Step 325. Intensive Training for the Finals — Two Weeks of Making What You Know Certain

Level 4 — Professional | Difficulty ★★★★☆ | Estimated time: 2 days (half a day to build the training plan + designing and launching the 2-week training)

Prerequisites: Step 324’s qualifier results record (the unsolved-problem list and stall points). This applies identically to teams whose finals slot is confirmed and to teams designing the same training format for next season.

What you need: the qualifier results record (Step 324’s deliverable), the finals announcement (format, time, rules), a training platform (Dreamhack, external wargames, etc.), and team meeting time. The schedule-generator script is a measured tool you run with your own data; finals-related information is marked as screen examples.
Caution: this chapter’s training period assumes "about two weeks left until the finals." Even if you didn’t advance, reproducing the qualifier’s unsolved problems remains exactly the most efficient training.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Reproduction training is performed only with published problem files in a local environment.

The finals slot is confirmed. The remaining two weeks decide the match — and there’s a trap in how you use these two weeks. Impatience demands "something new." Should we learn kernel pwn while we’re at it, pick up the latest web chains? That’s exactly the temptation to watch for. And that temptation is the road to losing the finals.

The last two weeks are not a time for learning new things — they’re a time for making what you know certain. The problems you couldn’t solve in the qualifier were designed by the authors as "finals level," and reproducing them is itself the best finals preparation. Today you’ll research the finals format, build a reproduction-centered two-week schedule with a tool, and break ground on the training.

1. Learning Objectives

By the end of this chapter, you will be able to:

Research the finals format (long-duration Jeopardy / Attack & Defense / presentation included) and explain how preparation differs by format
Explain why reproducing the qualifier’s unsolved problems is the best finals prep, and complete those reproductions
Organize training items by importance and duration, and generate a schedule that assigns them across the remaining days
List the three additional trainings needed when the format is Attack & Defense (A&D)
Explain the rationale for the "no new techniques in the last two weeks" principle and apply it to the training plan

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3 (training-schedule generation), local reproduction environment (VM/Docker), training platform, shared document
Today’s command	`python step325_training_plan.py` — auto-assign training items across the remaining days
Concepts needed	Reproduction training (understanding a solution ≠ solution ability), format-specific prep, the last-two-weeks principle, buffer
Today’s deliverable	A finals-format research memo + reproduction records + a 2-week training schedule + a draft operations plan

2-1. The Finals Are a Different Game — Three Formats

If the qualifier was a 24-hour online Jeopardy, the finals split by competition into different formats. Preparing without knowing the format is like training without knowing your event.

Format	Structure	The core of preparation
Long-duration Jeopardy	1–2 days, fewer problems, higher difficulty	Stamina for deep digging, long-session operations, adapting to an offline venue
Attack & Defense (A&D)	Every team runs the same services — patch your services + attack opponents’	Patch speed, exploit automation, traffic monitoring
Solution presentation included	Present your submitted solutions before judges, with Q&A	Documentation quality of solutions, explanatory power, handling questions

The same skill converts at different rates depending on the format. The team that wins a long Jeopardy is the team with "the endurance to dig one problem for six hours"; the team that wins A&D is the team with "the division of labor that runs attack and patching simultaneously." The first act of preparation is not training but format research — check past finals retrospectives and the rules for format, duration, and scoring.

2-2. Reproduction Training — Why "Solve Again," Not "Understand"

Write-ups for the problems you couldn’t solve in the qualifier get published. Here’s the fork in the road: reading one and ending at "ah, I see," versus building the environment yourself and solving it again by hand. The difference shows up precisely at the competition.

Understanding a solution ≠ solution ability. Reading a write-up, we follow the process already knowing the result, so every step looks natural. But a competition problem comes with no result — where to form which hypothesis is exactly the object of training, and it only grows from colliding with problems without the answer. Reproduction is training where your hands perform the whole process themselves, even with the write-up beside you.

