Step 336. Challenging for the Domestic Championship — Mustering Total Strength: 24 Hours of Discipline Makes a Champion

Level 4 — Professional | Difficulty ★★★★★ | Estimated time: 2+ days (2 weeks of focused training before the competition + completing competition day + results recording)

Prerequisites: Steps 324–326’s domestic-competition cycle, Step 327’s gap analysis and reinforcement plan, Step 328’s international competition experience. This time the goal is different — not experience, but the championship.

What you need: one target domestic competition (a major like CODEGATE or CCE), a best-of-the-best team, proven team operating rules, your accumulated exploit library, and a Python environment (for the library auditor). The library-audit script is a measured tool you run against your own folders; competition scenes and scoreboards are all screen examples.
Caution: you don’t connect to external CTF platforms or competition servers from here — competition-progress scenes are all written as screen examples, and the actual entry is an assignment you perform on the competition’s schedule.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Read and follow the competition rules (team-size cap, no external collaboration, tool restrictions) before the start.

Until now, your goal in competitions was "experience and learning" — completion for the first, plan execution for the finals, seeing the world’s ceiling at the international one. Starting today, the goal changes: the championship. When the goal changes, the nature of preparation changes — the only question becomes not "am I growing?" but "does our team score the most points?"

The diagnosis is clear. A championship comes not from the sum of individual skills but from the optimization of team strength — elite members whose fields don’t overlap, proven operating rules, the accumulated exploit library, and focused pre-competition training. Today we organize the procedure for mustering those four assets.

1. Learning Objectives

By the end of this chapter, you will be able to:

Do a final field-by-field audit of team strength and judge whether to reinforce weak fields
Design and execute 2 weeks of focused pre-competition training (team mock CTFs, library audits)
Check field-by-field readiness as numbers with the library-audit script
Reconfirm operating rules (enumeration, handoffs, scoreboard, meals) and enforce them through the competition
Build a team-agreement sentence for managing championship pressure, and record the results

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3 (library audit), the team exploit library, the team channel, the competition platform
Today’s command	`python step336_lib_audit.py <library folder>` — field-by-field readiness check
Concepts needed	Strength optimization, the 2-week focused-training cycle, enforcing operating rules, championship-pressure management
Today’s deliverable	A team-strength audit table + a 2-week training plan + library-audit results + a competition-results record

2-1. The Arithmetic of Winning — A Product, Not a Sum

A learning-goal competition and a championship-goal competition have different score structures. In a learning competition, a zero in one field still leaves meaning in the others’ scores — the learning remains. In a championship competition, it’s different. In top-tier fights, the gap between the winning team and second place is usually one or two problems, and those one or two problems mostly come from a team’s zero-solve field.

So the championship challenge’s first work is not strengthening strengths but confirming whether weaknesses exist. Among web, pwn, rev, crypto, and forensics, if your team has even one field where "if it appears, we stall," that competition’s win probability rides on whether that field’s problems get set — on luck, not skill. Strength optimization is the work of eliminating this zone of luck.

2-2. Conditions of an Elite Team — Fields That Don’t Overlap

Championship team composition has one rule — fields must not overlap. A combination of a web ace and a crypto ace beats two web aces. Same two people, but different covered fields widens the team’s total coverage — and coverage is expected score.

The team-strength audit asks three questions. ① Is per-field ownership clear — "everyone looks at everything" is a state with no owner. ② Has the weak field been reinforced — if not, is there an operating plan for when that field appears (fast abandonment judgment, a time cap)? ③ Is each member’s condition being managed toward the competition date — a member at 50% condition on the day must be known in advance for strength calculations.

2-3. Two Weeks of Focused Training — The Resilience of Simulation

The 2 weeks before the competition train for a different purpose than usual. Not a period for learning new techniques — a period for practicing pulling out what you have under competition conditions. Two axes compose it.

Axis	Content	Frequency
Team mock CTFs	Past-problem sets, timed, run under real operating rules	1–2 times over 2 weeks
Library/checklist audit	Verify templates execute, refresh READMEs, reinforce thin fields	2–3 times a week, short

A mock CTF’s value is not problem solving but rehearsal of operations — confirming that enumeration order, handoff documents, meeting times, and meal timing run like the real thing. A rule first run on competition day is not a rule but a hope.

2-4. Championship Pressure — What Blocks Your Ordinary Skill

The moment you target the championship, a new enemy appears — pressure. The thought "this time we must win" shakes judgments you normally make fine. You double-check even easy problems repeatedly, make unplanned switches during stalls, and watch the scoreboard far too often.

