Can you analyze this file?

Dr.Binary
open_ghidra_server
list_imports
list_methods
decompile_function_by_address
decompile_function_by_address
decompile_function
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
list_data_items
sandbox_initialize
sandbox_download_binary
sandbox_execute
sandbox_execute
sandbox_execute
sandbox_execute
sandbox_execute

Here’s a quick rundown of what the binary does:

  1. Anti-debug check

    • It opens “/proc/self/status” and looks for “TracerPid:”
    • If TracerPid≠0 it prints “Nooooooo. La Policiaaa.” and exits.
  2. Password prompt

    • It asks “What’s the password?”, reads your input, strips the newline.
  3. Password verification

    • In .rodata there’s an XOR-encrypted string at address 0x00102023.

    • The routine walks that string and XORs each byte with 0xA9.

    • That yields the plain text:

      ts_pmo_gng_icl

  4. If you enter exactly “ts_pmo_gng_icl” (and you’re not being traced), it prints
    “Logged in as root.”
    otherwise it prints “Nuh Uh Nuh Uh.”

Conclusion: the correct password is

ts_pmo_gng_icl