Tools / pwntools Payload Builder
pwntools Payload Builder (p32 / p64)
Three operations every binary exploitation challenge needs: pack an address into little-endian bytes, unpack the bytes you saw at crash time, and flat - build a padded payload with arbitrary insertions at known offsets. Output as raw hex or as a Python b'...' literal you can drop straight into your exploit script.
Why little-endian
x86 and x86_64 store multi-byte integers low byte first in memory. When you find a gadget at 0x4011a6, you write it into your buffer as the bytes a6 11 40 00 on x86 (32-bit) or a6 11 40 00 00 00 00 00 on x86_64 (64-bit). Forgetting the byte order is the most common cause of mysteriously wrong-looking RIPs in pwn challenges.
The flat-payload mode is the equivalent of pwntools flat({offset: payload}): it fills a buffer with a filler byte (default A), inserts your payload bytes at the offsets you give, and pads to a final length. Use it to build the canonical ret2win payload - junk to the saved RIP, then the address of the win function.
Need to find the offset first? Use the Cyclic Pattern Generator to send a unique pattern, crash the target, then look up where the corrupted RIP came from. Once you have a payload, view its raw bytes with the Hex Viewer to confirm alignment.
Challenges that use this tool
- Echo Escape 1picoCTF 2026 · Binary Exploitation · Medium
- Echo Escape 2picoCTF 2026 · Binary Exploitation · Medium
- offset-cyclepicoCTF 2026 · Binary Exploitation · Medium
- Heap HavocpicoCTF 2026 · Binary Exploitation · Hard
- offset-cycleV2picoCTF 2026 · Binary Exploitation · Hard
- PIE TIMEpicoCTF 2025 · Binary Exploitation · Easy
- Echo ValleypicoCTF 2025 · Binary Exploitation · Medium
- PIE TIME 2picoCTF 2025 · Binary Exploitation · Medium
- handoffpicoCTF 2025 · Binary Exploitation · Hard
- format string 0picoCTF 2024 · Binary Exploitation · Easy
- heap 0picoCTF 2024 · Binary Exploitation · Easy
- format string 1picoCTF 2024 · Binary Exploitation · Medium
- format string 2picoCTF 2024 · Binary Exploitation · Medium
- format string 3picoCTF 2024 · Binary Exploitation · Medium
- heap 1picoCTF 2024 · Binary Exploitation · Medium
- heap 2picoCTF 2024 · Binary Exploitation · Medium
- heap 3picoCTF 2024 · Binary Exploitation · Medium
- buffer overflow 0picoCTF 2022 · Binary Exploitation · Medium
- buffer overflow 1picoCTF 2022 · Binary Exploitation · Medium
- buffer overflow 2picoCTF 2022 · Binary Exploitation · Medium
- x-sixty-whatpicoCTF 2022 · Binary Exploitation · Medium
- buffer overflow 3picoCTF 2022 · Binary Exploitation · Hard
- ropfupicoCTF 2022 · Binary Exploitation · Hard
- stack cachepicoCTF 2022 · Binary Exploitation · Hard
- winepicoCTF 2022 · Binary Exploitation · Hard
- Binary Gauntlet 0picoCTF 2021 · Binary Exploitation · Medium
- Binary Gauntlet 1picoCTF 2021 · Binary Exploitation · Medium
- Binary Gauntlet 2picoCTF 2021 · Binary Exploitation · Medium
- Binary Gauntlet 3picoCTF 2021 · Binary Exploitation · Medium
- Cache Me OutsidepicoCTF 2021 · Binary Exploitation · Hard
- Here's a LIBCpicoCTF 2021 · Binary Exploitation · Hard
- The OfficepicoCTF 2021 · Binary Exploitation · Hard
- clutter-overflowpicoMini by redpwn · Binary Exploitation · Medium
- homeworkpicoMini by redpwn · Binary Exploitation · Hard
- vr-schoolpicoMini by redpwn · Binary Exploitation · Hard
- Local TargetpicoGym Exclusive · Binary Exploitation · Medium