diff options
| -rwxr-xr-x | util/brescue.sh | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/util/brescue.sh b/util/brescue.sh index 16bf9cfbec..87fcac91d9 100755 --- a/util/brescue.sh +++ b/util/brescue.sh @@ -64,8 +64,11 @@ rw_offset() { local base src="$1" + # The second grep term filters out the 'fake' cryptolib header, which does + # not contain a valid signature, the signature field is filled with SSSSS + # (0x53...). base=$(/usr/bin/od -Ax -t x1 -v "${src}" | - grep -E '^....00 fd ff ff ff' | + grep -E '^....00 fd ff ff ff' | grep -v '00 fd ff ff ff 53 53 53' | head -2 | tail -1 | sed 's/ .*//') |