Inspired by this challenge, which got closed. This is meant to be an easier, but no less interesting version of that.

This is the robbers thread of a challenge. For the cops thread, see here.

Cops will provide a program/function and a flag. Robbers will guess a password. When the password is given to the cop's program, the flag should be outputted.

## Robber rules

• When the cop's program is given the password you guess, it should output the flag.
• You are allowed to take advantage of ambiguous descriptions of the flag by cops.

Cop answers will be safe if they haven't been cracked for two weeks.

Cop:

## Scala, 4 bytes

x=>x

Flag: Yay, you cracked it! (an object of type String is returned from the lambda above)

Try it online!

Robber:

Password: the string "Yay, you cracked it!"

Try it online!

• Chat for robbers to discuss answers. – user Oct 22 '20 at 18:40

# Sisyphus, PHP

A string golf with 1,000,000 leading whitespaces and 1,000,000 trailing whitespaces

Output: golf

Reason: 1,000,000 is the default backtracking limit of PCRE (which you can get by var_dump(ini_get('pcre.backtrack_limit'));). And preg_match will return FALSE other than 0 or 1 when this limit is breaked.

Try it online!

• Impressive first post! Welcome to the site. – Redwolf Programs Oct 23 '20 at 15:17
• @RedwolfPrograms Thank you! – Benkerd22 Oct 23 '20 at 15:20
• Very nice! I've always found it amusing that PHP gives up and returns false when it reaches the backtrack limit rather than throw an exception. – Sisyphus Oct 23 '20 at 21:49

# ovs, Python 2

class m:0
m.__init__ = hex.__init__
n = 49374
m.__str__ = n.__hex__
class a: __metaclass__ = m

Output: 0xc0de

Try it online!

• Very nice first answer! I had this which is basically the same. – ovs Oct 23 '20 at 10:26
• Really cool problem. Keeping this idea in the back pocket for the next time I need to break out of a Python jail. – Christian Mann Oct 23 '20 at 10:30

# R, Robin Ryder

It was roman numerals!

Try it online!

• Welcome to the site and nice first answer! – caird coinheringaahing Oct 26 '20 at 16:42
• Congratulations! – Robin Ryder Oct 26 '20 at 16:43
• Very well done! I've been struggling in vain with this for ages... – Dominic van Essen Oct 26 '20 at 16:56
• Ahahahahahahahahah. – Eric Duminil Oct 27 '20 at 14:44
• Oh, that's clever! Well done finding it, and very nice challenge as well @RobinRyder. :) – Kevin Cruijssen Oct 28 '20 at 16:09

Lynn created a stack based mini-language, the task was to generate the primes up to 500 in 60 or less operation. Here is my 55-operation password:

[0,0,2,1,4,1,0,2,1,1,4,4,4,30,0,2,0,2,0,20,10,0,3,10,2,0,3,1,0,10,3,6,6,6,6,5,4,7,5,0,7,3,10,2,0,3,20,2,1,0,3,0,3,30,2]

Try it online!

The available operations are

0   push 1
1   duplicate top of stack
3   subtract
4   multiply
5   integer divide top value by second value
6   push the second value without popping it
7   swap top two values
c>7 while loop, runs until top of stack is 0
the loops ends at the first instruction >=c

0,0,2,1,4,1,0,2,1,1,4,4,4 pushes the initial number 500. The remainder of the code is best explained inside out:

