41
\$\begingroup\$

Inspired by this challenge, which got closed. This is meant to be an easier, but no less interesting version of that.

This is the cops thread of a challenge. For the robbers thread, see here.

Cops will provide a program/function and a flag. Robbers will try to guess a password such that, when the password is given to the cop's program, the flag is outputted.

Basic rules

  • The language used should be provided.
  • The flag, which can be an integer, string, or value of any other type, should be provided.
  • The flag may be printed to STDOUT, returned from a function, or outputted using any of the other standard output methods, as long as you specify how it will be outputted.
  • The program/function can take the password through STDIN, as a function argument, or using any of the other standard input methods, as long as you specify how the it will be inputted.
  • A free online compiler/interpreter should also be linked, preferably with the cop's code already pasted in and ready to run.

Some more rules

  • There must be at least one valid password that causes your program to return the flag, and you should know at least one of those passwords when posting your answer.
  • In case of a function submission, the cop should also include a full runnable program including the function either in the answer or in the linked online compiler/interpreter.
  • If it is at all ambiguous what the type of the flag is, it must be specified.
  • If a cop's description of the output is ambiguous (e.g. "HashSet(2, 1) should be printed"), robbers are allowed take advantage of that (e.g. print the string "HashSet(2, 1)" instead of an actual hashset)
  • Forcing robbers to simply brute force the password is not allowed.
  • The program must take input, and must output the flag when given the correct password. When not given the correct password, you are free to error, output something else, or immediately terminate. If your program never halts if given the wrong password, you must tell robbers of this behavior so no one waits around for the program to output something.

Cops's score will be the number of bytes their code takes up.

Cop answers will be safe if they haven't been cracked for two weeks.

Example

Cop:

Scala, 4 bytes

x=>x

Flag: Yay, you cracked it! (an object of type String is returned from the lambda above) Try it online!

Robber:

Password: the string "Yay, you cracked it!" Try it online!

Find Uncracked Cops

<script>site='meta.codegolf';postID=5686;isAnswer=false;QUESTION_ID=213962;</script><script src='https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js'></script><script>jQuery(function(){var u='https://api.stackexchange.com/2.2/';if(isAnswer)u+='answers/'+postID+'?order=asc&sort=creation&site='+site+'&filter=!GeEyUcJFJeRCD';else u+='questions/'+postID+'?order=asc&sort=creation&site='+site+'&filter=!GeEyUcJFJO6t)';jQuery.get(u,function(b){function d(s){return jQuery('<textarea>').html(s).text()};function r(l){return new RegExp('<pre class="snippet-code-'+l+'\\b[^>]*><code>([\\s\\S]*?)</code></pre>')};b=b.items[0].body;var j=r('js').exec(b),c=r('css').exec(b),h=r('html').exec(b);if(c!==null)jQuery('head').append(jQuery('<style>').text(d(c[1])));if (h!==null)jQuery('body').append(d(h[1]));if(j!==null)jQuery('body').append(jQuery('<script>').text(d(j[1])))})})</script>

\$\endgroup\$
21
  • 6
    \$\begingroup\$ This is already explicitly mentioned in the challenge, but here is the meta post from Loopholes that are forbidden by default about using cryptographic functions in CnR challenges. \$\endgroup\$
    – Arnauld
    Commented Oct 22, 2020 at 17:56
  • 1
    \$\begingroup\$ May we specify multiple output formats at once; that is, specify that STDOUT must be a and STDERR must be b? \$\endgroup\$
    – hyperneutrino
    Commented Oct 22, 2020 at 18:23
  • 4
    \$\begingroup\$ @SunnyMoon Sure, you can tell robbers that the password is a multiple of 34. Whether it's wise to leave robbers that clue, I don't know :) \$\endgroup\$
    – user
    Commented Oct 22, 2020 at 20:36
  • 4
    \$\begingroup\$ What is your definition of cryptographic functions? \$\endgroup\$ Commented Oct 24, 2020 at 12:08
  • 2
    \$\begingroup\$ This challenge seems to amount to just do cryptography without using cryptography. \$\endgroup\$
    – Wheat Wizard
    Commented Oct 25, 2020 at 12:09

68 Answers 68

3
\$\begingroup\$

Python 3, 67 bytes, cracked by @rak1507 and @ovs

def f():
 try:exec(open(0).read())
 except:0
 return lambda:["wow"]

Attempt This Online!

