ACPI-rootkit-scan: volatility plugin to detect ACPI rootkits

~ hucktech

Two new tools: dumpACPITables.py and scanACPITables.py:

[…] The plugin is able to extract the ACPI tables from a memory dump in raw and aml format (for description of the parameters see “-h” option in volatility). The files are extracted to a special folder e.g. ./dumpedTables/ and sub-folders are created for every base pointer (RSDP) found in the specified memory region.[…]

https://github.com/mdenzel/ACPI-rootkit-scan

Published by hucktech

One thought on “ACPI-rootkit-scan: volatility plugin to detect ACPI rootkits”

  1. Pingback: Linux-Surface: ACPIDumps: ACPI dumps from various Microsoft Surface devices – Firmware Security

Leave a Reply

Please log in using one of these methods to post your comment:

Gravatar
WordPress.com Logo

You are commenting using your WordPress.com account. ( Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. ( Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. ( Log Out /  Change )

Cancel

Connecting to %s