Step 326. Competing in the Finals — The Highest-Level Experience: Executing Our Plan Under Pressure

Level 4 — Professional | Difficulty ★★★★☆ | Estimated time: 2 days (gear & condition prep + offline finals + results recording)

Prerequisites: Step 325’s two weeks of training complete — qualifier unsolved-problem reproductions, the training schedule consumed, the finals-day strategy document fixed.

What you need: the finals-day strategy document, the offline package (local copies of libraries & cheat sheets), laptop + adapter + power bank, and venue info (routes, seats, network). Every finals competition scene is a screen example; the day-of log-analysis script is a measured tool you run with your own records.
Caution: the finals’ goal is not winning alone — performing your team role, executing the plan, and learning the highest-level solutions are all part of the goal.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Confirm the competition’s operating rules (allowed tools, communication limits, no-photography zones) via on-site announcements and follow them.

The finals are here at last. The country’s top teams gather in one room, and you can see in real time the typing sounds from the next table and the score shifts on the giant scoreboard. Your skill is the same as in the qualifier, but the environment is different — and that environment shakes the rate at which skill converts to score.

Today’s topic is managing that shake. What splits results as much as skill is pressure management, and pressure management made concrete is "executing our plan to the very end." Gear and condition before the competition, operations and distance from the scoreboard during it, records after it — here’s how to pass through a finals day.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the environmental differences of an offline finals (venue atmosphere, network, operating rules) and prepare for them
Execute gear checks and day-before condition management as checklists
Pass through scoreboard pressure and a stalled first hour by "executing the plan"
Maintain the habit of recording each solved problem’s solution immediately in the shared document
Analyze the day-of log after the end to inspect the time-use structure and record the final rank

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3 (day-of log analysis), the offline package, shared document, team channel (confirm on-site communication rules)
Today’s command	`python step326_match_log.py` — analyze the competition day’s time-use structure
Concepts needed	Pressure management, distance from the scoreboard, condition as a resource, immediate recording, on-site operating rules
Today’s deliverable	A completed gear-check record + finals competition log + final-rank record + debrief-meeting memo

2-1. The Offline Finals Environment — What’s Different

Let’s organize the differences between the online qualifier and the offline finals along three axes.

Axis	Online qualifier	Offline finals
Atmosphere	Your own space, quiet	One room — other teams’ typing, cheers, and frustration are audible
Network	Familiar home/office environment	Venue network, external internet possibly restricted
Rules	Confirmed from documents	On-site announcements are added — allowed tools, communication means, rules for leaving your seat

All three axes can be offset by preparation. Atmosphere shocks less when known in advance; network is covered by the offline package (Step 325’s Wall 5); rules are handled by always attending the on-site announcements before the start. The problem is the fourth axis, which preparation can’t offset: pressure.

2-2. Pressure Management — What You See Is What Shakes You

Finals pressure arrives in three forms. ① The giant scoreboard shows neighboring teams’ solves in real time. ② Nothing solves in the first hour, contrary to expectation — finals problems are harder than qualifier ones, and you panic even though it’s natural. ③ Some teammate’s condition collapses.

The shared remedy for all three is one thing — returning to our plan. The scoreboard is checked only during meetings (Step 324’s rule); the first-hour stall is an anticipated scenario already written in the plan; condition trouble is handled by the reassignment rule. Pressure’s essence is "this moment feeling uniquely special," and the plan is the device that dissolves that specialness.

Here’s the one sentence to remember — the team that doesn’t shake and executes its plan finishes ahead in the final ranking. Technical comebacks are rare at finals, but operational comebacks happen every competition.

2-3. Condition Is a Resource — Management Starting the Day Before

If you think of condition as "how you feel that morning," it’s not a managed object. Condition is a resource you charge starting the day before.

Condition-management rules (screen example):
- Day before: keep your usual bedtime. Finish the last inspection by 9 PM; no new work after
- Competition morning: no waking earlier than usual — just secure a 30-minute arrival margin
- Caffeine: keep your usual pattern. A "special for today" energy drink creates an afternoon crash
- During the competition: don't skip meals — no problem was ever solved hungry, but problems have been missed from hunger

The rules look plain, but on finals day, doing anything different from usual is itself a risk. What holds up the final three hours of an 8-hour competition is not focus training — it’s blood sugar and sleep.

2-4. Immediate Recording — Mining Raw Material On Site

Record the solution of every problem you solve in the shared document, right there. Two reasons. ① It’s the raw material for the post-competition debrief (Step 327) and Write-ups, and ② the act of recording is itself organizing — if you notice "wait, I skipped this step" while recording, your vision for the next problem widens.