The prescription is one sentence the team engraves together — "this one competition does not decide our lives." It sounds glib, but this sentence does work. Pressure’s essence is "overestimating this moment’s weight," and the sentence corrects that weight. If you’ve done your best training, what remains is execution — and execution is handled by rules, not pressure. A championship is made not by one problem’s genius but by 24 hours of discipline — this sentence is today’s axis.

3. Follow Along

3-1. Final Team-Strength Audit — Write It as a Table and the Gaps Show

Two weeks before the competition, write the team-strength audit table. The moment you write it as a table rather than memory, the blanks show.

■ Team-strength audit table (screen example):

| Field     | Primary | Backup | Solved in recent events | Assessment |
|-----------|---------|--------|-------------------------|------------|
| web       | A       | C      | Solved in all last 3    | Strong     |
| pwn       | B       | —      | 2 of last 3             | Decent     |
| rev       | C       | A      | 2 of last 3             | Decent     |
| crypto    | B       | —      | 1 of last 3 (basics only)| Weak      |
| forensics | A       | —      | 3 of last 3             | Strong     |

Verdict: crypto is the zero-solve-risk field → if reinforcement is
impossible, add the operating rule "crypto time cap: 2 hours"
Condition: all members confirmed free of overtime/exams during competition
week (B works until Friday evening — first-2-hours coverage plan)

How to read it: check three things. ① Fields with an empty backup — the structure where the primary’s bad-condition day is that field’s death becomes visible. ② Handling of the weak field — if reinforcement time is short, cage the risk with an operating rule (time cap). ③ Advance knowledge of condition — learning on the day forces a strategy revision; learning in advance is strategy.

3-2. Library Audit — Battle-Testing the Armory

The accumulated exploit library is the championship challenge’s ammunition. But "having it" and "being able to pull it out and use it" are different. Run the audit script 2 weeks before the competition. Save it as step336_lib_audit.py.

# step336_lib_audit.py — pre-competition auditor for the team exploit library
# usage: python step336_lib_audit.py <library folder>
# checks: per-field templates exist, README exists, warn if untouched 90+ days
import sys
import time
from pathlib import Path

FIELDS = ["web", "pwn", "rev", "crypto", "forensics", "misc"]
STALE_DAYS = 90

def main():
    root = Path(sys.argv[1])
    now = time.time()
    print("=== Team Library Pre-Competition Audit ===")
    print(f"criteria: README required, updated within {STALE_DAYS} daysn")
    ok, warn = 0, 0
    for field in FIELDS:
        d = root / field
        if not d.is_dir():
            print(f"[MISSING] {field}/ — the folder itself doesn't exist. Fill it before the competition.")
            warn += 1
            continue
        files = sorted(p for p in d.iterdir() if p.is_file())
        has_readme = any(p.name.lower() == "readme.md" for p in files)
        newest = max((p.stat().st_mtime for p in files), default=0)
        age = (now - newest) / 86400
        state = []
        if not has_readme:
            state.append("no README")
        if age > STALE_DAYS:
            state.append(f"newest file is {age:.0f} days old — confirm recent techniques are reflected")
        if state:
            warn += 1
            print(f"[WARN] {field}/ ({len(files)} files) — " + "; ".join(state))
        else:
            ok += 1
            print(f"[PASS] {field}/ ({len(files)} files) — README present, newest {age:.0f} days old")
    print(f"nResult: of {len(FIELDS)} fields, {ok} passed, {warn} warned/missing")
    print("Even one warning makes the weekend before the competition your reinforcement window.")

if __name__ == "__main__":
    main()

Here’s the measured output from running it against a sample library folder (with deliberate defects — forensics’ README deleted, crypto clocked back 120 days):

=== Team Library Pre-Competition Audit ===
criteria: README required, updated within 90 days

[PASS] web/ (3 files) — README present, newest 0 days old
[PASS] pwn/ (3 files) — README present, newest 0 days old
[PASS] rev/ (2 files) — README present, newest 0 days old
[WARN] crypto/ (2 files) — newest file is 120 days old — confirm recent techniques are reflected
[WARN] forensics/ (1 files) — no README
[PASS] misc/ (2 files) — README present, newest 0 days old

Result: of 6 fields, 4 passed, 2 warned/missing
Even one warning makes the weekend before the competition your reinforcement window.

How to read it: distinguish the two warning kinds. ① "No README" is a usability defect — when a teammate pulls out your template mid-competition, a file without a README is the same as no file. Usage knowledge in someone else’s head doesn’t transmit during a competition. ② "120 days old" is a freshness warning — in fast-moving fields like crypto, solvers commonly break within three months of framework updates. When the audit ends, the warning items become the 2-week training’s reinforcement list. Run it against your real library — until zero warnings appear here is your pre-competition work.

