Inspired by this challenge, which got closed. This is meant to be an easier, but no less interesting version of that.

This is the cops thread of a challenge. For the robbers thread, see here.

Cops will provide a program/function and a flag. Robbers will try to guess a password such that, when the password is given to the cop's program, the flag is outputted.

# Basic rules

• The language used should be provided.
• The flag, which can be an integer, string, or value of any other type, should be provided.
• The flag may be printed to STDOUT, returned from a function, or outputted using any of the other standard output methods, as long as you specify how it will be outputted.
• The program/function can take the password through STDIN, as a function argument, or using any of the other standard input methods, as long as you specify how the it will be inputted.
• A free online compiler/interpreter should also be linked, preferably with the cop's code already pasted in and ready to run.

# Some more rules

• There must be at least one valid password that causes your program to return the flag, and you should know at least one of those passwords when posting your answer.
• In case of a function submission, the cop should also include a full runnable program including the function either in the answer or in the linked online compiler/interpreter.
• If it is at all ambiguous what the type of the flag is, it must be specified.
• If a cop's description of the output is ambiguous (e.g. "HashSet(2, 1) should be printed"), robbers are allowed take advantage of that (e.g. print the string "HashSet(2, 1)" instead of an actual hashset)
• Forcing robbers to simply brute force the password is not allowed.
• The program must take input, and must output the flag when given the correct password. When not given the correct password, you are free to error, output something else, or immediately terminate. If your program never halts if given the wrong password, you must tell robbers of this behavior so no one waits around for the program to output something.

Cops's score will be the number of bytes their code takes up.

Cop answers will be safe if they haven't been cracked for two weeks.

Cop:

# Scala, 4 bytes

x=>x


Flag: Yay, you cracked it! (an object of type String is returned from the lambda above) Try it online!

Robber:

Password: the string "Yay, you cracked it!" Try it online!

# Find Uncracked Cops

<script>site='meta.codegolf';postID=5686;isAnswer=false;QUESTION_ID=213962;</script><script src='https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js'></script><script>jQuery(function(){var u='https://api.stackexchange.com/2.2/';if(isAnswer)u+='answers/'+postID+'?order=asc&sort=creation&site='+site+'&filter=!GeEyUcJFJeRCD';else u+='questions/'+postID+'?order=asc&sort=creation&site='+site+'&filter=!GeEyUcJFJO6t)';jQuery.get(u,function(b){function d(s){return jQuery('<textarea>').html(s).text()};function r(l){return new RegExp('<pre class="snippet-code-'+l+'\\b[^>]*><code>([\\s\\S]*?)</code></pre>')};b=b.items[0].body;var j=r('js').exec(b),c=r('css').exec(b),h=r('html').exec(b);if(c!==null)jQuery('head').append(jQuery('<style>').text(d(c[1])));if (h!==null)jQuery('body').append(d(h[1]));if(j!==null)jQuery('body').append(jQuery('<script>').text(d(j[1])))})})</script>

• This is already explicitly mentioned in the challenge, but here is the meta post from Loopholes that are forbidden by default about using cryptographic functions in CnR challenges. Oct 22, 2020 at 17:56
• May we specify multiple output formats at once; that is, specify that STDOUT must be a and STDERR must be b? Oct 22, 2020 at 18:23
• @SunnyMoon Sure, you can tell robbers that the password is a multiple of 34. Whether it's wise to leave robbers that clue, I don't know :)
– user
Oct 22, 2020 at 20:36
• What is your definition of cryptographic functions? Oct 24, 2020 at 12:08
• This challenge seems to amount to just do cryptography without using cryptography. Oct 25, 2020 at 12:09

# Python 3, 70 bytes, cracked by @ovs

c=compile(c:=open(0,"rb").read(),"","exec").replace(co_code=c)
exec(c)

Attempt This Online!

Works in CPython 3.9.6. Takes input from STDIN and should output 42 with a trailing newline to STDOUT.

The challenge was to create something of a polyglot between Python source code and CPython bytecode. The Python source would be compiled (so it needed to be syntactically valid), and then have its bytecode replaced with itself, keeping constants and names.

My solution was:

d,F,d,S,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,44,43,42


Disassembly:

Bytes  Instruction      Argument  Meaning
d,     LOAD_CONST             44  stored integer 42
F,     PRINT_EXPR             44  ignored
d,     LOAD_CONST             44  stored integer 42
S,     RETURN_VALUE           44  ignored
...    [garbage...]


