Step 298. Preparing for Domestic Qualifiers: Solving CODEGATE/CCE Past Exams — Past Exams Are the Best Textbook

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 2 days (half a day collecting & analyzing past exams + 1 day solving & boot-camp planning)

Prerequisites: the Season 2 plan from Step 297, the type boot-camp methodology from Step 288, and the completed exploit library.

What you need: access to public past-exam archives (the CODEGATE/CCE public repositories and community Write-ups), a spreadsheet or CSV for organizing past exams, a Python runtime, and a memo of the qualifier schedule. The solving scenes for past exams are screen examples; the trend-analysis script is a measured tool you run yourself on your own organized data.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Use only past-exam archives the organizers have published for learning, and check the competition rules’ scope for past-exam use (e.g., clauses forbidding external references during the competition).
This chapter is preparation training — rather than new concepts, you learn to grasp the grain of a concrete stage — the domestic major competitions — from data, and to prepare accordingly.

You’ve run ten weekend CTFs; your next stage is the domestic majors — named competitions like CODEGATE and CCE. These competitions have a different grain of problem style: problems reenacting real intrusion scenarios, Korean-flavored material, and a difficulty curve split into qualifier and finals. Go in with only the feel of overseas weekend competitions and you’ll experience "I know this but it won’t solve."

Fortunately, these competitions run every year, and their past exams and Write-ups are public. If passing the qualifier is the goal, past exams are the best textbook — a workbook carrying the problem setters’ habits intact. Today we collect and solve past exams, analyze problem trends in a table, and contrast them against our team’s coverage to produce a boot-camp plan.

1. Learning Objectives

By the end of this chapter, you will be able to:

Collect problems from CODEGATE/CCE public past-exam archives and structure the list
Explain the style characteristics of domestic competitions (scenario-type problems, the qualifier difficulty curve)
Organize past exams by field, technique, and solved status to build a trend-analysis table
Derive a "types we can’t solve" boot-camp list by contrasting team coverage against past-exam types
Check the qualifier schedule and format (team composition, time, rules) and prepare registration

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3 (trend analysis), spreadsheet/CSV (past-exam list), every attack tool you’ve used so far
Today’s command	`python past_exam_analysis.py` — field share, repeated techniques, coverage analysis
Concepts needed	Past-exam-centered preparation, trend analysis, type generalization, qualifier strategy
Today’s deliverable	Past-exam table + trend-analysis table + boot-camp plan + qualifier registration checklist

2-1. The Grain of Domestic Majors — What’s Different

Overseas weekend CTFs and domestic majors are different leagues of the same sport. Three representative differences.

Axis	Overseas weekend CTF (the stage so far)	CODEGATE/CCE (domestic majors)
Problem grain	Mostly independent per-type problems	High share of real-intrusion-scenario reenactments
Material	English-speaking memes and tech stacks	Korean material (parodies of domestic services and environments)
Structure	Single round, 24–48 hours	Split into qualifier (online) → finals (offline)

The qualifier’s difficulty curve is also a feature — its purpose is to filter teams for the finals, so the gap between easy and hard problems is wide, and how fast and accurately you eat the mid-difficulty band decides passage. The tactics you’ve trained — "blitz the easy problems + concentrate on Medium tier" (Step 295) — work as-is on this structure. However, the problems’ grain differs, so the library must be tuned to that grain.

2-2. Past-Exam-Centered Preparation — Why Past Exams

Preparing by imagining new problems is divergence; preparing with past exams is convergence. Same problem setters, repeated habits — preferred techniques, trap placements, even flag formats. The difference between a team that has solved 16 past problems and one that hasn’t is not knowledge but "do you know what this competition’s problems are asking."

Two cautions about past exams. ① They’re scarce — a twice-yearly competition’s public archive holds only a few problems per type, so spend them sparingly, and always generalize every solved problem into a type. ② Past grain ≠ this year’s grain — if the problem setters change, the trends change. Past exams are not prophecy; they are a topographic map.

2-3. Structuring the Past-Exam List — To Be Analyzable, It Must Be a Table

Don’t let past exams end at "solved." Only when organized into an analyzable form — a table — do trends become visible. One row per problem.

Competition | Year | Field | Representative technique | Solved by us
CODEGATE | 2025 | pwn | stack BOF + ROP | O
CCE | 2024 | crypto | AES mode misuse | X
...

