Buffer Overflow Pattern Generator & Offset Finder
Generate a unique cyclic pattern, send it as your input to crash the target, then paste the overwritten EIP/RIP value to get the exact offset – instantly, in your browser. The pattern and offsets match Metasploit’s pattern_create/pattern_offset and mona.py, so they line up with WinDbg, Immunity Debugger, and x64dbg.
Generate a cyclic pattern
A non-repeating string so you can find exactly where your input
overwrote a saved return address / SEH / register. Compatible with
msf-pattern_create and mona's pattern_create.
Advanced - character sets
Copy as Python / C
Find the offset
Paste the value that landed in the crashed register
(EIP, RIP, nSEH, RAX…) - as hex or as the raw ASCII you
see. It auto-detects little-endian (x86/x64 reality), big-endian, and ASCII, and
tells you which matched.
How to use it
Pick a Length a little larger than the input that crashes the target, hit Generate, and send that cyclic pattern as your payload.
Note the value sitting in the overwritten register - EIP (x86),
RIP (x64), or nSEH for an SEH overflow.
Paste that value into Find the offset - hex or ASCII. It returns the exact offset and a ready-to-paste payload.
Why this one
Nothing you type is sent anywhere and it works offline - safe to use with sensitive engagement data.
Tries little-endian, big-endian and ASCII for 32- and 64-bit, and tells you which one matched.
Outputs the pwntools / Python
lines (b"A"*off + p32(...)), not just a bare number.
Same character sets and offsets
as pattern_create - they line up with your debugger session.
FAQ
Is this the same as msf-pattern_create / mona?
Yes - identical default character sets and ordering, so patterns and offsets are interchangeable with Metasploit and mona.py.
Does it support 64-bit (RIP)?
Yes. Paste an 8-byte value and it returns the offset plus a p64() payload.
Why does endianness matter?
x86/x64 are little-endian, so the bytes that overwrite EIP/RIP appear byte-reversed in the register. The tool reverses them for you and confirms which interpretation matched.
Is my data sent anywhere?
No. All generation and offset-finding run in JavaScript in your browser - there is no server call.
Runs entirely in your browser - nothing you type is sent anywhere. New to this? Read the EIP offset walkthrough or SEH overwrite tutorials.