47
\$\begingroup\$

This is the robbers' thread. The cops' thread is here.

Your challenge is to crack a cop's submission by finding an input that makes it halt. You don't have to find out why, or all inputs that make it halt if there's more than one, or the input the cop intended, just one input will do.

Once you have cracked a submission, post a link to it in a comment or edit to the cop's post. You can also flag your submission for a mod to edit it in the cop's post. Also, post the input used and a link to the cop's post in an answer in this thread. The robber that cracks the most submissions wins.

Multiple people can post cracks to the same cop submission, as long as they are different.

(If SE converted your duplicate answer to a comment, you may want to vote on this feature request)


Looking for uncracked submissions?

fetch("https://api.stackexchange.com/2.2/questions/135363/answers?order=desc&sort=activity&site=codegolf&filter=!.Fjs-H6J36vlFcdkRGfButLhYEngU&key=kAc8QIHB*IqJDUFcjEF1KA((&pagesize=100").then(x=>x.json()).then(data=>{var res = data.items.filter(i=>!i.body_markdown.toLowerCase().includes("cracked")).map(x=>{const matched = /^ ?##? ?(?:(?:(?:\[|<a href ?= ?".*?">)([^\]]+)(?:\]|<\/a>)(?:[\(\[][a-z0-9/:\.]+[\]\)])?)|([^, ]+)).*[^\d](\d+) ?\[?(?:(?:byte|block|codel)s?)(?:\](?:\(.+\))?)? ?(?:\(?(?!no[nt][ -]competing)\)?)?/gim.exec(x.body_markdown);if(!matched){return;}return {link: x.link, lang: matched[1] || matched[2], owner: x.owner}}).filter(Boolean).forEach(ans=>{var tr = document.createElement("tr");var add = (lang, link)=>{var td = document.createElement("td");var a = document.createElement("a");a.innerText = lang;a.href = link;td.appendChild(a);tr.appendChild(td);};add(ans.lang, ans.link);add(ans.owner.display_name, ans.owner.link);document.querySelector("tbody").appendChild(tr);});});
<html><body><h1>Uncracked Submissions</h1><table><thead><tr><th>Language</th><th>Author</th></tr></thead><tbody></tbody></table></body></html>

\$\endgroup\$
  • 2
    \$\begingroup\$ Does different mean different inputs (say, all inputs ending with 2 crack the cop's post - can you different people post different numbers ending in 2?) or different families of inputs, or different types of inputs? \$\endgroup\$ – Stephen Jul 24 '17 at 17:03
  • 1
    \$\begingroup\$ Multiple people can post cracks to the same cop submission... Please define different. \$\endgroup\$ – Dennis Jul 25 '17 at 13:41
  • \$\begingroup\$ @NoOneIsHere codegolf.meta.stackexchange.com/q/13437/58826 \$\endgroup\$ – programmer5000 Jul 25 '17 at 15:26

139 Answers 139

3
\$\begingroup\$

MATL, Luis Mendo

0/0

MATL evaluates 0/0 as NaN. Since NaN != NaN it does not loop

Try it online!

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

Octave, Stewie Griffin

Any undefined input such as a will work: Try it online!

Defined values would not work, because | in a while environment is short-circuiting, so when it sees 1, it will already become true, no matter what the value of x is. So, the only way to make it halt is to make x=input('') halt, i.e. by giving it undefined inputs.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ +1 for teaching me that | short-circuits in while environments \$\endgroup\$ – Luis Mendo Jul 27 '17 at 15:22
3
\$\begingroup\$

Javascript (NOT node.js)

Feel like this is cheating based on the last answer...

{toString:_=>{throw''}}
| improve this answer | |
\$\endgroup\$
  • 1
    \$\begingroup\$ IMO this is perfectly fine :) \$\endgroup\$ – Stephen Jul 24 '17 at 19:53
3
\$\begingroup\$

C (gcc), Justin

With input %s, the program crashes.

#include<stdio.h>
int main(){char c[9];while(1){scanf("%8s",c);printf(c);}}

Try it online!

