Skip to main content
affpapa.org
RU EN
skill CX Codex

ntwarden-windows-analysis-toolkit — Claude Code skill: Windows

A skill for digging into Windows internals: processes, services, network, ETW, kernel. Useful when you need to break down what a suspicious process is doing.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a claude-code
Open on GitHub

What ntwarden-windows-analysis-toolkit does

The skill covers NtWarden, a GUI app built on ImGui and DirectX 11 for inspecting Windows. Four pieces sit inside: the GUI itself, the WinSys static library for enumerating processes, services and network connections, the KWinSys kernel driver, and the headless WinSysServer for remote TCP connections.

Build it in Visual Studio 2022 with Windows SDK 10.0.26100.0 or newer. WDK is only needed for the KWinSys driver. Output lands in x64/Release/: NtWarden.exe, WinSysServer.exe and KWinSys/KWinSys.sys. Run the app as Administrator or some features drop out.

The driver installs after bcdedit /set testsigning on and a reboot; on a VM you may also need bcdedit /set nointegritychecks on. The remote server speaks a custom binary protocol with no authentication, so keep it on an isolated lab machine or VM rather than a production network.

What it helps with

  • list kernel modules and trace where each one came from
  • find unbacked executable memory regions inside a process
  • check a process for hollowing by comparing PEB and PE header image bases
  • spot direct syscalls that bypass ntdll
  • pull TCP connections and map them back to PIDs

Example prompts for the agent

  • list processes with NtWarden and sort them by memory use
  • check process 1234 for inline user-mode hooks
  • start WinSysServer on the VM and connect to it from NtWarden

How to install ntwarden-windows-analysis-toolkit

1Skills CLI (Vercel)

npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a claude-code

2Manually: put the files in place

~/.claude/skills/ntwarden-windows-analysis-toolkit/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/ntwarden-windows-analysis-toolkit/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about ntwarden-windows-analysis-toolkit

How do I install ntwarden-windows-analysis-toolkit in Claude?

Run npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a claude-code. The skill file then lands at ~/.claude/skills/ntwarden-windows-analysis-toolkit/SKILL.md.

What does ntwarden-windows-analysis-toolkit do?

It documents how to build and run NtWarden, a Windows inspection tool. You use it to look at processes, services, network, ETW, registry, the object manager and kernel internals.

Do I need the KWinSys driver for NtWarden?

No. Processes, services, network, ETW, registry and the object manager all work in user mode. KWinSys is only required for the kernel tabs: SSDT hooks, callbacks, modules and pool.

Similar skills

Everything for Security →
windows-hardening devops-skills An agent skill that hardens Windows Server to Microsoft security baselines and CIS benchmarks: account policy, Group Policy, Defender, SMB. CX Codex +1 388installs windows-privilege-escalation yaklang This skill guides authorized reviews of Windows local privilege-escalation paths after a low-privilege shell is available. Use it to inspect system configuration and token context. CX Codex +1 3,600installs windows-av-evasion yaklang A playbook skill for bypassing AV and EDR on Windows: AMSI, ETW, .NET assembly loading, shellcode execution, process injection. CX Codex +1 3,600installs malware-analysis-dragonflyTomb-avast reason-machines A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing. CX Codex +1 1,000installs windows-ui-automation martinholovsky A skill for automating Windows apps through UI Automation and Win32 APIs: element discovery, input simulation, process interaction. Risk level HIGH. CX Codex +1 1,300installs

From the same set42

bluehammer-vulnerability-poc A skill that walks the agent through the BlueHammer repo: building the C exploit, running it, and reading the vulnerability code. For isolated labs only. CX Codex +1 570installs 3dsvg-interactive-react Turns SVGs and text into interactive 3D React components with the 3dsvg library. Useful for a dimensional logo or hero badge. CX Codex +1 529installs rattles-terminal-spinners A Claude skill covering rattles, a minimal Rust library for terminal spinners. Useful when a CLI needs a loading indicator without extra dependencies. CX Codex +1 497installs isolet-widget-isolation This skill packages a component into a self-contained widget with shadow DOM and scoped styles, ready to embed on any page. CX Codex +1 474installs tech-doc-style-chinese Style rules for Chinese technical writing: spacing between CJK and Latin, corner brackets, no buzzwords. Ships with a Python linter. CX Codex +1 434installs anubis-android-app-manager A skill for building and configuring Anubis, an Android app manager that freezes app groups through Shizuku depending on VPN state. CX Codex +1 427installs huashu-design-html-native Turns a plain-language request into a finished file: prototype, slide deck, animation or infographic in HTML/CSS/JS. No Figma involved. CX Codex +1 426installs cc-design-html-prototyping This skill builds HTML mockups, slide decks, and interactive prototypes. Use it to explore visual directions before implementing an interface. CX Codex +1 423installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor