1

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like this:

lea eax, [OldProtect]
push eax                      //here it will store the old protection value
push PAGE_EXECUTE_READWRITE
push dwSize                   //size of section
push lpAddress                //start address of section
call Virtual_Alloc
...
blahblah
...
lea eax, [OldProtect]
push eax
push OldProtect               //the protection value to revert
push dwSize                   //size of section               
push lpAddress                //address of section             
call Virtual_Protect

The loop runs correctly on the first three sections .text, .RT and .data which have initial memory permissions ER, ER, RW respectively.

The problem is that the in the next section which is the .mrdata section and it is readable only, the memory protection changed succesfully from R to ERW. But When i try to revert back to the old protection the return value is 0x00000050 in eax and i get an exception.

What i want to ask is why? Is this a false use of VirtualProtect? Or has something to do with the .mrdata section

  • 2
    a non zero return value from VirtualProtect would indicate success according to the microsoft docs. maybe we need more info about the exception and some reproducible code. – Abigail Sep 8 '18 at 1:20
1

Oook i think i i found an answer but i didn't try it and needs more research, it seems there is a special Windows API function used to change protections on .mrdata called LdrProtectMrdata( bProtect )

source: http://mohamoha.club/2017/12/23/Bypass_CFG_Through_MRDATA/

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.