The list of numbers is just to get the Python compiler to store enough constants for , (decimal codepoint 44) to be a valid argument in order to index into the tuple and load 42.

By the way, PRINT_EXPR is an opcode used solely by the Python shell to print the return value of an expression. It's never used in normal code, but it's very useful for hacking around in bytecode-land.

• cracked
– ovs
Jul 16, 2021 at 11:48

# Python 3, 67 bytes, cracked by @rak1507and @ovs

def f():
except:0
return lambda:["wow"]

Attempt This Online!

Works in CPython 3.9.6. Input via stdin, and outputs by returning a function that returns a singleton list. Your crack should change the output to the string hah (also in a singleton list, in a function, as the return value).

Addendum: I keep trying to write answers to It almost works, but I keep finding unintended workarounds and having to post them here where I can set stricter rules.

@rak1507 and @ovs both cracked this, presumably separately, using ctypes to directly mutate the strings. Here's my intended solution:

import sys
def t(_, m, v):
import sys
if m == "return": v[0] = "hah"
return sys.t
sys.t = t
sys.settrace(t)


If it weren't for some complicated problems (see below), I could have this answer which is a bit easier to read:

import sys
def t(_, m, v):
if m == "return": v[0] = "hah"
return t
sys.settrace(t)


sys.settrace enables tracing for the interpreter, which means many operations trigger the calling of the given trace function (here that's t), a feature intended for implementing Python debuggers.

One of the operations that triggers a trace is just before the return of a function; the third argument is the returned object. In this case the returned object is a list which we can mutate, so when the second argument ("event type" is "return"), I set its first element to hah. (The first argument is the stack frame object, which is unused here).

My answer had to return a function that returns the value because tracing is not enabled until a new stack frame is entered (another function being called).

The trace function should return a new trace function (normally itself), or None to disable tracing. My trace function needs to return itself here, but because the code is run by exec, by the time the trace function is executed, it's lost a reference to its global scope and t is no longer defined. For this reason we need to store it somewhere else that won't be garbage collected. Here I chose to set it as an attribute on the sys module because it's convenient.

• This is so much simpler than the other one, yet so much more confusing... Jul 17, 2021 at 7:23
• cracked, but I assume you had something a bit more involved in mind?
– ovs
Jul 17, 2021 at 8:25
• It was rak1507, not me Jul 17, 2021 at 9:09
• @Ausername oops I'm stupid lol Jul 17, 2021 at 9:11
• cracked? Jul 18, 2021 at 3:01

# Python 3, 166 bytes, cracked by @ovs

def f(s,a):1/(not{*"_.}"}&{*s});c=compile(s,"","exec");x=bytearray(c.co_code);[0for i in a for x[i]in[9]];return eval(c.replace(co_code=bytes(x)),{"__builtins__":{}})

Attempt This Online!

Works on CPython 3.9.6. Accepts two inputs: a string s and a list of integers a. Should return the dictionary {"a": "b"} (not a string that looks like that dictionary!).

• cracked
– ovs
Aug 7, 2021 at 10:14

# JavaScript (SpiderMonkey), 66 bytes, cracked by @user

if (readline() === ([0][1]+"").slice(4,8)) console.log('cracked!')


Try it online!

The flag is the string cracked!

• Cracked
– user
Oct 23, 2020 at 18:31

# Python 3, 42 bytes, cracked by pppery

Just a single line of Python.

eval(input(),{'__builtins__':{}})(**{0:0})


Try it online!

The password is inputted via STDIN, the flag is (nothing) and should be printed to STDERR. That means no output to STDERR.

• Cracked Oct 24, 2020 at 16:38
• @pppery Thats not how I intended it ;)
– ovs
Oct 24, 2020 at 16:44

# Python 3, 73 bytes, cracked by pxeger

Hopefully this time there are no loopholes.

s=input()
assert not{*s}&{*'()[]{}'}
eval(s,{'__builtins__':{}})(**{0:0})


Try it online!

Just as before, the password is inputted via STDIN, the flag is (nothing) and should be printed to STDERR. That means no output to STDERR.

# R, 143 bytes, cracked by Giuseppe

function(x, y, z){
if(length(ls(1)) > 1 | length(ls()) != 3) return("S")
LETTERS[lengths(lapply(y, intToUtf8(x), z)) * lengths(lapply(y, intToUtf8(x+32), z))]
}


Try it online!

