47
\$\begingroup\$

This is the robbers' thread. The cops' thread is here.

Your challenge is to crack a cop's submission by finding an input that makes it halt. You don't have to find out why, or all inputs that make it halt if there's more than one, or the input the cop intended, just one input will do.

Once you have cracked a submission, post a link to it in a comment or edit to the cop's post. You can also flag your submission for a mod to edit it in the cop's post. Also, post the input used and a link to the cop's post in an answer in this thread. The robber that cracks the most submissions wins.

Multiple people can post cracks to the same cop submission, as long as they are different.

(If SE converted your duplicate answer to a comment, you may want to vote on this feature request)


Looking for uncracked submissions?

fetch("https://api.stackexchange.com/2.2/questions/135363/answers?order=desc&sort=activity&site=codegolf&filter=!.Fjs-H6J36vlFcdkRGfButLhYEngU&key=kAc8QIHB*IqJDUFcjEF1KA((&pagesize=100").then(x=>x.json()).then(data=>{var res = data.items.filter(i=>!i.body_markdown.toLowerCase().includes("cracked")).map(x=>{const matched = /^ ?##? ?(?:(?:(?:\[|<a href ?= ?".*?">)([^\]]+)(?:\]|<\/a>)(?:[\(\[][a-z0-9/:\.]+[\]\)])?)|([^, ]+)).*[^\d](\d+) ?\[?(?:(?:byte|block|codel)s?)(?:\](?:\(.+\))?)? ?(?:\(?(?!no[nt][ -]competing)\)?)?/gim.exec(x.body_markdown);if(!matched){return;}return {link: x.link, lang: matched[1] || matched[2], owner: x.owner}}).filter(Boolean).forEach(ans=>{var tr = document.createElement("tr");var add = (lang, link)=>{var td = document.createElement("td");var a = document.createElement("a");a.innerText = lang;a.href = link;td.appendChild(a);tr.appendChild(td);};add(ans.lang, ans.link);add(ans.owner.display_name, ans.owner.link);document.querySelector("tbody").appendChild(tr);});});
<html><body><h1>Uncracked Submissions</h1><table><thead><tr><th>Language</th><th>Author</th></tr></thead><tbody></tbody></table></body></html>

\$\endgroup\$
3
  • 2
    \$\begingroup\$ Does different mean different inputs (say, all inputs ending with 2 crack the cop's post - can you different people post different numbers ending in 2?) or different families of inputs, or different types of inputs? \$\endgroup\$
    – Stephen
    Jul 24, 2017 at 17:03
  • 1
    \$\begingroup\$ Multiple people can post cracks to the same cop submission... Please define different. \$\endgroup\$
    – Dennis
    Jul 25, 2017 at 13:41
  • \$\begingroup\$ @NoOneIsHere codegolf.meta.stackexchange.com/q/13437/58826 \$\endgroup\$
    – user58826
    Jul 25, 2017 at 15:26

144 Answers 144

2
\$\begingroup\$

C, Steadybox

1597463007 1065353216

Try it online.

This one was clever.

\$\endgroup\$
0
2
\$\begingroup\$

Pyth, isaacg

exec(input())
__import__("os")._exit(1)

I call this "privilege escalation" :P.

\$\endgroup\$
2
\$\begingroup\$

C++, ecatmur

struct C { int m; };
int C::* t = &C::m;

Try it online!

For some reasons, default initialization of pointer-to-member make that -1, which become true when cast to bool.

\$\endgroup\$
0
2
\$\begingroup\$

R, Jarko Dubbeldam

"unlist"

Though it's just one more function that could be added to the exceptions - I doubt it's the intended solution.


Two more cracks: 'is.vector' and 'return'. These both work on the modified (list(0)) version.

