I'm working about PE on those days and I have some troubles

1) How can be VirtualSize greater than SizeofRawData. SizeofRawData is still rounded with FileAlignment.

2) What is the different of FileAlignment and SectionAlignment exactly. And why sectionalignment must be greater or equal to File Alignment.

might anybody help me for those problem.Thans a lot.

Well, this is rather hard to explain by couple of words..
so, oversimplified and perhaps not 100% correct:

The smallest addressable part of a disk is sector, and its size is 512Kb. Two section can't be placed in one sector (this is OS' memory manager restriction), that's why FileAlignment should be a power of 2 between 512 and 64K inclusive. And SizeofRawData actually depends on size of sector, too (FileAlignment is just to abstrac from hardware).

When file is mapped to memory, each section should fit one or more pages (because each section may have different attributes) and page size on x86 windos is 4K. That's why SectionAlignment is usually greater than FileAlignment (and is equal to 4K )
(if PE is a kernel mode driver, 512-byte SectionAlignment is also available, since kernel may have different memory model (4Mb pages), so its possible to put many section in one page anyway)

Default values for alignments are:

FileAlignment = 200h
SectionAlignment = 1000h

Now you see why VirtualSize is larger. Let's say we have 496h bytes in a section. Then in a file it'll be padded to 600h (600h mod 200h == 0) and in memory it'll be padeed to 1000h (1000h mod 200h == 0).

You can change values of alignments manually, but the new values must be multiplies of primary one, and cannot be less than it. For example for FilAlignment it can be 200h, 400h, ..., 1000h, even 0A00000h.

Drivers can also have alignment that is a multiply of 2 (at least I know it about FileAlignment). But remember that it is only up to drivers.

There's also one thing you should know. Every last section in a PE file doesn't need to be aligned. It is well loaded on all win version although it's not specified and theoretically it's incorrect. Some PE-packers use such trick

Thanks a lot for your interest. I read some documents, article (from microsoft). I saw in several documents the reason of the difference with virtual size and sizeofrawdata is the events in the running time. So, creating dynamic arrays or some memory reservation. Can that be true ? Because I read from microsof PECOFF document "If sizeofrawdata is less than VirtualSize the remainder of the section is zero filled". So if we do that I think the dynamic array or another memory rezervation aren't be happy. Am I missing somethink ?