Extract Function Names from DWARF Debug Info

DWARF Debug Format

DWARF is the standard debugging data format used by GCC and Clang on Unix-like systems. It stores information about types, variables, functions, and source line numbers inside sections like .debug_info and .debug_line.

Structure and Key Tags

DWARF organizes debug data as a tree of Debugging Information Entries (DIEs):

• DW_TAG_compile_unit: Root of a compilation unit
• DW_TAG_subprogram: A function or subroutine
• DW_TAG_variable: A variable
• DW_AT_name: Name of the entity
• DW_AT_low_pc / DW_AT_high_pc: Function address range

For example, scanning .debug_info for DW_TAG_subprogram entries with DW_AT_name reveals every function name even when the symbol table has been stripped.

For This Exercise

You will implement a simplified DWARF scanner that extracts function names from a .debug_info section. Full DWARF parsing is complex, but this exercise teaches you what GDB uses to map instruction addresses back to source lines.

Line Number Information

Beyond function names, .debug_line maps instruction addresses to source file and line number. GDB uses this mapping when you break main.c:42. The abbreviation table in each compilation unit compresses repeated DIE patterns, which is why raw .debug_info bytes look opaque until you decode the abbrev entries. Even a simplified scanner teaches you what debuggers rely on under the hood.