47
\$\begingroup\$

This is the robbers' thread. The cops' thread is here.

Your challenge is to crack a cop's submission by finding an input that makes it halt. You don't have to find out why, or all inputs that make it halt if there's more than one, or the input the cop intended, just one input will do.

Once you have cracked a submission, post a link to it in a comment or edit to the cop's post. You can also flag your submission for a mod to edit it in the cop's post. Also, post the input used and a link to the cop's post in an answer in this thread. The robber that cracks the most submissions wins.

Multiple people can post cracks to the same cop submission, as long as they are different.

(If SE converted your duplicate answer to a comment, you may want to vote on this feature request)


Looking for uncracked submissions?

fetch("https://api.stackexchange.com/2.2/questions/135363/answers?order=desc&sort=activity&site=codegolf&filter=!.Fjs-H6J36vlFcdkRGfButLhYEngU&key=kAc8QIHB*IqJDUFcjEF1KA((&pagesize=100").then(x=>x.json()).then(data=>{var res = data.items.filter(i=>!i.body_markdown.toLowerCase().includes("cracked")).map(x=>{const matched = /^ ?##? ?(?:(?:(?:\[|<a href ?= ?".*?">)([^\]]+)(?:\]|<\/a>)(?:[\(\[][a-z0-9/:\.]+[\]\)])?)|([^, ]+)).*[^\d](\d+) ?\[?(?:(?:byte|block|codel)s?)(?:\](?:\(.+\))?)? ?(?:\(?(?!no[nt][ -]competing)\)?)?/gim.exec(x.body_markdown);if(!matched){return;}return {link: x.link, lang: matched[1] || matched[2], owner: x.owner}}).filter(Boolean).forEach(ans=>{var tr = document.createElement("tr");var add = (lang, link)=>{var td = document.createElement("td");var a = document.createElement("a");a.innerText = lang;a.href = link;td.appendChild(a);tr.appendChild(td);};add(ans.lang, ans.link);add(ans.owner.display_name, ans.owner.link);document.querySelector("tbody").appendChild(tr);});});
<html><body><h1>Uncracked Submissions</h1><table><thead><tr><th>Language</th><th>Author</th></tr></thead><tbody></tbody></table></body></html>

\$\endgroup\$
3
  • 2
    \$\begingroup\$ Does different mean different inputs (say, all inputs ending with 2 crack the cop's post - can you different people post different numbers ending in 2?) or different families of inputs, or different types of inputs? \$\endgroup\$ – Stephen Jul 24 '17 at 17:03
  • 1
    \$\begingroup\$ Multiple people can post cracks to the same cop submission... Please define different. \$\endgroup\$ – Dennis Jul 25 '17 at 13:41
  • \$\begingroup\$ @NoOneIsHere codegolf.meta.stackexchange.com/q/13437/58826 \$\endgroup\$ – user58826 Jul 25 '17 at 15:26

144 Answers 144

1
2 3 4 5
52
\$\begingroup\$

Malbolge, Doorknob

Try it online (Thanks Dennis!)

Input for Windows: F_⌠1234567890

Input on Linux based system using ISO-8559-1: F_ô1234567890

The heart of how the Malbolge program worked is that it depended on a behavior of the Malbolge interpreter which causes an infinite loop if it encounters any instruction which is not between 33 and 126. The program was constructed such that your input would allow you to modify a single instruction.

I modified the interpreter to dump the program memory state at the beginning of execution and to also produce 'normalized' source code which takes the form of a list of op codes that will be run during the execution of the program. With that information you could (slowly) determine that even though the program took 13 inputs only the 1st and 3rd inputs actually mattered.

Looking through the normalized code and memory dump (and a touch of debugger help) I devised the following:

a = op(input 1, 29524)

b = op(input 3, a)

c = op(486, b)

d = op(c, 37)

e = d/4 + d%3 * 3^9

e must be between 33 and 126

Where op is the so called tritwise "op" that is described in the specification. Using this information you can write a simple program which iterates over the possible inputs (0 to 255) and finds all solutions which meet the above criteria. I had found 2219 possible solutions, some of which will probably not be working solutions (you can't input the required characters). Specifically the above inputs are based on the solution:

(Input 1 = 70, Input 3 = 244)

