Finding the Offset by Inspecting the Crash
- Send a long run of
As (0x41); the program crashes inret. - In GDB, inspect the fault:
RIP(or the top ofRSP) holds0x4141...— your bytes reached it. - Reduce/adjust the length until you know exactly which bytes overwrite the saved return address.
- Cyclic patterns just automate this "which byte landed where" step.
Key Takeaway
The offset (the "magic number") is the count of padding bytes from the buffer start to the saved return address. Find it once, reuse it.