"Hello, World!" (Robbers' thread)

Question

This is the robbers' thread. The cops' thread is here.

Your challenge is to take an uncracked submission from the cops' thread and find, for what input or inputs, the program will print Hello, World! and a newline. Capitalization, spacing, and punctuation must be exact.

Please comment on the cop's submission when you've cracked their code.

Answer 1

Bash by Sisyphus

Original code:

[[ ! "${1////x}" =~ [[:alnum:]] ]]&&[[ $# = 1 ]]&&bash -c "$1"

Input:

__=; (( __++, __-- ));
(( ___        = __,        ___++));
(( ____       = ___,       ____++));
(( _____      = ____,      _____++));
(( ______     = _____,     ______++));
(( _______    = ______,    _______++));
(( ________   = _______,   ________++));
(( _________  = ________,  _________++));

${!__##-} <<<\$\'\\$___$______$_______\\$___$______$_____\\$___$_______$__\\$___$_______$_________\'\ \$\'\\$___$___$__\\$___$______$_______\\$___$_______$______\\$___$_______$______\\$___$_______$_________,\ \\$___$____$_________\\$___$_______$_________\\$___$________$____\\$___$_______$______\\$___$______$______\\$__$______$___\'

Explanation:

This encodes "echo Hello, World!" as octal escape sequences (\xxx).

Except you also can't use numbers, so the first part builds up variables for the numbers 0-7. You can use those to build a string with octal sequences that will evaluate to give you the actual command.

But eval is also alphanumeric. So instead this pipes that string as input to another instance of bash. $0 contains the name of the command used to invoke Bash, which is usually just bash (or -bash for a login shell) if you're running it normally (through TIO or by pasting it in a terminal). (This incidentally means that if you try to run this by pasting it into a script, things will go horribly wrong as it tries to fork itself a bunch of times.)

But anyway, you can't say $0 directly. Instead, $__ contains the name of $0 ("0"), and you can use indirect expansion to access it (${!__} refers to the contents of $0).

And that, finally, gives you all the pieces you need.

Answer 2

05AB1E, Adnan

•GG∍Mñ¡÷dÖéZ•2ô¹βƵ6B

-107

Try it online!

How?

•GG∍Mñ¡÷dÖéZ•        - big number
             2ô      - split into twos (base-10-digit-wise)
               ¹β    - to base of input
                   B - convert to base (using 012...ABC...abc...):
                 Ƶ6  -   107 (ToBase10(FromBase255(6))+101 = 6+101 = 107)

Answer 3

totallyhuman, Python 2

A solution is

'Uryyb, Jbeyq!' 

Answer 4

Pyth: Mr. Xcoder

"abcdefghijklmnopqrstuvwxyz"

G is the built-in for the lowercase alphabet. The code checks for equality against that.

Answer 5

Jelly: EriktheOutgolfer

〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ〡㋄ⶐ✐сᑀ⟙ⶐⶐ〡ސЀᶑ

Jelly, 11 bytes

sLƽ$Xṙ5O½Ọ

Try it online!

Explanation

The original code can be explained as such:

sLƽ$Xṙ5O½Ọ  Main link; argument is z
s            Split z into n slices, where n is:
    $
  ƽ         The integer square root of
 L                                      the length of z
     X       Random of a list. Returns a random row of the input put into a square
      ṙ5     Rotate the list left 5 times
        O    Get codepoints
         ½   Floating-point square root
          Ọ  From codepoints

So, just take "Hello, World!" and get codepoints, square them, cast back to codepoints, rotate right 5 times, and then square and flatten the result.

Answer 6

Octave by Stewie Griffin

Not sure if this is the correct solution (on TIO it prints the \00 character), but in my octave-cli shell it looks like this:

Also in the original challenge it says print nothing (or the null-character), so if nothing is the same as \00 then this should be fine.

[72, 101, 108, 108, 111, 44, 32, 87, 111, 114, 108, 100, 33, 0]

Try it online!

Answer 7

Python 3 by rexroni

print("Hello, World!") or __import__('sys').exit(0)

Prevent any errors by exiting early.

Try it online!

Answer 8

Lua 5.1 by tehtmi

Pass this as the first argument:

C=("").char;_G[C(112,114,105,110,116)](C(72,101,108,108,111,44,32,87,111,114,108,100,33))

Assuming the original code is in a file tehtmi.lua, run (in bash or a similar shell):

lua tehtmi.lua 'C=("").char;_G[C(112,114,105,110,116)](C(72,101,108,108,111,44,32,87,111,114,108,100,33))'

It also works on Lua 5.3, which is what TIO uses, so why don't you try it online? I haven't tested on a implementation that uses the "PUC-Rio's Lua 5.1" core (because I can't really find any information), but my solution probably also works there.

How?

It runs the first argument as code, but only if it contains less than 5 lowercase characters.

The trick is to run print("Hello, World!"). Another way this can be run is using _G["print"]("Hello, World!"), which only uses strings.

But we can't use the string directly due to the lowercase-count restriction, however, you can run ("").char to get the function string.char, that can convert from a series of bytes to a string. I assigned it to an uppercase variable (so we don't hit the limit) so we can use it to construct both the print and the Hello, World! strings that can be used like above.

Answer 9

JavaScript (ES6) By Ephellon Dantzler

{length:1, charCodeAt:()=>(e='Hello, World!', String.fromCharCode=()=>'')}

Try it online!