Works in CPython 3.9.6. Input via stdin, and outputs by returning a function that returns a singleton list. Your crack should change the output to the string hah (also in a singleton list, in a function, as the return value).

Addendum: I keep trying to write answers to It almost works, but I keep finding unintended workarounds and having to post them here where I can set stricter rules.


@rak1507 and @ovs both cracked this, presumably separately, using ctypes to directly mutate the strings. Here's my intended solution:

import sys
def t(_, m, v):
    import sys
    if m == "return": v[0] = "hah"
    return sys.t
sys.t = t
sys.settrace(t)

If it weren't for some complicated problems (see below), I could have this answer which is a bit easier to read:

import sys
def t(_, m, v):
    if m == "return": v[0] = "hah"
    return t
sys.settrace(t)

sys.settrace enables tracing for the interpreter, which means many operations trigger the calling of the given trace function (here that's t), a feature intended for implementing Python debuggers.

One of the operations that triggers a trace is just before the return of a function; the third argument is the returned object. In this case the returned object is a list which we can mutate, so when the second argument ("event type" is "return"), I set its first element to hah. (The first argument is the stack frame object, which is unused here).

My answer had to return a function that returns the value because tracing is not enabled until a new stack frame is entered (another function being called).

The trace function should return a new trace function (normally itself), or None to disable tracing. My trace function needs to return itself here, but because the code is run by exec, by the time the trace function is executed, it's lost a reference to its global scope and t is no longer defined. For this reason we need to store it somewhere else that won't be garbage collected. Here I chose to set it as an attribute on the sys module because it's convenient.

\$\endgroup\$
5
  • \$\begingroup\$ This is so much simpler than the other one, yet so much more confusing... \$\endgroup\$
    – emanresu A
    Commented Jul 17, 2021 at 7:23
  • \$\begingroup\$ cracked, but I assume you had something a bit more involved in mind? \$\endgroup\$
    – ovs
    Commented Jul 17, 2021 at 8:25
  • \$\begingroup\$ It was rak1507, not me \$\endgroup\$
    – emanresu A
    Commented Jul 17, 2021 at 9:09
  • \$\begingroup\$ @Ausername oops I'm stupid lol \$\endgroup\$
    – pxeger
    Commented Jul 17, 2021 at 9:11
  • \$\begingroup\$ cracked? \$\endgroup\$
    – M Virts
    Commented Jul 18, 2021 at 3:01
3
\$\begingroup\$

Python 3, 166 bytes, cracked by @ovs

def f(s,a):1/(not{*"_.}"}&{*s});c=compile(s,"","exec");x=bytearray(c.co_code);[0for i in a for x[i]in[9]];return eval(c.replace(co_code=bytes(x)),{"__builtins__":{}})

Attempt This Online!

Works on CPython 3.9.6. Accepts two inputs: a string s and a list of integers a. Should return the dictionary {"a": "b"} (not a string that looks like that dictionary!).

\$\endgroup\$
1
  • \$\begingroup\$ cracked \$\endgroup\$
    – ovs
    Commented Aug 7, 2021 at 10:14
3
\$\begingroup\$

JavaScript, 10428 bytes, cracked by ovs

Because no one said there was a character limit :)

The flag is cracked! otherwise there is no output.

[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]]+(([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+([][[]]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]])[(![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]]((!![]+[])[+[]])[([][(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]](([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+![]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])+[])[+!+[]])+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]])())

\$\endgroup\$
3
  • 1
    \$\begingroup\$ I suppose it's too late to add a character limit now :/ \$\endgroup\$
    – user
    Commented Oct 23, 2020 at 18:46
  • 1
    \$\begingroup\$ So is this just jsf*ck? \$\endgroup\$
    – user
    Commented Oct 23, 2020 at 18:59
  • 1
    \$\begingroup\$ cracked. \$\endgroup\$
    – ovs
    Commented Oct 23, 2020 at 21:11
2
\$\begingroup\$

Python 3, 42 bytes, cracked by pppery

Just a single line of Python.

eval(input(),{'__builtins__':{}})(**{0:0})

Try it online!