Reproduction has three rules. ① Build the environment yourself — run the problem binary locally, or build the Docker file if one’s provided. ② When stuck, look at only the write-up’s "next one step" — read the whole thing and follow along and it’s not reproduction, it’s transcription. ③ After finishing, generalize the type in one sentence and commit it to your library (Step 298’s generalization formula).

2-3. Preparing for Attack & Defense — Three Extra Trainings If the Format Is A&D

If the finals are A&D, Jeopardy training alone is not enough. A&D is not a game of "solving problems" but a game of "operating services." Three trainings to add.

A&D additional training list:
1. Patch-speed training — take a vulnerable service's source and practice writing,
   applying, and verifying a patch that blocks only the vulnerability without
   breaking features, within 30 minutes (timer required)
2. Exploit automation — convert an exploit that succeeded by hand into "a script
   that works against every opposing team's server just by changing the IP"
   (including repeated runs and result collection)
3. Traffic-monitoring system — a system that watches attack traffic hitting your
   service and reverse-engineers the opponent's exploit (pcap collection +
   suspicious-pattern alerts)

What the three share is speed and repetition. In A&D, a quickly deployed 80% patch defends more points than one perfect patch, and a plain automation that runs against every opponent harvests more points than one exquisite exploit. Jeopardy’s depth and A&D’s speed are different muscles.

2-4. The Last-Two-Weeks Principle and Buffers — The Plan’s Two Axes

The principle for this period is one: the last two weeks are not "a time to learn new things" but "a time to make what you know certain." A new technique’s learning curve mostly doesn’t reach field level within two weeks, and a half-learned technique creates "pretending to know" at the finals, burning time. Raising the accuracy and speed of what you know is the highest-expected-value investment of this period.

The second axis is the buffer. Reproductions take longer than expected, team members’ schedules slip, environment setups tangle. If required time and available time are exactly equal, the plan collapses at the first delay. Leaving 15–20% of available time as empty space is part of the plan. The tool in 3-3 computes this buffer for you automatically.

3. Follow Along

3-1. Finals-Format Research — The Plan’s Input Values

First of all, confirm the finals format. Research channels: the competition announcement and rules document, past finals retrospectives (participants’ blogs), and the organizer’s pre-event briefing.

Finals-format research memo (screen example):
- Format: offline long-duration Jeopardy (10:00–18:00, 8 hours)
- Problems: 6–8, mixed categories, some with staged flags
- Environment: venue network, bring your own laptop, some stretches with restricted external internet
- Scoring: static points + ties broken by earliest last-flag submission time
- Notable: top 3 teams give solution presentations after the end

An example of research changing the plan: if there’s "restricted external internet," the plan gains an item to prepare exploit libraries and documents as local copies. If "ties broken by submission time," the swift harvesting of easy problems returns to importance. A plan without research is a plan built on imagination.

3-2. Reproducing the Qualifier’s Unsolved Problems — The Top-Priority Item

Pull the unsolved-problem list from Step 324’s results record. Since these problems were designed by the authors at finals level, reproducing them is itself solving anticipated finals problems. Distribute them among team members and proceed under 2-2’s reproduction rules.

Reproduction record template (screen example):
[Qualifier crypto-aes reproduction — owner C]
- Environment setup: built the problem source locally (Docker file provided) — 40 min
- First attempt: same approach as in the qualifier (assuming an ECB oracle) — 50 min, stall reproduced
- Checked the write-up's first hint: "check the mode" — confirmed CBC via response-length analysis
- Wrote the bit-flipping exploit — 1h 20m, obtained the local flag
- Generalization commit: "a procedure for ruling out CBC even when it looks like a fixed-prefix oracle"
  → added a 'mode identification procedure' item to the crypto cheat sheet

How to read it: the most valuable line in the record is "first attempt … stall reproduced." That’s the moment confirming the qualifier’s stall wasn’t chance but structure (the absence of a procedure for verifying assumptions). Reproduction’s deliverable is not the flag — it’s this confirmation and the generalized cheat-sheet item.

