diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py index be120f2af..16a312c07 100644 --- a/volatility3/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -78,6 +78,17 @@ def valid( ) -> bool: """Validates a json schema.""" input_hash = create_json_hash(input, schema) + + # Warn about using known bad + producer = input.get("metadata", {}).get("producer", {}) + if producer: + if producer.get("name") == "dwarf2json" and [ + int(x) for x in ".".split(producer.get("version")) + ] < (0, 8, 0): + raise UserWarning( + "Dwarf2json < 0.8.0 is known to produce faulty symbols for kernels > 6.0.0" + ) + if input_hash in cached_validations and use_cache: return True try: