Ntwarden Windows Analysis Toolkit

#include "WinSys/ProcessManager.h"
// Enumerate all processes (user mode)auto& pm = WinSys::ProcessManager::Get();pm.Update();  // Refresh snapshot
for (auto& proc : pm.GetProcesses()) {    printf("PID: %5u  Name: %s\n",        proc->Id,        proc->GetImageName().c_str());}

#include "WinSys/ServiceManager.h"
WinSys::ServiceManager svcMgr;auto services = svcMgr.EnumServices();
for (auto& svc : services) {    printf("Service: %-40s  State: %u  StartType: %u\n",        svc.GetName().c_str(),        svc.Status.dwCurrentState,        svc.Config.dwStartType);}

#include "WinSys/NetworkManager.h"
WinSys::NetworkManager netMgr;auto conns = netMgr.GetTcpConnections();
for (auto& conn : conns) {    printf("PID: %u  Local: %s:%u  Remote: %s:%u  State: %u\n",        conn.ProcessId,        conn.LocalAddress.c_str(), conn.LocalPort,        conn.RemoteAddress.c_str(), conn.RemotePort,        conn.State);}

#include "WinSys/KernelInterface.h"
// Open handle to driver deviceWinSys::KernelInterface ki;if (!ki.Open()) {    fprintf(stderr, "Failed to open KWinSys device. Is driver loaded?\n");    return;}
// Enumerate kernel modulesauto modules = ki.EnumKernelModules();for (auto& mod : modules) {    printf("Base: %p  Size: 0x%X  Path: %s\n",        mod.Base, mod.Size, mod.FullPath.c_str());}
// Read kernel callbacksauto callbacks = ki.EnumProcessCallbacks();for (auto& cb : callbacks) {    printf("Callback: %p  Module: %s  Suspicious: %d\n",        cb.Address,        cb.OwnerModule.c_str(),        cb.IsSuspicious ? 1 : 0);}

#include "WinSys/ProcessAnalyzer.h"
DWORD targetPid = 1234;WinSys::ProcessAnalyzer analyzer(targetPid);
auto result = analyzer.Analyze();
// Unbacked executable memory (shellcode indicator)for (auto& region : result.UnbackedRegions) {    printf("Unbacked RX region: base=%p size=0x%zX\n",        region.Base, region.Size);}
// Hollowing detectionif (result.HollowingDetected) {    printf("Hollowing: PEB ImageBase=%p vs PE Header ImageBase=%p\n",        result.PebImageBase, result.PeHeaderImageBase);}
// Direct syscalls outside ntdllfor (auto& sc : result.DirectSyscalls) {    printf("Direct syscall at: %p in module: %s\n",        sc.Address, sc.ModuleName.c_str());}
// Inline user hooksfor (auto& hook : result.UserHooks) {    printf("Hook in %s!%s at %p -> %p\n",        hook.Module.c_str(),        hook.Function.c_str(),        hook.Address,        hook.Target);}
// Token infoprintf("Elevated: %d  IntegrityLevel: %u\n",    result.Token.IsElevated,    result.Token.IntegrityLevel);

#include "WinSys/KernelInterface.h"
WinSys::KernelInterface ki;bool driverAvailable = ki.Open();
if (driverAvailable) {    // Use kernel-mode features    auto ssdt = ki.GetSSDTEntries();} else {    // Fall back to user-mode only    fprintf(stderr, "KWinSys not loaded — kernel features unavailable.\n");}

WinSys::KernelInterface ki;ki.Open();
auto kernelProcs = ki.EnumProcessObjects();  // Via EPROCESS walkauto& pm = WinSys::ProcessManager::Get();pm.Update();auto userProcs = pm.GetProcesses();
// Build set of user-visible PIDsstd::unordered_set<DWORD> visiblePids;for (auto& p : userProcs) visiblePids.insert(p->Id);
// Find PIDs in kernel list but not user listfor (auto& kp : kernelProcs) {    if (visiblePids.find(kp.ProcessId) == visiblePids.end()) {        printf("HIDDEN PROCESS: PID=%u Name=%s\n",            kp.ProcessId, kp.ImageName.c_str());    }}