# ntwarden-windows-analysis-toolkit

A skill for digging into Windows internals: processes, services, network, ETW, kernel. Useful when you need to break down what a suspicious process is doing.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 443 installs · ★ 88
- Author: reason-machines
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/trending-skills/tree/HEAD/skills/ntwarden-windows-analysis-toolkit/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/ntwarden-windows-analysis-toolkit

## What it does

The skill covers NtWarden, a GUI app built on ImGui and DirectX 11 for inspecting Windows. Four pieces sit inside: the GUI itself, the WinSys static library for enumerating processes, services and network connections, the KWinSys kernel driver, and the headless WinSysServer for remote TCP connections.

Build it in Visual Studio 2022 with Windows SDK 10.0.26100.0 or newer. WDK is only needed for the KWinSys driver. Output lands in `x64/Release/`: `NtWarden.exe`, `WinSysServer.exe` and `KWinSys/KWinSys.sys`. Run the app as Administrator or some features drop out.

The driver installs after `bcdedit /set testsigning on` and a reboot; on a VM you may also need `bcdedit /set nointegritychecks on`. The remote server speaks a custom binary protocol with no authentication, so keep it on an isolated lab machine or VM rather than a production network.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/ntwarden-windows-analysis-toolkit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/ntwarden-windows-analysis-toolkit/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/ntwarden-windows-analysis-toolkit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/ntwarden-windows-analysis-toolkit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/trending-skills ntwarden-windows-analysis-toolkit
```

2. **Manually: put the files in place**
- File: `.github/skills/ntwarden-windows-analysis-toolkit/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/trending-skills --path skills/ntwarden-windows-analysis-toolkit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/ntwarden-windows-analysis-toolkit/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill ntwarden-windows-analysis-toolkit -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/trending-skills/tree/HEAD/skills/ntwarden-windows-analysis-toolkit/SKILL.md

## When to use it
- list kernel modules and trace where each one came from
- find unbacked executable memory regions inside a process
- check a process for hollowing by comparing PEB and PE header image bases
- spot direct syscalls that bypass ntdll
- pull TCP connections and map them back to PIDs

## Example prompts
- list processes with NtWarden and sort them by memory use
- check process 1234 for inline user-mode hooks
- start WinSysServer on the VM and connect to it from NtWarden

## Similar
- [windows-hardening](https://affpapa.org/en/nevibecode/skills/windows-hardening.md) — skill · 388 installs
- [windows-privilege-escalation](https://affpapa.org/en/nevibecode/skills/windows-privilege-escalation.md) — skill · 3600 installs
- [windows-av-evasion](https://affpapa.org/en/nevibecode/skills/windows-av-evasion.md) — skill · 3600 installs
- [malware-analysis-dragonflyTomb-avast](https://affpapa.org/en/nevibecode/skills/malware-analysis-dragonflytomb-avast.md) — skill · 1000 installs
- [windows-ui-automation](https://affpapa.org/en/nevibecode/skills/windows-ui-automation.md) — skill · 1300 installs

From the same set: [reason-machines/trending-skills](https://affpapa.org/en/nevibecode/by/reason-machines/trending-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md