Step 338. Intensive Weakness Training — Completing the Top Tier: Escaping the Trap of Doing More of What You’re Good At

Level 4 — Professional | Difficulty ★★★★☆ | Estimated time: 2+ days (per-weakness training plan + reproduction/variant sessions + a check mock exam)

Prerequisites: Step 337’s win/loss analysis — the gap-coordinate list and 0-solve field tags, plus a training schedule registered in calendars. This is a wargame chapter that converts analysis’s output into conquest.

What you need: Step 337’s weakness list, past-problem files for those fields (competition public archives, the CTFtime archive), a local reproduction environment, and a Python environment (for the training tracker). The training-tracker script is a measured tool; the past-problem solving scenes are screen examples.
Caution: this chapter’s training uses only past problems from competitions that have ended and local environments — it does not target problems from competitions in progress or active platforms. It was written without connecting to any external platform, and every solving scene is a screen example.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.

People tend to train only the fields they like. Someone strong at web solves more past web problems; someone weak at crypto pushes the crypto session to next week. Yet as Step 337’s analysis showed, competition rank is decided not by your strongest field but by your weakest field — in top-tier fights, the difference between the winning team and us was usually "the field where we scored zero."

Today you train that weakness head-on. The method is fixed — reproduction of past problems, then variation. Only after passing both stages can you call it "conquest." This is not a period of forcing yourself through an un-fun field — it’s a period of raising the team’s floor to complete the top tier.

1. Learning Objectives

By the end of this chapter, you will be able to:

Sort a weak field’s past problems by difficulty and build a training plan
Execute the "reproduction → variation" two-stage training method and apply each stage’s pass criteria
Manage conquest progress numerically with the training-tracker script
Run an intra-team knowledge-sharing session (the Feynman technique) to raise the whole team’s floor
Verify whether each weakness type has been conquered with a check mock exam

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	The weak field’s tools (e.g., SageMath & z3 for crypto, pwntools & gdb for pwn), Python 3 (tracker)
Today’s command	`python step338_weakness_tracker.py` — reproduction/variation pass status and next priorities
Concepts needed	Reproduction training, variant problems, the Feynman technique, time-attack checks, designing success experiences
Today’s deliverable	A per-weakness training plan + conquest tracking records + team sharing-session material + check-mock-exam results

2-1. Zeroing Out Weaknesses — The Floor Decides the Rank

Look again at the structure Step 337’s aggregation revealed — the point gap to the winning team opened not in the fields we’re good at, but in the fields where we bled points. This is not our team’s private story; it’s a general law of the top tier. Top-tier teams have similar scores in their strongest fields — because everyone harvests them. The difference happens at the floor.

So this period’s training goal differs from usual. Not "get even better" but "eliminate the 0-solve fields." Perfect conquest is not the goal; the goal is a state where, when a basic-to-mid-level problem from that field appears at a competition, the team doesn’t stall — that is the definition of zeroing out. When the floor rises, your strongest field’s score becomes championship competitiveness as-is.

2-2. Reproduction → Variation — The Two Stages of Conquest

The training method for a weak field is fixed at two stages.

Stage	Contents	Pass criteria
Reproduction	Solve an ended competition’s past problem again, without the Write-up	Obtain the flag (or equivalent result) in a local reproduction environment
Variation	Solve it again with changed conditions — swap parameters, protections, constraints	Pass under the varied conditions too

Why go as far as variation — because reproduction proves "I can solve this problem," but competitions don’t give the same problem. Variation proves "I can pull out this problem’s technique and use it." How to make a variation is simple — change one of the problem’s core conditions. For crypto, the parameter size or mode; for pwn, the protections (add Full RELRO, change the glibc version); for web, add one filter rule. Only a problem solved through variation gets recorded as "conquered" in the tracker.

2-3. The Psychology of the Un-Fun Field — It’s Boring Because You Can’t Do It

The real obstacle of weak-field training is not difficulty — it’s the absence of fun. But trust this diagnosis — a weak field is mostly "boring because you can’t do it." The causality is reversed. With no success experiences it’s no fun; with no fun you avoid it; by avoiding it, no success experiences accumulate.

The way to break this loop is not willpower but difficulty design. Sort the past problems by difficulty and start from a problem one step below your current skill. The first session’s goal is not learning but manufacturing a success experience — solving a solvable problem to put the feeling "this field yields too" into your hands. Interest is not a precondition; it’s a byproduct of success.

