My Eyes Burn

Category: Forensics
Points: 284

Walkthrough: Windows .KLC Dead Keys CTF Challenge

  1. Locate the Trigger Key
    In the LAYOUT section, find the key assigned with an @ symbol, which indicates a dead key trigger:
    129    OEM_3    0    0060@    007e    -1
    Pressing OEM_3 (the backtick ` key) triggers Dead Key State 0060.
  2. Understand the DEADKEY Section Structure
    Each DEADKEY block defines a state transition.
    • Left column: Hexadecimal ASCII/Unicode code of the required key press.
    • Right column: The next dead key state, indicated by the trailing @.
    For example:
    1DEADKEY 0060 → 0073 (Hex for 's') → transitions to state 02d0@
  3. Trace the Chained Dead Key Sequence
    Convert each input hexadecimal value to its corresponding ASCII character and follow the state transitions one by one:
    1State 0060 + 0073 (s) → 02d0@
    2
    3State 02d0 + 0075 (u) → 02ed@
    4
    5State 02ed + 006e (n) → 02b4@
    6
    7State 02b4 + 007b ({) → 02ef@
    8
    9State 02ef + 0070 (p) → 02ba@
    10
    11State 02ba + 0072 (r) → 02c9@
    12
    13State 02c9 + 0061 (a) → 02d3@
    14
    15State 02d3 + 0069 (i) → 02e9@
    16
    17State 02e9 + 0073 (s) → 02bd@
    18
    19State 02bd + 0065 (e) → 02cd@
    20
    21State 02cd + 0074 (t) → 02e4@
    22
    23State 02e4 + 0068 (h) → 02d8@
    24
    25State 02d8 + 0065 (e) → 02ee@
    26
    27State 02ee + 0073 (s) → 02d4@
    28
    29State 02d4 + 0075 (u) → 02e1@
    30
    31State 02e1 + 006e (n) → 02b0@
    32
    33State 02b0 + 007d (}) → 2600
    The final state outputs ☀, indicating the end of the sequence.
  4. Extract the Flag
    Combining all the input characters in order gives:
    1sun{praisethesun}

Flag

1sun{praisethesun}

Reference

The kbdlayout.info online viewer supports .KLC files and can be used to inspect Windows keyboard layouts and their dead-key mappings.