11

I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader.

Are there any good alternatives on both windows and Linux for these tools? I have used gdb on Linux a little and WinDbg on windows as well.

I just need a recommendation on what is industry standard if the three biggies can't be used?

Thanks, Don

  • What makes software screen reader friendly? Can you generalize and state that everything inside a GUI is worthless for you? I still use an old IDA Pro demo in a Mac Terminal - so 'plain characters only' - , and for me it's as good as any new-fangled Windows version. Plus, it has a delightful retro 90s MS-DOS look and feel. – usr2564301 Feb 14 '16 at 21:06
  • 1
    @rad screenreader accessibility is somewhat elusive to describe. Not Windbg is accessible albeit a little cumbersome to use, but I hvae used it successfully in a classroom situation. A text-based version of IDA might be exactly what I am looking for. Something that does a real good job of disassembling and/or decompiling would be helpful.all gui applications are inaccessible, in fact many of the gui programs are very accessible. Unfortunately, anything written using the QT or GTK+ development kits are for the most part inaccessible. – dnraikes Feb 18 '16 at 17:04
7

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// protocols ;) All of them have a textual interface that should be suitable for braille-interfaces.

But I guess that the killer-feature of radare2 for blind people is that it has ascii control-flow graphs:

                       =------------------------------------------------------=
                       | [0x400536]                                           |
                       | main:                                                |
                       | (fcn) sym.main 50                                    |
                       | ; arg int arg_0_2      @ rbp+0x2                     |
                       | ; var int local_0_1    @ rbp-0x1                     |
                       | push rbp                                             |
                       | mov rbp, rsp                                         |
                       | sub rsp, 0x10                                        |
                       | mov dword [rbp - 4], edi                             |
                       | mov qword [rbp - 0x10], rsi                          |
                       | cmp dword [rbp - 4], 2 ; test.c:2     if (argc > 2)  |
                       | jle 0x400557 ;[a]                                    |
                       =------------------------------------------------------=
                             t f
  .--------------------------' '------------------------------.
  |                                                           |
  |                                                           |
=--------------------------------------------------=      =--------------------------------------------------=
|  0x400557                                        |      |  0x40054b                                        |
| mov edi, 0x4005f7 ; test.c:5         puts("Oo"); |      | mov edi, 0x4005f4 ; test.c:3         puts("Ok"); |
| call sym.imp.puts ;[b]                           |      | call sym.imp.puts ;[b]                           |
=--------------------------------------------------=      | jmp 0x400561 ;[c]                                |
    v                                                     =--------------------------------------------------=
    |                                                         v
    '-----------------------------------.---------------------'
                                    |
                                    |
                                =-------------------------------------=
                                |  0x400561                           |
                                | mov eax, 0 ; test.c:6     return 0; |
                                | leave ; test.c:7 }                  |
                                | ret                                 |
                                =-------------------------------------=

There are a lot of slides available from various talks about radare2, but I guess the easiest way to lrean how to use it is to read the radare2 book. I'm quite sure that everyone would be happy to help you/implement missing features on the irc channel!

  • gdb from cygwin64 also seems to work very well. – dnraikes Feb 16 '16 at 16:20
4

A thought - Visual Studio has good accessibility features (according to their blog at least) and it can display assembly code for a compiled app. This is good if you want to learn what complied constructs look like in binary. Courses such as http://opensecuritytraining.info/IntroX86.html use Visual Studio for code analysis exclusively. I understand the videos for this course are not narrated well from a point of view of a blind person, but they are still useful even if you cannot see what is happening.

Also, Windbg is a very good debugger these days. You will be priceless if you master Windbg. Ollie is for wussies :) Immunity is essentially a few years' old version of Ollie with some plugins for exploit development.

  • While I haven't tried the latest visual studio versions I have never found vs to be very accessible, but I will take another look. – dnraikes Feb 16 '16 at 16:22
  • 1
    @dnraikes :( reverse engineering tools in general are far from getting any kind of accessible interface, they are barely out of "nasty hack with text interface" territory yet. – Vitaly Osipov Feb 16 '16 at 20:48
4

Sorry for the late answer but I only now noticed this question.

Disclaimer: I work at Hex-Rays, mainly on IDA development.

It so happens that we have a few blind users. With their help, in recent versions of IDA (especially 6.95) we made big improvements for accessibility, especially on Windows and Linux (OS X is working somewhat but not as well). So I suggest you to try the demo version to see how it works with your screen reader. Feel free to contact us with any issues; we're always willing to make IDA even more accessible.

2

You might give a try to Bokken, which is a front-end for Radare2 and Pyew. Pyew is a malware-analysis framework for Python, but Bokken can be useful as an extra set of eyes in your reverse engineering toolchain for any purpose.

Another great alternative is EmilPRO, a front-end for objdump (from the GNU binutils package). EmilPRO's main claim is support for many architectures, primarily leveraging the GNU binutils support of popular file types such as ELF, PE, and Mach-O. It's name is a play on IDA Pro. It has support for Qt and GTK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.