VirtualProtect failed to revert protections on mrdata section of ntdll, why?

Question

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like this:

lea eax, [OldProtect]
push eax                      //here it will store the old protection value
push PAGE_EXECUTE_READWRITE
push dwSize                   //size of section
push lpAddress                //start address of section
call Virtual_Alloc
...
blahblah
...
lea eax, [OldProtect]
push eax
push OldProtect               //the protection value to revert
push dwSize                   //size of section               
push lpAddress                //address of section             
call Virtual_Protect

The loop runs correctly on the first three sections .text, .RT and .data which have initial memory permissions ER, ER, RW respectively.

The problem is that the in the next section which is the .mrdata section and it is readable only, the memory protection changed succesfully from R to ERW. But When i try to revert back to the old protection the return value is 0x00000050 in eax and i get an exception.

What i want to ask is why? Is this a false use of VirtualProtect? Or has something to do with the .mrdata section

Answer 1

Oook i think i i found an answer but i didn't try it and needs more research, it seems there is a special Windows API function used to change protections on .mrdata called LdrProtectMrdata( bProtect )

source: http://mohamoha.club/2017/12/23/Bypass_CFG_Through_MRDATA/