Buffer overflow offset finder

The offset is the first unknown in any stack overflow: how many bytes of input sit between the start of the buffer and the saved return address. Guessing it by incrementing a counter takes dozens of runs; a de Bruijn pattern takes one.

Why one crash is enough

In a de Bruijn sequence every substring of the given length occurs exactly once. So whatever four or eight bytes land in the instruction pointer, their position in the sequence is unambiguous - and that position is the offset. See the pattern generator for the mechanics.

The offset is not the buffer size

It is the buffer size plus any other locals the compiler placed after it, plus the saved frame pointer, plus alignment padding. That is why reading char buf[64] in the source and assuming 64 is wrong often enough to waste an afternoon - the compiler’s layout is the truth, and the pattern measures it directly.