This one is a little more involved.

We want to write data to memory, so that requires a gadget which includes a str instruction.
Most of the gadgets that ropper finds with str are unsuitable, because they don't end nicely.
One candidate is pretty good, though; 0x080000d4 is "strb r3, [r4]; pop {r4, pc}", which allows
us to write a single byte to memory and continue with a next gadget.

The question is now, how do we initialize r3 and r4? ropper gives us the gadget at 0x08001b94
("pop {r3, r4, r5, r6, r7, pc}") which contains r3 and r4, but requires quite a lot of stack
space. We only have 48 bytes, which is very much not enough. Therefore, we'd like to find a way
to expand the stack space.

After staring at assignment_rop for a while, I realized it contained a gadget which allows us to do
just that; 0x0800343e ("mov sp, r7; add sp, #0x10; pop {r7, pc}") allows us to set the stack pointer,
but it requires us to be able to write to the first 8 bytes of the new stack pointer. Luckily, we
have access to a buffer which is below the stack pointer that we entered assignment_rop with, namely
inp_buf. This allows us to shift the stack down by 0x10¹ every iteration, jumping back to assignment_rop
afterwards, which allows us to generate enough space on the stack to use the gadgets described above.

¹: the buffer is 0x18 below the initial SP, but we lose 8 bytes to hold r7 and pc.