2-4. The Feynman Technique — Teaching Is the Completion of Conquest

A session where the person who trained the weak field teaches it to the team is not optional — it’s part of the procedure. There are two reasons. ① If you can’t teach it, you don’t know it yet — the empty spots reveal themselves the moment you try to explain. "Can you explain it to someone else" is the cheapest, most accurate test of "did I really understand it." ② The team’s floor rises — at a competition, problems aren’t posed only to the assignee. On the day the crypto assignee’s condition collapses, the second person who "sort of knows" crypto is the team’s floor.

Keep the session format light — 30 minutes, one problem, a screen-shared demonstration of "where I got stuck and the path I escaped through." Not a polished lecture but a reenactment of the stuckness is the core. What the listener needs is not the solution but the movement when stuck.

3. Follow Along

3-1. Finalizing the Weakness List and Sorting Past Problems

Bring the weakness list from Step 337’s deliverables. Then gather that field’s past problems and sort them by difficulty.

■ Weakness list and past-problem sorting (screen example — from Step 337's results):

Weakness 1: 0 solves on hard crypto (gap coordinates: rsa-again, ecc-trap)
Weakness 2: pwn heap family (gap coordinate: heap-vault — it was an operations issue, but reinforce anyway)

crypto past-problem sorting (easiest first):
  1. caesar-var   (difficulty 1) — basic substitution cipher, for manufacturing a success experience
  2. rsa-again    (difficulty 2) — common-factor attack, the problem we bled at the competition
  3. cbc-bitflip  (difficulty 3) — understanding the mode's structure
  4. ecc-trap     (difficulty 4) — elliptic curves, the problem we couldn't open at the competition
  5. ecc variant  (difficulty 4) — parameter-swapped version (made by us)

Two sessions a week (Wed & Sat evenings, 2 hours), 1 problem per session

How to read it: note that the sorting’s first slot is "difficulty 1" — that’s 2-3’s success-experience design. And the problem we bled at the competition (rsa-again) enters the list at #2 — solving that problem again becomes this training’s symbolic rite of passage. The final "variant — made by us" gets built in 3-3.

3-2. The Reproduction Session — No Write-ups, but Records Yes

Three rules for reproduction sessions. ① No Write-ups — if you read the published solution to a past problem, that’s not reproduction, it’s recitation. ② Time attack — cap the session at 2 hours for competition feel. ③ Record your attempts — when stuck, leave the stuck point and the discarded hypotheses (Write-up viewing is allowed after 2 hours, but only after "how far I got on my own" is recorded).

■ Reproduction session record (screen example — crypto session #2, rsa-again):

[00:00] Engaged. Observed that N is shared across two public keys — "a pattern I've seen somewhere"
[00:25] Hypothesis: common factor? Computed gcd(N1, N2) — a non-1 number comes out
[00:30] p obtained, factorization succeeds — private key restored, flag decrypted
[00:35] Pass. Elapsed 35 minutes.
Lesson: "The same problem had me tied up for 3 hours at the competition, but now,
         with 'shared N' in the pattern catalog, it's 35 minutes. The gap was not
         knowledge — it was the index."

That last sentence is this training’s reward — the reproduction proved that the failure at the competition was not "didn’t know" but "wasn’t in the index." This sentence is the raw material for the team sharing session (3-4).

3-3. The Variation Session — Change the Conditions and Solve Again

A problem that passed reproduction gets a variant built. The variant’s design principle is "keep the core technique, swap the surrounding conditions."

■ Variant-problem design examples (screen example):

Original: rsa-again — two public keys share p (common-factor attack)
Variant 1: only two of three public keys share one — requires identifying them by pairwise gcd
Variant 2: shares q instead of p + e is a non-65537 value — confirms generalization of private-key computation

Original: heap-vault — arbitrary-address write via tcache poisoning
Variant: glibc 2.32+ — safe-linking applied to tcache. A heap-address leak must come first

Making the variant yourself is itself training — because you can only change a condition when you know which conditions are the technique’s premises. Being able to design a variant means you’ve started seeing the problem "with the problem author’s eyes," and that point is the state where you won’t stall when you meet a varied problem at a competition.

3-4. The Conquest Tracker — See Progress in Numbers

Record each session’s results in the tracker to manage conquest progress. Save as step338_weakness_tracker.py.

