FIX: Getting right amount of data for search fix

[gordiig]

PR for #2266 and #2269

Description

As far as I researched ELF and your code, memory layout is looking something like this:

                                                            +-----------------------+
                                                            |         zeroes        | 
      |-----------------------------------------------------|-----------------------|
p_vaddr                                             p_vaddr + p_filesz      p_vaddr + p_memsz

If it is true, you are reading more data than needed ([offset:offset+memsz] instead of [offset:offset+filesz]).

[peace-maker]

Hm, looking at your readelf output in #2266 (comment), there are multiple segments with the same file offset but different virtual addresses and page flags, but only one of them is actually captured in the core dump file. What I'm wondering is if those addresses were actually valid and were really mapped to the same memory? Then this info of finding the needle in an executable section is important if you e.g. look for some gadget and the lookup using core.string(addr) might be misleading?

I'll try to replicate your setup and debug a bit.

[peace-maker]

Ok, no, this looks right. Finding something in data you don't have is a bug.