YanoSecA writeup records how you approached a task so the method can be reviewed later. Include the task, the steps you actually took, the evidence supporting the result and the remaining uncertainty. Attribution identifies the challenge author or supplied file rather than implying that someone else's work is yours.
Writing and publishing are separate decisions. An embargo is a restriction on sharing, sometimes with a release time or another condition. Read the event's actual publication rule before sharing a solution. An event ending does not supply permission that its rule never granted.
Before you begin
- Recommended first
- Where practice is allowed, How to take notes, Logs as evidence, Binary, hex, Base64, and URL encoding, HTTP methods, headers, status codes, cookies, Time, notes, and not blocking a teammate
- Estimated time
- 12 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Use the original fictional Desk Lamp board and supplied files in any current desktop or mobile browser. No account, event registration, installation or network request is required. Keep draft notes in your own file.
- Without a lab
- All board rows, requests, rules and log lines needed for reasoning are printed here. Trace them in notes and compare with the activity rubric; label fictional or predicted evidence accurately. Reading works without JavaScript. Checking needs JavaScript and a secure context; saving also needs usable browser storage.
After this lesson you can:
- Fill a writeup template for a mapping you can point to.
- Mark the activity note private when the written release is absent.
- Judge a forbid-publication rule by its own sentence, including after the event window.
01Example
This complete worked writeup maps a fresh hexadecimal byte sequence by hand. The activity uses C-2, a different encoding note, and its own publication policy.
Title: hex desk
Card id: worked hex, not C-2
Task: map 64 65 73 6b to letters
What you tried: read each byte as a code point
Evidence: 64 is d, 65 is e, 73 is s, 6b is k
Limit: the mapping does not say who wrote the note
Sharing: private file
Flag: blank02A method note is not a public post
The worked mapping gives both the input bytes and the rule used to interpret them. A reader can follow the method and see its limit: decoding a word does not identify who wrote it. The activity uses a different note and a fictional policy requiring written release before a public post.
Check the audience and release condition independently from whether the technical answer is correct. Some organizers allow writeups after an embargo; others request that solutions remain private. Apply the rule for that event. The pwn.college reference states its own ongoing no-public-writeup commitment and is not a universal policy for all CTFs.
Write the task, the method, the evidence, and the limit, then apply the publication rule that is actually written.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Playback is optional. Step through at your own pace.
Worked hex bytes
64byte 065byte 173byte 26bbyte 3Code-point correspondence
dcode pointecode pointscode pointkcode pointWorked reading
deskworked result64 → d64 → d
65 → e65 → e
73 → s73 → s
6b → k6b → k
Match each supplied byte with its letter.
Follow the explanation
- Match each supplied byte with its letter.
- The letters in byte order spell desk; keep the sample and evidence limit visible.
Read every state and value
1. Match each supplied byte with its letter.
- Example
- Supplied teaching sample
- Visible Item
- 64 · 65 · 73 · 6b · 64 → d · 65 → e · 73 → s · 6b → k
- Current mappings
- 64 → d · 65 → e · 73 → s · 6b → k
- Annotations
- None
2. The letters in byte order spell desk; keep the sample and evidence limit visible.
- Example
- Supplied teaching sample
- Visible Item
- 64 · 65 · 73 · 6b · 64 → d · 65 → e · 73 → s · 6b → k · desk
- Current mappings
- word
- Annotations
- Item: desk; Text: Private file; Flag: blank. Not card C-2; author not established.
03Mark the decoding note
Fill the template for C-2. The predicted text is already on the card, with its packaging source. Your job is the sharing mark.
Writeup
Title:
Card id:
Task in one sentence:
What you tried:
Evidence you can point to:
Limit, what this does not prove:
Sharing: private file, unless a written release is actually in the packet.
Flag: leave blank. This course does not collect one.
Card C-2
Category column: Cryptography
Transform named on the card: Base64
Note: bGFtcA==
Predicted text: lamp
Prediction source: Python 3 standard library, base64.b64encode of the bytes lamp, during asset packaging.
This note is not a flag. Do not submit it anywhere.
Activity policy
Label: original fiction for the owned decoding note. Apply this policy only to this activity.
A public post waits for a written release from the organizer.
That release is not in this packet.
The window printed on the board ends at 21:00 UTC.
Your method note for this activity stays in your own file.
Mark to write on the note: private
- Copy the task, the Base64 note, and the predicted word lamp into the template. Keep the packaging line with the prediction.
- Read the activity policy. The written release is not in the packet.
- Check: the sharing mark is private.
- Stop. Do not post the note, and do not submit lamp anywhere.
04Optional challenge
Write three lines about a stuck attempt on R-4 without a solution: the task you read, the skill you do not have yet, and the decision to stop. About ten minutes.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Mapping card A: independent hand-worked inputOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Card H6 asks for ASCII text from hex 6d 61 70.
Supplied mapping: 6d=m, 61=a, 70=p.
Method: map each byte in order. No program is run.
The mapping does not identify the author or prove a secret was protected.
Release card B: separate fictional policyOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Event Paper Window ends 2026-10-23 13:00 UTC.
Policy: public solutions need a written organizer release. The packet contains no release.
Local private method notes are permitted. The technical result is correct.
Later review COwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
It is now 2026-10-24 08:00 UTC. Paper Window ended yesterday. The packet still has no written release and no policy change.
06Explain the evidence and its limit
Optional self-check: write a short private note with task, input, method, cited result, limit and sharing rule.
Review it: the result follows from supplied evidence, predictions stay labeled, no outside flag appears, and public release depends on this event’s actual rule.
07Common mistakes
If the end of the printed window is treated as a release, the policy file was skipped. The release is a written sentence, and this packet does not contain one.
If lamp is copied into the flag line and then into a public page, the template's blank flag line was ignored.
If a pwn.college habit is used as Desk Lamp's rule, the wrong sentence was applied. Each event's own text controls.
References
- pwn.college: Register ground rules
States pwn.college's own restrictions on publishing challenge solutions. Apply each event's actual rules rather than assuming a universal release.
- CTFd: What are flags
A flag is the proof that a participant completed a challenge, and the platform checks a submission against stored flags. This course's checker is a separate box.