mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
5ba5942d0b
The catalog held 2 of 607 entries in entra-join, while the 0x801Cxxxx DSREG family is what an enrollment meets during hybrid join and the ESP account-setup phase. The Windows Hello PIN error page is the only MS table that documents it; both of its tables are now parsed, restricted to 0x801c* (607 -> 641 entries). The block runs after PROSE_ENTRIES so the Autopilot-specific text for 0x801c03ea keeps precedence over the generic one. The Mitigation column is not carried -- the catalog describes codes, it does not advise. A "SYMBOL: text" cell yields a symbol (0x801c004d -> DSREG_NO_DEFAULT_ACCOUNT). The run fails below 30 keys, because parseTables drops non-matching rows silently and a reshaped page would otherwise look like a clean run. decode() now strips zero-width and bidi marks: the page carries U+200B in one hex cell and four description cells, JS \s does not match it, and such a hex cell fails every ^0x...$ test. Placed in decode() rather than in the new source so the next parsed page cannot walk into it -- regeneration shows 34 added, 0 changed. 0x801C044F, the zero-hit lookup that started this, is on none of the three MS pages and deliberately stays unknown.