Signed Loop Counter Steering (Branch Selection via Negative Modulo)

Updated 13 Sep 2026

•
What it is
- •
  Overwrite a signed loop counter to select a useful branch on the next iteration. Small negative values can satisfy divisibility checks while encoding without null bytes.
•
How it works
- •
  The writable counter chooses a branch, rather than moving the write cursor as in Read-Counter Manipulation (Canary Skip).
- •
  The 32-bit two’s-complement representation of -6 is 0xfffffffa, which contains no null bytes.
- •
  A negative multiple still has zero remainder: -5 % 5 == 0. Account for the increment and branch order before choosing the overwrite.
- •
```
write -6 → increment to -5 → divisible by 5, not by 15
This selects the intended branch only if the verified dispatcher uses those tests.
```
- •
  Choose a final counter value that reaches the loop exit after its increment; null bytes may be acceptable once no string leak is needed.
•
When to use it
- •
  The counter is writable and controls modulo-based branches, such as a FizzBuzz-style dispatcher.
- •
  Use a negative value when it selects the desired branch and its encoding avoids nulls required by a simultaneous string leak.
•
Examples
- •
  Write -6; after i++, i=-5. Then i % 5 == 0 and i % 15 != 0, selecting the desired branch.
- •
  When finished, write 15 if the next increment to 16 makes the verified loop condition fail.

pwntools

stay = b'A' * offset + p32(-6, signed=True)
finish = p32(15)  # Verify the loop's increment and exit condition.

disas challenge  # Check signedness, increment order, and modulo branches.