dwarf-expert

Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).

Jump to install

Repository: trailofbits/skills
Last source activity: August 3, 2026 at 15:45
Detected SKILL.md language: English
Stars: 6,567
Forks: 564

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/trailofbits/skills --skill dwarf-expert

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

codeql

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.

2026-08-11

supply-chain-risk-auditor

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.

2026-08-10

semgrep

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.

2026-08-10

View all from this repository

name	dwarf-expert
description	Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).
effort	medium
allowed-tools	Read Write Edit Bash Grep Glob WebSearch WebFetch

DWARF Expert

Expertise for DWARF debug info: parsing and searching it, verifying its integrity, answering questions about the standard, and writing code that consumes it. Out of scope: runtime debugging (use gdb/lldb), reverse engineering beyond the DWARF sections (use Ghidra/IDA), and compiler-specific DWARF generation bugs.

Authoritative Sources

When precision matters, look standard details up instead of answering from memory:

dwarfstd.org — the official specification. Web-search specific sections, e.g. "DWARF5 DW_TAG_subprogram attributes site:dwarfstd.org".
LLVM — llvm/lib/DebugInfo/DWARF/ is a reliable reference implementation: DWARFDie.cpp (DIE and attribute access), DWARFUnit.cpp (compilation units), DWARFDebugLine.cpp (line tables), DWARFVerifier.cpp (validation).
libdwarf — the reference C implementation at github.com/davea42/libdwarf-code.

Library	Language	Notes
`libdwarf`	C/C++	github.com/davea42/libdwarf-code — low-level; used to implement `dwarfdump`
`pyelftools`	Python	github.com/eliben/pyelftools — also parses ELF in general
`gimli`	Rust	github.com/gimli-rs/gimli — pair with `object` to load container files
`debug/dwarf`	Go	standard library
`LibObjectFile`	.NET	github.com/xoofx/LibObjectFile — also handles ELF/PE object files

dwarf-expert

Install options

Review the source files

DWARF Expert

Authoritative Sources

Parsing and Searching with dwarfdump

DWARF Expert

Authoritative Sources

Parsing and Searching with dwarfdump

Searching DIEs

Verifying DWARF Integrity

readelf

Writing Code That Parses DWARF

dwarf-expert

Source facts

Install options

Review the source files

More from this repository

More from this repository

DWARF Expert

Authoritative Sources

Parsing and Searching with dwarfdump

DWARF Expert

Authoritative Sources

Parsing and Searching with dwarfdump

Searching DIEs

Verifying DWARF Integrity

readelf

Writing Code That Parses DWARF