\$\endgroup\$
10
  • \$\begingroup\$ I don't have the rep to comment cracked on the cops post. Could someone do that for me? \$\endgroup\$ – KBRON111 Jul 27 '17 at 2:23
  • 5
    \$\begingroup\$ Welcome to PPCG! Good job! I think with this crack, you'll soon have enough rep :) \$\endgroup\$ – Stephen Jul 27 '17 at 2:33
  • 1
    \$\begingroup\$ I commented across. And yes, excellent work; I was half expecting Malbolge to last the week! \$\endgroup\$ – Veedrac Jul 27 '17 at 2:34
  • 6
    \$\begingroup\$ Nice work! TIO uses UTF-8, but by wrapping it in Bash, your crack can still be verified. tio.run/… You don't seem to need anything but F_ô by the way. \$\endgroup\$ – Dennis Jul 27 '17 at 5:07
  • 1
    \$\begingroup\$ Now I can sleep again \$\endgroup\$ – Juan Tonina Jul 27 '17 at 12:58
15
\$\begingroup\$

JavaScript (in Browser)

document.all

This is falsy, surprisingly

Edit: why is document.all falsy?

\$\endgroup\$
3
  • 4
    \$\begingroup\$ I'm speechless. \$\endgroup\$ – Dennis Jul 25 '17 at 16:34
  • 3
    \$\begingroup\$ Aahh... javascript, where everything is weird \$\endgroup\$ – Juan Tonina Jul 25 '17 at 16:36
  • 1
    \$\begingroup\$ Yes! That's the only correct answer here! \$\endgroup\$ – tsh Jul 26 '17 at 1:33
12
\$\begingroup\$

JS (ES6), Juan Tonina

+0,-0

Took a bit of looking in Object.is to find. Basically, +0 === -0 since === checks them as numbers, and 0 is finite, but Object.is sees +0 and -0 as different objects. Very smart cop :)

Try it online!

\$\endgroup\$
2
  • \$\begingroup\$ Ninja got it while I was logging in. Shoot. \$\endgroup\$ – user3033745 Jul 24 '17 at 16:59
  • \$\begingroup\$ Damn, solved faster than the time I spent thinking about the code :D \$\endgroup\$ – Juan Tonina Jul 24 '17 at 17:02
12
\$\begingroup\$

Python, Siphor

class A:
    i = True
    def __eq__(self, a):
        self.i = not self.i
        return self.i

a = A()
f(a)

We just redefine equality to behave exactly as required to get the program to terminate.

\$\endgroup\$
7
  • \$\begingroup\$ Although I suppose I could have just defined __eq__ to raise... \$\endgroup\$ – Gavin S. Yancey Jul 24 '17 at 21:35
  • \$\begingroup\$ I was about to submit with just returning 0 :p \$\endgroup\$ – Jonathan Allan Jul 24 '17 at 21:40
  • \$\begingroup\$ @JonathanAllan How does that work? \$\endgroup\$ – Gavin S. Yancey Jul 24 '17 at 21:41
  • 1
    \$\begingroup\$ Pretty sure just class A:__eq__=lambda s,o:0 and f(A()) does the job. \$\endgroup\$ – Jonathan Allan Jul 24 '17 at 21:41
  • 1
    \$\begingroup\$ Ah yeah need the negation >_< \$\endgroup\$ – Jonathan Allan Jul 24 '17 at 21:42
8
\$\begingroup\$

Braingolf

-1

Any number less than 0 works.

Try it Online!

\$\endgroup\$
0
8
\$\begingroup\$

PHP, Sisyphus

(-0[0)> deal with it=1

The parse_str function changes the spaces and other characters to underscores. If you put a [ used for Array delimiter without closing, it changes it to an underscore but has the effect of not translating the following spaces (I don't know why).

Try it online!

\$\endgroup\$
1
  • \$\begingroup\$ WTF?! That is insane... \$\endgroup\$ – Veedrac Jul 25 '17 at 16:49
6
\$\begingroup\$

JavaScript (Node.js), Adnan

[] and [] seem to work. I tried a bunch of them including null, undefined, NaN...

[] >= [] && [] <= [] && [] != [] evaluates to true.

Moral of the story: JavaScript is weird.

Try it online!