\$\endgroup\$
7
  • 2
    \$\begingroup\$ you're right, not intended, but good solution! Instead of turning a fix into a new post, do you mind if I change list(1) to list(0)? :D \$\endgroup\$
    – JAD
    Jul 27, 2017 at 20:35
  • \$\begingroup\$ Sounds good to me :) \$\endgroup\$ Jul 27, 2017 at 20:54
  • 1
    \$\begingroup\$ @JarkoDubbeldam See edits for two more cracks that work on the list(0) version. 'return' seems like it might even be the intended solution. \$\endgroup\$ Jul 27, 2017 at 21:00
  • \$\begingroup\$ Getting closer, but not the intended solution. \$\endgroup\$
    – JAD
    Jul 28, 2017 at 4:42
  • 1
    \$\begingroup\$ A few more cracks for the new version: "NROW", "NCOL", and "lengths" \$\endgroup\$ Jul 28, 2017 at 6:16
2
\$\begingroup\$

JavaScript, iovoid

this.constructor.constructor("return process")().exit()

Try it online!

\$\endgroup\$
2
\$\begingroup\$

JavaScript (Node.js) by Alex Varga

Updated with what I'd intended to post, thanks to Patrick Roberts' comment!

{valueOf:_=>process.exit(0)}

Try it online!

\$\endgroup\$
3
  • 1
    \$\begingroup\$ Technically that terminates the program before even entering the function, as the process.exit() is invoked inside the call rather than the body. However, changing to {valueOf(){process.exit()}} would be sufficient. \$\endgroup\$ Jul 28, 2017 at 7:05
  • \$\begingroup\$ @PatrickRoberts yeah, that's what I'd intended to post... Not sure how I posted the wrong one. I validated it entered the loop on my system, but clearly missed that.. otherwise, I guess I could have just added process.exit(0) on its own, which kinda misses the point of the challenge really. Thanks for the nod! \$\endgroup\$ Jul 28, 2017 at 7:47
  • \$\begingroup\$ Also, the username typically links to their cop answer, not their account page, while you're editing. \$\endgroup\$ Jul 28, 2017 at 7:49
2
\$\begingroup\$

C (gcc), dj0wns

%s%s

Try It Online!

The offending command essentially evaluates to this and throws a seg fault when it tries to read a second string from beyond d, since there is no 5th argument to the function.

char b[256];
char*d = "abcd";
snprintf(b,4,"%s%s",d)
\$\endgroup\$
8
  • \$\begingroup\$ Not my intended solution but I guess it works on Tio, doesn't work on my local machine though. \$\endgroup\$
    – dj0wns
    Jul 24, 2017 at 19:59
  • \$\begingroup\$ I hope someone can find the intended solution then, this particular question allows for multiple cracks \$\endgroup\$
    – PunPun1000
    Jul 24, 2017 at 20:00
  • \$\begingroup\$ Well done mate! \$\endgroup\$
    – dj0wns
    Jul 24, 2017 at 20:01
  • \$\begingroup\$ C is perfectly happy letting you write to random places what? In C implementations on modern OSes, all pages mapped in your virtual address space will be read-only or read/write. I think some hardware does allow making pages write-only, but this is definitely not something you should expect. C as an abstract standard of course just says that writing outside of any object is Undefined Behaviour, so it's all implementation-specific behaviour here. A real-mode DOS C implementation might not fault at all here. \$\endgroup\$ Jul 29, 2017 at 10:17
  • 1
    \$\begingroup\$ @PeterCordes I've removed the unnecessary wording from my answer \$\endgroup\$
    – PunPun1000
    Jul 29, 2017 at 17:58
2
\$\begingroup\$

JavaScript (Node.js >= 6.0), Patrick Roberts

{__proto__:Function,toString:_=>process.kill(0)}

This probably isn't the intended answer, but it does work. It kills the process without giving either the exit handler or the exception handler a chance to run. Sending to PID 0 is shorter than to process.pid and sends the signal to all processes in the current process group.

