Step 292. CTF Debrief Blocks A + B: 40 Write-ups Accumulated — Writing That Gets Read Is Proof of Skill

Level 3 — The CTF Competition Cycle | Difficulty ★★☆☆☆ | Estimated time: 2 days (half a day of debriefing + 1.5 days of write-up authoring and rewriting)

Prerequisites: Step 291 (live-fire library validation) complete, 30–35 write-ups already accumulated, Python 3 (for the management script).

• What you need: the debrief records of competitions #6–#7, your existing write-up folder (or blog), Python 3. The write-up management script runs in this chapter are measured (2026-09-09, Python 3.12).
• ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.
• This is a writing-quality chapter — while keeping accumulation management going, we now raise quality toward "write-ups that get read."

Past 30 write-ups, something changes. "Writing" has become routine, and the next question is "does it get read?" Writing with readers grows the writer more — the process of converting sentences into ones a stranger can understand exposes the holes in your understanding, and readers’ questions bring perspectives you never thought of.

Today is a two-track job. With block A, tidy the unsolved problems of competitions #6–#7 to fill the count to 40, and pick one representative piece to rewrite into the four-part structure. Grabbing the quantity goal and the quality goal in the same two days.

---

1. Learning Objectives

By the end of this chapter, you will be able to:

• Dig three unsolved problems from competitions #6–#7 to the bottom with the block A routine and close them as write-ups
• Auto-check accumulated count, structural completeness, and the index with a write-up management script
• Rewrite a piece into the four-part structure: "Background → Approach → Implementation → Generalization"
• Run a loop that collects community feedback and reflects it into improvements
• Select a TOP 5 of your own pieces to recommend to teammates, with rationale

---

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. Why "Gets Read" — The Stagnation of Writing Without Feedback

A write-up’s first reader is future you. But past 30 accumulated, a second reader appears — the stranger who arrives via search, your teammates, and someday a recruiter looking at your blog.

Writing without readers stagnates. A sentence like "I understood it, so that’s enough" passes with no readers, but a stranger stops cold at that sentence. Where a reader stops is exactly where your understanding is shallow. So from today, write-ups aim not at "recording" but at "conveying" — and the quality of conveying is measured only by feedback.

2-2. The Four-Part Structure — The Skeleton of a Readable Write-up

The source’s rewriting structure. A format one level above a plain solution listing.

The difference from existing pieces is parts 2 and 4. A solution-listing piece has only "Implementation." Approach must include discarded hypotheses and stuck points, and Generalization is one reusable judgment line born from solving this problem. Without these two, the reader gains only the fact "this person solved it"; with them, they gain the feeling "I could solve it too."

2-3. Fixing the Template — How to Cut Writing Time

The source’s point — if writing time feels burdensome, fix the template. Same structure means faster writing.

The skeleton is five lines — the title # (problem name) — (platform, field, points) followed by four headers ## Background → ## Approach → ## Implementation → ## Generalization. Save these five lines as template.md, and a new piece starts by copying this file.

A new write-up starts from copying this skeleton. Not deliberating "what order should I write in today" — that deliberation is writing’s entry barrier. Fix the structure and creativity moves into the sentences.

2-4. Automating Accumulation Management — Don’t Count 40 by Hand

As the piece count grows, management itself becomes work. Count by hand how many there are and which pieces lack structure, and someday you miss one. So today we manage with a script — one that scans the folder, counts the accumulation, flags four-part-structure omissions, and builds the index. We actually build and run it in 3-2.

---

3. Follow Along

3-1. Block A — Digging the Unsolved Problems of Competitions #6–#7 to the Bottom

First, the fundamentals of debriefing. Pick three problems you couldn’t solve across the two competitions. The selection criterion is "the most regrettable" — problems you reached the entrance of but couldn’t break through have the highest learning efficiency.

Block A record form:
Problem: (name/competition/field)
Where we stopped: (one sentence)
The answer's decisive move: (one sentence, after checking a public write-up)
Reproduction: □ complete (re-solved by hand and confirmed the flag — reading alone doesn't count)
Write-up: □ written in the four-part structure

Reproduction matters. Reading the answer and going "ah, I see" is a different kind of study from re-solving it yourself and confirming the flag. Block A’s completion condition is always reproduction.

3-2. The Management Script — Accumulation Count and Structure Gaps in One Pass

Save the script below as step292_mgr.py. It scans your write-up folder and handles the accumulated count, four-part-structure completeness, and the index file in one pass.

# Write-up accumulation manager — count, four-part structure check, index generation
import sys
from pathlib import Path

REQUIRED = ["Background", "Approach", "Implementation", "Generalization"]
BASE = 34  # accumulated count before this competition — replace with your actual count

def scan(folder):
    rows = []
    for f in sorted(folder.glob("*.md")):
        if f.name == "INDEX.md":
            continue
        text = f.read_text(encoding="utf-8")
        missing = [s for s in REQUIRED if f"## {s}" not in text]
        rows.append((f.name, len(text), missing))
    return rows

# ... (main: table output + INDEX.md generation — same as the verification in section 5)

Run it with your write-up folder path as the argument. Here we made six samples (four complete, two with missing structure) and ran it.

