From f34d894f6e53a033678fe2f9faba0c85e7cb0728 Mon Sep 17 00:00:00 2001 From: Mounir IDRASSI Date: Tue, 10 Jun 2014 18:08:11 +0200 Subject: Detect correctly VeraCrypt rescue disk by looking for the little-endian encoding of "Vera" instead of "True". --- src/Boot/Windows/BootMain.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/Boot/Windows/BootMain.cpp') diff --git a/src/Boot/Windows/BootMain.cpp b/src/Boot/Windows/BootMain.cpp index f1df2e93..6df82bda 100644 --- a/src/Boot/Windows/BootMain.cpp +++ b/src/Boot/Windows/BootMain.cpp @@ -1081,7 +1081,7 @@ void main () // Check whether the user is not using the Rescue Disk to create a hidden system if (ReadWriteMBR (false, BootDrive, true) == BiosResultSuccess - && *(uint32 *) (SectorBuffer + 6) == 0x65757254 + && *(uint32 *) (SectorBuffer + 6) == 0x61726556 && *(uint32 *) (SectorBuffer + 10) == 0x70797243 && (SectorBuffer[TC_BOOT_SECTOR_CONFIG_OFFSET] & TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE) != TC_HIDDEN_OS_CREATION_PHASE_NONE) { -- cgit v1.2.3