47
\$\begingroup\$

This is the robbers' thread. The cops' thread is here.

Your challenge is to crack a cop's submission by finding an input that makes it halt. You don't have to find out why, or all inputs that make it halt if there's more than one, or the input the cop intended, just one input will do.

Once you have cracked a submission, post a link to it in a comment or edit to the cop's post. You can also flag your submission for a mod to edit it in the cop's post. Also, post the input used and a link to the cop's post in an answer in this thread. The robber that cracks the most submissions wins.

Multiple people can post cracks to the same cop submission, as long as they are different.

(If SE converted your duplicate answer to a comment, you may want to vote on this feature request)

Looking for uncracked submissions?

fetch("https://api.stackexchange.com/2.2/questions/135363/answers?order=desc&sort=activity&site=codegolf&filter=!.Fjs-H6J36vlFcdkRGfButLhYEngU&key=kAc8QIHB*IqJDUFcjEF1KA((&pagesize=100").then(x=>x.json()).then(data=>{var res = data.items.filter(i=>!i.body_markdown.toLowerCase().includes("cracked")).map(x=>{const matched = /^ ?##? ?(?:(?:(?:\[|<a href ?= ?".*?">)([^\]]+)(?:\]|<\/a>)(?:[\(\[][a-z0-9/:\.]+[\]\)])?)|([^, ]+)).*[^\d](\d+) ?\[?(?:(?:byte|block|codel)s?)(?:\](?:\(.+\))?)? ?(?:\(?(?!no[nt][ -]competing)\)?)?/gim.exec(x.body_markdown);if(!matched){return;}return {link: x.link, lang: matched[1] || matched[2], owner: x.owner}}).filter(Boolean).forEach(ans=>{var tr = document.createElement("tr");var add = (lang, link)=>{var td = document.createElement("td");var a = document.createElement("a");a.innerText = lang;a.href = link;td.appendChild(a);tr.appendChild(td);};add(ans.lang, ans.link);add(ans.owner.display_name, ans.owner.link);document.querySelector("tbody").appendChild(tr);});});
<html><body><h1>Uncracked Submissions</h1><table><thead><tr><th>Language</th><th>Author</th></tr></thead><tbody></tbody></table></body></html>

Improve this question
\$\endgroup\$
3
  • 2
    \$\begingroup\$ Does different mean different inputs (say, all inputs ending with 2 crack the cop's post - can you different people post different numbers ending in 2?) or different families of inputs, or different types of inputs? \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 17:03
  • 1
    \$\begingroup\$ Multiple people can post cracks to the same cop submission... Please define different. \$\endgroup\$
    – Dennis
    Commented Jul 25, 2017 at 13:41
  • \$\begingroup\$ @NoOneIsHere codegolf.meta.stackexchange.com/q/13437/58826 \$\endgroup\$
    – user58826
    Commented Jul 25, 2017 at 15:26

144 Answers 144

Reset to default
1
2 3 4 5
52
\$\begingroup\$

Malbolge, Doorknob

Try it online (Thanks Dennis!)

Input for Windows: F_⌠1234567890

Input on Linux based system using ISO-8559-1: F_ô1234567890

The heart of how the Malbolge program worked is that it depended on a behavior of the Malbolge interpreter which causes an infinite loop if it encounters any instruction which is not between 33 and 126. The program was constructed such that your input would allow you to modify a single instruction.

I modified the interpreter to dump the program memory state at the beginning of execution and to also produce 'normalized' source code which takes the form of a list of op codes that will be run during the execution of the program. With that information you could (slowly) determine that even though the program took 13 inputs only the 1st and 3rd inputs actually mattered.

Looking through the normalized code and memory dump (and a touch of debugger help) I devised the following:

a = op(input 1, 29524)

b = op(input 3, a)

c = op(486, b)

d = op(c, 37)

e = d/4 + d%3 * 3^9

e must be between 33 and 126

Where op is the so called tritwise "op" that is described in the specification. Using this information you can write a simple program which iterates over the possible inputs (0 to 255) and finds all solutions which meet the above criteria. I had found 2219 possible solutions, some of which will probably not be working solutions (you can't input the required characters). Specifically the above inputs are based on the solution:

(Input 1 = 70, Input 3 = 244)