The minimum unit of a record is four lines — problem name, core technique, decisive clue, time spent. This is not about writing a finished Write-up on site. Four lines take five minutes, and those five minutes save hours a few days later. Once the competition ends, memory’s resolution halves every day — four lines on site are more accurate than a hundred lines days later.

3. Follow Along

3-1. Before the Competition — Gear Check and Condition

The day before the competition, run the gear-check list. It’s Step 300’s three axes (gear, network, documents) updated for an offline finals.

Finals gear-check list (screen example):
[ ] Laptop — power adapter, power bank, mouse, (if allowed) external keyboard
[ ] Offline package — local copies of libraries, cheat sheets, documents; USB backup
[ ] Offline verification — can you solve one problem to the end with the network off?
[ ] Environment — VM/Docker images pre-built, disk free space confirmed
[ ] Accounts — competition platform login info, team channel access confirmed (along with on-site communication rules)
[ ] Body — sleep plan, morning route, snacks and water

The verification item is the core: confirm not that the list’s files "exist" but that everything "works" with the network off. The offline package’s completeness is proven by operation, not existence.

3-2. During the Competition — Executing the Fixed Plan

On finals day, proceed per the day-of strategy document fixed in Step 325. Here’s a finals day reconstructed as a screen example.

[09:30] Entry, seat setup. Listen to on-site announcements — partial external-internet
        restrictions confirmed; in-team communication by seat conversation only (no messengers)
[10:00] Start. Enumerate all problems — 8 problems, 40 minutes. Priority table fixed
[10:40] Engage web warmup (owner A), crypto basics (owner B), pwn stack (owner C)
[11:15] Consecutive flags from top teams on the scoreboard — not meeting time, so no checking
[12:00] warmup & crypto solved (+250). 40 minutes slower than expected — within plan tolerance
[13:00] Lunch. Lunchbox route checked in the morning
[15:00] First meeting — scoreboard check: 5th place. 100 points behind 4th. Decision: hold the plan
[16:10] rev medium, 90 minutes no progress — handoff rule fires, handed to B
[17:30] forensics solved (+150), progress on B's rev — anti-debugging bypass found
[19:30] rev solved (+250). The four-line solution record goes into the document on the spot
[21:00] One hour to deadline — final check of unsubmitted flags, tidy records
[22:00] End

How to read it: watch two scenes. ① 11:15 — the moment top-team flags appear on the scoreboard, "no checking" was executed. This is pressure management made concrete — not the absence of pressure, but the plan’s sentence winning in the presence of pressure. ② 19:30 — the four-line record right after the solve. A tired moment, but those five minutes are what make Step 327’s gap analysis possible.

3-3. Day-Of Log Analysis — Where Did the Time Go?

Right after the competition ends, feed your time-slot records into the script to inspect the time-use structure. Save as step326_match_log.py — replace LOG with your actual records.

# step326_match_log.py — finals-day timeline log analyzer
# (start time, end time, activity, result)
LOG = [
    ("09:00", "09:40", "Enumerate all problems & mark difficulty", "12 problems listed"),
    ("09:40", "10:35", "web warmup solving", "flag submitted (+100)"),
    ("10:35", "11:20", "crypto basics", "flag submitted (+150)"),
    ("11:20", "12:30", "pwn stack engaged", "offset confirmed"),
    ("12:30", "13:00", "lunch & rest", "-"),
    ("13:00", "14:40", "pwn stack continued", "exploit complete (+200)"),
    ("14:40", "16:10", "rev medium — 90 min no progress", "handoff rule fired → passed to teammate"),
    ("16:10", "17:30", "forensics newly engaged", "flag submitted (+150)"),
    ("17:30", "17:50", "scoreboard check & mid-meeting", "currently 5th, 100 pts behind 4th"),
    ("17:50", "19:00", "teammate progresses on rev handoff", "anti-debugging bypass found"),
    ("19:00", "19:30", "dinner & rest", "-"),
    ("19:30", "21:00", "rev wrap-up", "flag submitted (+250)"),
    ("21:00", "22:00", "tidy solution records & close", "Write-up material secured for 5 problems"),
]

def mins(s, e):
    sh, sm = map(int, s.split(":")); eh, em = map(int, e.split(":"))
    return (eh * 60 + em) - (sh * 60 + sm)