# step338_weakness_tracker.py — intensive weak-field training tracker
# DRILL: (field, past problem, difficulty 1~5, reproduction pass, variation pass)
DRILL = [
    ("crypto", "rsa-again (past-problem reproduction)", 2, True,  True),
    ("crypto", "cbc-bitflip (past-problem reproduction)", 3, True,  True),
    ("crypto", "ecc-trap (past-problem reproduction)", 4, True,  False),
    ("crypto", "ecc-trap variant — parameter swap",    4, False, False),
    ("pwn",    "heap-vault (past-problem reproduction)", 4, True,  False),
    ("pwn",    "heap-vault variant — protections added", 5, False, False),
]

print("=== Weak-Field Training Conquest Tracker ===n")
fields = sorted({d[0] for d in DRILL})
for f in fields:
    rows = [d for d in DRILL if d[0] == f]
    rep = sum(1 for _, _, _, r, _ in rows if r)
    var = sum(1 for _, _, _, _, v in rows if v)
    total = len(rows)
    conquered = all(r and v for _, _, _, r, v in rows)
    print(f"[{f}] reproduction {rep}/{total}, variation pass {var}/{total}"
          f" — {'conquest complete' if conquered else 'conquest in progress'}")

print("n[Next session priorities — problems where 'reproduction is done but variation isn't' first]")
todo = [d for d in DRILL if not (d[3] and d[4])]
for field, name, diff, r, v in sorted(todo, key=lambda d: (not d[3], -d[2])):
    state = "start from reproduction" if not r else "attempt variation"
    print(f"  {'*' * diff:<5} {field}/{name} — {state}")

print("nPass rule: it's 'conquered' only with BOTH past-problem reproduction (no Write-up) AND variation pass.")

Here’s the measured output from running it on the example data:

=== Weak-Field Training Conquest Tracker ===

[crypto] reproduction 3/4, variation pass 2/4 — conquest in progress
[pwn] reproduction 1/2, variation pass 0/2 — conquest in progress

[Next session priorities — problems where 'reproduction is done but variation isn't' first]
  ****  crypto/ecc-trap (past-problem reproduction) — attempt variation
  ****  pwn/heap-vault (past-problem reproduction) — attempt variation
  ***** pwn/heap-vault variant — protections added — start from reproduction
  ****  crypto/ecc-trap variant — parameter swap — start from reproduction

Pass rule: it's 'conquered' only with BOTH past-problem reproduction (no Write-up) AND variation pass.

How to read it: look at two things. ① There’s not a single "conquest complete" — that’s normal. Conquest’s pass judgment requires both reproduction and variation, and this tracker’s value lies in keeping "I sort of tried it" from being recorded. ② The priority ordering — "attempt variation" sits above "start from reproduction." A problem whose reproduction is done is one step from closing, so closing it first is efficient — and this order is decided not by feel but by a rule (the sort key). The longer a training period runs, the more the decision fatigue of "what do I do next" gnaws at the conquest rate — the tracker makes that decision for you.

3-5. The Team Sharing Session and the Check Mock Exam — Verifying Conquest

The last two procedures of training. First the sharing session — the person who trained the weak field holds a 30-minute session.

■ Team sharing-session format (screen example — 30 minutes):
- Topic: one problem (e.g., rsa-again and the common-factor attack)
- Structure: problem intro 5 min → reenactment of where I got stuck and the escape path 15 min → Q&A 10 min
- Rule: not a "solution demonstration" but a "reenactment of the stuckness" — what listeners take away is the movement
- Deliverable: a one-page session summary → linked in the team library's crypto/README

Then the check mock exam — take a time attack with a problem set that includes the weak field. This is conquest’s final verification.

■ Check mock-exam design (screen example):
- Composition: 2 crypto problems (basic + mid) + 1 pwn heap problem — all variants of trained types
- Conditions: 3-hour time attack, some competition operations rules applied (enumeration order, recording)
- Pass criteria: at least 2 of 3 problems + no 0-solve field
- Verdict: pass → zeroing-out complete, move to next-competition prep / shortfall → second-round drill on only the failed types

What differs between what you trained and the mock exam is that it’s mixed. At a competition, weak-field problems come out wedged between strong-field ones. Making that field emotionally "just another everyday problem" is part of completing the zeroing-out.

4. Missions & Exercises

Mission — Confirm Conquest by Weakness Type

Finalize Step 337’s weakness list, and sort each field’s past problems by difficulty — the first slot must be one step below your current skill.
Run reproduction training in twice-weekly sessions — observing the three rules: no Write-ups, time attack, recording attempts.
For each reproduction-passed problem, design a variant and run a variation session.
Record results in step338_weakness_tracker.py and close shortfall items in priority order.
Hold the team sharing session (30 minutes, reenactment of stuckness), and verify conquest with the check mock exam — failed types go to a second-round drill.

Exercises

Exercise 1. Explain why competition rank is decided by the weakest field rather than the strongest, using the score structure of top-tier teams.

Exercise 2. Why is "reproduction" alone not called conquest, with "variation" also required? Answer through the difference in what each stage proves.

