Hardware
DMA attacks with the PCIscreamer —
DMA attacks - more practical than you think, so much so that the average pentester could do it
Dumping memory using SMM —
Using System Management Mode for dumping memory
Sitting in hardware —
A tl;dr summary on System Management Mode (SMM), light covering on hardware backdoors and forensic capabilities