The assembly language

[ahmed22pm7]

When i try to open a non Pe excutable file the program doesn't recognize its assembly language automatically and i don't know the file assembly language to make it manually
What should i do

[bdemick]

You will need to run a tool like binwalk, cpu_rec, isadetect, or seer to attempt to infer the architecture. You might also get some hints from running strings on the binary to look for platform and/or processor-specific strings. Then you will need to load it as a raw binary and set the architecture manually.

If you're lucky, the base address is 0, if not, you'll have to figure out what address to load the binary at, which may or may not be encoded somewhere in the file depending on the format.

[ahmed22pm7]

I anlyzed the file with seer tool and there are sevral architectures which one i should choose when i anlyze the file on ghidra and will the code be not completed consedering it has a lot of architectures and i have to choose just one them?

[

[GhidorahRex]

It's unlikely that the binary has all of these architectures, and in fact it probably only has one. Given the balance between the various architectures with no one architecture standing out, it could be that the file is compressed in some way. Without doing some preliminary analysis or trying other tools, we don't have a way of determining the language.

[bdemick]

To follow this: An entropy graph of the file (binwalk -E) can provide some insight. High entropy closer to 1 indicates a high level of randomness (compression and/or encryption). If you plot the entropy and see some regions of the file where entropy is lower, you could get a more meaningful architecture detection by limiting it to these parts of the binary. Locating executable code can be a bit of an art.

[ahmed22pm7]

To follow this: An entropy graph of the file (binwalk -E) can provide some insight. High entropy closer to 1 indicates a high level of randomness (compression and/or encryption). If you plot the entropy and see some regions of the file where entropy is lower, you could get a more meaningful architecture detection by limiting it to these parts of the binary. Locating executable code can be a bit of an art.

I anlyze it with different tool which is isadetect and it give me three options
1-full
2-code
3-fragment
and that's the result for Every option with the same sequence
and i will also anlyze it with binwalk like you explained above

[ahmed22pm7]

It's unlikely that the binary has all of these architectures, and in fact it probably only has one. Given the balance between the various architectures with no one architecture standing out, it could be that the file is compressed in some way. Without doing some preliminary analysis or trying other tools, we don't have a way of determining the language.

Thank you for explaining and for your time

[EImran4ik]

Guys, I write an OS in assembler, I implemented a boot screen, a kernel and a notepad.
When I write the "write" command, notepad should open, but it doesn't work.
;kernel :
org 500h ;этот сектор будет загружаться по адресу 0000:0500h
message:
mov ax, 0002h ;очищаем экран
int 10h

mov dx,0h
call SetCursorPos
    mov bp, msg
    mov cx, 20
    mov bl,04h                  
    xor bh,bh
    mov ax,1301h
    int 10h         ;вывод приглашения к вводу команды
     
    add dh,2            ;переводим курсор на один пункт вниз для ввода команды
    call SetCursorPos
    mov si,0

Command:
mov ah,10h
int 16h
cmp ah, 0Eh ;Если нажата клавиша BackSpase - удалить символ
jz Delete_symbol
cmp al, 0Dh
jz Input_Command
mov [string+si],al
inc si
mov ah,09h
mov bx,0004h
mov cx,1
int 10h
add dl,1
call SetCursorPos
jmp Command

Input_Command: ;Если нажат Enter, то переходим в третий сектор
mov ax,cs
mov ds,ax
mov es,ax
mov di,string
push si ;так как содержание регистра si меняется, сохраним в стеке
mov si, write
mov cx,5
rep cmpsb ;сравниваем строки - если команда write, то переходим
je wrt
pop si
jmp Command

Delete_symbol:
cmp dl,0
jz Command
sub dl,1 ;сдвигаем курсор влево
call SetCursorPos
mov al,20h ;вместо уже напечатанного символа выводим пробел
mov [string + si],al ;стираем символ в строке
mov ah,09h
mov bx,0004h
mov cx,1
int 10h
dec si ;уменьшаем кол-во напечатанных символов
jmp Command

wrt: mov ax,0000h
mov es,ax
mov bx,700h
mov ch,0 ;номер цилиндра - 0
mov cl,03h ;начальный сектор - 3
mov dh,0 ;номер головки - 0
mov al,01h ;кол-во читаемых секторов -1
mov ah,02h
int 13h
jmp 0000:0700h