3-3. Two Weeks of Focused Training — Rehearsing Operations with Mock CTFs

Place 2-3’s two axes on the calendar. Here’s a 2-week plan as a screen example:

■ 2-week pre-competition training plan (screen example):

[Week 1]
- Mon: Reinforce from library-audit results — update crypto solvers,
  write forensics README
- Wed: Team mock CTF #1 — last year's problem set, 4-hour time attack,
  real operating rules exactly
- Fri: Mock CTF #1 debrief — 2 rule violations found (enumeration
  skipped, verbal handoff)
- Sat: Weak-field (crypto) intensive session — 3 past problems

[Week 2]
- Tue: Mock CTF #2 — a different year's set, this time starting at night,
  matching the competition's time slot
- Thu: Mock CTF #2 debrief — rule compliance confirmed, crypto cap
  rule's effect verified
- Sat: Final check — equipment, accounts, condition plan. No new work
  afterward

How to read it: this plan’s essence is that "debrief" occupies as much space as "mock CTF." The mock CTF is the rules’ test bench; the debrief is the rules’ revision meeting. Confirming that the 2 violations found in #1 disappeared in #2 — that is rehearsal’s completion condition. And the last Saturday’s "no new work" matters — trying to learn new techniques up to the eve and burning your condition is the classic self-destruction pattern of top-tier teams.

3-4. Competing — Trust the Planned Operations to the End

Competition-day operations inherit Step 326’s skeleton, but with the goal being the championship, one thing is strengthened — scoreboard response from the middle stretch on. In a championship fight, ranks 1–3 stick together by score margins, and judgment in this stretch decides the ranking.

■ Championship-challenge competition log (screen example):

[00:00] Start. Full problem enumeration, 35 min — 14 problems. Field
        owners engage immediately
[01:30] web warmup + forensics solved (+350). Ideal start
[04:00] 1st meeting — 2nd place, 50 points behind 1st. Plan holds.
        Scoreboard checks closed
[06:00] Hard crypto stalled — time-cap rule standing by
[08:00] Crypto cap reached → abandon, archive attempts. Switch to
        mid-tier pwn
[10:00] pwn solved (+400) — a problem 1st place hasn't solved. Comeback,
        now 1st
[14:00] 2nd meeting — 150 ahead of 2nd. 3 problems left: 1 crypto,
        1 rev, 1 misc
[18:00] rev solved (+350). misc: intent being analyzed
[21:00] misc solved (+200). Only hard crypto remains — confirmed the
        winning team is stalled on it too
[23:30] 90 minutes of crypto retry, no progress — switch to record
        cleanup per the rules
[24:00] End. Final 1,650 points. Champions — 150 ahead of 2nd

How to read it: look at the three scenes that made the win. ① The 08:00 crypto abandonment — the winning team was not "the team that grips one problem to the end" but "the team that keeps the abandonment rule." Those 2 hours returned as pwn +400. ② The 10:00 comeback — solving a problem the rival hadn’t was the ground for 1st place, and that came from 3-1’s coverage audit. ③ 21:00–23:30 — the one remaining problem had the other top team stalled too. The championship was not "solving every problem" but "recovering every solvable problem."

3-5. Recording Results — Turning Victory into Data

Post-event recording is not only for defeats. The record of a win must be more delicate — for reasons that are the next chapter’s (Step 337’s) topic.

■ Results-record form (screen example):
- Final rank / score / margin over 2nd:
- Per problem: solved (time taken, decisive clue) / unsolved (stall point)
- Operations evaluation: per-rule compliance — especially the abandonment
  rule and scoreboard rule
- Win-factor candidates (why we won): separate skill factors from luck
  factors — honestly
- Team debrief, 15 min: a list of "what among the win is reproducible"

The last item is the core — the separation of "is it reproducible." Winning thanks to coverage is reproducible; the last problem’s topic luckily overlapping our experience is not. Without this separation, a championship becomes not a strategy for the next competition but an illusion of confidence.

4. Missions & Exercises

Mission — An Elite Team’s Championship Challenge

Write the team-strength audit table in 3-1’s format — including backup blanks and the weak field’s handling policy.
Audit the team library with step336_lib_audit.py, and convert warning items into the 2-week training’s reinforcement list.
Execute the 2-week training in 3-3’s structure — 1–2 mock CTFs with their debriefs, tracking rule violations.
Enter the competition and enforce the planned operations (enumeration, handoffs, abandonment rule, scoreboard rule) to the end — confirm the team-agreement sentence ("this one competition…") out loud before the start.
Record the results in 3-5’s format — if you won, with win factors separated into skill and luck.

