how to save PE section to file

Help
2007-04-27
2013-04-22
  • How I can save on section from PE to file?
    It is useful for creating *.mdb signatures for clamav antivirus.
    I can view section size and offset using ht, convert this numbers to decimal and save section using dd if=pe of=pe_section bs=1 skip=ofset count=size but this inconveniently.

     
    • Select the bytes in question[1], select "edit->copy", select "file->new", then binary, (the new since it automatically adjusted to the size of the clipboard, so just press enter), select "edit->paste"

      [1]: You can select bytes in various ways:
      *) Press F4 in image mode, select with shift+cursor or toggle select mode with alt+s
      *) Goto start of section, note the size of the section, press F9 to view start of section in "hex mode", press alt+s, press F5, enter "$+12345" (where 12345 is the size of the section)