A tiny self-hosted repo claims GreatXML can turn a prior Defender offline scan state into a WinRE shell with access to a BitLocker volume. The evidence is only a README scrape listing an unattend.xml file and a Recovery directory, so the useful read is the trust boundary around recovery partitions, not a validated exploit report.