cameraboy
Joined: 21 Jan 2009 |
Posts: 0 |
|
|
 |
Posted: Fri May 01, 2009 3:55 am |
|
 |
 |
 |
 |
How can I generate MD5 based section signatures by extracting PE sections into separate files ? Please advise.
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Fri May 01, 2009 4:09 am |
|
 |
 |
 |
 |
Some debuggers give a sectional analysis of the PE file with MD5 hashes. The primary section you want is the one that has Execute Access. You have to be careful, however. Most malware is packed now, and sometimes it is obscured/scrambled to prevent analysis. And sometimes the debugger just gets it wrong. And every once in a while, you find code/sections in malware that is also used in non-malware programs.
Regards.
|
|
b0ne
Joined: 26 Oct 2006 |
Posts: 0 |
|
|
 |
Posted: Fri May 01, 2009 4:24 am |
|
 |
 |
 |
 |
The program PETools has a pe editor in it, which if you click the sections button, you can dump them to disk. You could also use any pe viewer and a hex editor to save the start offset + length of the section to disk. Some hex editors like HxD support performing calculations on any of the bytes selected.
|
|