Can you analyze this file?
open_ghidra_server
list_imports
list_methods
decompile_function_by_address
decompile_function_by_address
decompile_function
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
decompile_function_by_address
list_data_items
sandbox_initialize
sandbox_download_binary
sandbox_execute
sandbox_execute
sandbox_execute
sandbox_execute
sandbox_execute
Here’s a quick rundown of what the binary does:
-
Anti-debug check
- It opens “/proc/self/status” and looks for “TracerPid:”
- If TracerPid≠0 it prints “Nooooooo. La Policiaaa.” and exits.
-
Password prompt
- It asks “What’s the password?”, reads your input, strips the newline.
-
Password verification
-
In
.rodatathere’s an XOR-encrypted string at address 0x00102023. -
The routine walks that string and XORs each byte with 0xA9.
-
That yields the plain text:
ts_pmo_gng_icl
-
-
If you enter exactly “ts_pmo_gng_icl” (and you’re not being traced), it prints
“Logged in as root.”
otherwise it prints “Nuh Uh Nuh Uh.”
Conclusion: the correct password is
ts_pmo_gng_icl
