tools / Reverse Engineering & CTF
Cyclic Pattern Generator and Offset Finder
Generate a De Bruijn pattern, the same one pwntools makes, then feed the value that landed in the instruction pointer back in to get the exact offset. It is how you find the padding length for a stack overflow without counting bytes by hand.
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa
How it works
How the offset trick works
Every four-character window in a De Bruijn sequence is unique. Overflow with the pattern, see what value ends up in EIP/RIP, and because that four-byte chunk appears exactly once you can look up precisely how far into the input it sat.
Reading the crash value
On little-endian x86 a value like 0x6161616c is the ASCII 'laaa' byte-reversed. Paste the raw hex and this reverses it for you before searching.
FAQ
My crash shows 0x6161616c, what is the offset?
Paste 0x6161616c into the finder. It reverses the little-endian bytes to 'laaa' and returns the offset in the pattern.
Is this the same as pwntools cyclic?
Yes, same alphabet and n=4 De Bruijn sequence, so offsets match cyclic() and cyclic_find().