Once again, the value to output is the string "R". The line with length(ls()) is there to try to close some loopholes; in any case, you need to find objects x, y and z such that f(x, y, z) == "R" is TRUE.

Giuseppe found a nice solution using the functions ^ and ~. The solution I had in mind was f(67, list(as.factor(1:3)), 4:6): Try it online! (any vectors of length 3 would work). The trick is that the functions c and C both exist (with the second being much less known). Calling c(1:3, 4:6) returns the length 6 integer vector 1 2 3 4 5 6; calling C(as.factor(1:3), 4:6) returns a length 3 factor 1 2 3 (with contrasts 4 5 6). The product of the lengths is thus 18, which is the position of R in the alphabet.

• cracked! I went down a real rabbit hole with C and D, but figured it out in the end! Oct 27, 2020 at 14:59
• @Giuseppe Well done! I actually had a different solution in mind, with c and C. Oct 27, 2020 at 15:52

# BrainF***, 22 bytes, Cracked by Cinaski

+++++[>,[--->+<]>.<<-]


Try it online!

The flag is wEe0H with nothing else. This shouldn't be too hard.

• I made sure the flag would allow for a valid password Feb 12, 2021 at 1:08
• Wait i'm unsure did you forget to remove the password from the try it online link? Feb 12, 2021 at 7:50
• Maybe? I didn't look into that. Feb 12, 2021 at 15:03
• cracked Feb 12, 2021 at 16:09
– user
Feb 12, 2021 at 16:44

# Racket, 202 bytes, Safe

#lang racket

(define (h z)
(when (procedure? z) (error "you lose"))
(define a (λ (x) (not x)))
((λ (f) (call/cc (λ (k) (k (or (a z) (set! a ((eval f) k))))))) z)
(and z (print (a "hello"))))


The flag is hello. The password (in the form of a quote-string) is passed as the argument to the h function.

Try it online!

# Python 3.8, 322 bytes, safe

from ast import*
a=input()
b=walk(parse(a,"","eval"))
c=Constant
n=Name
if not {z.__class__ for z in b}-{Load,Call,Expression,c,n}:
for x in b:
if (i:=instanceof)(x,c):
if not i(x.value, str):
break
if i(x,n):
if x.id=="getattr":
break
else:
print(eval(a,{"__builtins__":{},"getattr":getattr})==eval)


Could probably be golfed more, but I'm trying to avoid accidentally leaking anything :P

Output is True followed by a newline

Solution:

The program only runs programs that load names or constants and call functions. It also runs the input with only the global function getattr (which is essentially a function implementation of the ., so a.b == getattr(a,"b"), so our goal is to get to eval with only these pieces. The solution that I came up with was by building up from an expression that I came up with that could become eval using the classes that Python loads at runtime, and then slowly using pythons magic dunder methods to try to "simplify" down language features that I can't use to get to getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr,"__class__"),"mro")(),"__getitem__")(1),"__subclasses__")(),"__getitem__")(getattr(getattr(getattr(getattr(getattr(getattr(getattr(getattr,"__class__"),"mro")(),"__getitem__")(1),"__subclasses__")(),"__repr__")(),"split")(","),"index")(" <class 'codecs.Codec'>")),"decode"),"__globals__"),"__getitem__")("__builtins__"),"__getitem__")("eval")

Try it online!

• instanceof isn't a thing in Python. Did you mean isinstance? May 29, 2021 at 9:38
• @pxeger I had actually meant to use isinstance, but I didn't realize until way too late to change it, and it would've changed the restrictions which would be unfair. Jun 1, 2021 at 8:15

# JavaScript (V8), 113 bytes, cracked by tsh

f=n=>n!=42?${n} is a number:${n} is the answer to the ultimate question of life, the universe, and everything


Try it online!

f needs to return 42 is a number.

Probably an easy one, but it's worth a shot.

