[Guy Harris <gharris@xxxxxxxxx>]

ronnie sahlberg wrote:

> i am not sure that the nt 64 bit time functions can handle
> FT_RELATIVE_TIME at all yet and that is likely the problem you see.

Yes, that's probably the problem.

We don't currently support an FT_ value that corresponds to a time that 
could be absolute or relative, so there's currently no way to implement 
that in dissect_nt_64bit_time() - we'd either need to implement a new 
FT_ type for times that could be absolute or relative, and have 
dissect_nt_t4bit_time() take hf_ values that refer to fields of that 
type, or we'd need to have dissect_nt_64bit_time() take *two* hf_ values 
as arguments, one referring to an FT_ABSOLUTE_TIME value and one 
referring to an FT_RELATIVE_TIME value, and use the absolute one for 
absolute times and the relative one for regular times.

I.e., the problem isn't a simple bug for which the fix is to replace 
incorrect code by correct code, it's a design limitation.