# Dwarf Expert

Analyzes DWARF debug information in compiled binaries.

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Testing
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills --skill dwarf-expert -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill dwarf-expert -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill dwarf-expert -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill dwarf-expert -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# DWARF Expert

Expertise for DWARF debug info: parsing and searching it, verifying its
integrity, answering questions about the standard, and writing code that
consumes it. Out of scope: runtime debugging (use gdb/lldb), reverse
engineering beyond the DWARF sections (use Ghidra/IDA), and compiler-specific
DWARF generation bugs.

# Authoritative Sources

When precision matters, look standard details up instead of answering from memory:

1. **dwarfstd.org**, the official specification. Web-search specific sections,
   e.g. "DWARF5 DW_TAG_subprogram attributes site:dwarfstd.org".
2. **LLVM**, `llvm/lib/DebugInfo/DWARF/` is a reliable reference implementation:
   `DWARFDie.cpp` (DIE and attribute access), `DWARFUnit.cpp` (compilation units),
   `DWARFDebugLine.cpp` (line tables), `DWARFVerifier.cpp` (validation).
3. **libdwarf**, the reference C implementation at github.com/davea42/libdwarf-code.

# Parsing and Searching with dwarfdump

Prefer `dwarfdump` over `readelf` for DWARF-specific work. Two implementations
exist, libdwarf's `dwarfdump` and LLVM's `llvm-dwarfdump`, with different
options, and a bare `dwarfdump` command may be either: check `dwarfdump --version`
first. The options below are LLVM's.

On macOS, linked Mach-O executables do not carry DWARF: it stays in the `.o`
files until `dsymutil` collects it into a `.dSYM` bundle. Point `dwarfdump` at
the dSYM (or the object files), not the executable. `pyelftools` is ELF-only, for Mach-O scripted work, stay with the LLVM tools.

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/dwarf-expert/skills/dwarf-expert/SKILL.md