NtWarden - Windows Analysis and Research Toolkit

[foosaa]

Good morning folks!

I hope this will come in handy for performing Windows application analysis and research.

A small gist of it's capabilities:

NtWarden is a user-mode windows inspection tool that provides good visibility into processes, services, networking, registry, IPC, and system internals, with real-time performance overlays and ETW/log tracing etc.

With the help of kernel mode component (KWinSys), it can extend into low-level analysis of detecting hidden processes, kernel hooks, SSDT tampering, callbacks, drivers, and integrity violations and can also do process level heuristics for identifying injection, process hollowing, syscall abuses, and other stealth techniques.

https://github.com/mrT4ntr4/NtWarden

I hope this will come in handy while performing reverse engineering, malware analysis and protection technique analysis.

Do let me know if it useful. Thanks and have a fantastic day!