47
\$\begingroup\$

This is the robbers' thread. The cops' thread is here.

Your challenge is to crack a cop's submission by finding an input that makes it halt. You don't have to find out why, or all inputs that make it halt if there's more than one, or the input the cop intended, just one input will do.

Once you have cracked a submission, post a link to it in a comment or edit to the cop's post. You can also flag your submission for a mod to edit it in the cop's post. Also, post the input used and a link to the cop's post in an answer in this thread. The robber that cracks the most submissions wins.

Multiple people can post cracks to the same cop submission, as long as they are different.

(If SE converted your duplicate answer to a comment, you may want to vote on this feature request)

Looking for uncracked submissions?

fetch("https://api.stackexchange.com/2.2/questions/135363/answers?order=desc&sort=activity&site=codegolf&filter=!.Fjs-H6J36vlFcdkRGfButLhYEngU&key=kAc8QIHB*IqJDUFcjEF1KA((&pagesize=100").then(x=>x.json()).then(data=>{var res = data.items.filter(i=>!i.body_markdown.toLowerCase().includes("cracked")).map(x=>{const matched = /^ ?##? ?(?:(?:(?:\[|<a href ?= ?".*?">)([^\]]+)(?:\]|<\/a>)(?:[\(\[][a-z0-9/:\.]+[\]\)])?)|([^, ]+)).*[^\d](\d+) ?\[?(?:(?:byte|block|codel)s?)(?:\](?:\(.+\))?)? ?(?:\(?(?!no[nt][ -]competing)\)?)?/gim.exec(x.body_markdown);if(!matched){return;}return {link: x.link, lang: matched[1] || matched[2], owner: x.owner}}).filter(Boolean).forEach(ans=>{var tr = document.createElement("tr");var add = (lang, link)=>{var td = document.createElement("td");var a = document.createElement("a");a.innerText = lang;a.href = link;td.appendChild(a);tr.appendChild(td);};add(ans.lang, ans.link);add(ans.owner.display_name, ans.owner.link);document.querySelector("tbody").appendChild(tr);});});
<html><body><h1>Uncracked Submissions</h1><table><thead><tr><th>Language</th><th>Author</th></tr></thead><tbody></tbody></table></body></html>

Improve this question
\$\endgroup\$
3
  • 2
    \$\begingroup\$ Does different mean different inputs (say, all inputs ending with 2 crack the cop's post - can you different people post different numbers ending in 2?) or different families of inputs, or different types of inputs? \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 17:03
  • 1
    \$\begingroup\$ Multiple people can post cracks to the same cop submission... Please define different. \$\endgroup\$
    – Dennis
    Commented Jul 25, 2017 at 13:41
  • \$\begingroup\$ @NoOneIsHere codegolf.meta.stackexchange.com/q/13437/58826 \$\endgroup\$
    – user58826
    Commented Jul 25, 2017 at 15:26

144 Answers 144

Reset to default
1 2
3
4 5
2
\$\begingroup\$

C, Steadybox

1597463007 1065353216

Try it online.

This one was clever.

Improve this answer
\$\endgroup\$
0
2
\$\begingroup\$

Pyth, isaacg

exec(input())
__import__("os")._exit(1)

I call this "privilege escalation" :P.

Improve this answer
\$\endgroup\$
2
\$\begingroup\$

C++, ecatmur 

struct C { int m; };
int C::* t = &C::m;

Try it online!

For some reasons, default initialization of pointer-to-member make that -1, which become true when cast to bool.

Improve this answer
\$\endgroup\$
0
2
\$\begingroup\$

R, Jarko Dubbeldam

"unlist"

Though it's just one more function that could be added to the exceptions - I doubt it's the intended solution.

Two more cracks: 'is.vector' and 'return'. These both work on the modified (list(0)) version.