solve = rest = stuck = ops = 0
solves = []
for s, e, act, res in LOG:
    d = mins(s, e)
    if "rest" in act or "lunch" in act or "dinner" in act:
        rest += d
    elif "no progress" in act:
        stuck += d
    elif "Enumerate" in act or "scoreboard" in act or "tidy" in act:
        ops += d
    else:
        solve += d
    if "flag submitted" in res:
        pts = int(res.split("+")[1].rstrip(")"))
        solves.append((act.split(" — ")[0], pts))

total = sum(mins(s, e) for s, e, _, _ in LOG)
print("=== Finals-Day Time-Use Analysis ===")
print(f"total competition time: {total//60}h {total%60}mn")
for label, v in [("problem solving", solve), ("no progress (handoff fired)", stuck),
                 ("operations (enum/meeting/tidy)", ops), ("meals & rest", rest)]:
    bar = "#" * round(v / total * 40)
    print(f"  {label:<32}{v:>4}m ({v/total*100:4.1f}%) {bar}")

print(f"npoints earned: {sum(p for _, p in solves)} ({len(solves)} problems)")
for name, p in solves:
    print(f"   +{p:>3}  {name}")

print("ncheck: is operations time within 15% of the total? ->",
      "OK" if ops / total <= 0.15 else "operations heavy — simplify meetings & tidying")
print("check: did a handoff actually fire after 90 stalled minutes? ->",
      "OK (handoff rule kept)" if stuck else "no handoff on record")

Here’s the measured output from running it with the log data above:

=== Finals-Day Time-Use Analysis ===
total competition time: 13h 0m

  problem solving                   510m (65.4%) ##########################
  no progress (handoff fired)        90m (11.5%) #####
  operations (enum/meeting/tidy)    120m (15.4%) ######
  meals & rest                       60m ( 7.7%) ###

points earned: 650 (4 problems)
   +100  web warmup solving
   +150  crypto basics
   +150  forensics newly engaged
   +250  rev wrap-up

check: is operations time within 15% of the total? -> operations heavy — simplify meetings & tidying
check: did a handoff actually fire after 90 stalled minutes? -> OK (handoff rule kept)

How to read it: this tool shows you structure, not praise. ① Problem solving at 65.4% — a healthy ratio (two-thirds of your time on the competition’s essence). ② Handoff-rule compliance OK — a handoff actually happened after 90 stalled minutes, and that problem (rev) was eventually solved for +250. A case of a rule converting to points. ③ Notice the operations-heavy warning — at 15.4% it barely exceeded the 15% threshold. It’s the sum of enumeration 40m, meeting 20m, and tidying 60m. The next competition’s improvement comes out of this number — the follow-up action becomes a rule to halve the closing 60 minutes (distributing solution records throughout the competition). The habit of seeing your own team’s time structure in numbers like this becomes the basis of the next competition’s operations plan.

3-4. Awards and Securing Solutions — The Competition’s Second Harvest

After the end, along with the awards, top teams’ solutions are published or presented. Secure these without fail — this competition’s goal includes not "winning" but "learning the winning team’s solutions."

Post-event securing checklist (screen example):
[ ] Final rank & score recorded (capture the official scoreboard)
[ ] Notes from top teams' solution presentations / collect public Write-up links
[ ] Problem authors' explanations for problems we didn't solve — collect without fail if available
[ ] A 15-minute debrief meeting right there — not impressions but "the most regrettable
    hour" and "the rule that worked best," one each

Detailed analysis is tomorrow’s job (Step 327). Today, just make sure the raw material is secured.

3-5. When the Gap to the Top Teams Shows — Handling Discouragement

At the finals, the gap to top teams is delivered in numbers and in sound (the next table’s cheers). Discouragement is a natural reaction — you just need to know the handling in advance.

Two sentences are the prescription. ① Reaching the finals is itself evidence of a top level — the fact that we’re on the list of teams that passed the qualifier is a fact, and facts outlast emotions. ② The gap is not a threat but a map — the problems they solved are "solvable problems," and those solutions will soon be public. Our job is only to take that map home. Let the emotion of discouragement pass through, and return the behavior to the plan.

4. Missions & Exercises

Mission — Complete the Finals and Secure the Records

The day before the competition, run the gear-check list (3-1) — including the "solve one problem with the network off" verification.
Apply the condition-management rules (2-3) starting the day before — usual bedtime, usual caffeine pattern.
At the finals, operate per the fixed day-of strategy document — scoreboard checks only during meetings, handoff-rule firings, immediate four-line records of solutions.
Within 30 minutes of the end, tidy the day-of log and analyze the time structure with step326_match_log.py.
Record the final rank, secure top teams’ solutions and authors’ explanations, then finish the 15-minute debrief meeting.