The password is inputted via STDIN, the flag is (nothing) and should be printed to STDERR. That means no output to STDERR.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ Cracked \$\endgroup\$ Commented Oct 24, 2020 at 16:38
  • \$\begingroup\$ @pppery Thats not how I intended it ;) \$\endgroup\$
    – ovs
    Commented Oct 24, 2020 at 16:44
2
\$\begingroup\$

Python 3, 73 bytes, cracked by pxeger

Hopefully this time there are no loopholes.

s=input()
assert not{*s}&{*'()[]{}'}
eval(s,{'__builtins__':{}})(**{0:0})

Try it online!

Just as before, the password is inputted via STDIN, the flag is (nothing) and should be printed to STDERR. That means no output to STDERR.

\$\endgroup\$
2
2
\$\begingroup\$

R, 143 bytes, cracked by Giuseppe

function(x, y, z){
  if(length(ls(1)) > 1 | length(ls()) != 3) return("S")
  LETTERS[lengths(lapply(y, intToUtf8(x), z)) * lengths(lapply(y, intToUtf8(x+32), z))]
}

Try it online!

Once again, the value to output is the string "R". The line with length(ls()) is there to try to close some loopholes; in any case, you need to find objects x, y and z such that f(x, y, z) == "R" is TRUE.


Giuseppe found a nice solution using the functions ^ and ~. The solution I had in mind was f(67, list(as.factor(1:3)), 4:6): Try it online! (any vectors of length 3 would work). The trick is that the functions c and C both exist (with the second being much less known). Calling c(1:3, 4:6) returns the length 6 integer vector 1 2 3 4 5 6; calling C(as.factor(1:3), 4:6) returns a length 3 factor 1 2 3 (with contrasts 4 5 6). The product of the lengths is thus 18, which is the position of R in the alphabet.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ cracked! I went down a real rabbit hole with C and D, but figured it out in the end! \$\endgroup\$
    – Giuseppe
    Commented Oct 27, 2020 at 14:59
  • 1
    \$\begingroup\$ @Giuseppe Well done! I actually had a different solution in mind, with c and C. \$\endgroup\$ Commented Oct 27, 2020 at 15:52
2
\$\begingroup\$

BrainF***, 22 bytes, Cracked by Cinaski

+++++[>,[--->+<]>.<<-]

Try it online!

The flag is wEe0H with nothing else. This shouldn't be too hard.

\$\endgroup\$
6
  • \$\begingroup\$ I made sure the flag would allow for a valid password \$\endgroup\$
    – SuperPizz
    Commented Feb 12, 2021 at 1:08
  • \$\begingroup\$ Wait i'm unsure did you forget to remove the password from the try it online link? \$\endgroup\$
    – RezNesX
    Commented Feb 12, 2021 at 7:50
  • \$\begingroup\$ Maybe? I didn't look into that. \$\endgroup\$
    – SuperPizz
    Commented Feb 12, 2021 at 15:03
  • \$\begingroup\$ cracked \$\endgroup\$
    – Cinaski
    Commented Feb 12, 2021 at 16:09
  • \$\begingroup\$ @SuperPizz You did leave the password in, but I edited in a link without it and anyway, Cinaski has cracked your answer. Btw, you should add "Cracked" to the header of your answer, with a link to the robber answer, so people know it's cracked. \$\endgroup\$
    – user
    Commented Feb 12, 2021 at 16:44
2
\$\begingroup\$

Racket, 202 bytes, Safe

#lang racket

(define (h z)
  (when (procedure? z) (error "you lose"))
  (define a (λ (x) (not x)))
  ((λ (f) (call/cc (λ (k) (k (or (a z) (set! a ((eval f) k))))))) z)
  (and z (print (a "hello"))))

The flag is hello. The password (in the form of a quote-string) is passed as the argument to the h function.

Try it online!

\$\endgroup\$
2
\$\begingroup\$

Python 3.8, 322 bytes, safe

from ast import*
a=input()
b=walk(parse(a,"","eval"))
c=Constant
n=Name
if not {z.__class__ for z in b}-{Load,Call,Expression,c,n}:
 for x in b:
  if (i:=instanceof)(x,c):
   if not i(x.value, str):
    break
  if i(x,n):
   if x.id=="getattr":
    break
 else:
  print(eval(a,{"__builtins__":{},"getattr":getattr})==eval)

Could probably be golfed more, but I'm trying to avoid accidentally leaking anything :P

Output is True followed by a newline

Solution:

The program only runs programs that load names or constants and call functions. It also runs the input with only the global function getattr (which is essentially a function implementation of the ., so a.b == getattr(a,"b"), so our goal is to get to eval with only these pieces. The solution that I came up with was by building up from an expression that I came up with that could become eval using the classes that Python loads at runtime, and then slowly using pythons magic dunder methods to try to "simplify" down language features that I can't use to get to getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr,"__class__"),"mro")(),"__getitem__")(1),"__subclasses__")(),"__getitem__")(getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr,"__class__"),"mro")(),"__getitem__")(1),"__subclasses__")(),"__repr__")(),"split")(","),"index")(" <class 'codecs.Codec'>")),"decode"),"__globals__"),"__getitem__")("__builtins__"),"__getitem__")("eval")

Try it online!

\$\endgroup\$
2
  • \$\begingroup\$ instanceof isn't a thing in Python. Did you mean isinstance? \$\endgroup\$
    – pxeger
    Commented May 29, 2021 at 9:38
  • \$\begingroup\$ @pxeger I had actually meant to use isinstance, but I didn't realize until way too late to change it, and it would've changed the restrictions which would be unfair. \$\endgroup\$
    – Citty
    Commented Jun 1, 2021 at 8:15
2
\$\begingroup\$

JavaScript (V8), 113 bytes, cracked by tsh

f=n=>n!=42?`${n} is a number`:`${n} is the answer to the ultimate question of life, the universe, and everything`

Try it online!

f needs to return 42 is a number.

Probably an easy one, but it's worth a shot.

\$\endgroup\$
1
2
\$\begingroup\$

Python 3, 958 bytes, safe

x=[(9,23),(10,24),(10,25),(11,23),(11,24)]
def f(g):
    h=g.copy()
    for move in range(30):
        n=[]
        for i in range(12):
            n.append([])
            for j in range(36):
                c=0
                for (a,b)in[(-1,-1),(-1,0),(-1,1),(0,-1),(0,1),(1,-1),(1,0),(1,1)]:
                    if i+a>=0 and i+a<12 and j+b>=0 and j+b<36:
                        c+=h[i+a][j+b]
                if h[i][j]==0 and c==3:
                    n[i].append(1)
                elif h[i][j]==0:
                    n[i].append(0)
                elif h[i][j]==1 and c!=2 and c!=3:
                    n[i].append(0)
                elif h[i][j]==1:
                    n[i].append(1)
        h=n.copy()
    for i in range(12):
        for j in range(36):
            if g[i][j]!=h[i][j]:
                if not((i,j)in x):
                    print('N')
    for (i,j)in x:
        if g[i][j]==h[i][j]:
            print('N')
    print('Y')

Try it online! Flag: Y. The password is taken through input to f, so to run the code just edit the last line f([]).

Solution:

The code simply runs Conway's game of life on a finite grid, and tests whether the result after 30 ticks is the original grid with a particular set of 5 cells toggled. The solution is:

Gosper's glider gun. [[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1], [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]] Try it online!

\$\endgroup\$
2
  • 1
    \$\begingroup\$ There's no need to post the solution right now, you can do that after your answer is cracked or it's safe \$\endgroup\$
    – user
    Commented Feb 19, 2021 at 18:37
  • 1
    \$\begingroup\$ Welcome to Code Golf! Nice first answer. \$\endgroup\$
    – rydwolf
    Commented Feb 19, 2021 at 19:01
2
\$\begingroup\$

Python 3, 53 bytes, cracked by EasyasPi

I=input
X=vars(vars()[I()])
X[I()]=X[I()]
class I:1/0

Try it online!

The password is 3 lines of input on STDIN. The flag is the following text, to be printed to STDERR:

Traceback (most recent call last):
  File ".code.tio", line 4, in <module>
    class I:1/0
IndexError: tuple index out of range

(replace .code.tio with whatever the filename of the program is)

\$\endgroup\$
1
  • 1
    \$\begingroup\$ Cracked \$\endgroup\$
    – EasyasPi
    Commented May 24, 2021 at 13:42
2
\$\begingroup\$

Python 3, 57 bytes, cracked by @the default.

class D(dict):__getitem__=0
exec("".join(open(0)),D())

Attempt This Online!

Works under CPython 3.9.6. Takes input from STDIN and should output uslcgtutmuexbwb with a trailing newline to STDOUT.

Hint: that string is completely random - it has no hidden meaning.


