diag

func ExtractRegister ¶

func ExtractRegister(regs, name string) string

ExtractRegister pulls a register value out of QEMU's "info registers" text.

name must include the trailing '=' (e.g. "PC=", "X30="). Matching is anchored to a token boundary so "PC=" cannot be found inside "FPCR=" — a looser match would silently return another register's value, and the caller feeds the result to a disassembly address where a wrong-but-plausible number is worse than nothing.

Returns "" when the register is absent.

func GuestLogPaths ¶

func GuestLogPaths() []string

GuestLogPaths is everything worth pulling off a stopped VM's disk.

Panther explains a failed install; DISM and CBS explain a failed *servicing* operation, which is a different failure with a different log. The OpenSSH capability failure of 2026-07-31 (0x80070002, capability left Staged) was invisible in Panther and had to be dug out of dism.log by hand — the DISM entry recorded the attempt with LimitAccess:0, proving Windows Update was permitted and had still failed.

func PantherLogPaths ¶

func PantherLogPaths() []string

PantherLogPaths lists the Setup logs worth recovering from a disk image, in both locations Setup uses.

$Windows.~BT/Sources/Panther is written during windowsPE, before the OS exists; Windows/Panther is written once the image is applied. A failed run may have reached either, so both are attempted and missing ones are skipped.

func ParseLargestPartitionOffset ¶

func ParseLargestPartitionOffset(mmlsOutput string) (int64, bool)

ParseLargestPartitionOffset picks the Windows volume out of mmls output by taking the largest partition, and returns its start sector.

Selecting by size rather than by name: the description text varies with how the disk was partitioned ("Basic data partition", "NTFS / exFAT", …), while the Windows volume is always dramatically the largest — the ESP is 256MB and the MSR 128MB against a 100GB target.