# Python 3, 958 bytes, safe

x=[(9,23),(10,24),(10,25),(11,23),(11,24)]
def f(g):
h=g.copy()
for move in range(30):
n=[]
for i in range(12):
n.append([])
for j in range(36):
c=0
for (a,b)in[(-1,-1),(-1,0),(-1,1),(0,-1),(0,1),(1,-1),(1,0),(1,1)]:
if i+a>=0 and i+a<12 and j+b>=0 and j+b<36:
c+=h[i+a][j+b]
if h[i][j]==0 and c==3:
n[i].append(1)
elif h[i][j]==0:
n[i].append(0)
elif h[i][j]==1 and c!=2 and c!=3:
n[i].append(0)
elif h[i][j]==1:
n[i].append(1)
h=n.copy()
for i in range(12):
for j in range(36):
if g[i][j]!=h[i][j]:
if not((i,j)in x):
print('N')
for (i,j)in x:
if g[i][j]==h[i][j]:
print('N')
print('Y')


Try it online! Flag: Y. The password is taken through input to f, so to run the code just edit the last line f([]).

Solution:

The code simply runs Conway's game of life on a finite grid, and tests whether the result after 30 ticks is the original grid with a particular set of 5 cells toggled. The solution is:

Gosper's glider gun. [[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1], [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]] Try it online!

• There's no need to post the solution right now, you can do that after your answer is cracked or it's safe
– user
Feb 19, 2021 at 18:37
• Welcome to Code Golf! Nice first answer. Feb 19, 2021 at 19:01

# Python 3, 57 bytes, cracked by @the default.

class D(dict):__getitem__=0
exec("".join(open(0)),D())

Attempt This Online!

Works under CPython 3.9.6. Takes input from STDIN and should output uslcgtutmuexbwb with a trailing newline to STDOUT.

Hint: that string is completely random - it has no hidden meaning.

The crack was not my intended one; here's an answer with it fixed!

• Cracked Jul 15, 2021 at 12:13

# Python 3, 70 bytes, cracked by @the default.

class D(dict):__getitem__=0
if"."not in s:exec(s,D())

Attempt This Online!

Works under CPython 3.9.6. Takes input from STDIN and should output ryjtufbohqszxgg with a trailing newline to STDOUT.

Hint: that string is pseudo-random with no hidden meaning.

@thedefault's crack was the same basic idea as mine, but it can be reduced to:

class c:
from builtins import print
print("ryjtufbohqszxgg")


As @thedefault says:

Our code is being executed in an environment where trying to access any global variable (including built-in functions) throws an error.

The way around this is to use local variables, using an immediately invoked function, or more simply here, an empty class.

However, import still functions correctly

This is because, when importing modules using the magic function __import__, the interpreter (bizarrely) doesn't dispatch to an overridden __getitem__ method on the __builtins__ namespace, but just uses normal built-in dict lookup semantics on the object. This is apparently not a bug, but an entirely implementation-defined quirk.

In fact, if you were a particularly good internet sleuth, you might have found this issue which I posted to the Python bug tracker yesterday about this very behaviour.

• Cracked Jul 15, 2021 at 14:26

# Pxem (lazypxem.posixism.tio.sh (8e9ac7ceb2)), filename only: 109 bytes, safe safe.

Sorry for misreading the rules; I misread I would safe if nobody cracked mine for one week; I had to wait for two weeks to be safe.

Some are escaped:

\002.r.w.i._._.-.-\240.z.d.aY.o.d.a\002.r.w.i.i.i.i.s.s.s.s._.i.!Q##.!.-.+.w.d.aY.o.d.a.w.+.i.c\001.+.a.+\377\377].+.+.z.d.aY.o

• Flag: Y, without trailing LF.
• Input from stdin, as a string consists of ASCII printables except space: 33 (!) to 126 (~).
• Output to stdout.

Try it online!

## Hint (posted after 5 days and 2 hours later, I think)

• This program uses a bug of my interpreter.

z317-35bP

# Python 3.8 (pre-release), 163 bytes, safe.

My output is KDIITIWDRIKIDITI

import random
f=open(1,'w')
random.seed(0)
r=[random.randint(0,255) for l in range(255)]
a=input().encode()
for b in a:
while b >26:
b=r[b]
f.write(chr(b+64))



Try it online!

My original password is passthevoidsalts

Since this basically follows a random directed graph (not a-cyclic, I just got lucky my password doesn't crash it) until it lands within a subset of nodes, it's straight forward to create a lookup table for each letter. Originally I tried to create a reversing crack, which works, but the .encode() on the input threw me off so I ran the process forwards to build a lookup table instead.

