I got template pe file to be filled with code, but I want resize it after fillin it in

easiest way is to add new section.

but i've got code inside this section related to that buffer that i want to resize, any way to resize the section/whole pe file?

Yes, it's doable, but you might have to fix up a whole lot of PE structures.

What are you going to use this for? Perhaps there's a smarter way.

for a "compiler". I fill the main buffer with code and I need a resize routine for the pe.

You should consider writing "proper" PE output code, then... you'll benefit from it in the long run.

anyway, I just need that.. any opinions how to do it? sources, tutorials?

It's not "just". Doing it this way could actually be harder, especially for lot of things "compiler" must do.

it's not harder, that's what I need. so somebody have a code that resizes a section?

note that only last section can be safely resized, and last section usually isn't code section (first is).

I know that. I need it for the last section.

Well, looks like nobody will give you the code. If you really want to resize PE (virus/trojan ), then study PE manual.

If you really want to write compiler, then resizing is bad way to do it.

doh.. I write a jit (vm) on C (to be multiplatform), the jit runs codebuffer (so the jit is inside the same exe, not as framework like .net/java etc.) so my 'compiler' fills up the codebuffer with bytecode that is executed by the jit. I use tcc to create the smallest template executable, but I need to resize it (if the code is ex. 5000 bytes, and template is 1k). You get my point?

i would suggest you to use some backend compiler (NASM, YASM) to create executable properly.

Increasing size of section is too tricky.

You can use one of two methods.

1) Make your code section the last section in the exe file, then you can extend it with your bytecode data.
2) Make a new section at the end for your bytecodes, this is by far the easiest method.

hmm.. sry but I have to do this. Check out metaPHOR, I think I have code if u need it, I got it to check out PE file internals by myself, I don't consider it a virus if you're not using it for that purpose. Pretty crazy how it totally obfuscates the host program's code, and injects it's own, I think it's an example of just what you're looking for.

Add a new section / expand last section, or simply attach the bytecode to the end of the .exe file.

there are so many ways to do this, none of them are easy for someone who doesn't know the PE structure. my suggestion would be to try coding a PE by hand. after you've done that once you should have learned enough to revise any part of a PE file.

ok somebody know an app to make the import section first, and code section last? I mean changing the positions of sections. so I can easily resize last (.code) section. LordPE does not do that

Snify: You can't just simply change the section order of a binary PE and expect it to still work properly. You will need to recompile/relink from the source/object files. This is necessary to properly set all the links and offsets within the program.