Improve this answer
\$\endgroup\$
7
  • 2
    \$\begingroup\$ you're right, not intended, but good solution! Instead of turning a fix into a new post, do you mind if I change list(1) to list(0)? :D \$\endgroup\$
    – JAD
    Commented Jul 27, 2017 at 20:35
  • \$\begingroup\$ Sounds good to me :) \$\endgroup\$
    – Gregor Thomas
    Commented Jul 27, 2017 at 20:54
  • 1
    \$\begingroup\$ @JarkoDubbeldam See edits for two more cracks that work on the list(0) version. 'return' seems like it might even be the intended solution. \$\endgroup\$
    – Gregor Thomas
    Commented Jul 27, 2017 at 21:00
  • \$\begingroup\$ Getting closer, but not the intended solution. \$\endgroup\$
    – JAD
    Commented Jul 28, 2017 at 4:42
  • 1
    \$\begingroup\$ A few more cracks for the new version: "NROW", "NCOL", and "lengths" \$\endgroup\$
    – Gregor Thomas
    Commented Jul 28, 2017 at 6:16
2
\$\begingroup\$

JavaScript, iovoid

this.constructor.constructor("return process")().exit()

Try it online!

Improve this answer
\$\endgroup\$
2
\$\begingroup\$

JavaScript (Node.js) by Alex Varga

Updated with what I'd intended to post, thanks to Patrick Roberts' comment!

{valueOf:_=>process.exit(0)}

Try it online!

Improve this answer
\$\endgroup\$
3
  • 1
    \$\begingroup\$ Technically that terminates the program before even entering the function, as the process.exit() is invoked inside the call rather than the body. However, changing to {valueOf(){process.exit()}} would be sufficient. \$\endgroup\$
    – Patrick Roberts
    Commented Jul 28, 2017 at 7:05
  • \$\begingroup\$ @PatrickRoberts yeah, that's what I'd intended to post... Not sure how I posted the wrong one. I validated it entered the loop on my system, but clearly missed that.. otherwise, I guess I could have just added process.exit(0) on its own, which kinda misses the point of the challenge really. Thanks for the nod! \$\endgroup\$
    – Dom Hastings
    Commented Jul 28, 2017 at 7:47
  • \$\begingroup\$ Also, the username typically links to their cop answer, not their account page, while you're editing. \$\endgroup\$
    – Patrick Roberts
    Commented Jul 28, 2017 at 7:49
2
\$\begingroup\$

C (gcc), dj0wns

%s%s

Try It Online!

The offending command essentially evaluates to this and throws a seg fault when it tries to read a second string from beyond d, since there is no 5th argument to the function. 

char b[256];
char*d = "abcd";
snprintf(b,4,"%s%s",d)
Improve this answer
\$\endgroup\$
8
  • \$\begingroup\$ Not my intended solution but I guess it works on Tio, doesn't work on my local machine though. \$\endgroup\$
    – dj0wns
    Commented Jul 24, 2017 at 19:59
  • \$\begingroup\$ I hope someone can find the intended solution then, this particular question allows for multiple cracks \$\endgroup\$
    – PunPun1000
    Commented Jul 24, 2017 at 20:00
  • \$\begingroup\$ Well done mate! \$\endgroup\$
    – dj0wns
    Commented Jul 24, 2017 at 20:01
  • \$\begingroup\$ C is perfectly happy letting you write to random places what? In C implementations on modern OSes, all pages mapped in your virtual address space will be read-only or read/write. I think some hardware does allow making pages write-only, but this is definitely not something you should expect. C as an abstract standard of course just says that writing outside of any object is Undefined Behaviour, so it's all implementation-specific behaviour here. A real-mode DOS C implementation might not fault at all here. \$\endgroup\$
    – Peter Cordes
    Commented Jul 29, 2017 at 10:17
  • 1
    \$\begingroup\$ @PeterCordes I've removed the unnecessary wording from my answer \$\endgroup\$
    – PunPun1000
    Commented Jul 29, 2017 at 17:58
2
\$\begingroup\$

JavaScript (Node.js >= 6.0), Patrick Roberts

{__proto__:Function,toString:_=>process.kill(0)}

This probably isn't the intended answer, but it does work. It kills the process without giving either the exit handler or the exception handler a chance to run. Sending to PID 0 is shorter than to process.pid and sends the signal to all processes in the current process group.