Improve this answer
\$\endgroup\$
10
  • \$\begingroup\$ I don't have the rep to comment cracked on the cops post. Could someone do that for me? \$\endgroup\$
    – KBRON111
    Commented Jul 27, 2017 at 2:23
  • 5
    \$\begingroup\$ Welcome to PPCG! Good job! I think with this crack, you'll soon have enough rep :) \$\endgroup\$
    – Stephen
    Commented Jul 27, 2017 at 2:33
  • 1
    \$\begingroup\$ I commented across. And yes, excellent work; I was half expecting Malbolge to last the week! \$\endgroup\$
    – Veedrac
    Commented Jul 27, 2017 at 2:34
  • 6
    \$\begingroup\$ Nice work! TIO uses UTF-8, but by wrapping it in Bash, your crack can still be verified. tio.run/… You don't seem to need anything but F_ô by the way. \$\endgroup\$
    – Dennis
    Commented Jul 27, 2017 at 5:07
  • 1
    \$\begingroup\$ Now I can sleep again \$\endgroup\$
    – Juan
    Commented Jul 27, 2017 at 12:58
15
\$\begingroup\$

JavaScript (in Browser)

document.all

This is falsy, surprisingly

Edit: why is document.all falsy?

Improve this answer
\$\endgroup\$
3
  • 4
    \$\begingroup\$ I'm speechless. \$\endgroup\$
    – Dennis
    Commented Jul 25, 2017 at 16:34
  • 3
    \$\begingroup\$ Aahh... javascript, where everything is weird \$\endgroup\$
    – Juan
    Commented Jul 25, 2017 at 16:36
  • 1
    \$\begingroup\$ Yes! That's the only correct answer here! \$\endgroup\$
    – tsh
    Commented Jul 26, 2017 at 1:33
12
\$\begingroup\$

JS (ES6), Juan Tonina

+0,-0

Took a bit of looking in Object.is to find. Basically, +0 === -0 since === checks them as numbers, and 0 is finite, but Object.is sees +0 and -0 as different objects. Very smart cop :)

Try it online!

Improve this answer
\$\endgroup\$
2
  • \$\begingroup\$ Ninja got it while I was logging in. Shoot. \$\endgroup\$
    – user3033745
    Commented Jul 24, 2017 at 16:59
  • \$\begingroup\$ Damn, solved faster than the time I spent thinking about the code :D \$\endgroup\$
    – Juan
    Commented Jul 24, 2017 at 17:02
12
\$\begingroup\$

Python, Siphor

class A:
    i = True
    def __eq__(self, a):
        self.i = not self.i
        return self.i

a = A()
f(a)

We just redefine equality to behave exactly as required to get the program to terminate.

Improve this answer
\$\endgroup\$
7
  • \$\begingroup\$ Although I suppose I could have just defined __eq__ to raise... \$\endgroup\$
    – Gavin S. Yancey
    Commented Jul 24, 2017 at 21:35
  • \$\begingroup\$ I was about to submit with just returning 0 :p \$\endgroup\$
    – Jonathan Allan
    Commented Jul 24, 2017 at 21:40
  • \$\begingroup\$ @JonathanAllan How does that work? \$\endgroup\$
    – Gavin S. Yancey
    Commented Jul 24, 2017 at 21:41
  • 1
    \$\begingroup\$ Pretty sure just class A:__eq__=lambda s,o:0 and f(A()) does the job. \$\endgroup\$
    – Jonathan Allan
    Commented Jul 24, 2017 at 21:41
  • 1
    \$\begingroup\$ Ah yeah need the negation >_< \$\endgroup\$
    – Jonathan Allan
    Commented Jul 24, 2017 at 21:42
8
\$\begingroup\$

Braingolf

-1

Any number less than 0 works.

Try it Online!

Improve this answer
\$\endgroup\$
0
8
\$\begingroup\$

PHP, Sisyphus

(-0[0)> deal with it=1

The parse_str function changes the spaces and other characters to underscores. If you put a [ used for Array delimiter without closing, it changes it to an underscore but has the effect of not translating the following spaces (I don't know why).

Try it online!

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ WTF?! That is insane... \$\endgroup\$
    – Veedrac
    Commented Jul 25, 2017 at 16:49
6
\$\begingroup\$

JavaScript (Node.js), Adnan

[] and [] seem to work. I tried a bunch of them including null, undefined, NaN...

[] >= [] && [] <= [] && [] != [] evaluates to true.

Moral of the story: JavaScript is weird.

Try it online!