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

RProgN 2, ATaco

Cracked, with input #. I have no idea why, I think C evals, and # is a comment.

` .iS‘"{".C

Try it online!

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ O_o Unintended solution. # isn't a comment, but it pushed the "{" function literally when it eval'd, rather than executing it. +1. \$\endgroup\$ – ATaco Jul 24 '17 at 23:14
  • \$\begingroup\$ @ATaco Oh cool lol \$\endgroup\$ – Conor O'Brien Jul 24 '17 at 23:15
3
\$\begingroup\$

Javascript, Conor O'Brien

NaN

Yes, typeof NaN returns "number".

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Darn. I forgot about that. \$\endgroup\$ – Conor O'Brien Jul 24 '17 at 23:48
  • 2
    \$\begingroup\$ "Not a number" is a "number"? So it's basically in some kind of quantum state where it might or might not be a number depending on how you observe it. \$\endgroup\$ – Robert Fraser Jul 25 '17 at 6:38
3
\$\begingroup\$

C (gcc), dj0wns

The intended solution is probably:

%n

This treats char *a as a writable unsigned int, but since it is assigned to a constant string, this invokes undefined behaviour which on TIO gives me:

/srv/wrappers/c-gcc: line 5: 18569 Segmentation fault (core dumped) ./.bin.tio "$@" < .input.tio

| improve this answer | |
\$\endgroup\$
  • 1
    \$\begingroup\$ Wow shows how much I suck at having a problem with one solution. Still not it! Nice job though. That was a really cool get, I didn't know about this at all \$\endgroup\$ – dj0wns Jul 25 '17 at 0:50
3
\$\begingroup\$

JavaScript (Node.js), tsh

The answer is '0'.

f=x=>{try{for(;!x||x!=0||x instanceof Object;);}catch(e){for(;;);}}

f('0')

Try it online!

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

Node.js, Евгений Новиков

input:

{__proto__:null}

Try it online!

The input gets applied to an object. My input is an object with the same name as the native functions (__proto__) which will get applied to the object in the while condition and will override the native functions (such as toString and valueOf), causing an error when the program tries to cast the object to true/false for the while loop (because the necessary functions are missing and broken).

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

JavaScript (Node.js), Haumed Rahmani

JavaScript uses floats for everything, so...

f(100000000000000000)

Try it online!

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

Java 8, Socratic Phoenix

-32760

Try it online.

The hardest part was recognising that taking >1s didn't mean it was stuck in a loop :P.

This is just due to the constant cache; the equality check is actually for identity.

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

Python 3, Veedrac

>>> import sys
>>> class A(type): pass
... 
>>> for _ in range(sys.getrecursionlimit()+1):
...   class A(type, metaclass=A): pass
... 
>>> T(A)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<stdin>", line 2, in T
  File "<stdin>", line 2, in T
  File "<stdin>", line 2, in T
  [Previous line repeated 995 more times]
RecursionError: maximum recursion depth exceeded while calling a Python object
| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Brute force, I like it! \$\endgroup\$ – ecatmur Jul 25 '17 at 16:14
3
\$\begingroup\$

JavaScript, w0lf

This is the same hack as many others, really. There's probably a smarter solution, but this works.

{toString:1}

This just throws an error when calling toString.

JavaScript, w0lf v2

Same deal, no exception.

function(){ let x=0; return {toString: () => x++} }()

I'm pretty sure that's not the normal way to make anonymous objects with locals, but I figure someone will correct me in the comments.

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

R, Jarko Dubbeldam

Just an invalid regex.

"["

Try it online.

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

Python, Siphor

f('t=False')

Crashes due to an UnboundLocalError. I think this is hapening because my t=False overrides the higher-scoped t with the local t, but it's not set at the time of the loop, causing the crash.

TIO

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ This seems so easy, good job. \$\endgroup\$ – 301_Moved_Permanently Jul 27 '17 at 8:18
3
\$\begingroup\$

Commodore 64 Basic, Mark

If I understood this correctly (and it's entirely plausible I have not), you just need to overflow the floating point variable.