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Ah, unfortunate... Interesting object literal though, can't say I've ever seen one with a __proto__ attribute in it. And no, this wasn't quite it, but it was indeed creative, and probably more efficient than my answer. \$\endgroup\$
    – Patrick Roberts
    Commented Jul 31, 2017 at 3:21
2
\$\begingroup\$

Python 2, by veedrac

import os, functools
class A:__int__ = os.abort
k(functools.partial(int, A()))
Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Nice effort; I see your solution to mine is very similar to my solution to yours. This wasn't the intended solution, but I only just figured out partial can be used like this so fair play. I'll probably add a revision that bans functools.partial, but I'll leave that for another day. \$\endgroup\$
    – Veedrac
    Commented Jul 31, 2017 at 3:01
2
\$\begingroup\$

Python 3, E.D. (Fixed)

The input 0526315789473684210344827586206896551724137931020408163265306122448979591836734693877551 halts the fixed program. Since each of the three chunks are separate from each other, you can compute them individually, then combine them together. A coworker of mine figured out the logic and wrote the script to generate this answer.

Also, the fix didn't entirely work as an input of "0"*88+"1" will halt the program as well, since the check for a nonzero n checks the whole string, while only n[:88] is used in the calculations. So, any input of the form "0"*88+A where A is a string where all elements are digits, and at least one is nonzero, will cause the program to halt.

Try it online!

Improve this answer
\$\endgroup\$
2
\$\begingroup\$

Javascript (Node.js), A username

Most inputs to the program will actually throw an error (null, 0, [] etc), but the below solution halts without an error:

f({ replace: () => {} })

Try it online!

Improve this answer
\$\endgroup\$
2
\$\begingroup\$

JavaScript (Node.js), cracks A username's challenge

f('`W`')

Try it online!

There are multiple ways to make this fail with an error (try a single backtick) but this evaluates to this

return +[`W`]

This results in NaN, and NaN !== NaN.

Improve this answer
\$\endgroup\$
1
\$\begingroup\$

cQuents, Step Hen

1 2

Try it online!

Essentially, anything that matches /^.+ \d+$/ is valid input that will halt the program.

Improve this answer
\$\endgroup\$
4
  • \$\begingroup\$ A crack containing alphanumerics exists, if a cop wants to try it. \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 17:04
  • \$\begingroup\$ @StepHen I am still trying, trying to figure out how the inputs work \$\endgroup\$
    – user41805
    Commented Jul 24, 2017 at 17:09
  • \$\begingroup\$ From documentation: Input is currently given as a space delimited list of numbers (although unless you do math on them they are not forced to be numbers, as in my test case on TIO) \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 17:11
  • \$\begingroup\$ @StepHen Figured it out as soon as you posted that comment :D \$\endgroup\$
    – user41805
    Commented Jul 24, 2017 at 17:12
1
\$\begingroup\$

Java

The strings __.-._.-._.-.-.-.-.-._.-._._.-.-._. and __-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- work, with a minor bug: Integer.toHexString doesn't give a leading 0x, under Java 8. (I didn't try other versions.) Trimming it from the source makes it work fine.

Improve this answer
\$\endgroup\$
6
  • \$\begingroup\$ @tuskiomi, it works in Jetbrains IntelliJ and in TIO, and neither prepend the 0x. The . characters are space-filler in the non-checked positions (only every other position is checked). \$\endgroup\$
    – user3033745
    Commented Jul 24, 2017 at 17:46
  • \$\begingroup\$ Well, you got me there. The characters could be technically anything... but this is the correct answer. \$\endgroup\$
    – tuskiomi
    Commented Jul 24, 2017 at 17:50
  • \$\begingroup\$ Also, How'd ya figure this one out? ;) \$\endgroup\$
    – tuskiomi
    Commented Jul 24, 2017 at 17:51
  • \$\begingroup\$ @tuskiomi I saw that the bitshifts at the bottom were constructing an int bit by bit with - being 1, and mentally transcribed the two hex ints to binary. Then I added in the padding to make it fit, and made the other string as simple as possible to enter the if. \$\endgroup\$
    – user3033745
    Commented Jul 24, 2017 at 17:54
  • 1
    \$\begingroup\$ @tuskiomi, I hadn't even heard of it until now, to be honest. It's obvious once I looked it up, though. Clever puzzle! \$\endgroup\$
    – user3033745
    Commented Jul 24, 2017 at 18:03
1
\$\begingroup\$

JavaScript (ES6), programmer5000

null

The condition was typeof x!=="object"||x; apparently null is an object but falsey in JavaScript.