\$\endgroup\$
1
  • \$\begingroup\$ Ah, unfortunate... Interesting object literal though, can't say I've ever seen one with a __proto__ attribute in it. And no, this wasn't quite it, but it was indeed creative, and probably more efficient than my answer. \$\endgroup\$ Jul 31, 2017 at 3:21
2
\$\begingroup\$

Python 2, by veedrac

import os, functools
class A:__int__ = os.abort
k(functools.partial(int, A()))
\$\endgroup\$
1
  • \$\begingroup\$ Nice effort; I see your solution to mine is very similar to my solution to yours. This wasn't the intended solution, but I only just figured out partial can be used like this so fair play. I'll probably add a revision that bans functools.partial, but I'll leave that for another day. \$\endgroup\$
    – Veedrac
    Jul 31, 2017 at 3:01
2
\$\begingroup\$

Python 3, E.D. (Fixed)

The input 0526315789473684210344827586206896551724137931020408163265306122448979591836734693877551 halts the fixed program. Since each of the three chunks are separate from each other, you can compute them individually, then combine them together. A coworker of mine figured out the logic and wrote the script to generate this answer.

Also, the fix didn't entirely work as an input of "0"*88+"1" will halt the program as well, since the check for a nonzero n checks the whole string, while only n[:88] is used in the calculations. So, any input of the form "0"*88+A where A is a string where all elements are digits, and at least one is nonzero, will cause the program to halt.

Try it online!

\$\endgroup\$
2
\$\begingroup\$

Javascript (Node.js), A username

Most inputs to the program will actually throw an error (null, 0, [] etc), but the below solution halts without an error:

f({ replace: () => {} })

Try it online!

\$\endgroup\$
2
\$\begingroup\$

JavaScript (Node.js), cracks A username's challenge

f('`W`')

Try it online!

There are multiple ways to make this fail with an error (try a single backtick) but this evaluates to this

return +[`W`]

This results in NaN, and NaN !== NaN.

\$\endgroup\$
1
\$\begingroup\$

cQuents, Step Hen

1 2

Try it online!

Essentially, anything that matches /^.+ \d+$/ is valid input that will halt the program.

\$\endgroup\$
4
  • \$\begingroup\$ A crack containing alphanumerics exists, if a cop wants to try it. \$\endgroup\$
    – Stephen
    Jul 24, 2017 at 17:04
  • \$\begingroup\$ @StepHen I am still trying, trying to figure out how the inputs work \$\endgroup\$
    – user41805
    Jul 24, 2017 at 17:09
  • \$\begingroup\$ From documentation: Input is currently given as a space delimited list of numbers (although unless you do math on them they are not forced to be numbers, as in my test case on TIO) \$\endgroup\$
    – Stephen
    Jul 24, 2017 at 17:11
  • \$\begingroup\$ @StepHen Figured it out as soon as you posted that comment :D \$\endgroup\$
    – user41805
    Jul 24, 2017 at 17:12
1
\$\begingroup\$

Java

The strings __.-._.-._.-.-.-.-.-._.-._._.-.-._. and __-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- work, with a minor bug: Integer.toHexString doesn't give a leading 0x, under Java 8. (I didn't try other versions.) Trimming it from the source makes it work fine.

\$\endgroup\$
6
  • \$\begingroup\$ @tuskiomi, it works in Jetbrains IntelliJ and in TIO, and neither prepend the 0x. The . characters are space-filler in the non-checked positions (only every other position is checked). \$\endgroup\$ Jul 24, 2017 at 17:46
  • \$\begingroup\$ Well, you got me there. The characters could be technically anything... but this is the correct answer. \$\endgroup\$
    – tuskiomi
    Jul 24, 2017 at 17:50
  • \$\begingroup\$ Also, How'd ya figure this one out? ;) \$\endgroup\$
    – tuskiomi
    Jul 24, 2017 at 17:51
  • \$\begingroup\$ @tuskiomi I saw that the bitshifts at the bottom were constructing an int bit by bit with - being 1, and mentally transcribed the two hex ints to binary. Then I added in the padding to make it fit, and made the other string as simple as possible to enter the if. \$\endgroup\$ Jul 24, 2017 at 17:54
  • 1
    \$\begingroup\$ @tuskiomi, I hadn't even heard of it until now, to be honest. It's obvious once I looked it up, though. Clever puzzle! \$\endgroup\$ Jul 24, 2017 at 18:03
1
\$\begingroup\$

JavaScript (ES6), programmer5000

null

The condition was typeof x!=="object"||x; apparently null is an object but falsey in JavaScript.