Exercises

Exercise 1. Explain how the meaning of a "zero-solve field" differs between a learning-goal competition and a championship-goal competition, from the score-structure perspective.

Exercise 2. Explain why "non-overlapping elite" beats "two aces in the same field," using the concepts of team coverage and expected score.

Exercise 3. Why does 3-3 allocate as much time to debriefs as to mock CTFs? Answer from the perspective of "rehearsal’s completion condition."

Exercise 4. In 3-4’s screen example, explain why the 08:00 crypto abandonment was a means to victory rather than a defeat, together with the two pre-built devices that made that judgment possible.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Audit-table completeness: does every field have a primary, and are backup blanks and weak fields stated with a "handling policy" — no empty cells.
Library-audit execution: is the script output preserved, and are warning items connected to reinforcement tasks in the training plan — audit separated from training is ritual.
Rehearsal evidence: is there a tracking record of whether rule violations found in a mock CTF’s debrief improved in the next mock CTF.
Rule-enforcement evidence: does the competition log record the actual firing times of the abandonment rule and scoreboard rule.
Results-record honesty: if won, are win factors separated into skill/luck; if lost, are loss causes specified per problem — "it was close" is not a record.

Exercise Answers

Answer 1. In a learning-goal competition, a zero-solve field is "a coordinate for the next training" — the other fields’ scores and learning remain, so the competition can still be a success. In a championship-goal competition, a zero-solve field is "a luck element in win probability" — the top tier’s score gap is one or two problems, so the moment that field’s problem is set, the championship rides not on skill but on the luck of what was set. The same zero-solve is information in the former, risk in the latter. Strength optimization is the work of removing this risk via reinforcement or an operating rule (time cap), and that is where championship preparation differs from learning-competition preparation.

Answer 2. A team’s expected score is proportional to "the fraction of set problems we can solve," and that fraction is decided by the team’s field coverage. Two web aces solve web problems fast but cover only web — in a competition where crypto appears, the second person becomes a spectator. A web ace + a crypto ace, by contrast, doubles coverage even if neither is the best in their field. CTF problems are set evenly across fields, so in top-tier fights, gapless breadth raises expected score more than peak depth. The "elite" in elite team means not the sum of individual rankings but the completeness of coverage.

Answer 3. Because a mock CTF is the rules’ test and a debrief is the rules’ revision. Running mock CTFs while skipping debriefs transplants violations like skipped enumeration or verbal handoffs into the real competition undiscovered — rehearsal’s purpose is not practice but pre-exposure of defects. Rehearsal’s completion condition is not "did N runs" but confirming "the violations found in run 1 disappeared in run 2." Only with that tracking do competition-day rules become verified procedures rather than hopes.

Answer 4. Why the abandonment was a means to victory — burning the remaining time on hard crypto would have erased the recovery opportunities of pwn +400 and rev +350, and in fact the other top team also failed that crypto problem. The abandoned 2 hours returned as 750 points, so the abandonment was not defeat but a relocation of points. The two pre-built devices that enabled the judgment: ① the "crypto time cap: 2 hours" rule agreed in 3-1 — what was enforced was not that day’s judgment but a prior agreement; ② the habit of archiving attempts — making abandonment "on hold" rather than "deleted," lowering the psychological resistance. Judgment quality under pressure is decided not by that day’s willpower but by the count of pre-built devices.

Completion Criteria Checklist

[ ] I wrote the team-strength audit table and set the weak field’s handling policy (reinforcement or time cap)
[ ] I ran the library-audit script and converted warning items into a reinforcement list
[ ] I placed the 2-week training plan on the calendar (1–2 mock CTFs + debriefs + final check)
[ ] I enforced real operating rules in the mock CTFs and tracked violations in the debriefs
[ ] Before the competition start, the team confirmed the agreement sentence ("this one competition does not decide our lives")
[ ] I actually enforced the abandonment rule and scoreboard rule in the competition
[ ] I completed the results record per the form — including the skill/luck separation of win (or loss) factors
[ ] I recorded a podium finish or the team’s best-ever result

6. Common Pitfalls & Fixes

Wall 1. I ran the audit script and got an argument error

Symptom:

    root = Path(sys.argv[1])
                ~~~~~~~~^^^
IndexError: list index out of range

Cause: you didn’t pass the library folder path as an argument (measured).

Fix: run it in the form python step336_lib_audit.py ~/team-lib. If the team library is a Git repo, point at the local clone location. If your field folder names differ, edit the script’s FIELDS list to match the team’s conventions — that edit itself documents the team’s field taxonomy.

