NtProtectVirtualMemory

Prototype

NTSTATUS NtProtectVirtualMemory(
  HANDLE  ProcessHandle,
  PVOID  *BaseAddress,
  PSIZE_T NumberOfBytesToProtect,
  ULONG   NewAccessProtection,
  PULONG  OldAccessProtection
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 50 00 00 00      mov eax, 0x50
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtProtectVirtualMemory has held SSN `0x50` from Windows 10 1507 through Windows 11 24H2 — one of the most stable syscall numbers on the platform. It is the kernel entry point behind `VirtualProtect`/`VirtualProtectEx` and ultimately reaches `MiProtectVirtualMemory`. Note that the function silently rounds `BaseAddress` down and `NumberOfBytesToProtect` up to page boundaries, so a request that touches even one byte of an adjacent page will reprotect that entire page.

Common malware usage

This is the second half of the canonical loader pattern: a region is allocated as `PAGE_READWRITE`, the payload is written, then `NtProtectVirtualMemory` flips it to `PAGE_EXECUTE_READ` (or `PAGE_EXECUTE_READWRITE` for self-modifying stubs). Switching from RW to RX after a write is the textbook way to defeat naive RWX-only memory scanners while still ending up with executable code. Used in Cobalt Strike beacon loaders, Sliver shellcode runners, Brute Ratel, and most module-stomping and thread-stack-spoofing implementations.

Detection opportunities

RX or RWX transitions on private (non-image) memory are a high-signal indicator. Sysmon does not have a dedicated event for it, but ETW Threat Intelligence (`Microsoft-Windows-Threat-Intelligence`) emits `EtwTiLogProtectExecVm` whenever protection is set to an executable value on private memory — this is exactly the event EDRs subscribe to. Userland ntdll hooks on `NtProtectVirtualMemory` are bypassed by direct or indirect syscalls, but the ETW-TI kernel-side telemetry still fires. PE-Sieve and Moneta detect private RX regions backed by no image as a post-mortem signal.

Direct syscall examples

; Direct syscall stub for NtProtectVirtualMemory (SSN 0x50, stable across all Win10/11)
NtProtectVirtualMemory PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 50h          ; SSN
    syscall
    ret
NtProtectVirtualMemory ENDP

// Classic two-phase loader: allocate RW, write, flip to RX.
SIZE_T size = payload_len;
PVOID  base = NULL;
NtAllocateVirtualMemory(NtCurrentProcess(), &base, 0, &size,
                        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
memcpy(base, payload, payload_len);

ULONG old = 0;
NTSTATUS st = NtProtectVirtualMemory(NtCurrentProcess(), &base, &size,
                                     PAGE_EXECUTE_READ, &old);
if (NT_SUCCESS(st)) ((void(*)())base)();

// Resolve SSN at runtime from a non-hooked ntdll copy.
typedef NTSTATUS (NTAPI *pNtProtect)(HANDLE, PVOID*, PSIZE_T, ULONG, PULONG);

DWORD ssn = GetSyscallNumber(GetProcAddress(GetModuleHandleA("ntdll.dll"),
                                            "NtProtectVirtualMemory"));
// hand SSN to your indirect-syscall trampoline; ssn is 0x50 on every supported build
set_ssn(ssn);
indirect_syscall_invoke(/* args */);

MITRE ATT&CK mappings

• T1055Process Injection
• T1055.002Portable Executable Injection
• T1620Reflective Code Loading