how to save PE section to file

  • Anonymous - 2007-04-27

    How I can save on section from PE to file?
    It is useful for creating *.mdb signatures for clamav antivirus.
    I can view section size and offset using ht, convert this numbers to decimal and save section using dd if=pe of=pe_section bs=1 skip=ofset count=size but this inconveniently.

    • Sebastian Biallas

      Select the bytes in question[1], select "edit->copy", select "file->new", then binary, (the new since it automatically adjusted to the size of the clipboard, so just press enter), select "edit->paste"

      [1]: You can select bytes in various ways:
      *) Press F4 in image mode, select with shift+cursor or toggle select mode with alt+s
      *) Goto start of section, note the size of the section, press F9 to view start of section in "hex mode", press alt+s, press F5, enter "$+12345" (where 12345 is the size of the section)


Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

No, thanks