The crack was not my intended one; here's an answer with it fixed!

\$\endgroup\$
1
2
\$\begingroup\$

Python 3, 70 bytes, cracked by @the default.

class D(dict):__getitem__=0
s=open(0).read()
if"."not in s:exec(s,D())

Attempt This Online!

Works under CPython 3.9.6. Takes input from STDIN and should output ryjtufbohqszxgg with a trailing newline to STDOUT.

Hint: that string is pseudo-random with no hidden meaning.


@thedefault's crack was the same basic idea as mine, but it can be reduced to:

class c:
 from builtins import print
 print("ryjtufbohqszxgg")

As @thedefault says:

Our code is being executed in an environment where trying to access any global variable (including built-in functions) throws an error.

The way around this is to use local variables, using an immediately invoked function, or more simply here, an empty class.

However, import still functions correctly

This is because, when importing modules using the magic function __import__, the interpreter (bizarrely) doesn't dispatch to an overridden __getitem__ method on the __builtins__ namespace, but just uses normal built-in dict lookup semantics on the object. This is apparently not a bug, but an entirely implementation-defined quirk.

In fact, if you were a particularly good internet sleuth, you might have found this issue which I posted to the Python bug tracker yesterday about this very behaviour.

\$\endgroup\$
1
2
\$\begingroup\$

Pxem (lazypxem.posixism.tio.sh (8e9ac7ceb2)), filename only: 109 bytes, safe safe.

Sorry for misreading the rules; I misread I would safe if nobody cracked mine for one week; I had to wait for two weeks to be safe.

Some are escaped:

\002.r.w.i._._.-.-\240.z.d.aY.o.d.a\002.r.w.i.i.i.i.s.s.s.s._.i.!Q##.!.-.+.w.d.aY.o.d.a.w.+.i.c\001.+.a.+\377\377].+.+.z.d.aY.o
  • Flag: Y, without trailing LF.
  • Input from stdin, as a string consists of ASCII printables except space: 33 (!) to 126 (~).
  • Output to stdout.
  • This program works randomly; your password must always work.

Try it online!

Hint (posted after 5 days and 2 hours later, I think)

  • This program uses a bug of my interpreter.

Intended password

z317-35bP

\$\endgroup\$
2
\$\begingroup\$

Python 3.8 (pre-release), 163 bytes, safe.

My output is KDIITIWDRIKIDITI

import random
f=open(1,'w')
random.seed(0)
r=[random.randint(0,255) for l in range(255)]
a=input().encode()
for b in a:
 while b >26:
  b=r[b]
 f.write(chr(b+64))

Try it online!


My original password is passthevoidsalts

Since this basically follows a random directed graph (not a-cyclic, I just got lucky my password doesn't crash it) until it lands within a subset of nodes, it's straight forward to create a lookup table for each letter. Originally I tried to create a reversing crack, which works, but the .encode() on the input threw me off so I ran the process forwards to build a lookup table instead.

For each line output by this crack is the list of options to generate the corresponding character in the desired output.

import random 
out = 'KDIITIWDRIKIDITI'
a = [c for c in range(127) if chr(c).isalpha()]
random.seed(0)
r=[random.randint(0,255) for l in range(255)]
od={}
odd={}
for b in a:
 ob = b
 while b >26:
  b=r[b]
 ch = chr(b+64)
 od[ch] = ob
 if ch in odd:
  odd[ch].append(ob)
 else:
  odd[ch] = [ob]
for c in out:
 print(''.join(chr(x) for x in odd[c]))

Try it online!

dpw
JKMPVWXacjqrvx
ABCDEFHLNRSTZbfhilmnsyz
ABCDEFHLNRSTZbfhilmnsyz
t
ABCDEFHLNRSTZbfhilmnsyz
e
JKMPVWXacjqrvx
o
ABCDEFHLNRSTZbfhilmnsyz
dpw
ABCDEFHLNRSTZbfhilmnsyz
JKMPVWXacjqrvx
ABCDEFHLNRSTZbfhilmnsyz
t
ABCDEFHLNRSTZbfhilmnsyz

\$\endgroup\$
2
\$\begingroup\$

Python, 141 bytes, cracked by okie

from keyword import*
x=input()
if~-iskeyword(x)and x.isidentifier():
 exec(x,d:={"__builtins__":{}})
 try:exec(f"del {x}",d)
 except:print(1)

Attempt This Online!