6,6,6,6,5,4,7,5 is a divisibility test. Given k and n as the top two values on the stack this calculates $$\\lfloor {\lfloor {n \over k} \rfloor \cdot k \over n}\rfloor$/extract_tex], which is only 1 if k divides n: Try it online! 1,0,10,3,div test,0,7,3,10,2,0,3 is a primality test, or a composite test since this returns truthy (non-zero) values for composite numbers: 1 -- duplicate n 0 -- push 1 - stack: [1, k=n, n] -- in the next iterations of the loop, -- the top of stack will be the inverted result -- of the divisibility test 10 10 -- while loop: -- runs until [0, d, n] is on the stack, -- where d is the largest divisor of n <n 3 -- subtract top value (always 1) from k div -- the divisibility test 0 -- push 1 7 -- swap top two values 3 -- subtract (1 - div test result) 2 -- add the top 0 to the last k 0,3 -- subtract 1 -- if the loop ended with [0, 1, n], this is now 0 -- otherwise we have a positive number Try it online! 0,20,10,0,3,10,2,0,3,comp. test,20,2,1 generates the next prime less than n: 0 -- push 1. This means the current number is composite -- Even if it isn't, we still want to find a prime <n 20 -- while loop. This iterates until the composite tests returns 0 10 10 -- we have an positive number on the top of the stack ... 0 3 -- by subtracting 1 until it is 0, ... 2 -- and adding this to the last prime candidate ... -- we can get rid of it. 0 3 -- subtract 1 to get new prime candidate pc comp -- check if pc is composite 20 -- end of loop, top of stack is now [0, p], with p prime 2 -- add 0+p 1 -- duplicate the prime, such that we store the result, -- and can use the value to find the next prime Try it online! 30,0,2,0,2,next prime,0,3,0,3,30,2 repeats this until the prime 2 is found: 30 30 -- while loop 0 2 -- add 1 0 2 -- add 1 np -- find the prime less than this 0 3 -- subtract 1 0 3 -- subtract 1 -- if the prime was 2, this is now 0 -- and the while loop terminates 2 -- add the 0 to the 2 to remove it Try it online! • Looking forward to future answers with "Lynn's stack based mini language from the crack my password thread" – Razetime Oct 24 '20 at 8:28 • Good job! I hope you had fun cracking this (I aimed for that much more than I aimed to write something uncrackable). – Lynn Oct 24 '20 at 12:31 • @Lynn It definitely was a fun program to write. Working with a stack, especially with this limited number of operations, is an interesting challenge. – ovs Oct 24 '20 at 13:10 # R, Robin Ryder 5.099829245500619335478113833945732102551318887107339446461762721i Try it online! • I think 5.1i would work just fine... – Giuseppe Oct 23 '20 at 2:27 • You're right. Wasn't sure how precise it needed to be, and Robbers' answers aren't graded by size. – pppery Oct 23 '20 at 2:43 • Yes, intToUtf8 will not only discard the imaginary part of a complex argument, it will also round down the real part, which is why 5.1i works. – Robin Ryder Oct 23 '20 at 6:12 # Sisyphus, Jelly Password: [1.1071487177940904,1.1071487177940904,1.1071487177940904,1.1071487177940904,1.1071487177940904,1.1071487177940904,1.1071487177940904,0.897846510365972] Try it online! The code OÆTP, when taken literally, means product(math.tan(ord(c)) for c in input). But the ord function in Jelly does nothing for numbers, so we can ignore that. Now the problem is to generate that very specific number. I figured that as product is likely to have precision loss, I'd use 2's as multiplicands. The number 1.1071487177940904 is equal to arctan(2), and I use seven copies of it to reduce the problem to arctan(x) where x<2 so that I have better chance at getting that exact result. Finally I computed arctan(answer/128) and put it as the last term of the input array, and it worked perfectly. • Very nice. Of course, I did not intend this to be cracked =) My solution was BVp6o0|zXBrJ?w<C/gv(jZz36wdQr*M@R^7jqovD_O05!~:G – Sisyphus Oct 23 '20 at 6:25 • @Sisyphus Yeah, I quickly figured it would be basically impossible using string input. Blame Jelly for the sidestep :P – Bubbler Oct 23 '20 at 6:27 • Actually, it seems you can make Jelly print anything by doing print(160.58880817718872),__import__('sys').stdout.flush(),__import__('os')._exit(0). So Jelly is useless for this C&R. – Sisyphus Oct 23 '20 at 6:34 # att, Wolfram Language (Mathematica) Password: flag /: Head[flag] = flag Try it online! . We can adapt this kind of solution to work with any Mathematica program: a /: _[a] = flag; a With this argument, any function returns flag. • Nice. UpSet is a bit shorter, but of course TagSet works perfectly well. – att Oct 23 '20 at 17:40 # Sisyphus, Python3 All you need to do is keep the processor busy for more than 9 seconds. Any regex that requires lots of backtracking will gum up the parser. The only real difficulty is not slowing it up so much that Tio runs over its 60-second limit. 