Measured (2026-09-09 — python step292_mgr.py writeups):

Existing: 34 / New this time: 6 / Accumulated: 40

file                              bytes  four-part structure
----------------------------------------------------
crypto_rsa_small_e.md            155  complete
forensic_pcap_flag.md             52  missing: Background, Approach, Generalization
pwn_bof_ret2win.md               149  complete
rev_crackme_xor.md                49  missing: Background, Approach, Generalization
web_jwt_none.md                  146  complete
web_ssti_board.md                148  complete
----------------------------------------------------
Four-part structure complete: 4/6
Index generated: ...writeupsINDEX.md
⚠ There are pieces with missing structure — reinforce them with the section-5 rewriting structure

How to read it: reaching 40 accumulated is confirmed in numbers, and simultaneously two pieces with missing structure are named. Both are old-format pieces with only "Implementation" — exactly today’s rewriting targets. The goal achieved (quantity) and the improvement targets (quality) appear on one screen — this is why management gets automated.

3-3. Rewriting — Rewrite One Representative Piece into the Four-Part Structure

Pick one of the missing-structure pieces the script flagged and rewrite it. Don’t try to fix them all — today’s goal is fixing one deeply and leaving the feel in your hands.

Rewriting procedure:
1. Put the original beside you, copy the four-part skeleton into a new file
2. Port the 'Implementation' part almost as-is from the original — it's an existing asset
3. Write 'Approach' fresh — dig through your memos and chat logs of the time
   to restore 2 discarded hypotheses and 1 stuck point (this is the body)
4. 'Background' is 3 sentences on "what I didn't know when I first saw this problem"
5. 'Generalization' is one sentence — "next time I see X, I check Y first"

Step 3 is hard — memories of stuck points vanish fast. That’s why, from the next competition on, you need the habit of jotting one line per discarded hypothesis while solving. The pain of rewriting creates the next recording habit.

3-4. The Feedback Loop — Publish and Collect Comments

Put the rewritten piece outside. Post it on your blog or share it in a CTF community Discord’s write-up channel.

Feedback collection form:
| comment | kind | action |
|--------|------|------|
| "In part 2 I can't tell why you discarded that hypothesis" | comprehension barrier | add 1 sentence on the discard rationale to part 2 |
| "There's also method Y for this type" | new knowledge | add a link in the Generalization part |
| typos, broken links | surface | fix immediately |

Why: classifying comments by kind is the point. When a "comprehension barrier" kind arrives, that spot is where a reader stopped — exactly the shallow point of your understanding from 2-1. Fix surface issues right away; fix comprehension barriers by studying again. Zero feedback? That’s data too — it may mean the title and first paragraph failed to hook search readers.

3-5. Selecting the TOP 5 — The Team’s Shared Textbook

Last, pick five of your 40 write-ups to recommend to teammates. The criterion is not "well-written pieces" but "pieces that patch teammates’ weak spots."

TOP 5 selection table (template):
| rank | piece | recommend to | reason |
|------|-----|-----------|------|
| 1 | crypto_rsa_small_e | the pwn person | the thinking method for crypto entrance problems reuses as-is |
| 2 | web_ssti_board | everyone | the standard for the SSTI detect→confirm procedure |
| ... | | | |

Share this table in the team channel and your write-up folder changes from a personal record into the team’s textbook. In the next step (293)’s role rotation, when a teammate takes a non-main field, this list is their first textbook.

---

4. Missions & Exercises

Mission — 40 Accumulated + 1 Rewritten Piece

1. Tidy three unsolved problems from competitions #6–#7 with the block A routine (reproduction included).
2. Write the new write-ups in the four-part structure template, reaching 40 accumulated.
3. Run the management script against your folder and extract the structure-gap list.
4. Rewrite one of the gap pieces by the 3-3 procedure — restoring 2 discarded hypotheses is mandatory.
5. Publish the rewritten piece and fill the feedback collection form (if zero, record that fact).
6. Make the TOP 5 selection table and share it with the team.

Exercises

Exercise 1. We said "where a reader stops is exactly where your understanding is shallow." Why does making a stranger read your writing become self-verification?

Exercise 2. What two things must the "Approach" part of the four-part structure contain, and what illusion does a piece without them give the reader?

Exercise 3. Explain, from the "entry barrier" standpoint, why fixing the write-up template speeds up writing.

Exercise 4. Why did we set the TOP 5 criterion as "pieces that patch teammates’ weak spots" rather than "well-written pieces"?

---

Answers & completion criteria · expand/collapse

5. Model Answers & Completion Criteria

Mission Model Answer

Verify against these criteria.

1. Evidence of reproduction: do all three block A problems have "re-solved by hand and confirmed the flag" — closing with only reading the answer doesn’t count.
2. Accuracy of the accumulated count: is 40 confirmed by script output (or manual tally) — "roughly 40ish" is not a record.
3. Depth of the rewrite: are 2 discarded hypotheses and 1 stuck point restored in the Approach part? Is part 2 actually thicker compared to the original?
4. The feedback loop: was the collection form filled within a week of publishing — if zero, was "check the title/first paragraph" recorded as the next action?
5. TOP 5 rationale: does each piece have a recommend-to and a reason — it must not be a "best written" selection.