Exercise 3. Explain why a weak field’s first session starts from a problem one step below current skill, through the causal relationship between fun and success experiences.

Exercise 4. Why does the team sharing session demand a "reenactment of the stuckness" rather than a "solution demonstration"? Explain through the difference in what listeners take away.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Form of the sorting: is the past-problem list in difficulty order, and is the first problem intended as "for manufacturing a success experience"? A list sorted hardest-first cannot break the fun loop.
Purity of reproduction: does the session record state the point reached without Write-up viewing? A post-viewing reproduction must not be recorded as "reached alone" (honesty of the records).
Existence of variants: is a variant condition designed for every reproduction-passed problem, and is the variant’s pass/fail reflected in the tracker?
Sharing-session deliverable: is the session summary linked into the team library — the question of whether it was converted into a team asset.
Mock-exam verdict: is a verdict against the pass criteria (no 0-solve field) stated, and if short, is a second-round drill scheduled?

Exercise Answers

Answer 1. Top-tier teams harvest nearly all the problems in their respective strongest fields, so almost no score difference arises in strong fields — everyone gets a similar maximum. Differences arise only in fields where even one team scores zero. If another team harvests even that field’s basic problems, those points become the rank difference as-is. Therefore, the higher you climb in the top tier, the more the championship variable moves from "depth of strengths" to "existence of weaknesses" — and this is the grounds for reallocating training resources to weaknesses: the same hours spent on a strength yield a small expected increment, while spent on a weakness they create points out of zero.

Answer 2. Because reproduction proves "I can solve this problem," while variation proves "I can pull out this technique and use it." Since competitions don’t pose the same problem, reproduction’s proof isn’t valid at a competition. Variation tests the technique’s range of application by changing one of the problem’s premises — to solve a variant you must know what the technique presupposes, and that knowledge is applicability on new problems. As a side effect, the act of designing a variant is itself training in seeing a problem with the author’s eyes. The difference between "a person who knows the problem" and "a person who knows the technique" lies between reproduction and variation.

Answer 3. Because a weak field’s lack of fun is not a cause but a result — a loop: no success experiences, so no fun; no fun, so you avoid it; avoiding it, so success experiences don’t accumulate. The only place where this loop’s link can be cut is "success experiences," and success experiences can be intentionally manufactured only from problems at or below current skill. Starting from a problem one step lower is not a compromise of training intensity — it’s the design of breaking the loop. As successes stack, the feeling "this field yields too" forms, and interest follows as a byproduct of that feeling — if you wait for interest before starting, you never start.

Answer 4. Because a solution demonstration only shows the path to the result, but what the listener needs at a competition is not the result — it’s the movement when stuck. Someone who watched a demonstration carries only the information "it won’t solve like that time" when they stall on a similar problem. A reenactment of stuckness, by contrast, conveys the judgment trajectory — "at this symptom, form this hypothesis, discard it like this" — and that trajectory gets reused on other problems. And the reenactment is also a test for the presenter — being able to reenact the stuckness means fully understanding that problem’s structure, and the Feynman technique’s point (if you can’t teach it, you don’t know it yet) is enforced here.

Completion Criteria Checklist

[ ] I finalized Step 337’s weakness list and sorted past problems by difficulty (first slot = one step below)
[ ] I kept the reproduction session’s three rules (no Write-ups · time attack · recording attempts)
[ ] I designed a variant for every reproduction-passed problem and ran variation sessions
[ ] I recorded reproduction/variation results in the tracker and proceeded in priority order
[ ] I held the team sharing session (30 minutes, reenactment of stuckness) and left the summary in the library
[ ] I verified conquest with a check mock exam (time attack, no 0-solve field)
[ ] For any shortfall types, I put a second-round drill schedule into the calendar

6. Common Pitfalls & Fixes

Wall 1. I keep postponing the weak-field sessions

Symptom: the calendar says Wed & Sat, but when the day comes you’re working a strong-field problem.

Cause: it’s 2-3’s loop exactly — the un-fun thing gets postponed, and the moment you postpone, the strong field tempts you with instant achievement.

Fix: stack three devices. ① Make the session a promise to the team, not to yourself — if you fix the sharing-session date first, preparing the presentation forces the training. ② The first-15-minutes rule — allow yourself to start with "just 15 minutes." Most of the time you’re inside the problem 15 minutes later. The resistance to starting is the barrier; rarely is sustaining the session the barrier. ③ Relocate the strong field as a reward — a rule that you may touch strong-field problems only on days you finished a weakness session. Repurposing a temptation lasts longer than removing it.

Wall 2. I don’t know how to make a variant problem

Symptom: you did the reproduction, but "change the conditions" leaves you blank on what to change.

