Analyze and Parse DWARF Debug Information

DWARF Expert provides technical knowledge and hands-on capability for working with the DWARF debug information standard (versions 3, 4, and 5). It answers questions about the DWARF standard, gives examples of specific DWARF features, parses and creates DWARF files, and writes, modifies, or reviews code that interacts with DWARF data.

For authoritative information it draws on three sources: the official DWARF specification at dwarfstd.org (searched with targeted queries like "DWARF5 DW_TAG_subprogram attributes site:dwarfstd.org"), the LLVM project's DWARF implementation at llvm/lib/DebugInfo/DWARF/ as a reference implementation (DWARFDie.cpp for DIE handling and attribute access, DWARFUnit.cpp for compilation unit parsing, DWARFDebugLine.cpp for line number information, DWARFVerifier.cpp for validation logic), and the reference C implementation libdwarf (github.com/davea42/libdwarf-code).

For verification it uses llvm-dwarfdump:

llvm-dwarfdump --verify <binary>
llvm-dwarfdump --verify --error-display=full <binary>
llvm-dwarfdump --verify --verify-json=errors.json <binary>
llvm-dwarfdump --statistics <binary>

Structural validation checks compile units, DIE relationships, and address ranges, with detailed or JSON error output available; --statistics outputs debug info quality metrics as JSON, useful for comparing debug info quality across compiler versions and optimization levels. Common verification patterns include checking that binaries have valid DWARF before distribution, using --statistics to catch debug info quality regressions between builds, diagnosing malformed DWARF that's causing debugger issues, and validating a DWARF parser's output against known-good binaries.

For parsing, it prefers dwarfdump over readelf for DWARF-specific work - dwarfdump handles complex DWARF information more effectively, while readelf is reserved for general ELF information. It also supports writing, modifying, and reviewing DWARF-handling code, whether that code parses DWARF data from scratch or leverages libraries such as libdwarf, pyelftools, or gimli. A decision guide routes the task: integrity verification goes to llvm-dwarfdump --verify, standard questions go to dwarfstd.org or the LLVM/libdwarf source, general ELF info or simple dumps go to readelf, DIE-node-level parsing goes to dwarfdump, and code work goes to the coding reference.

Use this skill for understanding or parsing DWARF debug information from compiled binaries, answering questions about the DWARF standard (v3, v4, v5), writing or reviewing code that interacts with DWARF data, using dwarfdump or readelf to extract debug information, verifying DWARF data integrity with llvm-dwarfdump --verify, or working with DWARF parsing libraries like libdwarf, pyelftools, or gimli.

Do not use it for DWARF v1/v2 analysis - expertise is limited to versions 3, 4, and 5 - or for general ELF parsing that doesn't need DWARF data (use standard ELF tools instead). It is not a substitute for dedicated debugging tools (gdb, lldb) when debugging executable code or runtime behavior, nor for dedicated reverse-engineering tools (Ghidra, IDA) unless the task is specifically about analyzing DWARF sections. Compiler-specific DWARF generation issues are also out of scope. Do not treat the output as a substitute for environment-specific validation, testing, or expert review, and stop to ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Compiler, toolchain, and debugger engineers, and reverse engineers, who need to parse, verify, generate, or reason precisely about DWARF v3-v5 debug information rather than general ELF or binary analysis.