'b(.*.*.*)*z|baaaaaaay' Try it online here. # JavaScript (SpiderMonkey), tsh Password hexdump: 61 61 61 00 (3 a followed by a null byte). Try it online! • – tsh Oct 23 '20 at 7:17 # Eric Duminil, Ruby My password is 14127792144400463565475544498208881214759697720904563865426051592050217695592754443713601541725640031x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000123456789 According to the Ruby documentation, to_i discards everything after the first integer it finds. Try it online! Alternative solution: 9164214512877268290754278122624834497733309914632715416260853069873976599113800182718102190123456789 I factored the semiprime with cado-nfs. Try it online! • That's interesting. As far as I can tell, the two large factors I used were primes, at least according to sympy. Do you have an example of the found factors? Did you check their product? Well done, by the way. That was the intended solution. I blame the documentation. – Eric Duminil Oct 25 '20 at 6:39 • @EricDuminil Indeed, it seems like I did something wrong (the most likely explanation is that I accidentally removed a digit from the middle when copying the base36-decoded result from Mathematica and removing the line break it inserted) – the default. Oct 25 '20 at 7:03 • @EricDuminil A better program could still factor the number (in around 865 seconds). – the default. Oct 25 '20 at 7:24 • Wow. Colored me impressed. I had no idea how to estimate the time it would take to factor the semiprime, and I didn't want the target to look suspiciously long. Do you know how the required time scales? How many more bits would be required for the factorization to be 3000 times longer (~1 month)? Even then, I guess that throwing more CPUs at the problem could bring the required time to a few days. It wasn't a bruteforce question anyway. Again : congrats. – Eric Duminil Oct 25 '20 at 8:44 • @EricDuminil I used the Wikipedia page en.wikipedia.org/wiki/RSA_numbers to check if it's feasible to factorize the number (and it said that a 100-digit prime can be factored in 72 minutes on an old CPU). It seems that a 250-digit number is the largest one factored, and it was factored in February 2020. It also seems that it took them around 2700 core-years and they used cado-nfs. – the default. Oct 25 '20 at 9:01 # ZippyMagician, Arn Password: J0e_Biden! I'm sure this isn't the password that ZippyMagician was thinking of, but it works at least. The flag is equal to 296, and the uncompressed code starts with :*:*, which raises something to the 4th power. I'm not sure what's going on in the middle, but the last few bytes of code (:i0^:i"n) calculate the value of ab, where a and b are the indexes of the characters 0 and n in some transformed version of the input. So if the second character is 0, it's just a matter of tweaking the input until the n is in the right place. # HyperNeutrino, Python 3 Password: import sys;sys.exit() Try it online! Output: nothing I'm not sure if erroring would be OK. It would not output anything to STDOUT, only STDERR. • I should've specified, i intended no output to either STDOUT or STDERR, though I'm not sure if the challenge permits me to do that. Raising an empty SystemError would've worked too though, but this is a good solution. – HyperNeutrino Oct 22 '20 at 18:22 • also import os;os._exit() which is effectively the same thing – pxeger Oct 24 '20 at 12:39 # HyperNeutrino, Python 3 Password: raise SystemExit Try it online! Output: nothing # ThisIsAQuestion, Python 2.7 True=False The Flag Try it online! Output is The Flag. Sadly reassigning True doesn't work in Python 3 anymore. • Dammit, I was seconds away!!! – pxeger Oct 22 '20 at 19:57 # Perl 5, cracks Nahuel Fouilleul Password: "^^@@^^:@@@^"^".,).*||,!'|" Try it online! # SE - stop firing the good guys, ><> One password is 5 8a*3+o ab*1+o ab*1-o aa*1+o ab*6+o aa*4+o aa*5+o ab*o aa*3+o 48*o ab*5+o ab*1-o aa*1+o aa*8+o aa*8+o ab*5+o 48*o aa*o aa*1+o aa*8+o aa*5+o aa*1-o aa*5+o ab*1+o ab*7+o ab*5+o 95*1+o 95*1+o 95*1+o; Try it online! The program was i10p. i reads one character of input 1 and 0 push 1 and 0, and p changes the value at x=1, y=0 to the inputted character. Whit the first input the program is modified to i50p, which allows to execute arbitrary commands from input. 