As this table accumulates, it answers questions — which fields appear often (share), which techniques repeat (frequency), which of them we can’t solve (coverage). Those three answers are exactly the boot-camp plan’s inputs.

2-4. Type Generalization — How to Turn 1 Past Exam into 10

This is how you overcome past exams’ scarcity. When you solve one past problem, generalize its type into a sentence ("the type that overwrites heap-chunk metadata to manipulate an adjacent chunk"), then find problems of the same type on external platforms (Dreamhack, pwnable, etc.) for additional training.

The generalization formula:
1. The problem's core technique in one sentence (as structure, not a tool name)
2. Three features of "other problems this technique solves"
3. Search external platforms by those features -> 3-5 similar problems of extra training

Do this and 16 past problems swell into 16 type textbooks. The past exam is the touchstone; generalization is the vein of ore you find with it.

3. Follow Along

3-1. Collecting Past Exams — From Public Archives

CODEGATE and CCE past exams live in public channels — the archive on the competition’s official page, past-exam collection repositories on GitHub (the CTF-writeups kind), and participants’ Write-up blogs. Three collection rules.

Store problem files and Write-ups separately — read the Write-up first and the problem dies. Split folders between what you’ll solve with and what you’ll consult when stuck.
Preserve originals as-is — rename files if you like, but never edit the contents. A past exam’s value is in its original form.
Focus on the last 2–3 years — older exams run on different tech stacks and lose reference value.

3-2. Solving 2–3 per Field — With a Timer

From the collected exams, pick 2–3 per field and solve them. One rule — time yourself so it becomes a qualifier simulation. Not leisurely practice: the purpose is to measure "how many hours it takes to eat this type if it appears in the qualifier."

Screen example (past-exam solving record):

[CODEGATE 2025 pwn — stack BOF + ROP]
Started 14:02 -> checksec (NX on, no canary) -> offset fixed at 40 bytes (14:25)
-> applied the library's ROP template -> shell at 14:47
Elapsed 45 min / verdict: within qualifier-cut range — the template saved 20 minutes

[CCE 2024 crypto — AES mode misuse]
Started 15:10 -> suspected ECB oracle, but CBC bit-flipping was the answer -> consulted Write-up (16:00)
-> reproduction complete 16:40 / verdict: type not owned — to the boot-camp list

How to read it: the second record is the very reason past-exam training exists — when an unknown type appears, go all the way to reproduction with the Write-up. Stop at "read and understood" and you won’t solve it in the qualifier either. Once reproduced, continue into 2-4’s generalization — three external similar problems of the CBC bit-flipping type become extra homework.

3-3. Trend Analysis — Reading Patterns from the Table

Feed the accumulated table into a script to extract trends. Save it as past_exam_analysis.py.

# past_exam_analysis.py — domestic competition past-exam trend analyzer
# Replace the PAST list with your team's organized past-exam data
from collections import Counter

# (competition, year, field, representative technique, solved by us)
PAST = [
    ("CODEGATE", 2024, "pwn",       "heap chunk manipulation",  False),
    ("CODEGATE", 2024, "web",       "SSRF",                     True),
    ("CODEGATE", 2024, "rev",       "anti-debugging",           False),
    ("CODEGATE", 2024, "crypto",    "RSA common factor",        True),
    ("CODEGATE", 2025, "pwn",       "stack BOF + ROP",          True),
    ("CODEGATE", 2025, "web",       "SSTI",                     True),
    ("CODEGATE", 2025, "forensics", "memory dump analysis",     False),
    ("CODEGATE", 2025, "misc",      "OSINT",                    True),
    ("CCE",      2024, "pwn",       "stack BOF + ROP",          True),
    ("CCE",      2024, "web",       "file upload bypass",       True),
    ("CCE",      2024, "crypto",    "AES mode misuse",          False),
    ("CCE",      2024, "rev",       "packing/unpacking",        False),
    ("CCE",      2025, "pwn",       "format string",            True),
    ("CCE",      2025, "web",       "JWT manipulation",         True),
    ("CCE",      2025, "forensics", "network packet analysis",  True),
    ("CCE",      2025, "crypto",    "RSA common factor",        True),
]

n = len(PAST)
cats = Counter(p[2] for p in PAST)
techs = Counter(p[3] for p in PAST)
print(f"Analysis of {n} past problems (CODEGATE/CCE 2024-2025)\n")
print("[Field share]")
for c, k in cats.most_common():
    print(f"  {c:<10} {k} problems ({k/n*100:.0f}%)")
print("\n[Repeated techniques TOP 5]")
for t, k in techs.most_common(5):
    print(f"  {t}: {k}x")
unsolved = [p for p in PAST if not p[4]]
print(f"\n[Team coverage] solved {n-len(unsolved)}/{n} ({(n-len(unsolved))/n*100:.0f}%)")
print("[Unsolved types -> boot-camp list]")
for d, y, c, t, _ in unsolved:
    print(f"  {d} {y} | {c} | {t}")