Try it online!

\$\endgroup\$
1
\$\begingroup\$

Java, tuskiomi

Fatally errors when the two arguments '_-_-_-_-_-' and '__________' are given.

\$\endgroup\$
3
  • \$\begingroup\$ For me it keeps running \$\endgroup\$
    – tuskiomi
    Jul 24, 2017 at 17:43
  • \$\begingroup\$ Did you type it correctly? 10 underscores and then 5 underscores and 5 dashes alternating \$\endgroup\$
    – Okx
    Jul 24, 2017 at 17:43
  • \$\begingroup\$ I copied straight from your post; I just tried switching the parameter's order. no cigar. \$\endgroup\$
    – tuskiomi
    Jul 24, 2017 at 17:44
1
\$\begingroup\$

JavaScript, programmer5000

null

That's basically it.

\$\endgroup\$
1
  • \$\begingroup\$ @programmer5000 Sorry, I didn't see the mistake when trying to FGITW \$\endgroup\$
    – user41805
    Jul 24, 2017 at 17:47
1
\$\begingroup\$

JavaScript, programmer5000

new Buffer(268435440)

Throws an error when it is coerced into a string.

Try it online!

Got it from this request for better error documentation.

\$\endgroup\$
2
  • \$\begingroup\$ Woah! Nice job! \$\endgroup\$
    – user58826
    Jul 24, 2017 at 19:14
  • \$\begingroup\$ @programmer5000 thanks :P now go crack mine two newest ones, have fun :P \$\endgroup\$
    – Stephen
    Jul 24, 2017 at 19:15
1
\$\begingroup\$

JavaScript (Node.js)

g("13")(13/321)

It works, apparently you can replace 13 with 33, 53, etc

\$\endgroup\$
1
  • 1
    \$\begingroup\$ That's not what I had in mind, but good job getting around what I had in mind, because you would never have guessed it :P \$\endgroup\$
    – Stephen
    Jul 24, 2017 at 19:28
1
\$\begingroup\$

Python 2, Foon

Crack or hack? I'm not sure which this is yet...

Windows:

exit()
<ctrl>C

Where <ctrl> is the actual key modifier. This will eval exit() in the first pass of the loop and catch the keyboard interrupt in the second. quit will work in place of exit too.

(Nix replace <ctrl>C with <ctrl>D ?)

\$\endgroup\$
1
\$\begingroup\$

Python 3.5, Siphor

"\r def t():pass"

Calling f("\r def t():pass") will redefine the "inner" t to a function that does nothing prior to it being created inside the "outer" t.

\$\endgroup\$
0
1
\$\begingroup\$

Python 2, Quelklef

def x():
    import ctypes
    ctypes.cast(1, ctypes.POINTER(ctypes.c_int))[0]

f(x)

I'm sure this isn't the intended solution, but a segfault counts, right?

\$\endgroup\$
1
  • \$\begingroup\$ Not intended, but does work... Wish I could disable imports. \$\endgroup\$
    – Quelklef
    Jul 25, 2017 at 1:53
1
\$\begingroup\$

Python 2, Quelklef

def f(x):
	try:x()
	except:1
	while True:1
def x():global True;True=False
f(x)

Try it online!

Redefines True to False.

\$\endgroup\$
1
  • \$\begingroup\$ Yay! This is the solution I was looking for! I did it differently, as f( lambda: globals().update({"True": False}) ) \$\endgroup\$
    – Quelklef
    Jul 25, 2017 at 2:33
1
\$\begingroup\$

J, miles

Input: '' (the empty vector). Errors with an index error.

$:@#~^:(0([=[e.{#])#~) ''

This approach (erroring out) will work for infinity, floats, and non-positive numbers.

