Eggs Over Easy

Platform: bluehensctf | Category: Crypto | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-22 | Status: Solved Techniques: bytewise_ascii_decoding, unicode_nfkc_normalization, whitespace_to_bits

Summary

Task: a text file containing only spaces and tabs hides the flag through layered encoding. Solution: convert whitespace to bits, decode the bytes into hex code points, then apply Unicode NFKC normalization to recover the ASCII flag.

Eggs Over Easy — BlueHens CTF 2026

Description

If you know what goes well with eggs, this will be over easily...

We are given a text file with no visible content and need to recover the hidden flag.

Analysis

The file is made entirely of spaces and tabs, which suggests a binary encoding. Mapping space = 0 and tab = 1 produces a bitstring that can be read as 8-bit bytes.

Those bytes decode to the ASCII text:

 text read-only • copy allowed Copy
ff35 ff24 ff23 ff34 46 ff5b ff22 ff14 ff43 ff4f ff4e ff5d

Treating each hex word as a Unicode code point yields mostly fullwidth characters. Applying Unicode NFKC normalization converts them back into standard ASCII. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Read the file as raw text.
2. Replace spaces with 0 and tabs with 1.
3. Split the bitstring into bytes and convert each byte to a character.
4. Split the resulting string on spaces and interpret each token as a hex Unicode code point.
5. Normalize the Unicode string with NFKC to get the flag.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path
import unicodedata

data = Path("tasks/BlueHens CTF 2026/Eggs Over Easy/txt").read_text()
bits = data.replace(" ", "0").replace("\t", "1")
hex_words = "".join(chr(int(bits[i:i+8], 2)) for i in range(0, len(bits), 8))
text = "".join(chr(int(word, 16)) for word in hex_words.split())
flag = unicodedata.normalize("NFKC", text)
print(flag)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The script prints:

 text read-only • copy allowed Copy
UDCTF{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