Run result — measured output with the organized data above:

Analysis of 16 past problems (CODEGATE/CCE 2024-2025)

[Field share]
  pwn        4 problems (25%)
  web        4 problems (25%)
  crypto     3 problems (19%)
  rev        2 problems (12%)
  forensics  2 problems (12%)
  misc       1 problems (6%)

[Repeated techniques TOP 5]
  RSA common factor: 2x
  stack BOF + ROP: 2x
  heap chunk manipulation: 1x
  SSRF: 1x
  anti-debugging: 1x

[Team coverage] solved 11/16 (69%)
[Unsolved types -> boot-camp list]
  CODEGATE 2024 | pwn | heap chunk manipulation
  CODEGATE 2024 | rev | anti-debugging
  CODEGATE 2025 | forensics | memory dump analysis
  CCE 2024 | crypto | AES mode misuse
  CCE 2024 | rev | packing/unpacking

How to read it: three conclusions emerge. ① In field share, pwn and web make up 50% — half the qualifier — so the owners of these two fields are the qualifier’s deciding ground. ② Repeated techniques — RSA common factor and stack BOF+ROP were each posed twice. What repeats is likely to appear again this year, and fortunately we’ve solved both (they’re in the library). ③ Coverage 69% and a boot-camp list of 5 items — that list is the boot-camp plan itself, through the qualifier. Note also that rev is 0 of 2 — its share is low, but a complete blank creates a "giving away solvable problems" situation in the qualifier.

3-4. The Boot-Camp Plan — Prioritizing Unsolved Types

You can’t do all 5 boot-camp items at once (Step 295’s single-goal principle). Two priority criteria — field-share weighting (pwn’s heap chunk manipulation is more urgent than rev’s unpacking) and the type’s recency continuity (did it appear in recent years too).

Boot-camp plan (screen example):
Priority 1: heap chunk manipulation (pwn's 25% share + posed in 2024) — 10-problem boot camp, owner assigned
Priority 2: AES mode misuse (neighbor of crypto's repeated techniques) — 6 problems bundling ECB/CBC oracles
Priority 3: memory dump analysis (forensics) — Volatility basics course + past-exam reproduction
Deferred: 2 rev items — postponed to finals goals; for the qualifier, limit the role to "basic static analysis"

Each boot camp follows Step 288’s format — 10 problems of the type, a cheat sheet, and a self-test at the end: one fresh problem under a time attack. The boot camp’s output (the cheat sheet) is committed to the team library and turned into an asset.

3-5. Preparing Qualifier Registration — The Rules Are Tactics

Finally, check the competition’s hardware. Checking the rules connects to points as directly as technical preparation.

Qualifier preparation checklist (screen example):
[ ] Qualifier date and duration (24 hours? 36 hours?) — calendar entry, team members' schedules fixed
[ ] Team composition rules — member limits, affiliation limits, dual-affiliation prohibition
[ ] During-competition rules — scope of external references, Write-up publication timing, clauses forbidding attacks on problem servers
[ ] Submission method — flag format, submission-count limits, dynamic scoring or not
[ ] Accounts/infrastructure — pre-register on the competition platform, pre-test VPN/environment
[ ] Team registration complete — deadline checked, confirmation email saved

Why rules are tactics: a "submission-count limit" bans blind submitting; "dynamic scoring" raises the value of the eat-easy-first tactic; a "4-member limit" changes the answer to the recruiting discussion (Step 296). Knowing the rules is also a skill — every year some team loses points in the qualifier for not knowing them.

4. Missions & Exercises

Mission — Solve 10+ Past Problems + Trend-Analysis Table

Collect public past exams from CODEGATE/CCE, store problems and Write-ups separately, and build the organized table in 2-3’s structure (competition | year | field | technique | solved).
Solve at least 10 problems total, 2–3 per field, with a timer — for unknown types, always reproduce after consulting the Write-up.
Replace PAST in past_exam_analysis.py with your organized data, run it, and check field share, repeated techniques, and coverage.
Prioritize the unsolved-types list (share, continuity) into a boot-camp plan — connect each type to external similar problems via 2-4’s generalization.
Fill the qualifier preparation checklist (3-5) with your team’s actual information and complete team registration.

