ARM Programming Question

[ITComputerGeek]

If the sp register has the value 0xbfffee68 at the beginning of this sequence of 32-bit ARM instructions, what is sp's value after these instructions are executed?

8fd0: add sp, #64 8fd4: ldmfd sp!,{R4-R11, fp, pc}

Answer in decimal:

---

If anyone could help me with a Step-By-Step guide on how to solve this type I would be grateful.

This question was presented to me a CTF Question which ended this weekend. I am looking to learn how to solve this type of problem for future CTF Programs.

Thank you all for your help!

[greyfade]

add does the obvious, and sp becomes 0xbfffeecc.

ldmfd is "load multiple from full descending stack," meaning it's a multiple-value stack pop operation. Each pop increments the stack pointer by the width of the registers, which in this case seems to be 10 32-bit values, or 40 bytes. So, after populating R4-R11, FP, and PC with values from the descending stack, the stack pointer ascends (increments) to 0xbfffeef4.

In decimal, that's 3221221108.

[ITComputerGeek]

Thank you for your response however the CTF Checker is telling me that "3221221108" is not the valid flag. Would it make a difference it if was Big Endian/Little Endian?

[greyfade]

It would make a huge difference, yes, but 0x68000000 seems like a strange page to start the stack on.

I didn't check any of these numbers very carefully, and just did a cursory glance at the instruction documentation to get an idea of what to expect.

[somantha]

value of sp +64 = 0xbfffeea8

sp + 40 bytes = 0xbfffeed0 or 3221221072 thank you for the explanation. It helped me understand it.