9999999999999999999999999999999999999999999999999999999999999999.9
| improve this answer | |
\$\endgroup\$
  • 3
    \$\begingroup\$ You can use scientific notation for a shorter crack. A simple 1E50 will do just as well, and is easier to type. \$\endgroup\$ – Mark Jul 25 '17 at 22:16
3
\$\begingroup\$

Python 3, Veedrac

One value for which the program stops (with a ZeroDivisionError) is:

324835776096020208287573140963456

Try it online!

Edit: I'm not completely sure this is the smallest such value, but I will continue to check.

Edit2: OK, I've been looking for smaller solutions and haven't been able to find any. I cannot demonstrate that this is the smallest such value, but I'm pretty confident that it is.


Explanation

The algorithm does the following (considering the binary representations of the numbers):

  • p, n, and c are initialized to 0 (no bits set)
  • at each step, it consumes the 12 rightmost bits from x (the input)
  • out of these 12 bits, the 3 leftmost are discarded (&511) and only the remaining 9 bits are used. The value represented by these 9 bits is assigned to b.
  • out of the 9 bits, at most one must be set (b must be 0, or a power of 2), otherwise b&(b-1) will make the inner while loop forever.
  • the bit that is currently set in b will be set in p, n, and c
  • p is shifted 1 bit to the right (p>>=1)
  • n is shifted 1 bit to the left (n*=2)
  • in the next iteration, the bit set in b must be set in neither p, n, nor c (otherwise the (p|c|n)&b condition will make the inner while loop forever)

The objective is at the end to have all 9 bits in c set (it will be equal to 511 and therefore the last line will fail with the ZeroDivisionError), otherwise the last while will loop forever.

So, I was looking for a minimal way to make x out of 12-bit chunks, such that:

  • every chunk will have one of the rightmost 9 bits set
  • no chunk will "collide" diagonally with any of the former ones

The code I used to generate x with the smallest value I found is this:

chunks = [
        0b000000000001,
        0b000000000100,
        0b000000010000,
        0b000001000000,
        0b000100000000,
        0b000000000000,
        0b000000000010,
        0b000000001000,
        0b000000100000,
        0b000010000000,
]

x = 0
for c in (chunks):
    x += c
    x <<= 12
x >>= 12

print(x)
| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

C#, TheLethalCoder

new char[0]

string.Empty ("") is always interned. Therefore, an empty array or null will work.

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

JavaScript, programmer5000

Symbol.split

Try it online!

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

Husk, Leo

Pass 4 arguments! It only works with 0-3. You can't do it with less because the arguments aren't actually used.

Try it online.

| improve this answer | |
\$\endgroup\$
3
\$\begingroup\$

JavaScript, programmer5000

window[0]

Works on the Code Golf StackExchange page on Firefox (i.e. while(window[0] + "h"); throws a Error: Permission denied to access property Symbol.toPrimitive error in the console and exits)

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ window apparently doesn't implement the [Symbol.toPrimitive] function (which is used when converting an object to a string) - nice find! \$\endgroup\$ – Birjolaxew Jul 26 '17 at 14:02
  • \$\begingroup\$ @Birjolaxew it's not window; see !!(window + "h") === true. Not sure what it is. Found it by looking at all the window attributes. I was sure one would fail because of a security exception or cross domain stuff. \$\endgroup\$ – jadkik94 Jul 26 '17 at 14:06
3
\$\begingroup\$

BASIC, Stilez

https://www.youtube.com/watch?v=9NcPvmk4vfo

This input halts the program. Weird choice, but it works.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Ah nooooo! And its the 8 b8t version!! :) \$\endgroup\$ – Stilez Jul 26 '17 at 17:34
3
\$\begingroup\$

C (gcc), dj0wns

%s%s

Try It Online!