Improve this answer
\$\endgroup\$
2
  • \$\begingroup\$ Yep, arrays are just objects. \$\endgroup\$
    – user58826
    Commented Jul 24, 2017 at 18:05
  • \$\begingroup\$ And objects are cast to strings for these types of comparisons. \$\endgroup\$
    – Conor O'Brien
    Commented Jul 24, 2017 at 20:49
6
\$\begingroup\$

JavaScript (ES7), Arnauld

Standard

"8e7" is solution

var crack_me = (x=0)=>{for(;~x/x.length**3!=-2962963;);}

var key = "8e7"

crack_me(key)
console.log("stopped :)")

Hack

No need to calculate this number, we can redefine length property

This sets ~x/x.length**3!=-2962963 to false

var crack_me = (x=0)=>{for(;~x/x.length**3!=-2962963;);}

var key = {toString:()=>"2962962",length:"1"}

crack_me(key)
console.log("stopped :)")

Operators priority

~ bitwise not is first

** exponentiation second

/ division third

Improve this answer
\$\endgroup\$
5
\$\begingroup\$

Bash, Veedrac

LD_TRACE_LOADED_OBJECTS

Try it online!

From the ld.so(8) manpage:

LD_TRACE_LOADED_OBJECTS

If set (to any value), causes the program to list its dynamic dependencies, as if run by ldd(1), instead of running normally.

Improve this answer
\$\endgroup\$
2
  • \$\begingroup\$ I thought this would last longer! Excellent work. \$\endgroup\$
    – Veedrac
    Commented Jul 25, 2017 at 13:09
  • 1
    \$\begingroup\$ @Veedrac: I guess since you specified bash, it's unlikely that you'd find a statically-linked (e.g. busybox?) /bin/yes, but that is possible, in which case this env var would be ignored. \$\endgroup\$
    – Peter Cordes
    Commented Jul 27, 2017 at 10:35
5
\$\begingroup\$

Mathematica, JungHwan Min

Unevaluated@Throw@"hammertime"

No clue whether this is the intended solution, but it passes in an expression that doesn't get evaluated until it's referenced as # inside the function, which will cause it turn return from the function immediately without doing any further evaluation. You can see that the function is actually called (instead of just throwing the exception before even invoking the function) by changing the function to:

#0[Print@"stop";#;$IterationLimit=∞]&

Which will indeed print the stop before throwing the error.

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Bingo! (I was actually going for Unevaluated[Abort[]], but same thing.) \$\endgroup\$
    – JungHwan Min
    Commented Jul 25, 2017 at 15:29
5
\$\begingroup\$

R, Jarko Dubbeldam

function(x)if(is.list(x))return(1)

First time contributing anything, so do call out any mistakes I've made in format.

Pretty sure this is valid. Just a rewrapping of is.list(), right?

Improve this answer
\$\endgroup\$
3
  • \$\begingroup\$ Incidentally, I don't have the rep to comment on the original so a hand would be appreciated if it's valid. \$\endgroup\$
    – CriminallyVulgar
    Commented Jul 27, 2017 at 12:59
  • \$\begingroup\$ Commented for you. \$\endgroup\$
    – TheLethalCoder
    Commented Jul 27, 2017 at 13:02
  • \$\begingroup\$ Not the intended solution, but works. Good job. \$\endgroup\$
    – JAD
    Commented Jul 27, 2017 at 13:04
4
\$\begingroup\$

Retina, PunPun1000

11111

Try it online!

Any input with n 1s where the sum of the divisors of n+1 is equal to n+1 should work.

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Nice to see someone get the intended solution \$\endgroup\$
    – PunPun1000
    Commented Jul 24, 2017 at 16:52
4
\$\begingroup\$

Node.js, Adnan

{} and {} or any 2 objects are the two inputs. I don't even understand how this works.

Here's JS's amazing object compare logics:

console.log({} == {});
console.log({} === {});
console.log({} > {});
console.log({} < {});
console.log(!!{});

console.log({} >= {});
console.log({} <= {});

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Yup, that was the intended solution :) \$\endgroup\$
    – Adnan
    Commented Jul 24, 2017 at 18:04
4
\$\begingroup\$

Ruby

exit

without newline. 3.send('exit') surely isn't equal to 5, but it executes Kernel#exit:

Initiates the termination of the Ruby script by raising the SystemExit exception

It's possible to call exit on 3 because:

The Kernel module is included by class Object, so its methods are available in every Ruby object [as private methods].

abort also works:

Terminate execution immediately, effectively by calling Kernel.exit(false). If msg is given, it is written to STDERR prior to terminating.

Improve this answer
\$\endgroup\$
4
\$\begingroup\$

JavaScript (Node.js), programmer5000

Already cracked, but mine is slightly different :) Don't have enough rep to comment over in the cops. Also feel free to edit to fix formatting, my first post here.