\$\endgroup\$
2
  • \$\begingroup\$ Yep, arrays are just objects. \$\endgroup\$ – user58826 Jul 24 '17 at 18:05
  • \$\begingroup\$ And objects are cast to strings for these types of comparisons. \$\endgroup\$ – Conor O'Brien Jul 24 '17 at 20:49
6
\$\begingroup\$

JavaScript (ES7), Arnauld

Standard

"8e7" is solution

var crack_me = (x=0)=>{for(;~x/x.length**3!=-2962963;);}

var key = "8e7"

crack_me(key)
console.log("stopped :)")

Hack

No need to calculate this number, we can redefine length property

This sets ~x/x.length**3!=-2962963 to false

var crack_me = (x=0)=>{for(;~x/x.length**3!=-2962963;);}

var key = {toString:()=>"2962962",length:"1"}

crack_me(key)
console.log("stopped :)")

Operators priority

~ bitwise not is first

** exponentiation second

/ division third

\$\endgroup\$
5
\$\begingroup\$

Bash, Veedrac

LD_TRACE_LOADED_OBJECTS

Try it online!

From the ld.so(8) manpage:

LD_TRACE_LOADED_OBJECTS

If set (to any value), causes the program to list its dynamic dependencies, as if run by ldd(1), instead of running normally.

\$\endgroup\$
2
  • \$\begingroup\$ I thought this would last longer! Excellent work. \$\endgroup\$ – Veedrac Jul 25 '17 at 13:09
  • 1
    \$\begingroup\$ @Veedrac: I guess since you specified bash, it's unlikely that you'd find a statically-linked (e.g. busybox?) /bin/yes, but that is possible, in which case this env var would be ignored. \$\endgroup\$ – Peter Cordes Jul 27 '17 at 10:35
5
\$\begingroup\$

Mathematica, JungHwan Min

Unevaluated@Throw@"hammertime"

No clue whether this is the intended solution, but it passes in an expression that doesn't get evaluated until it's referenced as # inside the function, which will cause it turn return from the function immediately without doing any further evaluation. You can see that the function is actually called (instead of just throwing the exception before even invoking the function) by changing the function to:

#0[Print@"stop";#;$IterationLimit=∞]&

Which will indeed print the stop before throwing the error.

\$\endgroup\$
1
  • \$\begingroup\$ Bingo! (I was actually going for Unevaluated[Abort[]], but same thing.) \$\endgroup\$ – JungHwan Min Jul 25 '17 at 15:29
5
\$\begingroup\$

R, Jarko Dubbeldam

function(x)if(is.list(x))return(1)

First time contributing anything, so do call out any mistakes I've made in format.

Pretty sure this is valid. Just a rewrapping of is.list(), right?

\$\endgroup\$
3
  • \$\begingroup\$ Incidentally, I don't have the rep to comment on the original so a hand would be appreciated if it's valid. \$\endgroup\$ – CriminallyVulgar Jul 27 '17 at 12:59
  • \$\begingroup\$ Commented for you. \$\endgroup\$ – TheLethalCoder Jul 27 '17 at 13:02
  • \$\begingroup\$ Not the intended solution, but works. Good job. \$\endgroup\$ – JAD Jul 27 '17 at 13:04
4
\$\begingroup\$

Retina, PunPun1000

11111

Try it online!

Any input with n 1s where the sum of the divisors of n+1 is equal to n+1 should work.

\$\endgroup\$
1
  • \$\begingroup\$ Nice to see someone get the intended solution \$\endgroup\$ – PunPun1000 Jul 24 '17 at 16:52
4
\$\begingroup\$

Node.js, Adnan

{} and {} or any 2 objects are the two inputs. I don't even understand how this works.

Here's JS's amazing object compare logics:

console.log({} == {});
console.log({} === {});
console.log({} > {});
console.log({} < {});
console.log(!!{});

console.log({} >= {});
console.log({} <= {});

\$\endgroup\$
1
  • \$\begingroup\$ Yup, that was the intended solution :) \$\endgroup\$ – Adnan Jul 24 '17 at 18:04
4
\$\begingroup\$

Ruby

exit

without newline. 3.send('exit') surely isn't equal to 5, but it executes Kernel#exit:

Initiates the termination of the Ruby script by raising the SystemExit exception

It's possible to call exit on 3 because:

The Kernel module is included by class Object, so its methods are available in every Ruby object [as private methods].

abort also works:

Terminate execution immediately, effectively by calling Kernel.exit(false). If msg is given, it is written to STDERR prior to terminating.

\$\endgroup\$
4
\$\begingroup\$

JavaScript (Node.js), programmer5000

Already cracked, but mine is slightly different :) Don't have enough rep to comment over in the cops. Also feel free to edit to fix formatting, my first post here.

