How I can save on section from PE to file?
It is useful for creating *.mdb signatures for clamav antivirus.
I can view section size and offset using ht, convert this numbers to decimal and save section using dd if=pe of=pe_section bs=1 skip=ofset count=size but this inconveniently.
Select the bytes in question, select "edit->copy", select "file->new", then binary, (the new since it automatically adjusted to the size of the clipboard, so just press enter), select "edit->paste"
: You can select bytes in various ways:
*) Press F4 in image mode, select with shift+cursor or toggle select mode with alt+s
*) Goto start of section, note the size of the section, press F9 to view start of section in "hex mode", press alt+s, press F5, enter "$+12345" (where 12345 is the size of the section)