So we're given a PCAP file containing USB keypresses. Sounds simple enough. After having figured out which USB host is the keyboard it's a simple matter of sorting out that 'traffic' and extracting the "Leftover Capture Data" containing the actual keystrokes. Some grep and text omission gives us these keys: `09 0c 17 30 0c 87 1a 08 2a 21 11 17 87 21 87 0e 08 2a 20 1c 05 12 21 15 07 32 16`
Mapping the keys from [http://www.usb.org/developers/hidpage/Hut1_12v2.pdf](http://www.usb.org/developers/hidpage/Hut1_12v2.pdf) p. 53-60 gives us something that looks like a key: `FIT}IxWEx4NTx4xKEx3YBO4RDxS`
Now we know the key should begin with FIT{ and end with }, so something's up here. Oh wait, it's a japanese CTF! Let's take [http://hp.vector.co.jp/authors/VA003720/lpproj/others/kbdjpn.htm](http://hp.vector.co.jp/authors/VA003720/lpproj/others/kbdjpn.htm) into account and mark 2A as backspace, 87 as japanese keyboard's underscore and correct 30 and 32 for japanese keyboard's { and }.
Our final mapping has these additions:
`0x30:"{", # Japanese 30 = {`
`0x32:"}", # Japanese 32 = }`
`0x87:"_", # Japanese 87 = Underscore _ or Pipe | or Backslash \`
`0x2A:"<backspace>", # DELETE (Backspace)`
Running our python script again, we get `FIT{I_WE<backspace>4NT_4_KE<backspace>3YBO4RD}S` Submitting `FIT{I_W4NT_4_K3YBO4RD}` tells us incorrect flag. Hrm! Going back to the leftover capture data, only a few of the characters have the shift key pressed, besides special characters only I, leaving us with `FIT{I_w4nt_4_k3ybo4rd}` - which submits as correct flag!