Exercises

Exercise 1. What does the domestic major qualifier’s difficulty-curve feature (a wide gap between easy and hard problems) demand of team tactics? Answer by connecting it to Step 295’s two-stage tactics.

Exercise 2. Why must problem files and Write-ups be stored separately when collecting past exams?

Exercise 3. Using the concept of "type generalization," explain why past-exam-centered preparation is effective despite past exams’ scarcity.

Exercise 4. Explain the two boot-camp priority criteria (field-share weighting, posing continuity) with examples from this chapter’s measured analysis results.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Table structure: does every past-exam row have competition, year, field, technique, and solved status filled — without these five cells, it can’t be the analysis script’s input.
Time records of solving: does each problem have start/solve times and a "within qualifier-cut range" verdict — untimed past-exam solving is not a simulation.
Evidence of reproduction: for problems where the Write-up was consulted, is there a reproduction record (a log of solving to the end yourself)?
Analysis completeness: were the script output’s three blocks (share, repeated techniques, coverage) read together in a meeting?
Boot-camp connection: has each type on the boot-camp list been expanded to 3+ similar problems on external platforms — did 1 past problem swell into type training?
Registration complete: are the checklist’s 6 cells filled with actual information and proof of registration (email, etc.) saved?

Exercise Answers

Answer 1. Since the structure is decided by the ability to eat mid-difficulty problems "fast and accurately," tactics require separating rapid capture of the base score from mid-tier concentration — in other words, Step 295’s two-stage tactics (blitz easy problems in 4 hours → commit 70% to Medium tier) become the qualifier tactics as-is. A wide gap means most teams can’t solve the hard problems even if they grind them, so the judgment to drop Hard ambitions and concentrate firepower on mid-tier completion matters. What past exams should drill is exactly that mid tier’s speed and accuracy.

Answer 2. Because reading the Write-up first destroys the problem’s training value. A CTF problem’s value lies in "the process of finding the entrance yourself"; solving after seeing the answer is reproduction practice, not exploration training — and with only 16 past exams, wasting one problem is felt heavily. Separate storage is a physical device — the folder structure forces you to open the Write-up folder only when consultation is needed (after the set time limit passes). It keeps the rule by structure, not by willpower.

Answer 3. Past exams are few, but they are the only sample carrying the problem setters’ habits, and generalization can grow their volume. Solve one past problem and verbalize its core technique as structure ("manipulating an adjacent chunk by overwriting heap metadata"), and you can find 3–5 more problems of the same structure on external platforms for additional training. This way 16 past exams become textbooks of 16 types, each backed by a practical volume of practice problems. The past exam’s role is not a question bank but "a map that tells you what to practice," and generalization converts that map into actual training volume.

Answer 4. Example of field-share weighting: in the measured data, pwn has the largest share at 25%, so among unsolved types, "heap chunk manipulation (pwn)" outranks "anti-debugging (rev 12%)" — because the probability of meeting it in the qualifier is higher. Example of posing continuity: "RSA common factor" and "stack BOF+ROP" were posed repeatedly across 2024–2025, making them high-continuity types (our team can solve both — defense complete, confirmed in the library). Conversely, techniques posed only once drop in priority. Multiply the two criteria and the 5-item boot-camp list becomes an ordered plan.

Completion Criteria Checklist

[ ] I collected past exams and stored problems/Write-ups separately
[ ] I completed the past-exam table (competition | year | field | technique | solved)
[ ] I solved 10+ past problems with a timer
[ ] For unknown types, I completed reproduction after consulting the Write-up
[ ] I ran the trend-analysis script on my data and checked share, repeated techniques, and coverage
[ ] I established a boot-camp plan for unsolved types (with priorities)
[ ] I generalized and expanded each boot-camp type to external similar problems
[ ] I filled the qualifier preparation checklist and completed team registration

6. Common Pitfalls & Fixes

Wall 1. I opened my past-exam CSV and got an encoding error

Symptom: reading an Excel-saved CSV in Python throws this error.

UnicodeDecodeError: 'utf-8' codec can't decode byte 0xba in position 0: invalid start byte

Cause: Excel on Korean Windows saves CSV as CP949 by default, while Python’s default read encoding is UTF-8 (measured).

