ACPI-rootkit-scan: volatility plugin to detect ACPI rootkits

Two new tools: dumpACPITables.py and scanACPITables.py:

[…] The plugin is able to extract the ACPI tables from a memory dump in raw and aml format (for description of the parameters see “-h” option in volatility). The files are extracted to a special folder e.g. ./dumpedTables/ and sub-folders are created for every base pointer (RSDP) found in the specified memory region.[…]

https://github.com/mdenzel/ACPI-rootkit-scan