Agent skill · security · aradotso
ntwarden-windows-analysis-toolkit
NtWarden is a Windows Analysis and Research Toolkit providing GUI-based inspection of processes, kernel internals, services, network, ETW, and more via ImGui + DirectX 11 with optional kernel driver support.
Why this skill is useful
Provides specific commands and procedures for kernel driver setup and remote inspection that are not widely known.
What it needs
Requires visual studio, wdk, windows installed locally. About 6k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
NtWarden Windows Analysis and Research Toolkit Skill by ara.so — Daily 2026 Skills collection. NtWarden is a Windows system inspection tool built on ImGui + DirectX 11. It covers processes, services, network, kernel internals, ETW, registry, object manager, and more — locally or remotely via WinSysServer. A kernel driver (KWinSys) enables deep kernel-mode analysis including SSDT hooks, kernel callbacks, EPT hook detection, and driver integrity checks. --- Architecture Component Role --- --- NtWarden GUI app (ImGui + DirectX 11) WinSys Static lib — process, service, network enumeration KWinSys Kernel driver — callbacks, SSDT, kernel modules, pool, etc. WinSysServer Headless TCP server for remote inspection --- Build Requirements Visual Studio 2022 Windows SDK 10.0.26100.0+ WDK (Windows Driver Kit) — required only for KWinSys kernel driver --- Building Solution structure: --- Running NtWarden Always run as Administrator for full functionality. User-mode features (processes, services, network, ETW, registry, object manager) work without the driver. --- Kernel Driver Setup (KWinSys) ⚠️ Use only in a test VM. Enable test signing before installing. Manual driver management: The NtWarden GUI also exposes driver management under the Driver menu. --- Remote Inspection (WinSysServer) Deploy to a target machine (typically a VM) and connect from NtWarden. Files to copy to target File Source Path Purpose --- --- --- WinSysServer.exe x64/Release/WinSysServer.exe Always required KWinSys.sys x64/Release/KWinSys/KWinSys.sys Kernel features only Starting the server (on target, elevated) Connecting from NtWarden (on host) 1. Launch NtWarden 2. Go to Remote menu 3. Enter target IP and port (default: 50002) 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/ntwarden-windows-analysis-toolkit