This is quite a long setup for what is perhaps a simple trick. Works in CPython 3.9.7. Given the correct input, it should print 1 (with a newline, to STDOUT).

\$\endgroup\$
1
  • \$\begingroup\$ cracked \$\endgroup\$
    – okie
    Commented Sep 13, 2021 at 5:18
2
\$\begingroup\$

Python, 54 bytes, cracked by m90

lambda x,y:x.isidentifier()and exec(f"{x}(1),1/0;{y}")

Attempt This Online!

Works in CPython 3.9.7. Accepts two strings as passwords. The flag is None, which should be returned from the function.


m90 got my intended solution. y was just a red herring

\$\endgroup\$
1
  • \$\begingroup\$ Cracked. \$\endgroup\$
    – m90
    Commented Oct 3, 2021 at 15:23
2
\$\begingroup\$

ayr, 41 bytes

Not the most creative, but it makes use of some weird + unique behavior I discovered or wanted to use while thinking of something. I'm not sure if there are multiple flags that will work for this one, which was the case for my previous Arn problem.

%/=:"101&~:&:`;:,/.;`.'/ /%'#.,./&.`#&:=I

The desired flag is 4.368051189167166e_9. This is a full program, so don't run it from the cli.

There is currently no online interpreter, but I'm going to set one up within the next couple of days, as the language is written entirely in JS. As it stands you can npm i -g ayr-lang and use ayr <file of program> [flag].

\$\endgroup\$
2
\$\begingroup\$

JavaScript (Node.js), 209 bytes, Cracked by m90

p=v=>{try{a=[];(f=c=>c?f(c/6n|0n,a.push('![]()+'[c%6n])):0n)(h=BigInt(JSON.stringify(v).replace(/\D/g,'')));try{v=eval(a.join``)}catch(e){return false};if(h<1n<<10000n)throw'x'}catch(e){return v[0]===Math.PI}}

Try it online!

Confused? Good.

Takes a JS value as input, flag is true returned from the function.

This basically resolved down to two separate problems - either expressing Math.PI in ~3600 bytes (10k bits) of Jsfuck which I wasn't sure was possible - My best attempt was around 4000 bytes; or making JSON.stringify error.

I intended to use a cyclic object reference - Try it online!, but m90's idea of a BigInt also works, and probably several other things.

\$\endgroup\$
1
  • \$\begingroup\$ Cracked. \$\endgroup\$
    – m90
    Commented Nov 23, 2021 at 7:02
2
\$\begingroup\$

JavaScript, 81 bytes, cracked by ovs

Let's try this again...

alert("xx".split(new RegExp(p=prompt())).reduce((a,b)=>a+b,"").length>2+p.length)

The flag is true.

https://xkcd.com/2217/

\$\endgroup\$
1
  • \$\begingroup\$ Cracked. \$\endgroup\$
    – ovs
    Commented Dec 7, 2021 at 12:48
2
\$\begingroup\$

JavaScript, 13 bytes, cracked by m90

x=>x in x&&!x

The password must be passed in to the function, and the flag, true, must be returned from the function.

You can try solutions out in the (non-normative) snippet below:

console.log((x=>x in x&&!x)(eval(prompt())))

\$\endgroup\$
3
  • \$\begingroup\$ Is a solution allowed to modify stuff before the function executes? \$\endgroup\$
    – m90
    Commented Dec 14, 2021 at 11:33
  • \$\begingroup\$ @m90 Yes [padding] \$\endgroup\$
    – tjjfvi
    Commented Dec 14, 2021 at 17:06
  • \$\begingroup\$ Cracked. \$\endgroup\$
    – m90
    Commented Dec 15, 2021 at 8:13
2
\$\begingroup\$

Python, 57 bytes, cracked by PyGamer0

exec(input(),{"__builtins__":{"if":__import__(input())}})

Attempt This Online!

Works in CPython 3.10. Inputs via STDIN, and should print Hello world! with a trailing newline to standard output.

Unintended crack, so let's have another go.

\$\endgroup\$
1
  • \$\begingroup\$ cracked! \$\endgroup\$
    – zoomlogo
    Commented Jan 1, 2022 at 9:51
2
\$\begingroup\$

Python, 62 bytes, cracked by @dingledooper and later @M Virts

exec(input(),{"__builtins__":{"if":dir(__import__(input()))}})

Attempt This Online!