Mainly I set __proto__ equal to a function that throws. Taken from looking at the Mozilla page for proto. (Sorry, low rep, can't post a link.)

x = {}
let No = function () { throw 'halted' }
x.__proto__ = new No()

f = x=>{while(x.__proto__);}

Try it online!

EDIT: Got some rep, so here's the link: Mozilla __proto__

Improve this answer
\$\endgroup\$
3
  • \$\begingroup\$ I commented on the cop for you. \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 23:03
  • 1
    \$\begingroup\$ Thanks! Also thanks all for the ups, guess I can comment now! \$\endgroup\$
    – Phoenix Vizva'i
    Commented Jul 24, 2017 at 23:15
  • 1
    \$\begingroup\$ Welcome to PPCG :D \$\endgroup\$
    – Conor O'Brien
    Commented Jul 24, 2017 at 23:22
4
\$\begingroup\$

Bash, Sisyphus

kill 0

Fortunately, kill is a shell builtin.

Try it online!

Improve this answer
\$\endgroup\$
4
\$\begingroup\$

Javascript, programmer5000

Max string length

Uses a string with a length one less than what your engine supports. When adding "h" to this string, an error is thrown. Try it online!

function getAlmostMaxLenStr() {
  var prevBases = [];
  var base = "a";
  try {
    while(true) {
      prevBases.push(base);
      base += base;
    }
  } catch(e) {}
  for (var i = prevBases.length-1; i>=0; --i) {
    try {
      base += prevBases[i];
    } catch (e) {}
  }
  return base;
}
f(getAlmostMaxLenStr());

Cross-origin block

Heavily inspired by the answer from @jadkik94, but works everywhere. Creates a cross-origin iframe, then passes the .contentWindow of said iframe. This fails when the function tries to use the value due to cross-origin safety.

let f=x=>{
  try {
    console.log(x+"h"); // we don't want to lock up your browser, do we ;)
  } catch (e) { console.log("Halted!\n",e); }
}
let iframe=document.createElement("iframe");
const url = location.host.indexOf("google") === -1 ? "https://google.com" : "https://stackexchange.com";
iframe.src=url;
iframe.onload=a=>f(iframe.contentWindow);
document.body.appendChild(iframe);

Primitive value

Variant of the .toString() answers - this just uses toPrimitive instead. It returns an object as the primitive value, which Javascript doesn't know how to handle (so it throws an error). Try it online!

f({
  [Symbol.toPrimitive](){return {}}
});
Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Nice job, but still not intended solution! Very clever! \$\endgroup\$
    – user58826
    Commented Jul 25, 2017 at 11:30
3
\$\begingroup\$

JavaScript (Babel Node), Conor O'Brien

(Repost, accidentally put in cops.) Not sure what was intended but positive decimals that aren't enormous all seem to work.

Also I guess I still can't comment in Cops.

f(0.1)
console.log('done')

Try it online!

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Forgot about that as well, good one. \$\endgroup\$
    – Conor O'Brien
    Commented Jul 24, 2017 at 23:48
3
\$\begingroup\$

Javascript (NOT node.js), programmer5000

This can't be added because it creates an object that has no toString because a new Set does not inherent prototypes from from Object.

input:

new Set()

Try it online!

Improve this answer
\$\endgroup\$
4
  • \$\begingroup\$ This was probably the intended solution, I'll keep that in the bag of my head from now on :P \$\endgroup\$
    – Stephen
    Commented Jul 24, 2017 at 20:29
  • \$\begingroup\$ Sorry this doesn't seem to work for me? Try it online! \$\endgroup\$
    – Phoenix Vizva'i
    Commented Jul 25, 2017 at 1:04
  • \$\begingroup\$ @HaumedRahmani added a try online button. I used spider monkey, not babel. \$\endgroup\$
    – Grant Davis
    Commented Jul 25, 2017 at 1:40
  • \$\begingroup\$ Not the intended solution, but nice job! \$\endgroup\$
    – user58826
    Commented Jul 25, 2017 at 1:49
3
\$\begingroup\$

Bash 4.2, Dennis

PATH=1

Clearly not the intended solution, because it works on newer bash as well.

Try it online.

Improve this answer
\$\endgroup\$
3
\$\begingroup\$

Octave, Stewie Griffin

Input: exit

Reasoning: input evalutes whatever is input. exit exits the program.

Try it online!

Improve this answer
\$\endgroup\$
3
\$\begingroup\$

Python 2, Foon

__import__("os")._exit(0)

What it says on the tin, basically.

Try it online.