Mainly I set __proto__ equal to a function that throws. Taken from looking at the Mozilla page for proto. (Sorry, low rep, can't post a link.)

x = {}
let No = function () { throw 'halted' }
x.__proto__ = new No()
f = x=>{while(x.__proto__);}

Try it online!

EDIT: Got some rep, so here's the link: Mozilla __proto__

\$\endgroup\$
3
  • \$\begingroup\$ I commented on the cop for you. \$\endgroup\$ – Stephen Jul 24 '17 at 23:03
  • 1
    \$\begingroup\$ Thanks! Also thanks all for the ups, guess I can comment now! \$\endgroup\$ – Haumed Rahmani Jul 24 '17 at 23:15
  • 1
    \$\begingroup\$ Welcome to PPCG :D \$\endgroup\$ – Conor O'Brien Jul 24 '17 at 23:22
4
\$\begingroup\$

Bash, Sisyphus

kill 0

Fortunately, kill is a shell builtin.

Try it online!

\$\endgroup\$
4
\$\begingroup\$

Javascript, programmer5000

Max string length

Uses a string with a length one less than what your engine supports. When adding "h" to this string, an error is thrown. Try it online!

function getAlmostMaxLenStr() {
  var prevBases = [];
  var base = "a";
  try {
    while(true) {
      prevBases.push(base);
      base += base;
    }
  } catch(e) {}
  for (var i = prevBases.length-1; i>=0; --i) {
    try {
      base += prevBases[i];
    } catch (e) {}
  }
  return base;
}
f(getAlmostMaxLenStr());

Cross-origin block

Heavily inspired by the answer from @jadkik94, but works everywhere. Creates a cross-origin iframe, then passes the .contentWindow of said iframe. This fails when the function tries to use the value due to cross-origin safety.

let f=x=>{
  try {
    console.log(x+"h"); // we don't want to lock up your browser, do we ;)
  } catch (e) { console.log("Halted!\n",e); }
}
let iframe=document.createElement("iframe");
const url = location.host.indexOf("google") === -1 ? "https://google.com" : "https://stackexchange.com";
iframe.src=url;
iframe.onload=a=>f(iframe.contentWindow);
document.body.appendChild(iframe);

Primitive value

Variant of the .toString() answers - this just uses toPrimitive instead. It returns an object as the primitive value, which Javascript doesn't know how to handle (so it throws an error). Try it online!

f({
  [Symbol.toPrimitive](){return {}}
});
\$\endgroup\$
1
  • \$\begingroup\$ Nice job, but still not intended solution! Very clever! \$\endgroup\$ – user58826 Jul 25 '17 at 11:30
3
\$\begingroup\$

JavaScript (Babel Node), Conor O'Brien

(Repost, accidentally put in cops.) Not sure what was intended but positive decimals that aren't enormous all seem to work.

Also I guess I still can't comment in Cops.

f(0.1)
console.log('done')

Try it online!

\$\endgroup\$
1
  • \$\begingroup\$ Forgot about that as well, good one. \$\endgroup\$ – Conor O'Brien Jul 24 '17 at 23:48
3
\$\begingroup\$

Javascript (NOT node.js), programmer5000

This can't be added because it creates an object that has no toString because a new Set does not inherent prototypes from from Object.

input:

new Set()

Try it online!

\$\endgroup\$
4
  • \$\begingroup\$ This was probably the intended solution, I'll keep that in the bag of my head from now on :P \$\endgroup\$ – Stephen Jul 24 '17 at 20:29
  • \$\begingroup\$ Sorry this doesn't seem to work for me? Try it online! \$\endgroup\$ – Haumed Rahmani Jul 25 '17 at 1:04
  • \$\begingroup\$ @HaumedRahmani added a try online button. I used spider monkey, not babel. \$\endgroup\$ – Grant Davis Jul 25 '17 at 1:40
  • \$\begingroup\$ Not the intended solution, but nice job! \$\endgroup\$ – user58826 Jul 25 '17 at 1:49
3
\$\begingroup\$

Bash 4.2, Dennis

PATH=1

Clearly not the intended solution, because it works on newer bash as well.

Try it online.

\$\endgroup\$
3
\$\begingroup\$

Octave, Stewie Griffin

Input: exit

Reasoning: input evalutes whatever is input. exit exits the program.

Try it online!

\$\endgroup\$
3
\$\begingroup\$

Python 2, Foon

__import__("os")._exit(0)

What it says on the tin, basically.

