i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like this:
lea eax, [OldProtect] push eax //here it will store the old protection value push PAGE_EXECUTE_READWRITE push dwSize //size of section push lpAddress //start address of section call Virtual_Alloc ... blahblah ... lea eax, [OldProtect] push eax push OldProtect //the protection value to revert push dwSize //size of section push lpAddress //address of section call Virtual_Protect
The loop runs correctly on the first three sections .text, .RT and .data which have initial memory permissions ER, ER, RW respectively.
The problem is that the in the next section which is the .mrdata section and it is readable only, the memory protection changed succesfully from R to ERW. But When i try to revert back to the old protection the return value is 0x00000050 in eax and i get an exception.
What i want to ask is why? Is this a false use of VirtualProtect? Or has something to do with the .mrdata section