For each line output by this crack is the list of options to generate the corresponding character in the desired output.

import random
out = 'KDIITIWDRIKIDITI'
a = [c for c in range(127) if chr(c).isalpha()]
random.seed(0)
r=[random.randint(0,255) for l in range(255)]
od={}
odd={}
for b in a:
ob = b
while b >26:
b=r[b]
ch = chr(b+64)
od[ch] = ob
if ch in odd:
odd[ch].append(ob)
else:
odd[ch] = [ob]
for c in out:
print(''.join(chr(x) for x in odd[c]))


Try it online!

dpw
JKMPVWXacjqrvx
ABCDEFHLNRSTZbfhilmnsyz
ABCDEFHLNRSTZbfhilmnsyz
t
ABCDEFHLNRSTZbfhilmnsyz
e
JKMPVWXacjqrvx
o
ABCDEFHLNRSTZbfhilmnsyz
dpw
ABCDEFHLNRSTZbfhilmnsyz
JKMPVWXacjqrvx
ABCDEFHLNRSTZbfhilmnsyz
t
ABCDEFHLNRSTZbfhilmnsyz



# Python, 141 bytes, cracked by okie

from keyword import*
x=input()
if~-iskeyword(x)and x.isidentifier():
exec(x,d:={"__builtins__":{}})
try:exec(f"del {x}",d)
except:print(1)

Attempt This Online!

This is quite a long setup for what is perhaps a simple trick. Works in CPython 3.9.7. Given the correct input, it should print 1 (with a newline, to STDOUT).

• cracked
– okie
Sep 13, 2021 at 5:18

# Python, 54 bytes, cracked by m90

lambda x,y:x.isidentifier()and exec(f"{x}(1),1/0;{y}")

Attempt This Online!

Works in CPython 3.9.7. Accepts two strings as passwords. The flag is None, which should be returned from the function.

m90 got my intended solution. y was just a red herring

• – m90
Oct 3, 2021 at 15:23

# ayr, 41 bytes

Not the most creative, but it makes use of some weird + unique behavior I discovered or wanted to use while thinking of something. I'm not sure if there are multiple flags that will work for this one, which was the case for my previous Arn problem.

%/=:"101&~:&:;:,/.;.'/ /%'#.,./&.#&:=I


The desired flag is 4.368051189167166e_9. This is a full program, so don't run it from the cli.

There is currently no online interpreter, but I'm going to set one up within the next couple of days, as the language is written entirely in JS. As it stands you can npm i -g ayr-lang and use ayr <file of program> [flag].

# JavaScript (Node.js), 209 bytes, Cracked by m90

p=v=>{try{a=[];(f=c=>c?f(c/6n|0n,a.push('![]()+'[c%6n])):0n)(h=BigInt(JSON.stringify(v).replace(/\D/g,'')));try{v=eval(a.join)}catch(e){return false};if(h<1n<<10000n)throw'x'}catch(e){return v[0]===Math.PI}}


Try it online!

Confused? Good.

Takes a JS value as input, flag is true returned from the function.

This basically resolved down to two separate problems - either expressing Math.PI in ~3600 bytes (10k bits) of Jsfuck which I wasn't sure was possible - My best attempt was around 4000 bytes; or making JSON.stringify error.

I intended to use a cyclic object reference - Try it online!, but m90's idea of a BigInt also works, and probably several other things.

• Cracked.
– m90
Nov 23, 2021 at 7:02

# JavaScript, 81 bytes, cracked by ovs

Let's try this again...

alert("xx".split(new RegExp(p=prompt())).reduce((a,b)=>a+b,"").length>2+p.length)


The flag is true.

https://xkcd.com/2217/

• – ovs
Dec 7, 2021 at 12:48

# JavaScript, 13 bytes, cracked by m90

x=>x in x&&!x


The password must be passed in to the function, and the flag, true, must be returned from the function.

You can try solutions out in the (non-normative) snippet below:

console.log((x=>x in x&&!x)(eval(prompt())))

• Is a solution allowed to modify stuff before the function executes?
– m90
Dec 14, 2021 at 11:33
• @m90 Yes [padding] Dec 14, 2021 at 17:06
• Cracked.
– m90
Dec 15, 2021 at 8:13

# Python, 57 bytes, cracked by PyGamer0

exec(input(),{"__builtins__":{"if":__import__(input())}})

Attempt This Online!

Works in CPython 3.10. Inputs via STDIN, and should print Hello world! with a trailing newline to standard output.

Unintended crack, so let's have another go.

