Inspired by this challenge, which got closed. This is meant to be an easier, but no less interesting version of that.

This is the robbers thread of a challenge. For the cops thread, see here.

Cops will provide a program/function and a flag. Robbers will guess a password. When the password is given to the cop's program, the flag should be outputted.

## Robber rules

• When the cop's program is given the password you guess, it should output the flag.
• You are allowed to take advantage of ambiguous descriptions of the flag by cops.

Cop answers will be safe if they haven't been cracked for two weeks.

Cop:

## Scala, 4 bytes

x=>x


Flag: Yay, you cracked it! (an object of type String is returned from the lambda above)

Try it online!

Robber:

Password: the string "Yay, you cracked it!"

Try it online!

• Chat for robbers to discuss answers.
– user
Oct 22 '20 at 18:40

# Python 3 by pxeger

assert, int

Attempt This Online!

An assert statement can take two expressions; if the first expression evaluates to a true value, the second expression is not evaluated.

# Aaron, Vyxal (Not intended)

aka this solution is not correct.

.dI:⅛kF*×u⅛Ė.SṪḢ42f÷₍+*Π¾J∑Cøṙ


input:

1.2
EEEEEEEEEEEEEEEEEEEEEEEE


1.2 Make program have exception and the top of the stack is the flag.

1.2 can be any float.

Try it Online!

# JavaScript by tjjfvi

Input:

((x))


I'm not 100% why it works, but it seems that JavaScript insists that all capture groups appear in the split. Because the same string exists twice, it is captured twice. This is consistent with, e.g., input = (((x))), which lists each x three times. Furthermore, what occurs before each string seems to also be preserved:

> "Hello".split(/(He)(llo)/)
[ '', 'He', 'llo', '' ]
> "Why Hello There".split(/(He)(llo)/)
[ 'Why ', 'He', 'llo', ' There' ]


In any case, either behavior is enough to cause a discrepancy between the length we might intuitively expect (2) and the actual result.

# Cracks pxeger's python 3 answer

__builtins__['if'].stdout.write("Hello, World!\n")
sys


Attempt it Online!

#### Explanation

The code exec(s the first input, and exec('s second argument is the dictionary which contains all the variables / functions in the scope of exec(.

What I did was simply import sys and access the library using __builtins__['if'] and print to stdout.

# JavaScript (V8), cracks Scott's answer

Password: {length:"0"}

Try it online!

The password is defined.

Using this reverseengineering.SE answer I was able to able to decode the JSFuck back to normal JavaScript:

if (prompt('Password') === ([0][1]+"").slice(2,9)) alert('cracked!')

The password needs to be equal to ([0][1]+"").slice(2,9)), which evaluates to "defined".

• You just need to execute eval = console.log.bind(console); before the bf code. And these text will just appear on your console.
– tsh
Oct 26 '20 at 1:32

# ovs, Python 3

Password: "".format

Try it online!

• Yes, this is what I had in mind. Your TIO throws an error because you have an empty command line argument.
– ovs
Oct 24 '20 at 17:58

# tsh, Javascript (SpiderMonkey)

Password: -0

Output: true

# R, Paul

data.frame(a = 1, b = 0/0)


Try it online!

• Ah. Good job. I didn't mean for it to have such a straightforward answer. I'll add a new question with the hole plugged.
– Paul
Oct 28 '20 at 15:38

# Dorian, dotcomma

[49375, -1]


Of course, the cryptic response in the comments turned out to mean "no, it's not a string". I think it's a big problem with the answer if "it would become too easy" if you told me what IO format I must use.

I noticed that the code seems to ignore all the input except for the first number until it finds a negative number. Then I noticed that it subtracts something from 49375. I don't know how does the code work, though.

Try it online!

• Good job. The intended solution is only the number 49375. I had the idea to use the decimal value of 0xC0DE, but somehow messed things up and ended one number to high. I will write a detailed solution when I'm back from my vacation next Monday. Nov 2 '20 at 8:29

# Python 3, pxeger

Object-oriented programming is always the best solution.

class c:
def f():
from os import system
system('echo ryjtufbohqszxgg')
f()


Our code is being executed in an environment where trying to access any global variable (including built-in functions) throws an error. However, import still functions correctly (I don't really understand this part of Python, but I suppose it's because __import__ technically isn't being removed; it's just no longer accessible by the normal means). But just importing a necessary function is not enough: once imported, it will become a global variable, and these can't be accessed!
And the following fix doesn't work:

def f():
from os import system
system('echo ryjtufbohqszxgg')
f()


because once f is declared, it also becomes an inaccessible global variable! Fortunately, classes are executed as normal code when declared, and variables declared inside them are not global (and therefore are accessible).

Attempt This Online!