Exercises

Exercise 1. Among the offline finals’ three environmental differences (atmosphere, network, rules), what is the fourth element that preparation cannot offset — and what is its countermeasure made concrete?

Exercise 2. Explain how the rule "check the scoreboard only during meetings" protects focus, connecting it to the behavioral changes real-time checking creates.

Exercise 3. In 3-3’s measured analysis, "operations 15.4% — heavy warning" appeared. Suggest two concrete improvement points this result gives the next competition’s operations plan.

Exercise 4. Explain why recording a solution "four lines on the spot" is more accurate than a finished Write-up days later, connecting it to the characteristics of memory.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Verification by demonstration: was the offline package confirmed not by "the files exist" but by "solved one problem to the end with the network off"?
Condition by rules: were the day-before bedtime and morning route executed as planned — did you avoid doing "something special"?
Evidence of plan execution: do the scoreboard-check times in the competition log coincide with meeting times? The log itself is the evidence.
Immediate records exist: does every solved problem have a four-line record (name, technique, clue, time) written that day?
Analysis and securing: did you check the two check items in the log-analysis output, and do the rank record, top teams’ solutions, and debrief memo remain?

Exercise Answers

Answer 1. What preparation cannot offset is pressure — the psychological shake created by the scoreboard’s real-time shifts, the first-hour stall, and a teammate’s condition trouble. Since pressure itself can’t be removed, the countermeasure made concrete is "executing our plan even under pressure." Specifically, pre-decided rules (scoreboard-check times, handoff rule, reassignment) stand in for tired and shaken judgment. Pressure management is not removing emotion — it’s enforcing rules.

Answer 2. Real-time checking creates two behavioral changes. ① Comparison anxiety — every time another team’s flag appears, the temptation arises of "should we grab that problem too?", shaking the fixed engagement order. ② Attention fragmentation — the act of checking scoreboard updates itself cuts deep thought about a problem into minutes-long slices. Since progress on CTF problems comes out of long immersion stretches, interruption is directly point loss. The meeting-only rule doesn’t block information — it controls information’s arrival time, so information is spent on strategy revision (meetings) and never on immersion destruction.

Answer 3. First, distribute the closing 60 minutes — writing solution records in four lines right after each problem during the competition shrinks post-event tidying to 30 minutes or less, and the recovered 30 minutes become problem-solving time. Second, shorten the 40-minute enumeration — preparing an enumeration template (a form of fields to record) in advance cuts recording time via copy-paste, completing it in 25–30 minutes. Lowering operations time below 15% with these two measures becomes the concrete revision of the next competition’s plan. In this way, log analysis is a tool that derives not impressions but numerically grounded revisions for the next plan.

Answer 4. Memory loses detail over time and reorganizes around results — in problem solving especially, "what the decisive clue was" starts looking obvious from the moment you know the answer, and days later it distorts into "something I saw from the start." Four lines written right after the competition hold the state before that distortion — the actual branch points of the search process. Only with this raw material can Step 327’s gap analysis precisely contrast "why didn’t we see that clue?" Accuracy comes from timeliness more than polish — that’s why four lines on the day are worth more to analysis than a hundred lines days later.

Completion Criteria Checklist

[ ] I ran the gear-check list and passed the offline-operation verification (completing a problem with the network off)
[ ] I applied the condition-management rules (sleep, caffeine, routes) starting the day before
[ ] I confirmed the on-site announcements (communication rules, network restrictions) and reflected them in operations
[ ] I kept the rule of restricting scoreboard checks to meeting times
[ ] The handoff rule actually fired when needed (or the log confirms it wasn’t needed)
[ ] I wrote four-line solution records on the spot for solved problems
[ ] I analyzed the day-of log with the script and checked the time-structure results
[ ] I completed the final-rank record, top-team solution securing, and the debrief meeting

6. Common Pitfalls & Fixes

Wall 1. The venue network makes my VM/tools demand updates

Symptom: right after the start, a tool hangs trying to update, or the VM image demands a license check.

Unable to connect to the update server. Please check your network connection.

Cause: an accident entangled with the venue network’s external restrictions — the classic "it worked at home" (happens if you skip the offline verification).

Fix: preparation is the answer — 3-1’s "solve one problem with the network off" verification surfaces exactly this accident in advance. If it hits you on site: confirm the venue network policy with the staff (there may be an allowed update channel), and if that fails, switch to the copy tools in the offline package. Record the lesson — the item "disable auto-updates" gets added to the checklist from the next competition on.