0-9a-f push their hexadecimal value to the stack, *+- work as expected, o outputs a value as a character and ; terminates the program. • That was quick. – Razetime Oct 23 '20 at 15:37 # SunnyMoon, !@#%^&*()_+ 1728 I read the code, and it seemed to parse decimal input, divide it by 48 (not halting if it's not divisible) and print the corresponding character 3 times. Try it online! • Exactly! Congratulations! :) – SunnyMoon Oct 23 '20 at 16:50 # Kevin Cruijssen, 05AB1E The password is 2 ,*xžIž?¶ The .E builtin seems to push the Python code back to stack when it failed. The first input is just any number for the loop. The second input is a reversed 05AB1E program to produce the correct output: ¶ # push newline character ? # print without trailing newline žI # push 2**31 žx # push 2**6 = 64 * # multiply these numbers => 2**37 = 137438953472 , # print this with trailing newline # since there was explicit output, implicit is now disabled Try it online! After some more experimenting, I found a cleaner password: 3 print() 3 Try it online! .E executed on "print()" returns None, reversed is enoN. This is then executed as 05AB1E code, which seems to return the right result. I'm not sure how though, there might some features of the legacy version used here that I don't know of. Beacuse Python was used to print the newline, the value is still implicitly outputted. • Nice, the second is indeed the intended solution (although I had print(''), hence the head to 9 - didn't realize those quotes could be removed, but makes sense). As for why this works: in the legacy version of 05AB1E the F} that loops N in the range $$0,3)\ will remember this N if it's pushed later on (in the new version it defaults to 0 outside of loops). So enoN will basically execute as those builtins: e (\\frac{a!}{(a-b)!} = \frac{3!}{(3-3)!} = 6\), n (\n^2=36\), o (\2^n=68719476736\), N (pushes the 2 from the last iteration of the loop);* (multiply). – Kevin Cruijssen Oct 23 '20 at 16:59 • Another solution I realized would also work later on was this one, but well done finding the intended solution, as well as another alternative! :) – Kevin Cruijssen Oct 23 '20 at 17:06 # Python 3.8 pre-release, pxeger ("unittest.mock",("mock","sentinel","pxeger","name"),()) Probably not the intended solution. Try it online! • Aww I knew there was gonna be some kind of bypass gadget in the standard library. Not intended but more-or-less the same idea. – pxeger Oct 24 '20 at 17:04 # Ruby, Dingus' answer system gets;exit echo '"""' Try it online! • Very creative! If you're interested, I found a pure Ruby solution (codegolf.stackexchange.com/questions/213963/…) which works for both challenges by dingus. – Eric Duminil Oct 26 '20 at 23:00 • Actually, I don't get why system gets;exit somehow breaks out of Ruby into the shell. Could you please explain? Is it specific to ruby -n? – Eric Duminil Oct 26 '20 at 23:18 • @EricDuminil Dingus' first answer only reads a single line, so only system gets;exit gets read and eval'd. The second gets call then reads the line echo '"""' and passes it into system. The exit runs after the shell has finished executing the command and terminates the ruby process to avoid the p. – Sisyphus Oct 26 '20 at 23:24 • Dingus' second answer reads all of stdin at once, so this trick does not work. – Sisyphus Oct 26 '20 at 23:25 • Thanks a lot for the explanation. I couldn't seem to understand that gets retrieves the next line. Old-school debugging helped me understand it : tio.run/… – Eric Duminil Oct 27 '20 at 13:07 # r3mainer, C I'm really sorry, but this answer on Stack Overflow has code that directly undoes elementary xorshift operations... It made running xorshift in reverse much easier (I only had to copy-paste some code and write 6 lines of Python). 07RtUrVE Try it online! • Oh bother. I actually did a quick search for reversing Xorshift on SO and GitHub and came up with nothing. Should have looked a bit harder, I guess! – r3mainer Oct 25 '20 at 17:05 # JavaScript (V8) by PkmnQ ({toString(){return this.i--;},i:43}) Try it online! JavaScript variables like: ({toString(){return this.i.shift();},i:[1,2,3,4,5]}) would be useful in many answers. ({valueOf:()=>43,toString:()=>42}) Try it online! It is strange: While, let p=({valueOf:()=>43,toString:()=>42}): ''+p results "43" but {p} results "42"... • The latter is my intended solution. – PkmnQ Oct 26 '20 at 6:58 # Conor O'Brien, Javascript ^^^Z_][_\\\\$_\$$]]]]]]]]]]]]]]]]]]]]_\\\]_\\\\\\\]_\\\\\\\\\\\\\\\\\\\\\\\\]b_\\\\\\\\\]aa

