Inspired by this challenge, which got closed. This is meant to be an easier, but no less interesting version of that.

This is the robbers thread of a challenge. For the cops thread, see here.

Cops will provide a program/function and a flag. Robbers will guess a password. When the password is given to the cop's program, the flag should be outputted.

Robber rules

• When the cop's program is given the password you guess, it should output the flag.
• You are allowed to take advantage of ambiguous descriptions of the flag by cops.

Cop answers will be safe if they haven't been cracked for two weeks.

Cop:

Scala, 4 bytes

x=>x


Flag: Yay, you cracked it! (an object of type String is returned from the lambda above)

Try it online!

Robber:

Password: the string "Yay, you cracked it!"

Try it online!

• Chat for robbers to discuss answers.
– user
Oct 22 '20 at 18:40

ovs, Python 3

Password: "".format

Try it online!

• Yes, this is what I had in mind. Your TIO throws an error because you have an empty command line argument.
– ovs
Oct 24 '20 at 17:58

tsh, Javascript (SpiderMonkey)

Password: -0

Output: true

R, Paul

data.frame(a = 1, b = 0/0)


Try it online!

• Ah. Good job. I didn't mean for it to have such a straightforward answer. I'll add a new question with the hole plugged.
– Paul
Oct 28 '20 at 15:38

Dorian, dotcomma

[49375, -1]


Of course, the cryptic response in the comments turned out to mean "no, it's not a string". I think it's a big problem with the answer if "it would become too easy" if you told me what IO format I must use.

I noticed that the code seems to ignore all the input except for the first number until it finds a negative number. Then I noticed that it subtracts something from 49375. I don't know how does the code work, though.

Try it online!

• Good job. The intended solution is only the number 49375. I had the idea to use the decimal value of 0xC0DE, but somehow messed things up and ended one number to high. I will write a detailed solution when I'm back from my vacation next Monday. Nov 2 '20 at 8:29

Python 3, pxeger

Object-oriented programming is always the best solution.

class c:
def f():
from os import system
system('echo ryjtufbohqszxgg')
f()


Our code is being executed in an environment where trying to access any global variable (including built-in functions) throws an error. However, import still functions correctly (I don't really understand this part of Python, but I suppose it's because __import__ technically isn't being removed; it's just no longer accessible by the normal means). But just importing a necessary function is not enough: once imported, it will become a global variable, and these can't be accessed!
And the following fix doesn't work:

def f():
from os import system
system('echo ryjtufbohqszxgg')
f()


because once f is declared, it also becomes an inaccessible global variable! Fortunately, classes are executed as normal code when declared, and variables declared inside them are not global (and therefore are accessible).

Attempt This Online!

• An alternative to using a class to call the function are decorators, which have a lot less restrictions since 3.9: ATO
– ovs
Jul 15 at 14:35
• Nice, although it can actually be a bit simpler than this. (see my edit on the cops answer) Jul 15 at 14:42

Python 3, pxeger

e%e#d¹F¹S
z(1,42)
A;B;C;D;E;F;G;H;I;J;K;L;M;N;O;P;Q;R;S
T;U;V;W;X;Y;Z;a;b;c;d;f;g;h;abs;j;id


¹ represents a byte with value 1

Attempt This Online!

The input first needs to pass the exec call. This checks the syntax and creates tables of constants and names:

co_consts = (1, 42, None)
co_names = ('e', 'z', 'A', ..., 'id')


Then all the bytecode is replaced with our input, the relevant part is the first line:

e%   101 37   LOAD_NAME   37 (=id)
e#   101 35   LOAD_NAME   35 (=abs)
d¹   100  1   LOAD_CONST   1 (=42)
F¹    70  1   PRINT_EXPR   1 (argument is ignored)
S     83      RETURN_VALUE   (exits the execution)


dAdAFFS(71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42)


Attempt This Online!

The first 8 bytes are actually executed:

dA   100 65   LOAD_CONST  65 (=42)
dA   100 65   LOAD_CONST  65 (=42)
FF    70 70   PRINT_EXPR  70 (argument is ignored)
S(    83 40   RETURN_VALUE   (returns 42 and exits the execution)

• A bit different from my solution, but great work! Jul 16 at 11:51
• Actually, the sequence F¹ is interpreted as PRINT_EXPR with the 0x01 byte being its (ignored) argument, not as PRINT_EXPR then POP, because all bytecode comes in (opcode, arg) pairs since Python 3.6, and RETURN_VALUE is actually returning the abs builtin. The RETURN_VALUE also interprets the newline byte following it as its argument. Jul 16 at 12:10
• @pxeger I see, that knowledge would have helped me a lot while creating this answer, it was a lot of trial and error ;). Is the second part closer to what you had? I assume this can be done quite a bit shorter
– ovs
Jul 16 at 12:19
• I've just edited a write-up of my solution into my cops answer. Jul 16 at 12:19

Python 3, pxeger

f("(lambda **k:k)(a='b')", [12, 14])


Attempt This Online!

The challenge consists of two parts, first to create a dictionary without } and any builtins, and to get code compiled for exec to return a value.
The dictionary can be created using named function arguments.

The instructions in the bytecode at the indices specified in the integer list are set to NOP (9). The expression compiles compiles to the following bytecode, if we remove (convert to NOP) 12 and 14, the dictionary is returned.

 0 LOAD_CONST               0 (<code object <lambda> at 0x10f79ad40, file "<dis>", line 1>)
4 MAKE_FUNCTION            0
10 CALL_FUNCTION_KW         1
12 POP_TOP                  0
16 RETURN_VALUE

• Excellent work! I used type annotations instead of function call kwargs, but you got it! Aug 7 at 10:28

function a(){this.i=0;this.toString=()=>this.i++?'is':'constructor'}
f(new a())


Try it online!