Fix: match the encoding when reading — Path("past.csv").read_text(encoding="cp949"). The fundamental prevention is at the save step — save from Excel in "CSV UTF-8" format, or manage the organized table as a Markdown table from the start. For a team-shared document, Markdown without encoding issues is better.

Wall 2. There are far fewer past exams than I expected — is this enough to prepare?

Symptom: public past exams number only a few per year and field.

Cause: that’s normal — domestic competitions’ public archives are small by nature. Which is why 2-4’s generalization exists.

Fix: redefine the past exam’s role — not a question bank but a sample of posing trends. Sixteen problems are enough to read field share and repeated techniques, and the actual training volume is filled by the external similar problems found through generalization. If it’s still not enough, widen the sample with past exams from other domestic competitions of similar setters or tier (such as the Cyber Attack Defense Competition) — but distinguish per-competition grain differences with the table’s "competition" column.

Wall 3. I read the Write-up but can’t reproduce — there’s no environment

Symptom: the past exam’s server is down, so there’s nowhere to fire the exploit.

Cause: past-exam archives often keep only the problem files while the service is long gone.

Fix: three routes. ① If you have the problem files (binary, source), rebuild the environment locally — a pwn problem’s binary runs locally too. ② If rebuilding is impossible, substitute type reproduction — find a problem of the same technique on an external platform (Dreamhack, etc.) and solve it to the end. The technique’s hand muscles are the same muscles wherever you train them. ③ If neither works, go all the way with static analysis — confirming in code that "this input crashes here" is half the training.

Wall 4. I finished the trend analysis, then a notice appeared: "different problem setters from last year"

Symptom: the analysis’s premise (the setters’ habits) is shaken.

Cause: setter changes really happen — as 2-2 warned, past exams are a topographic map, not prophecy.

Fix: don’t discard the analysis; adjust the weights. Raise the weight of recent years’ exams, and trust field share (a competition’s identity survives setter changes better) over repeated techniques. And in the qualifier’s first 30-minute full sweep, verify "this year’s grain" on the spot — noticing early that the map is wrong is also a sense past-exam training gave you.

Wall 5. Buried in qualifier prep, my regular competition cycle collapsed

Symptom: absorbed in boot camps and past-exam analysis, you’re about to skip the weekend competition (#11).

Cause: a new goal pushes routines aside — yet the competition cycle is the very proving ground of the boot camps.

Fix: use weekend competitions as the boot camp’s exam hall — bundle the two schedules, as in "if a heap type appears in this competition, we measure the boot camp’s results," and conflict becomes synergy. The final check of qualifier prep belongs to Step 300’s dress-rehearsal competition, so keeping the cycle alive is itself part of qualifier prep. The moment the routine breaks, the growth engine we validated over ten competitions stops.

7. Summary

Today’s Concepts

Concept	One-line explanation
Domestic competitions’ grain	Scenario-reenactment problems, Korean material, qualifier-finals structure — same sport, different league
Past-exam-centered preparation	Convergent preparation using the only sample carrying the setters’ habits
Past-exam table	Competition, year, field, technique, solved — the condition of analyzable form
Type generalization	Turn 1 past exam into a structure sentence and expand to external similar problems
Coverage contrast	The list of past-exam types we can’t solve = the boot-camp plan
Rules are tactics	Limits, formats, and scoring methods are inputs to tactics

Today’s Commands & Tools

Command/tool	What it does
`python past_exam_analysis.py`	Output field share, repeated techniques, coverage, and the boot-camp list
Separate past-exam storage	Problems folder / Write-ups folder — the device that preserves training value
Qualifier preparation checklist	The 6 cells: date, composition, rules, submission, infrastructure, registration
Boot-camp plan template	Priority (share × continuity) + problem count per type + owner
Generalization 3-step formula	Verbalize technique → 3 features → external search & expansion

The Core Instinct

What ten overseas weekend competitions grew in you is skill; what past-exam analysis grows is stage adaptability — the sense of "knowing what this competition asks." Equal skill, more points for the team that knows the stage. The qualifier is that sense’s first exam hall.

And don’t forget — the end of past-exam analysis is not analysis but boot camps; the end of a boot camp is a cheat sheet; the end of a cheat sheet is a library commit. Only when this chain turns will the problems you face on qualifier day be not "problems never seen before" but "types solved somewhere before."

Once every box is checked, Step 298 is complete. Click the checkbox in the sidebar to save your progress.