3-3. The Two-Week Training Schedule — Assigned by a Tool

Assign reproductions, special training, and operations prep across the remaining days. Split it by feel and it piles up front, leaving training on the final days. Save as step325_training_plan.py — just replace DAYS_LEFT and TASKS with your team’s situation.

# step325_training_plan.py — finals-prep intensive-training schedule generator
DAYS_LEFT = 14          # days until the finals
HOURS_PER_DAY = 4       # trainable hours per day

# (training item, hours needed, importance 1~5, kind: reproduction/special/operations)
TASKS = [
    ("Qualifier unsolved-problem reproduction (split among all)", 16, 5, "reproduction"),
    ("Heap pwn special training, 10 problems",                    12, 4, "special"),
    ("Advanced crypto (AES oracles) special training",             8, 3, "special"),
    ("Exploit library cleanup & commit",                           4, 5, "operations"),
    ("Finals operations-plan meeting (confirm roles & shifts)",    3, 5, "operations"),
    ("Final gear & checklist inspection",                          2, 4, "operations"),
    ("Condition management (no training, rest)",                   0, 5, "operations"),
]

capacity = DAYS_LEFT * HOURS_PER_DAY
need = sum(t[1] for t in TASKS)
print(f"=== Finals D-{DAYS_LEFT} Training Schedule ===")
print(f"available: {DAYS_LEFT} days x {HOURS_PER_DAY}h = {capacity}h / needed: {need}h")
print(f"slack: {capacity - need}h (buffer {max(0,(capacity-need))*100//capacity}%)n")

plan = []
day, left = 1, HOURS_PER_DAY
for name, hours, imp, kind in sorted(TASKS, key=lambda t: -t[2]):
    if kind == "operations" and "Condition" in name:
        plan.append((DAYS_LEFT, name, 0))
        continue
    remain = hours
    while remain > 0:
        if day > DAYS_LEFT - 2 and kind != "operations":
            day = DAYS_LEFT - 2  # no new training in the last two days
        use = min(remain, left)
        plan.append((day, name, use))
        remain -= use
        left -= use
        if left <= 0:
            day += 1
            left = HOURS_PER_DAY

plan.sort()
cur = None
for d, name, use in plan:
    if d != cur:
        print(f"day {d:>2} (D-{DAYS_LEFT - d:>2}):")
        cur = d
    print(f"   - {name}" + (f" ({use}h)" if use else ""))

print("nRule check: is no new-technique training scheduled in the last 2 days (D-1, D-0)?")
bad = [p for p in plan if p[0] >= DAYS_LEFT - 1 and p[2] > 0 and "inspection" not in p[1]]
print("   ->", "OK, last 2 days are inspection & rest only" if not bad else f"violation: {bad}")

Here’s the measured output from running it with the data above:

=== Finals D-14 Training Schedule ===
available: 14 days x 4h = 56h / needed: 45h
slack: 11h (buffer 19%)

day  1 (D-13):
   - Qualifier unsolved-problem reproduction (split among all) (4h)
day  2 (D-12):
   - Qualifier unsolved-problem reproduction (split among all) (4h)
day  3 (D-11):
   - Qualifier unsolved-problem reproduction (split among all) (4h)
day  4 (D-10):
   - Qualifier unsolved-problem reproduction (split among all) (4h)
day  5 (D- 9):
   - Exploit library cleanup & commit (4h)
day  6 (D- 8):
   - Finals operations-plan meeting (confirm roles & shifts) (3h)
   - Heap pwn special training, 10 problems (1h)
day  7 (D- 7):
   - Heap pwn special training, 10 problems (4h)
day  8 (D- 6):
   - Heap pwn special training, 10 problems (4h)
day  9 (D- 5):
   - Final gear & checklist inspection (1h)
   - Heap pwn special training, 10 problems (3h)
day 10 (D- 4):
   - Advanced crypto (AES oracles) special training (3h)
   - Final gear & checklist inspection (1h)
day 11 (D- 3):
   - Advanced crypto (AES oracles) special training (4h)
day 12 (D- 2):
   - Advanced crypto (AES oracles) special training (1h)
day 14 (D- 0):
   - Condition management (no training, rest)