• An alternative to using a class to call the function are decorators, which have a lot less restrictions since 3.9: ATO
– ovs
Jul 15 '21 at 14:35
• Nice, although it can actually be a bit simpler than this. (see my edit on the cops answer) Jul 15 '21 at 14:42

# Python 3, pxeger

e%e#d¹F¹S
z(1,42)
A;B;C;D;E;F;G;H;I;J;K;L;M;N;O;P;Q;R;S
T;U;V;W;X;Y;Z;a;b;c;d;f;g;h;abs;j;id


¹ represents a byte with value 1

Attempt This Online!

The input first needs to pass the exec call. This checks the syntax and creates tables of constants and names:

co_consts = (1, 42, None)
co_names = ('e', 'z', 'A', ..., 'id')


Then all the bytecode is replaced with our input, the relevant part is the first line:

e%   101 37   LOAD_NAME   37 (=id)
e#   101 35   LOAD_NAME   35 (=abs)
d¹   100  1   LOAD_CONST   1 (=42)
F¹    70  1   PRINT_EXPR   1 (argument is ignored)
S     83      RETURN_VALUE   (exits the execution)


dAdAFFS(71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42)


Attempt This Online!

The first 8 bytes are actually executed:

dA   100 65   LOAD_CONST  65 (=42)
dA   100 65   LOAD_CONST  65 (=42)
FF    70 70   PRINT_EXPR  70 (argument is ignored)
S(    83 40   RETURN_VALUE   (returns 42 and exits the execution)

• A bit different from my solution, but great work! Jul 16 '21 at 11:51
• Actually, the sequence F¹ is interpreted as PRINT_EXPR with the 0x01 byte being its (ignored) argument, not as PRINT_EXPR then POP, because all bytecode comes in (opcode, arg) pairs since Python 3.6, and RETURN_VALUE is actually returning the abs builtin. The RETURN_VALUE also interprets the newline byte following it as its argument. Jul 16 '21 at 12:10
• @pxeger I see, that knowledge would have helped me a lot while creating this answer, it was a lot of trial and error ;). Is the second part closer to what you had? I assume this can be done quite a bit shorter
– ovs
Jul 16 '21 at 12:19
• I've just edited a write-up of my solution into my cops answer. Jul 16 '21 at 12:19

# Python 3, pxeger

f("(lambda **k:k)(a='b')", [12, 14])


Attempt This Online!

The challenge consists of two parts, first to create a dictionary without } and any builtins, and to get code compiled for exec to return a value.
The dictionary can be created using named function arguments.

The instructions in the bytecode at the indices specified in the integer list are set to NOP (9). The expression compiles compiles to the following bytecode, if we remove (convert to NOP) 12 and 14, the dictionary is returned.

 0 LOAD_CONST               0 (<code object <lambda> at 0x10f79ad40, file "<dis>", line 1>)
4 MAKE_FUNCTION            0
10 CALL_FUNCTION_KW         1
12 POP_TOP                  0
16 RETURN_VALUE

• Excellent work! I used type annotations instead of function call kwargs, but you got it! Aug 7 '21 at 10:28

function a(){this.i=0;this.toString=()=>this.i++?'is':'constructor'}
f(new a())


Try it online!

A bit of a mess. This uses the fact that Object.is() called with no parameters returns true.

• Very clever, but sadly not my intended crack. Do I reveal it now? Sep 14 '21 at 12:06
• @EnderShadow8 You can either reveal it now, or create a newer version without this vulnerability. Then again, if your strategy was just to modify the value of x on getting the value so {}[x][x]() returns true, you may as well reveal it. Sep 14 '21 at 12:08
• @EnderShadow8 Also, if you simply have a neater version of this without the constructor, you may as well reveal that - I just couldn't figure out how to mantain an obkect's state without using one. Sep 14 '21 at 12:11
• It's not too far off actually. I'll add my intended solution to my answer Sep 14 '21 at 12:12

# FZs, JavaScript

o=Object.defineProperty;o.a=window;o.b="x";o.c=o;o.get=x=>i++==0?2:i;i=0;o


This essentially encodes

i = 0
Object.defineProperty(window, "x", { get: () => i++ == 0 ? 2 : i })


Once run, x will return 2 the first call, 2 the second, then 3, 4, 5, etc. This means that x === x && x !== x, as 2 === 2 && 3 !== 4.

# JavaScript by tjjfvi

document.all.toString = ()=>"length", document.all


document.all is an object that is unique in several ways, including being falsy.

in uses toString, so the first part can be made true by changing toString.

• +1; this was the intended solution. (Though my version was document.all[document.all]=document.all :P) Dec 15 '21 at 16:47


__hello__


Attempt This Online!

Coincidentally, import __hello__ is an easter egg that outputs the exact text Hello world!. As such, the first line of input doesn't really matter here; perhaps it was used as a red herring.