• cracked! Jan 1 at 9:51

# Python, 62 bytes, cracked by @dingledooper and later @M Virts

exec(input(),{"__builtins__":{"if":dir(__import__(input()))}})

Attempt This Online!

Let's try again. Inputs via STDIN, output should be Hello world! printed to STDOUT with a trailing newline. Works in CPython 3.10.

dingledooper got my intended solution.

As for M Virts': dammit, I always forget Python can do that kind of stuff!

• Cracked? Jan 1 at 21:39
• Cracked?? for some reason I just assumed the string was different from the import-only approach, Jan 3 at 21:20

# JavaScript (SpiderMonkey), 52 bytes, Cracked by r3mainer

i=>(a=+i,a<a/a?a/a<-a?1/a<a:a*a>1:1<a*a?a*a<a:1/a<a)


Try it online!

Expect output is true.

Input via parameter, output via return value. Global values should not be configured before the function execute. (For example, Object.defineProperty(globalThis, 'a', { get() { return ...; }, set() { return true; } }) is not valid.)

This one could be quite easy. I expected it will be cracked in 30 min...

• Yes, it was quite simple in the end :-) Cracked Oct 26, 2020 at 8:21
• Yeah, pretty much :-D Oct 26, 2020 at 8:39

# C (x86-64), 100 bytes, cracked by @the-default.

This will survive until someone figures out how to run Xorshift in reverse. (So probably not very long!). Requires a key of 8 characters as a command line argument. The flag is CodeGolf followed by a line break (and nothing else before or after). Liable to crash if the key is missing or less than 8 characters in length.

main(int a,char**b){for(unsigned long *x=*++b,i=59295;i--;*x^=*x<<13,*x^=*x>>7,*x^=*x<<5);puts(*b);}


Try it online!

• Cracked Oct 25, 2020 at 16:57

# Ruby, 39 bytes, cracked by @EricDuminil

p eval($<.read.tr'Scfpvy.:?\'"%<(',$/)


Try it online!

Here's hoping I've managed to close the backdoor that @Sisyphus exposed in the previous version. As before, input is via STDIN and the flag is """\n (with \n representing a trailing newline) printed to STDOUT. Nothing is printed to STDERR.

My password: Try it online! Same idea as the crack but somewhat different implementation.

• cracked. Not sure if it was the intended solution. Oct 26, 2020 at 21:52
• Very interesting. I spent about 2h in order to find a solution which was very close to yours. I didn't like the fact that the methods' ID were hardcoded, and would only work on TIO and not on my computer. So I spent another 2h, trying to find a reliable way to access the methods. Congrats for the interesting challenge BTW: it was, to me at least, just the right balance between frustrating and fun. Oct 27, 2020 at 10:46

# R, 67 bytes, cracked by pppery

function(x) with(x, is.finite(a) && !is.finite(b) && is.nan(a + b))


Try it online!

The flag is TRUE. That is, find x such that f(x) is TRUE.

• Cracked Oct 28, 2020 at 15:36

# Japt, 6 bytes, safe

OvUc^H


The flag is the array [-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14]. I recommend setting the language flag -Q to see the output correctly, this is included in the below link as well.

Beware that the above snippet may result in an endless loop for certain specific inputs, but this is not the case for most inputs.

Solution:

The program takes the input, XORs its charcodes with 32 and then evaluates the result as Japt. More or less any valid program that outputs the range will work once the program string is XORed beforehand. One such answer might be "gçé", but interestingly also "fOOBAR".

# Zsh + coreutils, 213 bytes, safe

n=$(shuf -n1 -i0-9999999);out=$( (eval "$(tr -dc '\t\n -/:-@[-{-~')") );s=$((n**.5));i=1;p=Yes;while [[ "$i" -le "$s" ]];do;i=$((i+1));if [[$((n%i)) -eq 0 ]];then;p=No;break;fi;done;[[ "$p" = "$out" ]]&&echo Win


Must be run as root on a typical modern Linux system. (so no TIO link). Telling you why would spoil the challenge.

Flag is Win` with a trailing newline, printed to stdout.

I no longer have my exact intended solution, but you can use this technique or similar to achieve arbitrary code execution without alphanumerics.

• Does the password have to work consistently? Nov 8, 2020 at 16:12
• @thedefault. yes Nov 8, 2020 at 16:15
• Cracked but too late
– user100411
Jun 12, 2021 at 9:34