tmp. The malformed keyboard layout file contains a byte that will result in the overly large index into the function table. NtUserLoadKeyboardLayoutEx is called to load the malformed keyboard layout file successfully invoking the exploit. The original keyboard layout is restored and then the malformed keyboard layout file is deleted.