A bit of a mess. This uses the fact that Object.is() called with no parameters returns true.

• Very clever, but sadly not my intended crack. Do I reveal it now? Sep 14 at 12:06
• @EnderShadow8 You can either reveal it now, or create a newer version without this vulnerability. Then again, if your strategy was just to modify the value of x on getting the value so {}[x][x]() returns true, you may as well reveal it. Sep 14 at 12:08
• @EnderShadow8 Also, if you simply have a neater version of this without the constructor, you may as well reveal that - I just couldn't figure out how to mantain an obkect's state without using one. Sep 14 at 12:11
• It's not too far off actually. I'll add my intended solution to my answer Sep 14 at 12:12

Python 3 by pxeger

assert, int

Attempt This Online!

An assert statement can take two expressions; if the first expression evaluates to a true value, the second expression is not evaluated.

pxeger, Python 3.8

• A = eval
• B = print("the_flag")

Try it online!

Output: the_flag

• Nice! I was thinking about using the thing where print is considered the same as print in other Unicode letters
– user
Oct 22 '20 at 20:42
• This was not my intended solution and I realised it as I was sleeping! But well done! Oct 23 '20 at 5:38

Password: fine

Try it online!

• Nice! How about trying to crack my second vault? I tried to make this one a tad harder :) Oct 23 '20 at 18:43

Python 3, ovs

[x for x in ().__class__.__base__.__subclasses__() if x.__name__ == "Quitter"][0]("a",True)()


Try it online!

SuperPizz, BrainF***

Password: ejaH

Try it online!

Python script used

Python 3, pxeger

(_ for _ in()).throw(E())


Yep. Apparently generators just have a throw method. Found by searching SO for "raise exception from python lambda".

Zsh + coreutils, pxeger's post, cracked after being safe.

${(#)$((){<<<$#}$                                                  )}${(#)$((){<<<$#}$                                                           $)}${(#)$((){<<<$#}                                                 $)}${(#)$((){<<<$#}                                                      )} ${(#)$((){<<<$#}$                                                    )}${(#)$((){<<<$#}$                              )}${(#)$((){<<<$#}$                        )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                           $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                                                          $)}${(#)$((){<<<$#}                                                     $)}${(#)$((){<<<$#}                                                      )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                    )}${(#)$((){<<<$#}$                    $)}${(#)$((){<<<$#}                                                     $)}${(#)$((){<<<$#}                               )}${(#)$((){<<<$#}$                                                       $)}${(#)$((){<<<$#}                     )}${(#)$((){<<<$#}$                     $)}${(#)$((){<<<$#}                       )}${(#)$((){<<<$#}$                          )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                  )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}                                                 $)}${(#)$((){<<<$#}                                                          $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                )}${(#)$((){<<<$#}$                  $)}${(#)$((){<<<$#}                    )}${(#)$((){<<<$#}$                    $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                  )}${(#)$((){<<<$#}$                     )}${(#)$((){<<<$#}$                     )}${(#)$((){<<<$#}$                                                    )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                                                     $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                        )}${(#)$((){<<<$#}$                    )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}                                                    )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                                       )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                            )}${(#)$((){<<<$#}$                                                    )}${(#)$((){<<<$#}$                                                          $)}${(#)$((){<<<$#}                              $)}${(#)$((){<<<$#}                              $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                          $)}${(#)$((){<<<$#}                                                 $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}     )}${(#)$((){<<<$#}$                                                  $)}${(#)$((){<<<$#}                                                        $)}${(#)$((){<<<$#}                                                       )}${(#)$((){<<<$#}$                                                  )}${(#)$((){<<<$#}$     $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                  $)}${(#)$((){<<<$#}                                                    )}${(#)$((){<<<$#}$                                                       )}${(#)$((){<<<$#}$                $)}${(#)$((){<<<$#}                                             $)}${(#)$((){<<<$#}                                                   $)}${(#)$((){<<<$#}                                                          \$)}


Try it online!

What original program does

• Generates one random integer: 1-9999999.
• Variable p should represent if the integer is prime.

How I cracked

• Password could be shorter, as in next comment (cont) Jun 12 at 13:14
• (comt) this. Jun 12 at 13:14

Python 3, pxeger

[].__class__.__base__.__subclasses__()[81].acquire.__globals__['__builtins__']['print']('uslcgtutmuexbwb')


Attempt This Online!

Our code is being executed in an environment where trying to access any variable throws an error (and there are no built-in functions). But the list of subclasses of object is very large, and includes multiple classes that somehow reference the original builtins object... The number 81 may stop working in other Python versions (but it can be replaced by something different, and it works in both Python 3.8 and 3.9)

• Wow, that was fast, and not at all my intended solution! I'll post a new fixed version now Jul 15 at 13:38
• Fixed version: codegolf.stackexchange.com/a/231421 Jul 15 at 14:01

Python 3, pxeger

With direct memory access, nothing is really immutable. Replaces the string in the constant table of the lambda function.

import ctypes

wow = f.__code__.co_consts[2].co_consts[1]
hah = 'hah'
ctypes.memmove(id(wow), id(hah), hah.__sizeof__())


Attempt This Online!

Python 3, pxeger - (Incorrect crack)

 f=open(1,'w')
f.write('hah')
f.close()
`

Attempt This Online!

• Ugh apologies for editing on my phone... Jul 18 at 2:58
• Nope, it has to return from the function. Jul 18 at 6:05
• Ah yes, missed that! Jul 18 at 19:21