Rule check: is no new-technique training scheduled in the last 2 days (D-1, D-0)?
   -> OK, last 2 days are inspection & rest only

How to read it: look at four structures. ① The 19% buffer — 11 of 56 hours are empty space. Delays and extra reproductions consume this space. ② Reproduction takes the first 4 days — importance 5 goes first, and bunching it while memories are fresh is also intentional. ③ Special training is placed consecutively — the 12 hours of heap training run across days 6–9. Special training builds hand muscle that cools when interrupted, so it must clump. ④ Day 13 (D-1) is empty — the result of the script’s "no new training in the last two days" rule pushing things out. The last two days are inspection and rest only. This empty space is what 2-4’s principle looks like carved into a plan.

3-4. The Operations-Plan Meeting — The Training’s Final Item

The operations-plan meeting assigned to day 6 finalizes not training but finals-day operations. It’s the occasion to revise Step 324’s strategy document for the finals format.

Finals operations-plan meeting agenda (screen example):
1. Reflect the format — revise the time constants of enumeration, meeting, and
   handoff rules for an 8-hour Jeopardy
   (e.g., the 2-hour handoff rule → shorten to 90 minutes for an 8-hour competition?)
2. Category assignments — reassign owners reflecting special-training results
3. Handoff rules — do we keep document handoffs even offline (same room)?
4. Meals & rest plan — meal routes at the venue, designate a condition manager
5. Local-copy check — offline packaging of libraries & documents for internet restrictions

The meeting’s deliverable is one page: the "finals-day strategy document." Everything in these two weeks of training was material for this document.

3-5. Managing the Training — The Schedule as a Living Document

The schedule is not a scroll to hang on the wall but a document to update daily. The rules are simple.

At the end of each training day, mark completions, and pull delayed items from the buffer to reassign them.
When the buffer runs out, don’t add items — cut the lower-priority special training; reproduction and operations prep are protected to the end.
In a weekly 15-minute check-in meeting, share each person’s progress and stalls — merge a second owner onto stalled reproductions.

A plan slipping is not failure but information. The habit of recomputing the schedule by however much it slipped becomes your re-judgment ability on finals day.

4. Missions & Exercises

Mission — Build the Two-Week Plan and Start Reproducing

Fill the finals-format research memo (3-1) with the real announcement and retrospectives — the five fields: format, duration, environment, scoring, notable items.
Distribute all of Step 324’s unsolved problems among team members and reproduce them under the reproduction rules (2-2). Leave a reproduction record per problem (3-2’s template).
Replace TASKS in step325_training_plan.py with your team’s items, generate the schedule, and confirm the buffer is at least 15% — adjust items if it falls short.
If the finals are A&D, add the three extra trainings (2-3) to TASKS and regenerate the schedule.
Hold the operations-plan meeting and complete the draft finals-day strategy document.

Exercises

Exercise 1. Explain the difference in "understanding a solution ≠ solution ability" through the difference in cognitive conditions between reading a write-up and meeting the problem at a competition.

Exercise 2. Explain why Jeopardy training alone is insufficient when the finals are Attack & Defense, through the difference in "how points are produced."

Exercise 3. Give two reasons why, in 3-3’s measured schedule, special training (heap pwn) is placed after reproduction and placed consecutively.

