int in the header field is the amount of seconds since midnight January 1, 1970 GMT, so you just need to add that uint as seconds to 1/1/1970 0:0:0 and take into account your local time zone.
5 namespace Debris
6 {
7 class Program
8 {
9 static void Main(string[] args)
10 {
11 uint timestamp = 0x43C05AAB; // Coff Header TimeDateStamp value
12 Console.WriteLine(ConvertTimeDateStamp(timestamp).ToString("G"));
13 }
14
15 /// <summary>
16 /// Convert an unsigned int to a date by adding seconds to Jan 1, 1970 0:0:0
17 /// </summary>
18 /// <param name="timeDateStamp">Number of seconds to add to start date</param>
19 /// <returns>DateTime timeDateStamp seconds after the start date</returns>
20 static DateTime ConvertTimeDateStamp(uint timeDateStamp)
21 {
22 const string STARTDATE = "1/1/1970 0:0:0";
23 TimeZone timeZone = TimeZone.CurrentTimeZone;
24
25 return timeZone.ToLocalTime(DateTime.Parse(STARTDATE).AddSeconds((double)timeDateStamp));
26 }
27 }
28 }