The code seems to generate a random maze (the seed is based on our input, but I don't use that) without loops. We must solve it (in at most 999 steps) with a program in a stack-based language with these 8 commands:

0, rotate stack: S.push(S.shift())
1, pop twice, compare and push difference: [a,b]=S.splice(-2);F=a==b;S.push(a-b)
2, increment register: M++
3, push register: S.push(M)
5, reset register: M=0
6, pop to register: M=S.pop();
7, set answer to ToS and halt: R=S.pop();O=[]
8, pop pop() numbers, and if the last equality comparison was true then
insert the numbers into the program: n=S.pop();n=S.splice(-n);if(F)O=n.concat(O)

The program receives its input as the lengths of the lines of sight in 4 directions, and must output one or more commands in base 4 (digits 0 and 3 are errors, 1 is "rotate left" and 2 is "move forward").

My algorithm checks if the line of sight to the left is zero; if it's zero, then it rotates right (by returning 21), otherwise it rotates left and moves forward (by returning 9). I might have confused left and right completely, though.

Our "program" is obtained from our input by concatenating all char codes in it (as decimal integers). However, nines are discarded. So I used characters with codes from 90 to 98 to access the commands.

Try it online!

• That was cracked way faster than I expected :) very nice! :D – Conor O'Brien Oct 26 '20 at 16:54

# Dingus, Ruby and Dingus, Ruby

One password for both Ruby challenges by Dingus is:

G=->*x{i=0;i+=1 while x[0][i]!~x[1];x[0][i]};Q=method G[methods,/^[o-q]ri/];C=method G[q=Q[],/[o-r]ut[b-d]/];D=method G[q,/^de/];P=G[q,/^[o-r]\z/];D[P]{|x|};C[34];C[34];C[34];C[10]
• Gets access to putc by listing all the available (private) methods and filters them with regexen.
• Also redefines p to not do anything.
• a lambda is used instead of def
• method :method_name with [] is used instead of ()
• . cannot be used, so only the methods for Object and Kernel are available
• Since putc is available, any string could be written.

FORTRAN like code:

GREP = lambda do |l,r|
i=0
while l[i]!~r do
i+=1
end
l[i]
end
PRIVATE_METHODs=method GREP[methods,/^[o-q]ri/]
PUTC=method GREP[PRIVATE_METHODs[],/[o-r]ut[b-d]/]
DEFINE_METHOD=method GREP[PRIVATE_METHODs[],/^de/]
P=GREP[PRIVATE_METHODs[],/^[o-r]\z/]
DEFINE_METHOD[P]{|x|}
PUTC[34]
PUTC[34]
PUTC[34]
PUTC[10]

Try it online!

• This is a very nice solution! – Sisyphus Oct 26 '20 at 23:02
• @Sisyphus: Thanks. That's also the most horrible Ruby one-liner I've ever written. – Eric Duminil Oct 26 '20 at 23:09
• Very nice! Same idea, different implementation. – Dingus Oct 27 '20 at 0:36

# R, Robin Ryder

function(x,y,z){if(length(ls(1))>1|length(ls())!=3)return("S");LETTERS[lengths(lapply(y,intToUtf8(x),z))*lengths(lapply(y,intToUtf8(x+32),z))]}

Try it online!

The password is pretty insecure: 94,(numeric vector of length 1),(numeric vector of length 6). In particular, 94,1,1:6 was what I used.

The first thing I did was note that the lengths have to multiply to 18, so we need to generate two lists such that the lengths are equal to 1,18,2,9,or 3,6.

Next, noting the intToUtf8(x) and intToUtf8(x+32) I found all pairs of functions that satisfy that condition with this script. I safely ruled out nrow and ncol since they would generate the same values, and the lengths must be distinct.

After that it was a matter of just trying things out; lapply always returns a list with length equal to the length of its first argument, so y had to be of length 1. Luckily, R recycles, so lapply(1,"^",1:6)==list(1^(1:6)), which has lengths equal to 6.

Finally, ~, the formula builder is very odd, x ~ y is a formula with length 3, with three elements, '~'(), x(), and y(), so lapply(1,"~",1:6 is the same as 1 ~ 1:6 which is also length 3.

• Congratulations! My solution was of the form 67, factor of length 3, vector of length 3, using the functions c and C. – Robin Ryder Oct 27 '20 at 15:59

# JavaScript (V8), cracks Scott's answer

Try it online!

Using this reverseengineering.SE answer I was able to able to decode the JSFuck back to normal JavaScript:

The password needs to be equal to ([0][1]+"").slice(2,9)), which evaluates to "defined".

• You just need to execute eval = console.log.bind(console); before the bf code. And these text will just appear on your console. – tsh Oct 26 '20 at 1:32

# ovs, Python 3

Try it online!

• Yes, this is what I had in mind. Your TIO throws an error because you have an empty command line argument. – ovs Oct 24 '20 at 17:58