Wall 2. We solved nothing in the first two hours — panic is setting in

Symptom: a different difficulty level from the qualifier stalls the opening, and the scoreboard shows other teams’ flags.

Cause: finals problems are simply harder than qualifier problems — an opening stall is not an anomaly but an anticipated scenario. Panic comes from the illusion that it’s "unexpected."

Fix: write this scenario into the day-of strategy document in advance — "taking 2–3 hours to the first flag is normal." The document’s sentence is the panic’s antidote. And there’s one behavior rule — even while stalled, the work is defined: return to the enumeration stage and restart from each problem’s "smallest verifiable thing." Progress is not only flags — discarding a hypothesis is also progress. Stack three "this isn’t the path" and the fourth is often the path.

Wall 3. Our team channel (Discord) is banned at the venue

Symptom: on-site announcements ban external messengers, neutralizing the online qualifier’s entire communication system.

Cause: the offline finals’ operating rules — communication channels are subject to venue regulations.

Fix: respond in two stages. ① An immediate substitute system — since you’re in the same room, switch to seat conversation + a shared whiteboard (one sheet of paper). What matters is keeping the handoff-document habit — verbal handoffs drop things, so substitute with sticky notes beside each problem reading "tried / next candidates." ② Prevention — from now on, put "if communication means are banned, what’s the substitute?" on the agenda of the operations-plan meeting (Step 325). Consider it a lesson learned on site: rules confirmation is part of tactics.

Wall 4. A teammate’s condition collapsed mid-competition

Symptom: falling focus, repeated simple mistakes, progress lost on their assigned problem.

Cause: condition is not a matter of individual willpower but of the team’s resource management — and the self-blame afterward creates secondary damage.

Fix: the day-of strategy document needs a "reassignment rule" — on condition trouble, the problem passes to another teammate, and that member moves to low-intensity work like record-tidying or enumeration support. What matters is a team atmosphere that treats this as normal operations, not a combat loss. A teammate’s condition trouble is a finals constant — a constant, not a variable, so the response is planned in advance.

Wall 5. The result fell short — the finals experience feels like a failure

Symptom: you didn’t place, and the feeling that all you did was confirm the gap to the top teams.

Cause: a goal-setting problem — set the first finals’ goal as winning, and most teams become "failures."

Fix: correct the goal — the finals experience itself is the next stage’s asset. Concretely, count what remains in your hands today: ① the experience of solving the same problems at the same time as the country’s top teams, ② the secured top-team solutions and authors’ explanations, ③ a day-of log whose time structure is numerically analyzed, ④ operations improvements for the next competition. These four are a harvest you can take home without winning — or rather, one non-winners must take home more desperately than winners. In Step 327 you’ll analyze the gap with this raw material — today’s "failure" is tomorrow’s analysis data.

7. Summary

Today’s Concepts

Concept	One-line explanation
The offline environment’s 3 axes	Atmosphere, network, rules — differences offsettable by preparation
Pressure management	Not removing the shake but maintaining plan execution — rules stand in for judgment
Distance from the scoreboard	Not blocking information but controlling its arrival time — meetings only
Condition as a resource	A resource charged starting the day before — "same as usual" is the best strategy
Immediate recording	Four lines right after a solve — raw material holding the search process before distortion
Reassignment	Condition trouble is a constant, not a variable — operations planned in advance

Today’s Tools & Commands

Tool/command	What it does
`python step326_match_log.py`	Analyzes the day-of log’s time-use structure and checks rule compliance
Gear-check list	Six fields: gear, offline package, environment, accounts, body
Offline-operation verification	Solve one problem with the network off — proof of the package
Four-line record template	Problem name, core technique, decisive clue, time spent
Post-event securing checklist	Rank record, top-team solutions, authors’ explanations, debrief meeting

The Core Instinct

The finals are a stage of skill and simultaneously a stage of rules. The rules you built in Level 3 (enumeration, handoffs, immediate recording, meetings) come under real pressure for the first time on this stage. Keeping "per our plan" in a room where the scoreboard moves before your eyes and the next table cheers — that is the skill the finals teach that can’t be learned online.

And regardless of rank, remember today’s real deliverables — the day-of log and the secured solutions. That raw material becomes, in Step 327, the ingredients for dissecting the gap to the winning team by type. The finals’ score ends in a day, but the raw material stays as the team’s asset.

Once every box is checked, Step 326 is complete.