Exercise 4. Imagine and describe one concrete accident scenario that happens at the finals when the "no new techniques in the last two weeks" principle is violated.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Research concreteness: are the five fields of the format-research memo filled based on actual documents (announcements, retrospectives)? "Probably Jeopardy" is not research.
Reproduction completeness: does every unsolved problem have a reproduction record, and does each record have the three stages — environment setup, stall reproduction, generalization commit?
Plan soundness: is the schedule’s buffer at least 15%, and is no new training scheduled in the last two days — does the script’s rule-check output say "OK"?
Format reflection: were the researched format’s traits (internet restrictions, A&D, presentations, etc.) converted into plan items?
Document linkage: are the training plan and special-training results reflected in the draft "finals-day strategy document"?

Exercise Answers

Answer 1. Reading a write-up, we follow the process backward already knowing the result (the correct technique). At every branch point we already know "which path is right," so the process of forming, testing, and discarding hypotheses is skipped. At a competition, that process is everything — where to suspect what, which experiment confirms it, when to abandon a hypothesis. This decision-making muscle is only trained in situations where you collide without the result. Reproduction training is the device that makes your hands perform the whole process even with a write-up available, converting "knowledge read" into "skill you can do."

Answer 2. Jeopardy points come from "solving a hard problem exactly once," so depth and focus are the assets. A&D points, by contrast, leak in continuously from three channels — the time your service stays alive (defense points), the number of opposing teams you breach (attack points), and service-health checks (SLA). The total is not one deep success but a running sum of repeated speed. Hence the need for three "operations muscles" — patch speed, exploit automation with repeated execution, and intrusion-detection systems — and these are not grown by Jeopardy training.

Answer 3. First, because reproduction’s importance (5) outranks special training (4–3) — the qualifier’s unsolved problems are actual specimens the authors designed at finals level, and the special-training types get confirmed during the reproduction process itself. Reproduction must come first for the special training’s targets to be accurate. Second, special training builds a technique’s hand muscle, and its effect halves when scattered — the same muscle must be repeated on consecutive days for that muscle to still be there on competition day. Contrary to the spacing effect for memory, scattering right before skill acquisition only inflates context-switching costs.

Answer 4. Example scenario: suppose a teammate starts learning "kernel exploitation" fresh one week before the finals. When a kernel problem opens at the finals, they engage it with half-learned knowledge — had they known nothing at all, the handoff rule would have fired, but "knowing a little" justifies engaging. Three hours later the problem is unsolved, and during those three hours a medium problem they could have solved went cold for lack of hands. The price of a new technique is billed not just as that time but as a double loss of opportunity cost. This is why the last-two-weeks principle is not a matter of greed but of total-score management.

Completion Criteria Checklist

[ ] I researched the finals format (format, duration, environment, scoring, notable items) and wrote the memo
[ ] The whole team reproduced the qualifier’s unsolved problems and left a record per problem
[ ] I generalized each reproduction’s type and committed it to the library/cheat sheets
[ ] I generated the 2-week training schedule and confirmed a buffer of at least 15%
[ ] (If A&D) I included patch-speed, automation, and monitoring training in the plan
[ ] I verified via the script’s rule check that no new training sits in the last two days
[ ] I completed the draft finals-day strategy document through the operations-plan meeting

6. Common Pitfalls & Fixes

Wall 1. I want to reproduce a qualifier problem, but its server is down

Symptom: the problem’s remote service is gone, so there’s nowhere to fire the exploit.

Cause: services coming down after the competition ends is normal — the same structure as Step 298’s Wall 3.

Fix: three branches. ① If the problem files (binary, source, Docker file) are public, rebuild the environment locally — the rebuilding process itself is training. ② If rebuilding is impossible, substitute with a type reproduction of the same technique from an external platform. ③ If neither works, complete a static analysis to the end. Whichever branch, you only count it as reproduction if there’s a record that "my hands went all the way" — ending with reading is not reproduction.

Wall 2. I ran the schedule and needed time exceeds available time

Symptom: the output shows a negative like "slack: -8h" (measured — happens when you stuff in too many items).