The offending command essentially evaluates to this and throws a seg fault when it tries to read a second string from beyond d, since there is no 5th argument to the function.

char b[256];
char*d = "abcd";
snprintf(b,4,"%s%s",d)
| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Not my intended solution but I guess it works on Tio, doesn't work on my local machine though. \$\endgroup\$ – dj0wns Jul 24 '17 at 19:59
  • \$\begingroup\$ I hope someone can find the intended solution then, this particular question allows for multiple cracks \$\endgroup\$ – PunPun1000 Jul 24 '17 at 20:00
  • \$\begingroup\$ Well done mate! \$\endgroup\$ – dj0wns Jul 24 '17 at 20:01
  • \$\begingroup\$ C is perfectly happy letting you write to random places what? In C implementations on modern OSes, all pages mapped in your virtual address space will be read-only or read/write. I think some hardware does allow making pages write-only, but this is definitely not something you should expect. C as an abstract standard of course just says that writing outside of any object is Undefined Behaviour, so it's all implementation-specific behaviour here. A real-mode DOS C implementation might not fault at all here. \$\endgroup\$ – Peter Cordes Jul 29 '17 at 10:17
  • 1
    \$\begingroup\$ @PeterCordes I've removed the unnecessary wording from my answer \$\endgroup\$ – PunPun1000 Jul 29 '17 at 17:58
3
\$\begingroup\$

Swift 3, Alexander

extension Bool {
    prefix static func !(val: Bool) -> Bool {
        return false
    }
}

Add above the loop.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Wow, defining the operation in an extension on Bool doesn't cause an ambiguity error, but defining it as a free function does. Odd. This wasn't what I had in mind, but well done, though! \$\endgroup\$ – Alexander Jul 31 '17 at 3:43
3
\$\begingroup\$

brainfuck, Jerry

B0000

Try it online!

Edit: This is the list of all 5-character input that makes the program halts, in range [a..z]: (Warning: large text file)

And this is all input in WordData[] of Mathematica 10:

{"aesop", "agape", "annon", "cloak", "daunt", "fagus", "filch", \
"gomel", "hijab", "jakes", "jerry", "rebut", "rover", "ruddy", \
"sewed", "trine", "villa"}

Perhaps jerry is the expected input.

Explanation:

First, we can see that there are 5 , signs in the program, therefore 5 characters are required. Call their character code {i0, i1, i2, i3, i4} respectively.

And, to "decrypt" the code:

>>,>,>,>,>,                     m0 = i0; m1 = i1; m2 = i2; m3 = i3; m4 = i4;
[-----------<-<+<--<--->>>>]    m3 -= m4 / 11; m2 += m4 / 11; m1 -= 2*m4 / 11; m0 -= 3*m4 / 11; m4 = 0;
<++<<+<++                       m3 += 2; m1 ++; m0 += 2;
[----->+<]                      m1 += m0 / 5; m0 = 0;
>
[----------------->+++++++<]    m2 += 7*m1 / 17; m1 = 0;
>
[----->>+<<]                    m4 += m2 / 5; m2 = 0;
>>
[-<->]                          m3 -= m4; m4 = 0;
<
[--->++++++<]                   m4 += 6*m3 / 3; m3 = 0;
>
[--->+<]                        m5 += m4 / 3; m4 = 0;
+>-                             m4 ++; m5 --;
[-----------------<+>]          m4 += m5 / 17; m5 = 0;
<
[-->-<]                         m5 -= m4 / 2; m4 = 0;
>+                              ++m5;
[+-]                            while (m5 != 0);

Where initially the tape has the form

... m-2 m-1 m0 m1 m2 m3 m4 m5 ...
     ^ (data pointer at initial position = m-2)

So, input

m5 = 0;
m0 = i0; m1 = i1; m2 = i2; m3 = i3; m4 = i4;
m3 -= m4/11; m2 += m4/11; m1 -= 2*m4/11; m0 -= 3*m4/11; m4 = 0;
m3 += 2; m1++; m0 += 2;
m1 += m0/5; m0 = 0;
m2 += 7*m1/17; m1 = 0;
m4 += m2/5; m2 = 0;
m3 -= m4; m4 = 0;
m4 += 6*m3/3; m3 = 0;
m5 += m4/3; m4 = 0;
m4++; m5--;
m4 += m5/17; m5 = 0;
m5 -= m4/2; m4 = 0;
++m5;