Cause: the problem’s premises haven’t been enumerated yet — you can’t see candidates to change, so you can’t design.

Fix: the variant’s candidates come from the problem’s premise list. Looking at the reproduction session’s record, write down everything "that must be true for this solution to hold" — parameter sizes, kinds of protections, input formats, the existence of external services. Each item on that list is one variant candidate. For crypto’s rsa-again, the premises are "N is shared," "e is the standard value," "two keys are given" — flipping each of them gives 3-3’s variants 1 and 2. If you can’t write the premises, the reproduction isn’t complete yet — go back. Variant design is also a test of understanding.

Wall 3. The temptation to read the Write-up of the past problem I’m reproducing is huge

Symptom: an hour into being stuck, you almost type the problem’s name into the search bar.

Cause: a normal temptation — and a Write-up once seen cannot be unseen. That problem’s reproduction value dies in that moment.

Fix: fix the rule by time — 3-2’s session rule (2-hour cap + viewing only after recording) is that device. When temptation comes, turn your hands to recording the attempt history — the act of writing "the point where I’m stuck now" does two things. It carries you past the moment of temptation, and it makes possible the comparison of "how far I got" when you later read the Write-up. And remember — a problem solved after reading the Write-up cannot be recorded as "reproduction" in the tracker. That’s a matter of honesty, and if the records aren’t honest, the mock exam’s verdict becomes false.

Wall 4. The sharing session balloons into "lecture prep" — I’ve been making slides for three days

Symptom: you’re making 40 slides for a 30-minute session.

Cause: confusion about the session’s purpose — this session is not a lecture; it’s conquest verification and floor-raising.

Fix: enforce the format — no slides, screen share + terminal only. Only two things to prepare — the reproduction session’s records, and the variant problem’s files. "Where I got stuck" is not explained with slides; it’s shown by retyping that day’s commands in the terminal. Set a cap on prep time too — session prep is 1 hour. Preparation that exceeds an hour is usually for the presenter’s pride, not the audience (the presentation-material skills you learned in Step 332 are a separate craft, and this session is not that stage).

Wall 5. I failed a trained type at the mock exam

Symptom: you missed a problem of a type whose reproduction and variation you both passed, during the time attack.

Cause: three candidates. ① Absence of time pressure — sessions were relaxed, the mock exam had a timer. ② The mixing effect — the emotional resistance when a weak-field problem sits among strong-field ones. ③ A misjudgment — the reproduction/variation passes were hasty (if you consulted the Write-up).

Fix: separate the causes and record them. If ①, apply time attack by default in the next drills. If ②, take the mock exam once more — this effect shrinks only through repeated exposure. If ③, it’s an honesty issue — demote that type from "conquered" and send it to the second-round drill. In all three cases, it’s not failure but information — that is precisely the mock exam’s reason for existing. A defect that would have been discovered on competition day was discovered today, so this mock exam is not a cost — it’s a refund.

7. Summary

Today’s Concepts

Concept	One-line explanation
Zeroing out weaknesses	Rank is decided by the weakest field — eliminating 0-solve fields is the goal
Reproduction	Solve past problems again without the Write-up — proof of "this problem"
Variation	Solve again with changed premises — proof of "this technique"
Designing success experiences	Start one step lower — fun is a result, not a precondition
Feynman technique	If you can’t teach it, you don’t know it yet — the reenactment of stuckness is the session’s form
Time-attack check	The final verification that closes the gap (time pressure, mixing) between training and competition

Today’s Tools & Commands

Tool/command	What it does
`python step338_weakness_tracker.py`	Computes reproduction/variation pass status and next priorities
Sorted past-problem list	Difficulty order + first slot for manufacturing success experiences
Three reproduction-session rules	No Write-ups · 2-hour cap · record attempt history
Premise list	Candidates for variant design — "what must be true for this solution"
Check mock exam	A set including weak types + a no-0-solve-field verdict

The Core Instinct

Remember one thing about how this period’s training differs from usual — you do not what you like, but what you need. And that discomfort is exactly the evidence of this training’s value. Everyone trains the fields they like — which is why the strong-field difference doesn’t open up in the top tier. Only the head-on training of weaknesses nobody wants to do creates the difference on the scoreboard.

Each time the tracker’s "conquest complete" grows by one, the team’s floor is rising. A team whose 0-solve fields have disappeared no longer leaves its results to the luck of problem-set direction. Next comes standing on the stage again with that completed force — a domestic rematch or an international final. The team’s final form, built over this journey, is what you’ll confirm on that stage.

Once every box is checked, Step 338 is complete.