Ntwarden Windows Analysis Toolkit

This is a comprehensive Windows internals toolkit that gives you both user-mode and kernel-mode visibility into running systems. You get process enumeration, service inspection, network connections, and ETW providers without a driver, but load the KWinSys kernel component and you unlock SSDT hook detection, kernel callback enumeration, and rootkit hunting features. The WinSysServer component lets you inspect remote machines over TCP, which is handy for analyzing VMs from your host. It's built for security research and malware analysis, not production monitoring. The skill includes detailed setup instructions for test signing and driver installation, plus code examples showing how to use the WinSys library directly if you want to script your own analyses instead of using the ImGui interface.

skills.sh installs: 336
GitHub stars: 26
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add aradotso/trending-skills --skill ntwarden-windows-analysis-toolkit --agent claude-code

Installs into .claude/skills of the current project.

Files

NtWarden Windows Analysis and Research Toolkit

Skill by ara.so — Daily 2026 Skills collection.

NtWarden is a Windows system inspection tool built on ImGui + DirectX 11. It covers processes, services, network, kernel internals, ETW, registry, object manager, and more — locally or remotely via WinSysServer. A kernel driver (KWinSys) enables deep kernel-mode analysis including SSDT hooks, kernel callbacks, EPT hook detection, and driver integrity checks.

Architecture

Component	Role
NtWarden	GUI app (ImGui + DirectX 11)
WinSys	Static lib — process, service, network enumeration
KWinSys	Kernel driver — callbacks, SSDT, kernel modules, pool, etc.
WinSysServer	Headless TCP server for remote inspection

Build Requirements

Visual Studio 2022
Windows SDK 10.0.26100.0+
WDK (Windows Driver Kit) — required only for KWinSys kernel driver

Building

# Open solution in Visual Studio 2022
# Select Release | x64
# Build All

# Output lands in:
x64/Release/NtWarden.exe
x64/Release/WinSysServer.exe
x64/Release/KWinSys/KWinSys.sys

SKILL.md on GitHub

Details

Repository: github.com/aradotso/trending-skills
First seen: Jun 3, 2026