Wall 2. Team schedules won’t align for a mock CTF

Symptom: two 4-hour slots with everyone present can’t be booked within the 2 weeks.

Cause: the more top-tier the team, the busier its members — a common situation.

Fix: three adjustments. ① Split runs — break 4 hours once into 2 hours twice, and focus on rehearsing operating rules (fewer problems still tests the rules). ② Asynchronous rehearsal — document-type rules like handoff documents and enumeration forms can be verified without shared time. ③ Prioritize — even if you give up the second mock CTF, keep the library audit and the debrief meeting. Verified operations are closer to the championship than a verified problem count.

Wall 3. Mid-competition, the gap from 1st place widens and the team gets frantic

Symptom: members drift to unplanned problems, and the abandonment rule starts getting ignored.

Cause: the classic moment when championship pressure melts the rules — the impulse "we must do something now" beats "keep doing what was planned."

Fix: the pre-built device is the team-agreement sentence confirmed in 3-4 — only because it was agreed out loud before the start can it be quoted in that moment. The immediate response is calling a meeting — grounded in the rule that scoreboard checks happen at meeting times, open a 15-minute meeting with one question: "is the grounds for changing the plan in new information, or in emotion?" New information — change the plan. Emotion — continue the plan. Asking this distinction out loud in the meeting is itself the antidote to pressure.

Wall 4. Championship pressure kept me from sleeping the night before

Symptom: you start at 70% of your ordinary skill.

Cause: condition management (Step 326’s 2-3) must be stricter for a championship challenge, yet pressure invades sleep first.

Fix: reclassify sleep from "the last item of competition prep" to "part of competition strength" — that’s why 3-3’s plan table specifies bedtime. Pre-decide the response for sleepless nights — the rule is "lying down," not "sleeping." Even without sleep, lying with eyes closed secures much of the recovery, and share the fact "I couldn’t sleep" with the team so it reflects in role assignments. Hidden insomnia hurts the team; shared insomnia is just an operating variable.

Wall 5. We lost — didn’t even place. Was the championship challenge reckless?

Symptom: total strength was mustered but the result fell short, and team morale drops.

Cause: a championship is a probabilistic goal — the best preparation raises the odds, it doesn’t guarantee. And the fact "we lost" has analytical value — a lost competition gives more data than a won one.

Fix: separate two things. ① Evaluating the preparation — if the audit table, training, and rule enforcement went as planned, that preparation is a success. Evaluating preparation and results in one basket breaks the power for the next preparation. ② Analyzing the result — if 3-5’s record is ready, the next chapter’s (Step 337’s) win/loss analysis turns that record into the blueprint of the next challenge. The principle doesn’t change: if you trained your best, what remained was execution — and execution’s result is data. Data is harvest, win or lose.

7. Summary

Today’s Concepts

Concept	One-line explanation
Championship arithmetic	The top tier’s gap is one or two problems — a zero-solve field is the zone of luck
Strength optimization	Completeness of coverage — gapless breadth beats peak depth
2-week focused training	Not new techniques but rehearsal of operations — the debrief is the completion condition
Library audit	Verifying "have it" vs. "can pull it out and use it" — READMEs and freshness
Championship-pressure management	Correcting the weight — the team-agreement sentence + the information/emotion distinction in meetings
Win-factor separation	Record skill factors (reproducible) apart from luck factors

Today’s Tools & Commands

Tool/command	What it does
`python step336_lib_audit.py <folder>`	Per-field README, freshness, and file-count check — derives the reinforcement list
Team-strength audit table	One-page summary of primary/backup, recent solves, condition
2-week training plan table	Layout of mock CTFs + debriefs + weak-field sessions + final check
Time-cap rule	A prior agreement that cages the weak field’s risk
Results-record form	Rank · per-problem · operations evaluation · factor separation · debrief

The Core Instinct

The gist of today’s learning is this sentence — a championship is made not by one problem’s genius but by 24 hours of discipline. Genius moments can’t be controlled; discipline can. Enumeration, handoffs, time caps, scoreboard rules — the rules you built one by one since this book’s Level 3 today finally reveal why they were made. Rules look like inefficiency in ordinary times, but in moments of pressure they are the only device that decides in your place.

And remember regardless of the result — wins and losses are data. If you won, whether the win’s causes are reproducible; if you lost, where the points leaked — the next chapter analyzes it coldly. The championship challenge’s last procedure is not the award ceremony but the analysis sheet, and that sheet becomes the blueprint of the next challenge.

Once every box is checked, Step 336 is complete.