Dwarf Expert
Analyzes DWARF debug information in compiled binaries.
Install
npx skills add trailofbits/skills --skill dwarf-expert -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Testing
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Lightabout 1,386 tokens
- Runs scripts
- No, instructions only
What it does
Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).
DWARF Expert
Expertise for DWARF debug info: parsing and searching it, verifying its integrity, answering questions about the standard, and writing code that consumes it. Out of scope: runtime debugging (use gdb/lldb), reverse engineering beyond the DWARF sections (use Ghidra/IDA), and compiler-specific DWARF generation bugs.
Authoritative Sources
When precision matters, look standard details up instead of answering from memory:
- dwarfstd.org, the official specification. Web-search specific sections, e.g. "DWARF5 DW_TAG_subprogram attributes site:dwarfstd.org".
- LLVM,
llvm/lib/DebugInfo/DWARF/is a reliable reference implementation:DWARFDie.cpp(DIE and attribute access),DWARFUnit.cpp(compilation units),DWARFDebugLine.cpp(line tables),DWARFVerifier.cpp(validation). - libdwarf, the reference C implementation at github.com/davea42/libdwarf-code.
Parsing and Searching with dwarfdump
Prefer dwarfdump over readelf for DWARF-specific work. Two implementations
exist, libdwarf's dwarfdump and LLVM's llvm-dwarfdump, with different
options, and a bare dwarfdump command may be either: check dwarfdump --version
first. The options below are LLVM's.
On macOS, linked Mach-O executables do not carry DWARF: it stays in the .o
files until dsymutil collects it into a .dSYM bundle. Point dwarfdump at
the dSYM (or the object files), not the executable. pyelftools is ELF-only, for Mach-O scripted work, stay with the LLVM tools.
