Cyclic pattern generator and offset finder
Generate a de Bruijn sequence and find the exact overflow offset from a crashed register value - the pwntools cyclic workflow, in the browser.
Open in ctfpalA de Bruijn sequence has the property that every substring of length n appears exactly once. Feed one into a program that overflows, and the four or eight bytes that end up in the instruction pointer identify their own position in the sequence - so one crash gives you the exact offset, with no counting and no binary search.
The whole workflow
- Generate a pattern comfortably longer than the buffer - 200 bytes for a small stack buffer.
- Feed it to the program and let it crash.
- Read the value in EIP/RIP from the debugger, or from the crash report.
- Look that value up in the sequence. Its index is the number of bytes before the return address.
Note the subsequence length: pwntools defaults to 4, which is right for 32-bit. On 64-bit use 8, or the lookup finds an ambiguous match.
Worked example
Finding an offset
Input
0x6161616c (the value found in EIP after a crash)Result
Offset 44 - the return address starts 44 bytes into your input`laaa` in little-endian. The four bytes name their own position.
Load this example in the workspaceGo deeper
- From crash to shell: stack overflows, offsets, ret2win, and ret2libcA segfault is not an exploit. The path from an unexpected crash to a controlled instruction pointer to a shell, with the mitigation checks that decide which technique you need and the stack-alignment detail that breaks working exploits.
Related tools
Buffer overflow offset finder
Find the exact number of bytes before the saved return address using a de Bruijn pattern and the value from a single crash.
Struct pack and unpack (p32, p64, u32, u64)
Convert integers to little-endian byte strings and back at 8, 16, 32, and 64 bits - the pwntools p32/p64 helpers without the install.
Pwntools exploit script generator
Generate a working pwntools template with the right context, process or remote connection, and the boilerplate every exploit repeats.
Endianness converter and byte swapper
Swap byte order for 16-, 32-, and 64-bit values, with a big-integer preview - the conversion every memory address needs before it goes in a payload.