Try it online!

Improve this answer
\$\endgroup\$
1
\$\begingroup\$

Java, tuskiomi

Fatally errors when the two arguments '_-_-_-_-_-' and '__________' are given.

Improve this answer
\$\endgroup\$
3
  • \$\begingroup\$ For me it keeps running \$\endgroup\$
    – tuskiomi
    Commented Jul 24, 2017 at 17:43
  • \$\begingroup\$ Did you type it correctly? 10 underscores and then 5 underscores and 5 dashes alternating \$\endgroup\$
    – Okx
    Commented Jul 24, 2017 at 17:43
  • \$\begingroup\$ I copied straight from your post; I just tried switching the parameter's order. no cigar. \$\endgroup\$
    – tuskiomi
    Commented Jul 24, 2017 at 17:44
1
\$\begingroup\$

JavaScript, programmer5000

null

That's basically it.

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ @programmer5000 Sorry, I didn't see the mistake when trying to FGITW \$\endgroup\$
    – user41805
    Commented Jul 24, 2017 at 17:47
1
\$\begingroup\$

JavaScript, programmer5000

new Buffer(268435440)

Throws an error when it is coerced into a string.

Try it online!

Got it from this request for better error documentation.

Improve this answer
\$\endgroup\$
2
  • \$\begingroup\$ Woah! Nice job! \$\endgroup\$
    – user58826
    Commented Jul 24, 2017 at 19:14
  • \$\begingroup\$ @programmer5000 thanks :P now go crack mine two newest ones, have fun :P \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 19:15
1
\$\begingroup\$

JavaScript (Node.js)

g("13")(13/321)

It works, apparently you can replace 13 with 33, 53, etc

Improve this answer
\$\endgroup\$
1
  • 1
    \$\begingroup\$ That's not what I had in mind, but good job getting around what I had in mind, because you would never have guessed it :P \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 19:28
1
\$\begingroup\$

Python 2, Foon

Crack or hack? I'm not sure which this is yet...

Windows:

exit()
<ctrl>C

Where <ctrl> is the actual key modifier. This will eval exit() in the first pass of the loop and catch the keyboard interrupt in the second. quit will work in place of exit too.

(Nix replace <ctrl>C with <ctrl>D ?)

Improve this answer
\$\endgroup\$
1
\$\begingroup\$

Python 3.5, Siphor

"\r def t():pass"

Calling f("\r def t():pass") will redefine the "inner" t to a function that does nothing prior to it being created inside the "outer" t.

Improve this answer
\$\endgroup\$
0
1
\$\begingroup\$

Python 2, Quelklef

def x():
    import ctypes
    ctypes.cast(1, ctypes.POINTER(ctypes.c_int))[0]

f(x)

I'm sure this isn't the intended solution, but a segfault counts, right?

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Not intended, but does work... Wish I could disable imports. \$\endgroup\$
    – Quelklef
    Commented Jul 25, 2017 at 1:53
1
\$\begingroup\$

Python 2, Quelklef

def f(x):
	try:x()
	except:1
	while True:1
def x():global True;True=False
f(x)

Try it online!

Redefines True to False.

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Yay! This is the solution I was looking for! I did it differently, as f( lambda: globals().update({"True": False}) ) \$\endgroup\$
    – Quelklef
    Commented Jul 25, 2017 at 2:33
1
\$\begingroup\$

J, miles

Input: '' (the empty vector). Errors with an index error.

$:@#~^:(0([=[e.{#])#~) ''

This approach (erroring out) will work for infinity, floats, and non-positive numbers.

The intended approach is probably an imaginary number, such as 2j2, which returns a result.

