Cyclic pattern generator and offset finder

A de Bruijn sequence has the property that every substring of length n appears exactly once. Feed one into a program that overflows, and the four or eight bytes that end up in the instruction pointer identify their own position in the sequence - so one crash gives you the exact offset, with no counting and no binary search.

The whole workflow

• Generate a pattern comfortably longer than the buffer - 200 bytes for a small stack buffer.
• Feed it to the program and let it crash.
• Read the value in EIP/RIP from the debugger, or from the crash report.
• Look that value up in the sequence. Its index is the number of bytes before the return address.

Note the subsequence length: pwntools defaults to 4, which is right for 32-bit. On 64-bit use 8, or the lookup finds an ambiguous match.