Tools / pwntools Payload Builder
pwntools Payload Builder (p32 / p64)
Three operations every binary exploitation challenge needs: pack an address into little-endian bytes, unpack the bytes you saw at crash time, and flat - build a padded payload with arbitrary insertions at known offsets. Output as raw hex or as a Python b'...' literal you can drop straight into your exploit script.
Why little-endian
x86 and x86_64 store multi-byte integers low byte first in memory. When you find a gadget at 0x4011a6, you write it into your buffer as the bytes a6 11 40 00 on x86 (32-bit) or a6 11 40 00 00 00 00 00 on x86_64 (64-bit). Forgetting the byte order is the most common cause of mysteriously wrong-looking RIPs in pwn challenges.
The flat-payload mode is the equivalent of pwntools flat({offset: payload}): it fills a buffer with a filler byte (default A), inserts your payload bytes at the offsets you give, and pads to a final length. Use it to build the canonical ret2win payload - junk to the saved RIP, then the address of the win function.
Need to find the offset first? Use the Cyclic Pattern Generator to send a unique pattern, crash the target, then look up where the corrupted RIP came from. Once you have a payload, view its raw bytes with the Hex Viewer to confirm alignment.
Challenges that use this tool
- Echo Escape 1picoCTF 2026 · Binary Exploitation · Medium
- Echo Escape 2picoCTF 2026 · Binary Exploitation · Medium
- Heap HavocpicoCTF 2026 · Binary Exploitation · Hard
- offset-cyclepicoCTF 2026 · Binary Exploitation · Medium
- offset-cycleV2picoCTF 2026 · Binary Exploitation · Hard
- Echo ValleypicoCTF 2025 · Binary Exploitation · Medium
- handoffpicoCTF 2025 · Binary Exploitation · Hard
- PIE TIMEpicoCTF 2025 · Binary Exploitation · Easy
- PIE TIME 2picoCTF 2025 · Binary Exploitation · Medium
- format string 0picoCTF 2024 · Binary Exploitation · Easy
- format string 1picoCTF 2024 · Binary Exploitation · Medium
- format string 2picoCTF 2024 · Binary Exploitation · Medium
Browse the full challenge library for 55 more.
Guides that use this tool
- Race Conditions and TOCTOU for CTF: Winning the Window Between Check and UseHow to find, widen and win race conditions in CTF: symlink TOCTOU on SUID binaries, limit-overrun bugs in web apps, signal races, and mempool front-running.
- Integer Overflow and Signedness Bugs for CTFWrap-around, signedness confusion, and truncation explained with two's complement, then used to buy flags, defeat length checks, and mint unlimited tokens.
- The picoCTF Binary Exploitation Roadmap: Stack to Heap to ROPHow to learn binary exploitation for CTF in order: a beginner-to-advanced pwn roadmap from x86 assembly and gdb through stack smashing, mitigations, ROP, and heap.
- SROP and ret2dlresolve: Advanced ROP Without a libc LeakA byte-level deep dive on SROP and ret2dlresolve: the sigreturn frame layout, rt_sigreturn, forging Elf64_Rela and Elf64_Sym, the symbol-index math, and pwntools.
- Use-After-Free for CTF: Dangling Pointers and tcacheUse-after-free for CTF: turn a dangling pointer into a shell. Read freed chunks for heap and libc leaks, tcache poisoning, hook targets, and double-free bypass.
- ret2libc for CTF: Leaking libc and Returning to system()NX killed your shellcode and there is no win function. Learn ret2libc: leak a libc address with puts, rebase libc, and return to system('/bin/sh') in pwntools.
Tools that pair with this one
- Cyclic Pattern GeneratorGenerate de Bruijn cyclic patterns and find buffer overflow offsets. The browser equivalent of pwntools cyclic and cyclic_find.
- Pwntools ForgeGenerate a complete pwntools exploit script from a template: ret2win, shellcode, ret2libc, ROP chain, format string, or blank scaffold. Fill the form, copy or download the .py file. Fully editable before saving.
- Endianness ConverterConvert between big-endian and little-endian byte order with visual byte layout. Supports 16-bit, 32-bit, and 64-bit words.
- Hex ViewerView text or raw hex bytes as a xxd-style hex dump with byte offset, hex columns, and ASCII sidebar. Highlights printable characters and null bytes.
Or browse all 40 CTF tools.