dwarf-expertlisted

Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).
gztes/security-for-platforms · ★ 0 · Code & Development · score 61

Install: claude install-skill gztes/security-for-platforms

# DWARF Expert Expertise for DWARF debug info: parsing and searching it, verifying its integrity, answering questions about the standard, and writing code that consumes it. Out of scope: runtime debugging (use gdb/lldb), reverse engineering beyond the DWARF sections (use Ghidra/IDA), and compiler-specific DWARF generation bugs. # Authoritative Sources When precision matters, look standard details up instead of answering from memory: 1. **dwarfstd.org** — the official specification. Web-search specific sections, e.g. "DWARF5 DW_TAG_subprogram attributes site:dwarfstd.org". 2. **LLVM** — `llvm/lib/DebugInfo/DWARF/` is a reliable reference implementation: `DWARFDie.cpp` (DIE and attribute access), `DWARFUnit.cpp` (compilation units), `DWARFDebugLine.cpp` (line tables), `DWARFVerifier.cpp` (validation). 3. **libdwarf** — the reference C implementation at github.com/davea42/libdwarf-code. # Parsing and Searching with dwarfdump Prefer `dwarfdump` over `readelf` for DWARF-specific work. Two implementations exist — libdwarf's `dwarfdump` and LLVM's `llvm-dwarfdump` — with different options, and a bare `dwarfdump` command may be either: check `dwarfdump --version` first. The options below are LLVM's. On macOS, linked Mach-O executables do not carry DWARF: it stays in the `.o` files until `dsymutil` collects it into a `.dSYM` bundle. Point `dwarfdump` at the dSYM (or the object files), not the executable. `pyelftools` is ELF-only — for Mach-O scripted work, stay with th