dwarf-expert

Name: dwarf-expert
Author: Trail of Bits

DWARFdebug infobinary analysiscompiler outputELFparsingreverse engineeringdebugging

⭐ 5.7k📄 CC-BY-SA-4.0🕒 2026-06-15Source ↗

Install this skill

npx skills add trailofbits/skills

Works across Claude Code, Cursor, Codex, Copilot & Antigravity

The dwarf-expert skill provides technical domain knowledge for interacting with DWARF debug information stored in ELF binaries. It facilitates precise queries regarding DWARF specifications versions 3 through 5 and assists in the structural analysis of Debugging Information Entries (DIEs). This skill guides developers through programmatic access patterns using libraries like pyelftools or gimli, and explains how to invoke CLI tools for diagnostic tasks. It covers the interpretation of debug sections such as .debug_info, .debug_line, and .debug_abbrev. Whether investigating compiler-generated metadata, verifying binary data integrity, or building custom debug information parsers, this skill acts as a technical reference to ensure adherence to DWARF standards and effective extraction of symbol, type, and source location information from compiled object files.

When to Use This Skill

•Troubleshooting incorrect source line mappings in debuggers
•Validating DWARF metadata output by custom compiler toolchains
•Extracting function signatures and type definitions from compiled binaries
•Comparing debug info overhead across different optimization levels

How to Invoke This Skill

Example prompts that trigger this skill in Claude Code, Cursor, or Antigravity:

“How do I verify the integrity of DWARF info in this binary?
“Explain the structure of a DWARF5 DW_TAG_subprogram entry.
“Help me parse the .debug_info section using pyelftools.
“Why is my debugger failing to resolve symbols in this build?
“Generate a quality report for the debug sections in my binary.

Pro Tips

💡Always specify the DWARF version you are interested in (e.g., 'DWARF v5') when asking questions to get the most precise answers.
💡Combine this skill with `llvm-dwarfdump --verify` output when debugging DWARF generation issues for targeted analysis.
💡For parsing tasks, mention the specific DWARF library you are using (e.g., 'pyelftools') to get tailored code examples.

What this skill does

•Interpreting and validating DWARFv3, v4, and v5 standard structures
•Automating binary integrity checks using llvm-dwarfdump
•Generating statistics on debug info quality and size
•Assisting in the development of custom DWARF parsing logic
•Mapping DIE nodes to source-level artifacts like functions and variables

When not to use it

✕Analyzing obsolete DWARF v1 or v2 formats
✕General reverse engineering of executable logic or control flow
✕Runtime debugging or memory inspection of live processes

Example workflow

Analyze the binary structure using llvm-dwarfdump to identify malformed sections.
Execute llvm-dwarfdump --verify to isolate specific structural violations.
Cross-reference problematic DIE offsets with the DWARF5 specification documentation.
Write a script using libdwarf or pyelftools to extract and inspect the target attributes.
Verify the corrected build output against previous quality metrics.

Prerequisites

–Access to the compiled ELF binary
–Basic familiarity with DWARF debug sections
–Installed llvm-dwarfdump or equivalent toolchain

Pitfalls & limitations

!False positives during structural verification if the compiler uses non-standard DWARF extensions
!High complexity when dealing with compressed debug sections like .zdebug
!Potential version mismatches between parser libraries and binary DWARF versions

FAQ

Does this skill help with DWARF v2?

No, this skill is focused on DWARF versions 3, 4, and 5.

Can I use this to debug a running process?

No, it is strictly for analyzing static debug information in binaries, not for runtime process inspection.

How do I check for DWARF quality regressions?

Use the llvm-dwarfdump --statistics command to generate metrics and compare outputs between different build iterations.

How it compares

While a generic LLM might provide outdated DWARF info, this skill maintains specific awareness of modern v5 standards and current verification CLI patterns.

Source & trust

⭐ 5.7k stars📄 CC-BY-SA-4.0🕒 Updated 2026-06-15

View original skill on GitHub →

📄 Full skill instructions — original source: trailofbits/skills

# Overview
This skill provides technical knowledge and expertise about the DWARF standard and how to interact with DWARF files. Tasks include answering questions about the DWARF standard, providing examples of various DWARF features, parsing and/or creating DWARF files, and writing/modifying/analyzing code that interacts with DWARF data.

## When to Use This Skill
- Understanding or parsing DWARF debug information from compiled binaries
- Answering questions about the DWARF standard (v3, v4, v5)
- Writing or reviewing code that interacts with DWARF data
- Using dwarfdump or readelf to extract debug information
- Verifying DWARF data integrity with llvm-dwarfdump --verify
- Working with DWARF parsing libraries (libdwarf, pyelftools, gimli, etc.)