• Yep, that's what I meant. I hadn't intended for the rest of the code to make it possible, but I forgot you can access the variable __builtins__ as PyGamer0 did. Jan 1 at 21:45

# Python, 62 bytes cracks @pxeger's answer

A generic escape from exec with no __builtins__:

Uses the class heirarchy to go from list to object, builds a dict of subclasses of 'object', finds BuiltinImporter and imports all of the builtins again.

module name doesn't matter, must be a valid module.

{x.__name__:x for x in [].__class__.__base__.__subclasses__()}['BuiltinImporter']().load_module('builtins').print('Hello world!')
csv

Attempt This Online! (yes, the code on ATO prints the wrong key)

# pxeger, Python 3.8

• A = eval
• B = print("the_flag")

Try it online!

Output: the_flag

• Nice! I was thinking about using the thing where print is considered the same as print in other Unicode letters
– user
Oct 22 '20 at 20:42
• This was not my intended solution and I realised it as I was sleeping! But well done! Oct 23 '20 at 5:38

Password: fine

Try it online!

# Python 3, ovs

[x for x in ().__class__.__base__.__subclasses__() if x.__name__ == "Quitter"][0]("a",True)()


Try it online!

# SuperPizz, BrainF***

Password: ejaH

Try it online!

Python script used

# Python 3, pxeger

(_ for _ in()).throw(E())


Yep. Apparently generators just have a throw method. Found by searching SO for "raise exception from python lambda".

# Zsh + coreutils, pxeger's post, cracked after being safe.

${(#)$((){<<<$#}$                                                  )}${(#)$((){<<<$#}$                                                           $)}${(#)$((){<<<$#}                                                 $)}${(#)$((){<<<$#}                                                      )} ${(#)$((){<<<$#}$                                                    )}${(#)$((){<<<$#}$                              )}${(#)$((){<<<$#}$                        )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                           $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                                                          $)}${(#)$((){<<<$#}                                                     $)}${(#)$((){<<<$#}                                                      )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                    )}${(#)$((){<<<$#}$                    $)}${(#)$((){<<<$#}                                                     $)}${(#)$((){<<<$#}                               )}${(#)$((){<<<$#}$                                                       $)}${(#)$((){<<<$#}                     )}${(#)$((){<<<$#}$                     $)}${(#)$((){<<<$#}                       )}${(#)$((){<<<$#}$                          )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                  )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}                                                 $)}${(#)$((){<<<$#}                                                          $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                )}${(#)$((){<<<$#}$                  $)}${(#)$((){<<<$#}                    )}${(#)$((){<<<$#}$                    $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                  )}${(#)$((){<<<$#}$                     )}${(#)$((){<<<$#}$                     )}${(#)$((){<<<$#}$                                                    )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                                                     $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                        )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}                                                    )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                                       )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                            )}${(#)$((){<<<$#}$                                                    )}${(#)$((){<<<$#}$                                                          $)}${(#)$((){<<<$#}                              $)}${(#)$((){<<<$#}                              $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                          $)}${(#)$((){<<<$#}                                                 $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}     )}${(#)$((){<<<$#}$                                                  $)}${(#)$((){<<<$#}                                                        $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                                                  )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}                                                    )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                                             $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                          \$)}


Try it online!

## What original program does

• Generates one random integer: 1-9999999.
• Variable p should represent if the integer is prime.

## How I cracked

• Password could be shorter, as in next comment (cont)
– user100411
Jun 12 '21 at 13:14
• (comt) this.
– user100411
Jun 12 '21 at 13:14

# Python 3, pxeger

[].__class__.__base__.__subclasses__()[81].acquire.__globals__['__builtins__']['print']('uslcgtutmuexbwb')


Attempt This Online!

Our code is being executed in an environment where trying to access any variable throws an error (and there are no built-in functions). But the list of subclasses of object is very large, and includes multiple classes that somehow reference the original builtins object... The number 81 may stop working in other Python versions (but it can be replaced by something different, and it works in both Python 3.8 and 3.9)

• Wow, that was fast, and not at all my intended solution! I'll post a new fixed version now Jul 15 '21 at 13:38
• Fixed version: codegolf.stackexchange.com/a/231421 Jul 15 '21 at 14:01

# Python 3, pxeger

With direct memory access, nothing is really immutable. Replaces the string in the constant table of the lambda function.

import ctypes

wow = f.__code__.co_consts[2].co_consts[1]
hah = 'hah'
ctypes.memmove(id(wow), id(hah), hah.__sizeof__())


Attempt This Online!

# Python 3, pxeger - (Incorrect crack)

 f=open(1,'w')
f.write('hah')
f.close()
`

Attempt This Online!

• Ugh apologies for editing on my phone... Jul 18 '21 at 2:58
• Nope, it has to return from the function. Jul 18 '21 at 6:05
• Ah yes, missed that! Jul 18 '21 at 19:21