SetCursorPos: ;установка курсора
mov ah,2h
xor bh,bh
int 10h
ret

msg db 'Input the command...',0
write db 'write',0
string db 5 dup(?) ;буфер для ввода команды

writer:
org 700h
start:
mov ax,0002h ;очищаем экран
int 10h
xor dx,dx
call SetCursorPos ;устанавливаем курсор

    mov bp, msg
    mov cx, 24
    call PrintMes   ;Вывод на экран строки msg
     
    mov dl,0
    mov dh,1
    call SetCursorPos   ;переводим курсор на одну строку вниз
    mov bp, helper
    mov cx,77
    call PrintMes       ;Вывод на экран строки helper

Option: ;Выбор - загрузить текст из четвертого сектора или начать новый
mov ah,10h
int 16h
cmp ah, 3Bh ;Если нажата клавиша F1 - загружаем текст
jz Load_text
cmp al, 0Dh ;Если нажата клавиша Enter - печатаем текст
jz Print_text
jmp Option

Load_text: ;Загрузка текста
mov ax,0000h
mov es,ax
mov bx,string
mov ch,0 ;номер цилиндра - 0
mov cl,4 ;начальный сектор - 4
mov dh,0 ;номер головки - 0
mov al,01h ;кол-во читаемых секторов -1
mov ah,02h
int 13h
xor dl,dl
mov dh,3
call SetCursorPos
mov bp, string
mov cx, 256
call PrintMes
mov si,255
add dl, 15 ;256-80*3=16
add dh,3
call SetCursorPos
jmp Command

Print_text:
xor dx,dx
add dh,3
call SetCursorPos ;получаем позицию курсора
mov si,0 ;Печать символов
Command:
mov ah,10h
int 16h
cmp al, 1Bh ;Если нажата клавиша Esc - выход из приложения
jz Esc
cmp al, 0Dh ;Если нажата клавиша Enter - переход на новую строку
jz Caret
cmp ah, 0Eh ;Если нажата клавиша BackSpase - удалить символ
jz Delete_symbol
cmp ah, 3Ch ;Если нажата клавиша F2- сохранить текст
jz Save_text
cmp si, 256
jz Command
mov [string + si],al
inc si
mov ah,09h
mov bx,0004h
mov cx,1
int 10h
add dl,1
call SetCursorPos
jmp Command

Caret: ;переход на новую строку
add dh,1
xor dl,dl
call SetCursorPos
jmp Command

Save_text: ;запись текста в 4 сектор
mov ax,0000h
mov es,ax
mov ah, 03h
mov al,1
mov ch,0
mov cl,4
mov dh,0
mov bx, string
int 13h
jmp Command

Delete_symbol: ;удаление символа после нажатия BackSpase
cmp dl,0
jne Delete
cmp dh,3
jz Command
sub dh,1
mov dl,79
jmp Cursor_Pos
Delete: sub dl,1 ;сдвигаем курсор влево
Cursor_Pos:
call SetCursorPos
mov al,20h ;вместо уже напечатанного символа выводим пробел
mov [string + si],al ;стираем символ в строке
mov ah,09h
mov bx,0004h
mov cx,1
int 10h
cmp si,0
jz Command
dec si ;уменьшаем кол-во напечатанных символов
jmp Command
Esc:
jmp 0000:0500h ;возвращаемся во второй сектор

;===================== Подпрограммы ===================================
PrintMes: ;в регистре bp - строка, в регистре cx - длина этой строки
mov bl,04h ;в регистре bl- атрибут
mov ax,1301h
int 10h
ret
;----------------------------------
SetCursorPos: ;установка курсора
mov ah,2h
xor bh,bh
int 10h
ret

    ;===================== выводимые сообщения===================== 
    msg db 'This is a text writer...',0 
    helper db 'To print text - press Enter, to load text - press F1, to save text - press F2',0
    string db 256 dup(?)    ;буфер для вводимого сообщения