   $:@#~^:(0([=[e.{#])#~) 2j2
2j2

Let's decompose the program:

$:@#~^:(0([=[e.{#])#~) 
$:@                       call this function (recurse)
   #~                     with the input repeated itself times
     ^:(             )    if:
        0(    f   )#~         f(0, #~ y)
          [=[e.{#]


dyad:
[ = [ e. { # ]  x = 0, y = #~ y
           #    repeat
             ]     y
         {         y[0] times
    [ e.        check if 0 is in this list
[ =             check if that is false

So, we want an input y such that (0{y) # (#~ y) contains a zero. When using an imaginary number as y = a + bi, we get:

#~ y
y # y
(a + j. b) # y
(a # y) , (b # 0)

Which gives us b zeroes in the input. This will make the aforementioned condition false, and this only run once.

Improve this answer
\$\endgroup\$
5
  • \$\begingroup\$ Does ending with an error count as cracked? There is actually an input that lets it exit without error. Good find, I didn't think of testing empty input. \$\endgroup\$
    – miles
    Commented Jul 25, 2017 at 2:48
  • \$\begingroup\$ @miles Yeah, so long as the program is finite. I'm still looking for a non-empty solution, however. \$\endgroup\$
    – Conor O'Brien
    Commented Jul 25, 2017 at 2:50
  • \$\begingroup\$ Yes, that's what I had in mind, I'll have to test more input types next time. \$\endgroup\$
    – miles
    Commented Jul 25, 2017 at 3:11
  • \$\begingroup\$ @miles Cool! That was fun, I learned something new about # today. \$\endgroup\$
    – Conor O'Brien
    Commented Jul 25, 2017 at 3:12
  • \$\begingroup\$ Yeah, it's one of the few features I haven't found a good use for yet. \$\endgroup\$
    – miles
    Commented Jul 25, 2017 at 3:13
1
\$\begingroup\$

JavaScript by Grant Davis

({t:1,get x(){ return this.t--; }})

getter is powerful. you may also try Proxy.

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ I used __proto__.defineGetter, but this is more elegant. This challenge has taught me a lot about JavaScript. \$\endgroup\$
    – Grant Davis
    Commented Jul 25, 2017 at 3:27
1
\$\begingroup\$

Bash, Dennis

//

Try it online.

Improve this answer
\$\endgroup\$
1
\$\begingroup\$

JavaScript (Node.js), tsh

code:

x=>{try{for(;!x||x!=0||x instanceof Object||typeof x!='object';);}catch(e){for(;;);}}

input:

{valueOf:g=>{Object=Number;return 0}}

Try it online!

!x: x resolves to true !true resolves to false

x!=0: valueOf is overridden and returns 0. 0!=0 is false Also sets Object to Number for next step

x instanceof Object: Object now points to Number and x is an Object not a Number so this resolves to false

typeof x!="object": x is an object so typeof x returns "object". "object"!="object" is false

Improve this answer
\$\endgroup\$
2
  • \$\begingroup\$ Good job. instanceof is just something too weak... \$\endgroup\$
    – tsh
    Commented Jul 25, 2017 at 5:06
  • \$\begingroup\$ @tsh Not hard to break things when one messes with prototypes and reassigns critical global variables. \$\endgroup\$
    – Grant Davis
    Commented Jul 25, 2017 at 5:15
1
\$\begingroup\$

JavaScript (Node.js), 36 bytes, tsh

1.00000001

Any value near 1 under the rounding threshold will make it.

Try it online!

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Wow, love it. although that is not what I want... \$\endgroup\$
    – tsh
    Commented Jul 25, 2017 at 8:50
1
\$\begingroup\$

R, Rift

expression(T <- 0)

Sets T to a false value. I don't know R, seems to work.

Try it online.

Improve this answer
\$\endgroup\$
1
\$\begingroup\$

JS, 11bytes / 18bytes

code:

 f=a=>{while(!Array.isArray(a)||!a.length);a.map(_=>{for(;;);})}

cracked (throws no error):

f(Array(5))

cracked (throws error):

 a=[1];a.map=1;f(a)
Improve this answer
\$\endgroup\$
1 2
3
4 5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.