Tools / Cyclic Pattern
Cyclic Pattern Generator (de Bruijn)
Generate the same cyclic patterns that pwntools cyclic and msf-pattern_create produce, then look up the offset of any 4-8 byte slice you saw at crash time. Lets you find the exact distance to RIP/EIP without leaving the browser.
Pattern
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab
200 bytes generated
Find offset
How cyclic patterns find the saved return address
A de Bruijn sequence of order n over alphabet k contains every possible n-length subsequence exactly once. That uniqueness is the trick: if you flood a vulnerable buffer with the pattern and crash the program, the bytes that landed in RIP (or EIP, or any other corrupted register) appear at one and only one position in the pattern. Look up that position and you know the exact distance from your buffer to the saved return address.
On x86 (32-bit) you usually want n=4 because EIP is 4 bytes. On x86_64 use n=8.
When you crash, GDB will show the corrupted register in little-endian order. Use the “Hex (LE-reversed)” mode to paste 0x6361616461616263 and have the tool reverse it before searching. Or copy the ASCII directly out of the crashing program’s output and use ASCII mode.
Once you have the offset, build the actual exploit payload with the pwntools Payload Builder (p32 / p64) and inspect raw bytes with the Hex Viewer.
Challenges that use this tool
- Echo Escape 1picoCTF 2026 · Binary Exploitation · Medium
- Echo Escape 2picoCTF 2026 · Binary Exploitation · Medium
- offset-cyclepicoCTF 2026 · Binary Exploitation · Medium
- offset-cycleV2picoCTF 2026 · Binary Exploitation · Hard
- handoffpicoCTF 2025 · Binary Exploitation · Hard
- PIE TIMEpicoCTF 2025 · Binary Exploitation · Easy
- PIE TIME 2picoCTF 2025 · Binary Exploitation · Medium
- buffer overflow 0picoCTF 2022 · Binary Exploitation · Medium
- buffer overflow 1picoCTF 2022 · Binary Exploitation · Medium
- buffer overflow 2picoCTF 2022 · Binary Exploitation · Medium
- buffer overflow 3picoCTF 2022 · Binary Exploitation · Hard
- ropfupicoCTF 2022 · Binary Exploitation · Hard
Browse the full challenge library for 49 more.
Guides that use this tool
- Race Conditions and TOCTOU for CTF: Winning the Window Between Check and UseHow to find, widen and win race conditions in CTF: symlink TOCTOU on SUID binaries, limit-overrun bugs in web apps, signal races, and mempool front-running.
- Integer Overflow and Signedness Bugs for CTFWrap-around, signedness confusion, and truncation explained with two's complement, then used to buy flags, defeat length checks, and mint unlimited tokens.
- The picoCTF Binary Exploitation Roadmap: Stack to Heap to ROPHow to learn binary exploitation for CTF in order: a beginner-to-advanced pwn roadmap from x86 assembly and gdb through stack smashing, mitigations, ROP, and heap.
- SROP and ret2dlresolve: Advanced ROP Without a libc LeakA byte-level deep dive on SROP and ret2dlresolve: the sigreturn frame layout, rt_sigreturn, forging Elf64_Rela and Elf64_Sym, the symbol-index math, and pwntools.
- Use-After-Free for CTF: Dangling Pointers and tcacheUse-after-free for CTF: turn a dangling pointer into a shell. Read freed chunks for heap and libc leaks, tcache poisoning, hook targets, and double-free bypass.
- ARM Assembly for CTF: The ARMssembly SeriesARM assembly for CTF: read AArch64 like x86 with load/store, the x0-x30 registers, control flow, the calling convention, and a hand-traced ARMssembly solve.
Tools that pair with this one
- pwntools Payload BuilderPack integers into little-endian bytes (p32 / p64), unpack bytes back to integers, and build flat ROP payloads with offset-based insertion.
- Pwntools ForgeGenerate a complete pwntools exploit script from a template: ret2win, shellcode, ret2libc, ROP chain, format string, or blank scaffold. Fill the form, copy or download the .py file. Fully editable before saving.
- Endianness ConverterConvert between big-endian and little-endian byte order with visual byte layout. Supports 16-bit, 32-bit, and 64-bit words.
- Hex ViewerView text or raw hex bytes as a xxd-style hex dump with byte offset, hex columns, and ASCII sidebar. Highlights printable characters and null bytes.
Or browse all 40 CTF tools.