Try it online.

\$\endgroup\$
5
  • \$\begingroup\$ Interestingly enough, on TIO this times out for me; under Windows (specifically with winpty python inputbad.py and pasting in the line), it does exit as desired... and yeah, not surprisingly my schtict was exploiting the "input under Python 2 does eval under the hood" bit \$\endgroup\$ – Foon Jul 25 '17 at 11:01
  • \$\begingroup\$ @Foon Hmm, it's working fine on TIO for me. See link in answer. \$\endgroup\$ – Veedrac Jul 25 '17 at 11:18
  • \$\begingroup\$ Weird... I must have hit play and then typed input on my TIO link and not realized it \$\endgroup\$ – Foon Jul 25 '17 at 13:42
  • \$\begingroup\$ I'm pretty sure this cracks every python submission.. \$\endgroup\$ – enderland Jul 26 '17 at 3:13
  • \$\begingroup\$ @enderland Only if they evaluate your input, which most of them don't. \$\endgroup\$ – Veedrac Jul 26 '17 at 3:26
3
\$\begingroup\$

Python 3 (CPython), Veedrac

a=('',(type,),{})
X=type(*a)(*a)
X.__class__=X

Try it online!

\$\endgroup\$
3
\$\begingroup\$

Python 3, Siphor

This was fun. We need to make the type(x) != str check pass, so we need to control the return value of type(). We have to override the __class__ attribute and replace it with a custom object, that extends type, which has the __ne__ method replaced by one that always returns false. This makes it pass the type check, but the search will fail because o is not a str.

class m(type):
    def __ne__(a,b):
        return False
class c:pass
o=c()
o.__class__=m("",(c,),{})
f(o)
\$\endgroup\$
1
  • \$\begingroup\$ Welcome to the site! :) \$\endgroup\$ – DJMcMayhem Jul 25 '17 at 21:01
3
\$\begingroup\$

R, Jarko Dubbeldam

Just an invalid regex.

"["

Try it online.

\$\endgroup\$
3
\$\begingroup\$

Python, Siphor

f('t=False')

Crashes due to an UnboundLocalError. I think this is hapening because my t=False overrides the higher-scoped t with the local t, but it's not set at the time of the loop, causing the crash.

TIO

\$\endgroup\$
1
  • \$\begingroup\$ This seems so easy, good job. \$\endgroup\$ – 301_Moved_Permanently Jul 27 '17 at 8:18
3
\$\begingroup\$

Commodore 64 Basic, Mark

If I understood this correctly (and it's entirely plausible I have not), you just need to overflow the floating point variable.

9999999999999999999999999999999999999999999999999999999999999999.9
\$\endgroup\$
1
  • 3
    \$\begingroup\$ You can use scientific notation for a shorter crack. A simple 1E50 will do just as well, and is easier to type. \$\endgroup\$ – Mark Jul 25 '17 at 22:16
3
\$\begingroup\$

Bash 4.2, Dennis

-9223372036854775808/-1

Why though, Dennis? y u do dis?

\$\endgroup\$
4
  • 1
    \$\begingroup\$ Well done. I had 2**63%-1, which results in the same operation. \$\endgroup\$ – Dennis Jul 26 '17 at 2:49
  • \$\begingroup\$ I assume this is a parsing or evaluation bug of some sort? What exactly causes it to fail? \$\endgroup\$ – Robert Fraser Jul 26 '17 at 7:51
  • 1
    \$\begingroup\$ @RobertFraser It overflows! They're stored in small registers and the division generates a SIGFPE. \$\endgroup\$ – Veedrac Jul 26 '17 at 11:08
  • 2
    \$\begingroup\$ It's somewhat ironic that (on most platforms, including x86) unless you on purpose unmask FP exceptions, the only thing that will normally raise SIGFPE is an integer division exception. (by zero, or overflow). But POSIX requires integer division to raise SIGFPE if it raises any signal at all: stackoverflow.com/questions/37262572/… \$\endgroup\$ – Peter Cordes Jul 27 '17 at 10:39
3
\$\begingroup\$

C#, TheLethalCoder

System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]

Or any other nullable class.

\$\endgroup\$
3
\$\begingroup\$

C#, TheLethalCoder

new char[0]

string.Empty ("") is always interned. Therefore, an empty array or null will work.

\$\endgroup\$
1
2 3 4 5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy