NtWarden - Windows Analysis and Research Toolkit

[foosaa]

Good morning folks!

I hope this will come in handy for performing Windows application analysis and research.

A small gist of it's capabilities:

NtWarden is a user-mode windows inspection tool that provides good visibility into processes, services, networking, registry, IPC, and system internals, with real-time performance overlays and ETW/log tracing etc.

With the help of kernel mode component (KWinSys), it can extend into low-level analysis of detecting hidden processes, kernel hooks, SSDT tampering, callbacks, drivers, and integrity violations and can also do process level heuristics for identifying injection, process hollowing, syscall abuses, and other stealth techniques.

https://github.com/mrT4ntr4/NtWarden

I hope this will come in handy while performing reverse engineering, malware analysis and protection technique analysis.

Do let me know if it useful. Thanks and have a fantastic day!

[Jupiter]

Note: DirectX 11 required for ImGui.

Looks like a hacker tool in Hollywood action movies

[Fyyre]

It's the old new thing!

[HarrySpoofer]

Originally Posted by Jupiter

Note: DirectX 11 required for ImGui.

My OS does not support DX11. I protest !
Why does a low-level utility need DX at all?, pfffff...

[Ibrahim_Mihai]

Originally Posted by HarrySpoofer

My OS does not support DX11. I protest !
Why does a low-level utility need DX at all?, pfffff...

Use System Informer instead: https://systeminformer.sourceforge.io/downloads
Download the portable version: https://sourceforge.net/projects/systeminformer/files/systeminformer-3.2.25011-release-bin.zip/download
I use it all the time.

It evolved from Process Hacker: https://processhacker.sourceforge.io/downloads.php
-Ibrahim Mihai

[chants]

Originally Posted by HarrySpoofer

My OS does not support DX11. I protest !
Why does a low-level utility need DX at all?, pfffff...

@HarrySpoofer to properly address your concern it is built with Win SDK 10 so it requires Windows 10 or higher anyway. I think Windows 7 and up support DX11, so only a pretty ancient OS would have that issue unless you are on a really stripped down version of Win10/11, the OS is likely a bigger blocker than DX11.