the tests could check if the new protections are effective (IsBadReadPtr/IsBadWritePtr could be used here)
IsBadReadPtr seems to be obsolete, and checking old_prot in the next test should be enough to check protections are in place.
I don't see a test to check behavior when old_prot is NULL (some APIs crashes, some APIs check the pointer and return an error, some support the NULL pointer by not returning the old value) (if it's crashing on native, this can be marked with a comment in the test file)
It's the same as VirtualProtect/VirtualProtectEx, it checks the pointer and returns an error.
the implementation will fail when eg PAGE_GUARD is passed, which is not what MSDN states. But an additional test is always better than believing MSDN which is not always very accurate.
Sure, I added an additional test.
is old_prot modified in case of failure? (eg. if PAGE_EXECUTE_READWRITE is passed, it could be that old_prot is still written to with current protection, or maybe it's not written to)
It is, I was investigating this on a virtual machine. In any case of failure, old_prot is set to PAGE_NOACCESS. I changed NtProtectVirtualMemory() to match this.