Cause: too many things you want to do in two weeks. Including buffer, the plan is physically impossible.

Fix: the cutting priorities are fixed. ① Trim importance-3-or-below special training first (10 problems → 6). ② If it still overflows, reduce the volume of importance-4 special training. ③ Reproduction and operations prep (importance 5) are protected to the end. The judgment criterion is "does it connect directly to finals-day total score?" Special training is an investment in possibility, but reproduction and operations are prep for harvesting confirmed points.

Wall 3. A reproduction is taking far longer than planned

Symptom: a reproduction budgeted at 16 hours stretches past 24.

Cause: problems that stalled you in the qualifier were hard to begin with. And environment rebuilds always exceed estimates.

Fix: respond two ways. ① Adjust the reproduction’s scope — "flag to the very end" is the goal, but if it’s truly stuck, lower the completion bar to "executing the core-technique stages by hand" and cover the rest with static analysis. ② Spend the buffer, and when it’s gone, reduce the number of reproduction problems — 100% of 2 problems beats 70% of 3. Reproduction’s value lies in depth, not breadth.

Wall 4. A teammate keeps saying "if we just learn this one technique"

Symptom: impatience shows up as greed for new techniques. The 2-4 principle wavers.

Cause: pre-finals anxiety is normal — because anxiety seeks "controllable action," it surfaces as an urge for new learning.

Fix: don’t defend the principle by debate; defend it with the schedule — add that technique’s learning hours to TASKS and re-run the script, and the numbers show the buffer going negative or other items being pushed out. Showing numerically the distance between "want to learn" and "fits in the plan" is persuasion. One exception, though — if research confirms that category is guaranteed at the finals and the team has no owner for it, that’s not greed but gap-filling. The distinguishing criterion is "is it grounded in research?"

Wall 5. It’s an offline finals and I forgot the "local copies"

Symptom: internet is restricted at the venue, but your cheat sheets and library live only in the cloud.

Cause: you prepared with online-qualifier habits — the typical accident when 3-1’s "environment" field went unfilled.

Fix: build the "offline package" before 3-4’s operations meeting — the whole exploit library, local copies of cheat sheets and playbooks, reference documents (offline docs for languages/libraries), plus a compressed archive of the package on USB. More important than making it is verifying it — turn off the laptop’s network and actually test "can I solve one problem to the end in this state?" The package’s completeness is proven not by file count but by this test.

7. Summary

Today’s Concepts

Concept	One-line explanation
The 3 finals formats	Long-duration Jeopardy / Attack & Defense / presentation included — format determines prep
Reproduction training	Solving again by hand beside the write-up — converting understanding into ability
Reproduction’s 3 rules	Build the environment yourself · consult only the next one step · generalization commit
A&D extra trainings	Patch speed · exploit automation · traffic monitoring
Last-two-weeks principle	No new techniques, make the known certain — not greed but total-score management
Buffer	15–20% of available time left empty — the plan’s durability component

Today’s Tools & Commands

Tool/command	What it does
`python step325_training_plan.py`	Sorts training items by importance, assigns days, computes buffer, verifies the last-2-days rule
Format-research memo	The five fields: format, duration, environment, scoring, notable items
Reproduction record template	Environment setup → stall reproduction → stepwise hints → generalization commit
Finals-day strategy document	The operations meeting’s deliverable — the qualifier document’s finals revision
Offline package	Local copies of libraries & documents + an actual no-network verification run

The Core Instinct

Two weeks of training are measured not by the amount of knowledge but by the depth of certainty. Ten "techniques I’ve seen" make fewer finals points than three "techniques my hands run even half-asleep." Reproduction is the shovel that digs that depth, and the schedule is the map that keeps the shovel from digging the wrong spot.

And don’t fear the empty last two days of these two weeks. That emptiness is not laziness but design — the logistics time for delivering condition, your most expensive resource, to competition day.

Once every box is checked, Step 325 is complete.