Let's try again. Inputs via STDIN, output should be Hello world! printed to STDOUT with a trailing newline. Works in CPython 3.10.


dingledooper got my intended solution.

As for M Virts': dammit, I always forget Python can do that kind of stuff!

\$\endgroup\$
2
  • \$\begingroup\$ Cracked? \$\endgroup\$ Commented Jan 1, 2022 at 21:39
  • \$\begingroup\$ Cracked?? for some reason I just assumed the string was different from the import-only approach, \$\endgroup\$
    – M Virts
    Commented Jan 3, 2022 at 21:20
2
\$\begingroup\$

JavaScript (SpiderMonkey), 66 bytes, cracked by user

if (readline() === ([0][1]+"").slice(4,8)) console.log('cracked!')

Try it online!

The flag is the string cracked!

\$\endgroup\$
1
  • 1
    \$\begingroup\$ Cracked \$\endgroup\$
    – user
    Commented Oct 23, 2020 at 18:31
1
\$\begingroup\$

JavaScript (SpiderMonkey), 52 bytes, Cracked by r3mainer

i=>(a=+i,a<a/a?a/a<-a?1/a<a:a*a>1:1<a*a?a*a<a:1/a<a)

Try it online!

Expect output is true.

Input via parameter, output via return value. Global values should not be configured before the function execute. (For example, Object.defineProperty(globalThis, 'a', { get() { return ...; }, set() { return true; } }) is not valid.)

This one could be quite easy. I expected it will be cracked in 30 min...

\$\endgroup\$
2
  • \$\begingroup\$ Yes, it was quite simple in the end :-) Cracked \$\endgroup\$
    – r3mainer
    Commented Oct 26, 2020 at 8:21
  • \$\begingroup\$ Yeah, pretty much :-D \$\endgroup\$
    – r3mainer
    Commented Oct 26, 2020 at 8:39
1
\$\begingroup\$

C (x86-64), 100 bytes, cracked by @the-default.

This will survive until someone figures out how to run Xorshift in reverse. (So probably not very long!). Requires a key of 8 characters as a command line argument. The flag is CodeGolf followed by a line break (and nothing else before or after). Liable to crash if the key is missing or less than 8 characters in length.

main(int a,char**b){for(unsigned long *x=*++b,i=59295;i--;*x^=*x<<13,*x^=*x>>7,*x^=*x<<5);puts(*b);}

Try it online!

\$\endgroup\$
1
1
\$\begingroup\$

Ruby, 39 bytes, cracked by @EricDuminil

p eval($<.read.tr'Scfpvy.:?\'"%<`(',$/)

Try it online!

Here's hoping I've managed to close the backdoor that @Sisyphus exposed in the previous version. As before, input is via STDIN and the flag is """\n (with \n representing a trailing newline) printed to STDOUT. Nothing is printed to STDERR.


My password: Try it online! Same idea as the crack but somewhat different implementation.

\$\endgroup\$
2
  • \$\begingroup\$ cracked. Not sure if it was the intended solution. \$\endgroup\$ Commented Oct 26, 2020 at 21:52
  • 1
    \$\begingroup\$ Very interesting. I spent about 2h in order to find a solution which was very close to yours. I didn't like the fact that the methods' ID were hardcoded, and would only work on TIO and not on my computer. So I spent another 2h, trying to find a reliable way to access the methods. Congrats for the interesting challenge BTW: it was, to me at least, just the right balance between frustrating and fun. \$\endgroup\$ Commented Oct 27, 2020 at 10:46
1
\$\begingroup\$

R, 67 bytes, cracked by pppery

function(x) with(x, is.finite(a) && !is.finite(b) && is.nan(a + b))

Try it online!

The flag is TRUE. That is, find x such that f(x) is TRUE.

\$\endgroup\$
1
1
\$\begingroup\$

Japt, 6 bytes, safe

OvUc^H

The flag is the array [-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14]. I recommend setting the language flag -Q to see the output correctly, this is included in the below link as well.

Beware that the above snippet may result in an endless loop for certain specific inputs, but this is not the case for most inputs.

Try it out here.

Solution:

The program takes the input, XORs its charcodes with 32 and then evaluates the result as Japt. More or less any valid program that outputs the range will work once the program string is XORed beforehand. One such answer might be "gçé", but interestingly also "fOOBAR".

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.