make pylint happy again

rex/crash_tracer/dumb_tracer.py

@@ -275,7 +275,8 @@ def bootstrap_state(self, state, **kwargs):
         word_size = self.project.arch.bytes
 
         # we operate on concrete memory so far, so it is safe to load and eval concrete memory
-        data = crashing_state.solver.eval(crashing_state.memory.load(self._save_ip_addr, len(self.testcase)), cast_to=bytes)
+        sim_data = crashing_state.memory.load(self._save_ip_addr, len(self.testcase))
+        data = crashing_state.solver.eval(sim_data, cast_to=bytes)
         assert data[:word_size] in self.testcase, "PC is not overwritten!"
 
         # identify marker from the original input on stack

rex/exploit/technique.py

@@ -516,7 +516,7 @@ def _ip_overwrite_with_chain(self, chain, state=None, assert_next_ip_controlled=
                 jumps_to = sp + (gadget.stack_change - self.crash.project.arch.bytes)
 
                 # does it hit the controlled region?
-                if not (addr <= jumps_to < addr + symbolic_stack[addr]):
+                if not addr <= jumps_to < addr + symbolic_stack[addr]:
                     continue
 
                 # it lands in a controlled region, but does our chain fit?

rex/exploit/techniques/ret2libc.py

@@ -12,6 +12,9 @@
 l = logging.getLogger("rex.exploit.techniques.ret2libc")
 
 class Ret2Libc(Technique):
+    """
+    A technique to ROP and invoke system in libc
+    """
 
     name = "ret2libc"
     applicable_to = ['unix']
@@ -32,7 +35,6 @@ def contain_bad_byte(self, ptr):
 
     def _find_libs_system_addrs(self):
         system_addrs = []
-        state = self.crash.state
         libc_name = os.path.basename(self.crash.libc_binary)
 
         # angr does not handle PLT well for some architectures,