## When NOT to Use This Skill
- **DWARF v1/v2 Analysis**: Expertise limited to versions 3, 4, and 5.
- **General ELF Parsing**: Use standard ELF tools if DWARF data isn't needed.
- **Executable Debugging**: Use dedicated debugging tools (gdb, lldb, etc) for debugging executable code/runtime behavior.
- **Binary Reverse Engineering**: Use dedicated RE tools (Ghidra, IDA) unless specifically analyzing DWARF sections.
- **Compiler Debugging**: DWARF generation issues are compiler-specific, not covered here.

# Authoritative Sources
When specific DWARF standard information is needed, use these authoritative sources:

1. **Official DWARF Standards (dwarfstd.org)**: Use web search to find specific sections of the official DWARF specification at dwarfstd.org. Search queries like "DWARF5 DW_TAG_subprogram attributes site:dwarfstd.org" are effective.

2. **LLVM DWARF Implementation**: The LLVM project's DWARF handling code at llvm/lib/DebugInfo/DWARF/ serves as a reliable reference implementation. Key files include:
- DWARFDie.cpp - DIE handling and attribute access
- DWARFUnit.cpp - Compilation unit parsing
- DWARFDebugLine.cpp - Line number information
- DWARFVerifier.cpp - Validation logic

3. **libdwarf**: The reference C implementation at github.com/davea42/libdwarf-code provides detailed handling of DWARF data structures.

# Verification Workflows
Use llvm-dwarfdump verification options to validate DWARF data integrity:

## Structural Validation

# Verify DWARF structure (compile units, DIE relationships, address ranges)
llvm-dwarfdump --verify <binary>

# Detailed error output with summary
llvm-dwarfdump --verify --error-display=full <binary>

# Machine-readable JSON error summary
llvm-dwarfdump --verify --verify-json=errors.json <binary>

## Quality Metrics

# Output debug info quality metrics as JSON
llvm-dwarfdump --statistics <binary>

The --statistics output helps compare debug info quality across compiler versions and optimization levels.

## Common Verification Patterns
- **After compilation**: Verify binaries have valid DWARF before distribution
- **Comparing builds**: Use --statistics to detect debug info quality regressions
- **Debugging debuggers**: Identify malformed DWARF causing debugger issues
- **DWARF tool development**: Validate parser output against known-good binaries

# Parsing DWARF Debug Information
## readelf
ELF files can be parsed via the readelf command ({baseDir}/reference/readelf.md). Use this for general ELF information, but prefer dwarfdump for DWARF-specific parsing.

## dwarfdump
DWARF files can be parsed via the dwarfdump command, which is more effective at parsing and displaying complex DWARF information than readelf and should be used for most DWARF parsing tasks ({baseDir}/reference/dwarfdump.md).

# Working With Code
This skill supports writing, modifying, and reviewing code that interacts with DWARF data. This may involve code that parses DWARF debug data from scratch or code that leverages libraries to parse and interact with DWARF data ({baseDir}/reference/coding.md).

# Choosing Your Approach

┌─ Need to verify DWARF data integrity?
│   └─ Use llvm-dwarfdump --verify (see Verification Workflows above)
├─ Need to answer questions about the DWARF standard?
│   └─ Search dwarfstd.org or reference LLVM/libdwarf source
├─ Need simple section dump or general ELF info?
│   └─ Use readelf ({baseDir}/reference/readelf.md)
├─ Need to parse, search, and/or dump DWARF DIE nodes?
│   └─ Use dwarfdump ({baseDir}/reference/dwarfdump.md)
└─ Need to write, modify, or review code that interacts with DWARF data?
    └─ Refer to the coding reference ({baseDir}/reference/coding.md)

By Trail of Bits

How to Use This Skill Unit

Option A: Project-Specific (Recommended)

Click "Download" above
In your project, create the directory: .agent/skills/dwarf-expert/
Save the file as SKILL.md
The agent will automatically discover the skill based on its description.

Option B: Global Installation (All Agents)

Save the file to these locations to make it available across all projects:

Claude Code: ~/.claude/skills/trailofbits/skills/dwarf-expert/SKILL.md
Cursor: ~/.cursor/skills/trailofbits/skills/dwarf-expert/SKILL.md
Antigravity: ~/.gemini/antigravity/skills/trailofbits/skills/dwarf-expert/SKILL.md