ntwarden-windows-analysis-toolkit

NtWarden.sln
├── NtWarden/          # GUI application
├── WinSys/            # Core static library
├── KWinSys/           # Kernel driver (.sys)
└── WinSysServer/      # Remote TCP server

# Run elevated
Start-Process NtWarden.exe -Verb RunAs

# Enable test signing (requires reboot)
bcdedit /set testsigning on
 
# On VMs, may also need:
bcdedit /set nointegritychecks on
 
# Reboot, then run NtWarden as Administrator.
# Switching to the Kernel Mode tab auto-installs and starts KWinSys.

# Install manually
sc create KWinSys type= kernel binPath= "C:\path\to\KWinSys.sys"
sc start KWinSys
 
# Stop and remove
sc stop KWinSys
sc delete KWinSys

# Auto-install driver + start server on default port 50002
WinSysServer.exe --install
 
# Custom port
WinSysServer.exe --install --port 9000
 
# If driver already installed manually:
WinSysServer.exe
WinSysServer.exe --port 9000

#include "WinSys/ProcessManager.h"
 
// Enumerate all processes (user mode)
auto& pm = WinSys::ProcessManager::Get();
pm.Update();  // Refresh snapshot
 
for (auto& proc : pm.GetProcesses()) {
    printf("PID: %5u  Name: %s\n",
        proc->Id,
        proc->GetImageName().c_str());
}

#include "WinSys/ServiceManager.h"
 
WinSys::ServiceManager svcMgr;
auto services = svcMgr.EnumServices();
 
for (auto& svc : services) {
    printf("Service: %-40s  State: %u  StartType: %u\n",
        svc.GetName().c_str(),
        svc.Status.dwCurrentState,
        svc.Config.dwStartType);
}

#include "WinSys/NetworkManager.h"
 
WinSys::NetworkManager netMgr;
auto conns = netMgr.GetTcpConnections();
 
for (auto& conn : conns) {
    printf("PID: %u  Local: %s:%u  Remote: %s:%u  State: %u\n",
        conn.ProcessId,
        conn.LocalAddress.c_str(), conn.LocalPort,
        conn.RemoteAddress.c_str(), conn.RemotePort,
        conn.State);
}

#include "WinSys/KernelInterface.h"
 
// Open handle to driver device
WinSys::KernelInterface ki;
if (!ki.Open()) {
    fprintf(stderr, "Failed to open KWinSys device. Is driver loaded?\n");
    return;
}
 
// Enumerate kernel modules
auto modules = ki.EnumKernelModules();
for (auto& mod : modules) {
    printf("Base: %p  Size: 0x%X  Path: %s\n",
        mod.Base, mod.Size, mod.FullPath.c_str());
}
 
// Read kernel callbacks
auto callbacks = ki.EnumProcessCallbacks();
for (auto& cb : callbacks) {
    printf("Callback: %p  Module: %s  Suspicious: %d\n",
        cb.Address,
        cb.OwnerModule.c_str(),
        cb.IsSuspicious ? 1 : 0);
}

#include "WinSys/ProcessAnalyzer.h"
 
DWORD targetPid = 1234;
WinSys::ProcessAnalyzer analyzer(targetPid);
 
auto result = analyzer.Analyze();
 
// Unbacked executable memory (shellcode indicator)
for (auto& region : result.UnbackedRegions) {
    printf("Unbacked RX region: base=%p size=0x%zX\n",
        region.Base, region.Size);
}
 
// Hollowing detection
if (result.HollowingDetected) {
    printf("Hollowing: PEB ImageBase=%p vs PE Header ImageBase=%p\n",
        result.PebImageBase, result.PeHeaderImageBase);
}
 
// Direct syscalls outside ntdll
for (auto& sc : result.DirectSyscalls) {
    printf("Direct syscall at: %p in module: %s\n",
        sc.Address, sc.ModuleName.c_str());
}
 
// Inline user hooks
for (auto& hook : result.UserHooks) {
    printf("Hook in %s!%s at %p -> %p\n",
        hook.Module.c_str(),
        hook.Function.c_str(),
        hook.Address,
        hook.Target);
}
 
// Token info
printf("Elevated: %d  IntegrityLevel: %u\n",
    result.Token.IsElevated,
    result.Token.IntegrityLevel);

#include "WinSys/KernelInterface.h"
 
WinSys::KernelInterface ki;
bool driverAvailable = ki.Open();
 
if (driverAvailable) {
    // Use kernel-mode features
    auto ssdt = ki.GetSSDTEntries();
} else {
    // Fall back to user-mode only
    fprintf(stderr, "KWinSys not loaded — kernel features unavailable.\n");
}

WinSys::KernelInterface ki;
ki.Open();
 
auto kernelProcs = ki.EnumProcessObjects();  // Via EPROCESS walk
auto& pm = WinSys::ProcessManager::Get();
pm.Update();
auto userProcs = pm.GetProcesses();
 
// Build set of user-visible PIDs
std::unordered_set<DWORD> visiblePids;
for (auto& p : userProcs) visiblePids.insert(p->Id);
 
// Find PIDs in kernel list but not user list
for (auto& kp : kernelProcs) {
    if (visiblePids.find(kp.ProcessId) == visiblePids.end()) {
        printf("HIDDEN PROCESS: PID=%u Name=%s\n",
            kp.ProcessId, kp.ImageName.c_str());
    }
}

# Verify test signing is on
bcdedit /enum | Select-String "testsigning"
 
# Check for existing broken service entry
sc query KWinSys
sc delete KWinSys  # if stuck, delete and retry
 
# Some VMs also need:
bcdedit /set nointegritychecks on
# Then reboot

# Verify server is running on target
netstat -ano | findstr 50002
 
# Check Windows Firewall on target
netsh advfirewall firewall add rule name="WinSysServer" `
  dir=in action=allow protocol=TCP localport=50002