(note: over modulo 256, all divisions will halt, except the m5 -= m4/2 is because of at that point m4 is even)

into Mathematica gives

m5 = (117414 + 77 i0 + 385 i1 + 935 i2 - 4675 i3 + 419 i4)/238425

m5 == 0 can be transformed to (mod 256)

i4 := Mod[222 + 177 i0 + 117 i1 + 211 i2 + 225 i3, 256]

Loop i0, i1, i2, i3 through all combination of a..z gives 46413 results, of which 17 of them are English words.

| improve this answer | |
\$\endgroup\$
2
\$\begingroup\$

JS (Node.js)

NaN

In JS, NaN !== NaN

| improve this answer | |
\$\endgroup\$
2
\$\begingroup\$

cQuents, Step Hen

1 2

Try it online!

Essentially, anything that matches /^.+ \d+$/ is valid input that will halt the program.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ A crack containing alphanumerics exists, if a cop wants to try it. \$\endgroup\$ – Stephen Jul 24 '17 at 17:04
  • \$\begingroup\$ @StepHen I am still trying, trying to figure out how the inputs work \$\endgroup\$ – user41805 Jul 24 '17 at 17:09
  • \$\begingroup\$ From documentation: Input is currently given as a space delimited list of numbers (although unless you do math on them they are not forced to be numbers, as in my test case on TIO) \$\endgroup\$ – Stephen Jul 24 '17 at 17:11
  • \$\begingroup\$ @StepHen Figured it out as soon as you posted that comment :D \$\endgroup\$ – user41805 Jul 24 '17 at 17:12
2
\$\begingroup\$

Java

The strings __.-._.-._.-.-.-.-.-._.-._._.-.-._. and __-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- work, with a minor bug: Integer.toHexString doesn't give a leading 0x, under Java 8. (I didn't try other versions.) Trimming it from the source makes it work fine.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ @tuskiomi, it works in Jetbrains IntelliJ and in TIO, and neither prepend the 0x. The . characters are space-filler in the non-checked positions (only every other position is checked). \$\endgroup\$ – user3033745 Jul 24 '17 at 17:46
  • \$\begingroup\$ Well, you got me there. The characters could be technically anything... but this is the correct answer. \$\endgroup\$ – tuskiomi Jul 24 '17 at 17:50
  • \$\begingroup\$ Also, How'd ya figure this one out? ;) \$\endgroup\$ – tuskiomi Jul 24 '17 at 17:51
  • \$\begingroup\$ @tuskiomi I saw that the bitshifts at the bottom were constructing an int bit by bit with - being 1, and mentally transcribed the two hex ints to binary. Then I added in the padding to make it fit, and made the other string as simple as possible to enter the if. \$\endgroup\$ – user3033745 Jul 24 '17 at 17:54
  • 1
    \$\begingroup\$ @tuskiomi, I hadn't even heard of it until now, to be honest. It's obvious once I looked it up, though. Clever puzzle! \$\endgroup\$ – user3033745 Jul 24 '17 at 18:03
2
\$\begingroup\$

JavaScript (ES6), programmer5000

null

The condition was typeof x!=="object"||x; apparently null is an object but falsey in JavaScript.

Try it online!

| improve this answer | |
\$\endgroup\$
2
\$\begingroup\$

Java, tuskiomi

Fatally errors when the two arguments '_-_-_-_-_-' and '__________' are given.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ For me it keeps running \$\endgroup\$ – tuskiomi Jul 24 '17 at 17:43
  • \$\begingroup\$ Did you type it correctly? 10 underscores and then 5 underscores and 5 dashes alternating \$\endgroup\$ – Okx Jul 24 '17 at 17:43
  • \$\begingroup\$ I copied straight from your post; I just tried switching the parameter's order. no cigar. \$\endgroup\$ – tuskiomi Jul 24 '17 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.