Exercise Answers

Answer 1. Because you write already knowing the answer, so you can’t discover your writing’s leaps yourself. A stranger stops honestly at those leaps — where background knowledge is missing, where a hypothesis’s discard rationale went unwritten, where a command’s reason is absent. Where a reader stops usually coincides with where the author "pretended to understand" and moved on. So feedback is not a service but a free comprehension exam.

Answer 2. Discarded hypotheses (with their discard rationale) and the stuck points. A piece without them gives the illusion "the author knew the answer from the start" — the reader learns nothing about how to judge when they get stuck, and falls into the same traps while reproducing. A success-path-only piece is a report of results; a piece with discard rationales is a transfer of judgment.

Answer 3. Because writing’s biggest time cost is not sentences but the structural decision of "what order do I write in?" With the template fixed, that decision becomes 0 seconds, and each section of the skeleton turns into a list of questions asking only "what do I fill here?" Empty slots create the urge to fill them, lowering the entry barrier. It’s an allocation that trades structural creativity for time spent on sentence quality.

Answer 4. Because the TOP 5’s use is not a personal portfolio but the team’s shared textbook. A best-written list becomes the author’s bragging, but a weak-spot-patching list becomes teammates’ growth paths. Especially in situations like role rotation (Step 293) where you take a non-main field, an "intro to my field" text is desperately needed — and a teammate’s write-up is the closest such textbook.

Completion Criteria Checklist

• [ ] I completed three unsolved problems from competitions #6–#7 through reproduction
• [ ] I wrote new write-ups in the four-part structure and reached 40 accumulated
• [ ] I extracted the structure-gap list with the management script
• [ ] I rewrote 1 gap piece (including restoring 2 discarded hypotheses)
• [ ] I published the rewritten piece and started the feedback collection form
• [ ] I shared the TOP 5 selection table (with recommend-to + reasons) with the team

---

6. Common Pitfalls & Fixes

Wall 1. When rewriting, I can’t remember what I was stuck on back then

Symptom: you try to write the Approach part and only "I just solved it" comes out.

Cause: memories of stuck points vanish within days. That’s normal — which is why mid-competition memos are needed.

Fix: the best you can do now is dig through write-ups, chat logs, and terminal history to restore clues. And from the next competition, add one rule — the one-line discarded-hypothesis memo. One line is enough mid-solve, and that one line becomes gold at rewriting time.

Wall 2. The script can’t find my pieces

Symptom: you gave it the folder and it says "New this time: 0."

Cause: mostly a path problem — a missing quote around a non-ASCII path, or running with no argument so it looked at the default path (writeups).

Fix: if the path has spaces or non-ASCII characters, wrap it in quotes — python step292_mgr.py "C:My Documentswriteups". If it’s still 0, check with dir whether .md files actually exist in that folder. The script doesn’t descend into subfolders — if you use a folder tree, change the script’s glob("*.md") to rglob("*.md").

Wall 3. Not a single piece of feedback arrives

Symptom: a week since publishing, zero comments.

Cause: one of three — ① insufficient exposure (a blog only you read), ② the title doesn’t match search terms, ③ the first paragraph fails to hook readers.

Fix: for ①, moving channels is the answer — to where readers gather, like a CTF Discord’s write-up channel. For ②③, become the search reader and check — are the problem name and platform in the title, does the first paragraph contain "what you’ll gain from this piece"? Recording zero feedback in the form also becomes the starting point of the next improvement.

Wall 4. The four-part structure doesn’t seem to fit every problem

Symptom: for a trivial problem (say, one layer of encoding), there’s nothing to say in "Background."

Cause: you’ve mistaken the structure for a format. The four parts are a questionnaire, not a length requirement.

Fix: for easy problems, each part can be a sentence or two — "Background: Base64 decoding (one link)" is a perfectly complete part 1. The structure’s purpose is not leaving things out, not padding. Conversely, for a hard problem it’s normal for part 2 to be half the piece.

Wall 5. Writing the write-up takes as long as solving the problem

Symptom: the two-day plan all goes to writing.

Cause: the overambition of writing every piece at rewriting level.

Fix: set a division rule — new pieces fast, straight from the template; rewriting one piece per week, deep. Not all 40 need to be masterpieces. It’s normal for the quantity routine and the quality routine to turn at different speeds, and since the management script keeps flagging "candidates for quality upgrades," rewriting material never runs dry.

---

7. Summary

Today’s Concepts

Today’s Tools & Commands

The Core Instinct

One thing matters more than the number 40 — the one piece you rewrote today. The other 39 are assets of quantity, but the rewritten one is evidence you raised your "writing skill." Quantity accumulates; quality is raised. They’re different muscles, and today you used both.

And your folder is no longer a mere record repository. The management script checks structure, feedback checks understanding, and the TOP 5 becomes the team’s guide. The moment records become a system.

---

Once every box is checked, Step 292 is complete.