Finding the Offset with Cyclic Patterns

A cyclic (De Bruijn) pattern lets each 4/8-byte window appear once, so the

crash value tells you exactly how many bytes precede the return address.

# Generate a non-repeating pattern and feed it in
$ cyclic 200                      # pwntools CLI
aaaabaaacaaadaaaeaaaf...

# Run in GDB (pwndbg), crash, then read the faulting value:
pwndbg> cyclic 200
pwndbg> run < pattern.txt
# ... SIGSEGV; RSP/RIP shows e.g. 0x6161616c ("laaa")

pwndbg> cyclic -l 0x6161616c      # look up the offset
72                                # <-- bytes to the return address

In a script: cyclic_find(0x6161616c) returns the same offset.