The intended approach is probably an imaginary number, such as 2j2, which returns a result.

   $:@#~^:(0([=[e.{#])#~) 2j2
2j2

Let's decompose the program:

$:@#~^:(0([=[e.{#])#~) 
$:@                       call this function (recurse)
   #~                     with the input repeated itself times
     ^:(             )    if:
        0(    f   )#~         f(0, #~ y)
          [=[e.{#]


dyad:
[ = [ e. { # ]  x = 0, y = #~ y
           #    repeat
             ]     y
         {         y[0] times
    [ e.        check if 0 is in this list
[ =             check if that is false

So, we want an input y such that (0{y) # (#~ y) contains a zero. When using an imaginary number as y = a + bi, we get:

#~ y
y # y
(a + j. b) # y
(a # y) , (b # 0)

Which gives us b zeroes in the input. This will make the aforementioned condition false, and this only run once.

\$\endgroup\$
5
  • \$\begingroup\$ Does ending with an error count as cracked? There is actually an input that lets it exit without error. Good find, I didn't think of testing empty input. \$\endgroup\$
    – miles
    Jul 25, 2017 at 2:48
  • \$\begingroup\$ @miles Yeah, so long as the program is finite. I'm still looking for a non-empty solution, however. \$\endgroup\$ Jul 25, 2017 at 2:50
  • \$\begingroup\$ Yes, that's what I had in mind, I'll have to test more input types next time. \$\endgroup\$
    – miles
    Jul 25, 2017 at 3:11
  • \$\begingroup\$ @miles Cool! That was fun, I learned something new about # today. \$\endgroup\$ Jul 25, 2017 at 3:12
  • \$\begingroup\$ Yeah, it's one of the few features I haven't found a good use for yet. \$\endgroup\$
    – miles
    Jul 25, 2017 at 3:13
1
\$\begingroup\$

JavaScript by Grant Davis

({t:1,get x(){ return this.t--; }})

getter is powerful. you may also try Proxy.

\$\endgroup\$
1
  • \$\begingroup\$ I used __proto__.defineGetter, but this is more elegant. This challenge has taught me a lot about JavaScript. \$\endgroup\$ Jul 25, 2017 at 3:27
1
\$\begingroup\$

Bash, Dennis

//

Try it online.

\$\endgroup\$
1
\$\begingroup\$

JavaScript (Node.js), tsh

code:

x=>{try{for(;!x||x!=0||x instanceof Object||typeof x!='object';);}catch(e){for(;;);}}

input:

{valueOf:g=>{Object=Number;return 0}}

Try it online!

!x: x resolves to true !true resolves to false

x!=0: valueOf is overridden and returns 0. 0!=0 is false Also sets Object to Number for next step

x instanceof Object: Object now points to Number and x is an Object not a Number so this resolves to false

typeof x!="object": x is an object so typeof x returns "object". "object"!="object" is false

\$\endgroup\$
2
  • \$\begingroup\$ Good job. instanceof is just something too weak... \$\endgroup\$
    – tsh
    Jul 25, 2017 at 5:06
  • \$\begingroup\$ @tsh Not hard to break things when one messes with prototypes and reassigns critical global variables. \$\endgroup\$ Jul 25, 2017 at 5:15
1
\$\begingroup\$

JavaScript (Node.js), 36 bytes, tsh

1.00000001

Any value near 1 under the rounding threshold will make it.

Try it online!

\$\endgroup\$
1
  • \$\begingroup\$ Wow, love it. although that is not what I want... \$\endgroup\$
    – tsh
    Jul 25, 2017 at 8:50
1
\$\begingroup\$

R, Rift

expression(T <- 0)

Sets T to a false value. I don't know R, seems to work.

Try it online.

\$\endgroup\$
1
\$\begingroup\$

JS, 11bytes / 18bytes

code:

 f=a=>{while(!Array.isArray(a)||!a.length);a.map(_=>{for(;;);})}

cracked (throws no error):

f(Array(5))

cracked (throws error):

 a=[1];a.map=1;f(a)
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.