NtWarden is a Windows Analysis and Research Toolkit providing GUI-based inspection of processes, kernel internals, services, network, ETW, and more via ImGui + DirectX 11 with optional kernel driver support.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
NtWarden is a Windows Analysis and Research Toolkit providing GUI-based inspection of processes, kernel internals, services, network, ETW, and more via ImGui + DirectX 11 with optional kernel driver support.
triggers
["use NtWarden to inspect Windows processes","analyze process with NtWarden","kernel callbacks with NtWarden","set up NtWarden kernel driver","connect NtWarden remote inspection","detect hooks with NtWarden","NtWarden SSDT hook detection","build and run NtWarden"]
NtWarden is a Windows system inspection tool built on ImGui + DirectX 11. It covers processes, services, network, kernel internals, ETW, registry, object manager, and more — locally or remotely via WinSysServer. A kernel driver (KWinSys) enables deep kernel-mode analysis including SSDT hooks, kernel callbacks, EPT hook detection, and driver integrity checks.
Always run as Administrator for full functionality.
# Run elevated
Start-Process NtWarden.exe -Verb RunAs
User-mode features (processes, services, network, ETW, registry, object manager) work without the driver.
Kernel Driver Setup (KWinSys)
⚠️ Use only in a test VM. Enable test signing before installing.
# Enable test signing (requires reboot)
bcdedit /set testsigning on
# On VMs, may also need:
bcdedit /set nointegritychecks on
# Reboot, then run NtWarden as Administrator.
# Switching to the Kernel Mode tab auto-installs and starts KWinSys.
Check if driver is loaded before using kernel features
#include"WinSys/KernelInterface.h"
WinSys::KernelInterface ki;
bool driverAvailable = ki.Open();
if (driverAvailable) {
// Use kernel-mode featuresauto ssdt = ki.GetSSDTEntries();
} else {
// Fall back to user-mode onlyfprintf(stderr, "KWinSys not loaded — kernel features unavailable.\n");
}
Detect hidden processes (cross-reference EPROCESS list vs user-mode list)
WinSys::KernelInterface ki;
ki.Open();
auto kernelProcs = ki.EnumProcessObjects(); // Via EPROCESS walkauto& pm = WinSys::ProcessManager::Get();
pm.Update();
auto userProcs = pm.GetProcesses();
// Build set of user-visible PIDs
std::unordered_set<DWORD> visiblePids;
for (auto& p : userProcs) visiblePids.insert(p->Id);
// Find PIDs in kernel list but not user listfor (auto& kp : kernelProcs) {
if (visiblePids.find(kp.ProcessId) == visiblePids.end()) {
printf("HIDDEN PROCESS: PID=%u Name=%s\n",
kp.ProcessId, kp.ImageName.c_str());
}
}
Troubleshooting
NtWarden won't show kernel tabs
Ensure KWinSys.sys is in the same directory as NtWarden.exe (or x64/Release/KWinSys/)
Run NtWarden as Administrator
Confirm test signing is enabled: bcdedit /enum | findstr testsigning
Check Logger tab for driver load errors
Driver fails to install
# Verify test signing is on
bcdedit /enum | Select-String "testsigning"
# Check for existing broken service entry
sc query KWinSys
sc delete KWinSys # if stuck, delete and retry
# Some VMs also need:
bcdedit /set nointegritychecks on
# Then reboot
WinSysServer connection refused
# Verify server is running on target
netstat -ano | findstr 50002
# Check Windows Firewall on target
netsh advfirewall firewall add rule name="WinSysServer" `
dir=in action=allow protocol=TCP localport=50002
Capstone not found (user hooks tab shows no data)
User hook detection with disassembly requires Capstone
Build WinSys with Capstone linked, or the hook scanner will report bytes without disassembly
Performance overlay not visible
Launch NtWarden, go to Performance tab
Enable overlay mode — it renders over other windows using DirectX 11 transparency
Build errors — missing WDK
KWinSys requires the Windows Driver Kit
If you only need user-mode features, exclude KWinSys project from build in Visual Studio (right-click project > Unload Project)