Improve this answer
\$\endgroup\$
5
  • \$\begingroup\$ Interestingly enough, on TIO this times out for me; under Windows (specifically with winpty python inputbad.py and pasting in the line), it does exit as desired... and yeah, not surprisingly my schtict was exploiting the "input under Python 2 does eval under the hood" bit \$\endgroup\$
    – Foon
    Commented Jul 25, 2017 at 11:01
  • \$\begingroup\$ @Foon Hmm, it's working fine on TIO for me. See link in answer. \$\endgroup\$
    – Veedrac
    Commented Jul 25, 2017 at 11:18
  • \$\begingroup\$ Weird... I must have hit play and then typed input on my TIO link and not realized it \$\endgroup\$
    – Foon
    Commented Jul 25, 2017 at 13:42
  • \$\begingroup\$ I'm pretty sure this cracks every python submission.. \$\endgroup\$
    – enderland
    Commented Jul 26, 2017 at 3:13
  • \$\begingroup\$ @enderland Only if they evaluate your input, which most of them don't. \$\endgroup\$
    – Veedrac
    Commented Jul 26, 2017 at 3:26
3
\$\begingroup\$

Python 3 (CPython), Veedrac

a=('',(type,),{})
X=type(*a)(*a)
X.__class__=X

Try it online!

Improve this answer
\$\endgroup\$
3
\$\begingroup\$

Python 3, Siphor

This was fun. We need to make the type(x) != str check pass, so we need to control the return value of type(). We have to override the __class__ attribute and replace it with a custom object, that extends type, which has the __ne__ method replaced by one that always returns false. This makes it pass the type check, but the search will fail because o is not a str.

class m(type):
    def __ne__(a,b):
        return False
class c:pass
o=c()
o.__class__=m("",(c,),{})
f(o)
Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Welcome to the site! :) \$\endgroup\$
    – DJMcMayhem
    Commented Jul 25, 2017 at 21:01
3
\$\begingroup\$

R, Jarko Dubbeldam

Just an invalid regex.

"["

Try it online.

Improve this answer
\$\endgroup\$
3
\$\begingroup\$

Python, Siphor

f('t=False')

Crashes due to an UnboundLocalError. I think this is hapening because my t=False overrides the higher-scoped t with the local t, but it's not set at the time of the loop, causing the crash.

TIO

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ This seems so easy, good job. \$\endgroup\$
    – 301_Moved_Permanently
    Commented Jul 27, 2017 at 8:18
3
\$\begingroup\$

Commodore 64 Basic, Mark

If I understood this correctly (and it's entirely plausible I have not), you just need to overflow the floating point variable.

9999999999999999999999999999999999999999999999999999999999999999.9
Improve this answer
\$\endgroup\$
1
  • 3
    \$\begingroup\$ You can use scientific notation for a shorter crack. A simple 1E50 will do just as well, and is easier to type. \$\endgroup\$
    – Mark
    Commented Jul 25, 2017 at 22:16
3
\$\begingroup\$

Bash 4.2, Dennis

-9223372036854775808/-1

Why though, Dennis? y u do dis?

Improve this answer
\$\endgroup\$
4
  • 1
    \$\begingroup\$ Well done. I had 2**63%-1, which results in the same operation. \$\endgroup\$
    – Dennis
    Commented Jul 26, 2017 at 2:49
  • \$\begingroup\$ I assume this is a parsing or evaluation bug of some sort? What exactly causes it to fail? \$\endgroup\$
    – Robert Fraser
    Commented Jul 26, 2017 at 7:51
  • 1
    \$\begingroup\$ @RobertFraser It overflows! They're stored in small registers and the division generates a SIGFPE. \$\endgroup\$
    – Veedrac
    Commented Jul 26, 2017 at 11:08
  • 2
    \$\begingroup\$ It's somewhat ironic that (on most platforms, including x86) unless you on purpose unmask FP exceptions, the only thing that will normally raise SIGFPE is an integer division exception. (by zero, or overflow). But POSIX requires integer division to raise SIGFPE if it raises any signal at all: stackoverflow.com/questions/37262572/… \$\endgroup\$
    – Peter Cordes
    Commented Jul 27, 2017 at 10:39
3
\$\begingroup\$

C#, TheLethalCoder

System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]

Or any other nullable class.

Improve this answer
\$\endgroup\$
3
\$\begingroup\$

C#, TheLethalCoder

new char[0]

string.Empty ("") is always interned. Therefore, an empty array or null will work.

Improve this answer
\$\endgroup\$
1
2 3 4 5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.