That was pretty easy.

I noticed that any string inputs wouldn't be possible to output Hello, World! because the whole thing inside String.fromCharCode will only return multiples of 4, and ! has a char code of 33. So clearly we just have to hack the whole program. Hacking built-ins in JavaScript is trivial if one doesn't try to stop them (and even if one does so, there are usually lots of workarounds...).

Answer 10

JavaScript (ES6), Voile

Simple proxy that only returns the wanted character every 3rd time it's called.

var i = 0;
var string = "Hello, World!";
var proxy = new Proxy([], {
  get: function(target, property) {
    if (!(++i%3)) {
      return string[property];
    }
    return [1];
  }
});

Try it online!

Answer 11

Ruby, by Histocrat

The magic input is: 1767707618171221 30191World!

Try it online.

Explanation:

• the number 1767707618171221 is a prime, and, written in base 36 it is "hello". When capitalized, this produces "Hello", which is printed using $><<
• the line $><<", #$'"if/30191/ looks for the number 30191 in the input and writes to stdout a string composed of a comma, a space, and whatever is in the input after the 30191 (using the $POSTMATCH, which is referred here by its short variant, $').

Answer 12

Cubically by MD XF

I imagine this is always dangerous, but I think I have a crack, pending that I am correct in that there is a bug in the interpreter (which I just now compiled).

My input

0 1 0 1 0 1 0 1 1 0 1 0 0

Output is Hello, World!\n\n\n\n\n\n\n\n\n\n..... with unending newlines.

But I noticed the last section of code:

:1/1+1$(@6)7

sets the notepad to 0x0A (newline) in a scary way, reads input to face 7 (the input face), and then prints the 6 face (notepad face) repeatedly until the 7 face is zero. If you set face 7 to zero, you should only get one newline. However, I got infinite newlines and my 13th input WAS a zero, and I can verify that the 7 face is always zero by inserting a "print number from 7 face" in the loop:

:1/1+1$(@6%7)7

then it prints unending \n0 pairs.

I am looking at the specs on the cubically github page and this behavior looks an awful lot like a bug. Changing the last character of the original program from a 7 to a 0 results in the expected behavior. The TIO interpreter exhibits the same incorrect behavior.

Answer 13

JavaScript (ES6) by Voile

Input must be a string containing this:

e(
`\
_\
=\
>\
"\
H\
e\
l\
l\
o\
,\
 \
W\
o\
r\
l\
d\
!\
"\
+\
\`
\`
`)

Try it using this:

const e=eval,p=''.split,c=''.slice,v=[].every,f=s=>(t=c.call(s),typeof s=='string'&&t.length<81&&v.call(p.call(t,`\n`),l=>l.length<3)&&e(t)(t))

input='e(\n`\\\n_\\\n=\\\n>\\\n\"\\\nH\\\ne\\\nl\\\nl\\\no\\\n,\\\n \\\nW\\\no\\\nr\\\nl\\\nd\\\n!\\\n\"\\\n+\\\n\\`\n\\`\n`)'
console.log(f(input))

If you don't care about the trailing newline requirement for the output, you can replace the last 6 lines with this instead:

!"
`)

How I did it

The restrictions on the input are that it's a string, each line is two bytes long or less, and that the total length is 80 bytes or less. My first attempt after understanding that correctly was this:

_
=>
`\
H\
e\
l\
l\
o\
,\
 \
W\
o\
r\
l\
d\
!
`

^{Note: the \s are to ignore the newlines in the string in the input. This is incredibly crucial to the answer, and I can't believe that I stumbled upon it on accident. (I was familiar with it before but forgot about it)}

But this didn't work, since the => has to be on the same line as the arguments. Thankfully, I had the idea of wrapping something similar in a string and putting an eval in my input to reduce it to one line, resulting in my final answer. After the eval in the input occurs, the following is generated as a string (which is then eval'd to a function and then run):

_=>"Hello, World!"+`
`

This was really tough to crack, but I succeeded in the end.

^{Also, first crack ever!}

Answer 14

JavaScript: ThePirateBay

I override the valueOf() and toString() methods of the parsed objects so that coercion fails with a TypeError.

{"valueOf": 7, "toString": 7}

Answer 15

CJam, Erik the Outgolfer

q5/:i:c

00072001010010800108001110004400032000870011100114001080010000033

Try it online!

How?

q       - Take input (string)
 5/     - split into chunks of five
   :i   - cast to integers
     :c - cast to characters

Answer 16

C# (.NET Core), Grzegorz Puławski

The solution I found makes very substantial use of unprintable characters, so attempting to paste it here didn't work well. The byte values for the input are:

109, 89, 4, 121, 3, 11, 8, 29, 37, 38, 27, 25, 72, 4, 4, 4, 3, 3, 3, 4, 4, 37, 3, 27, 4, 3

Or the string version is available in the input field of the TIO link.

Try it online!

The original program would take the distinct characters in the input, then reverse the input and multiply the elements of the two lists. Thus I created a string 26 characters long where the first 13 characters were distinct, the last 13 characters all also appeared in the first 13, and each pair of indexes [i, 26-i] multiplied to the byte value of the i-th character in Hello, World!.

Answer 17

Ly, LyricLy

n[>n]<[8+o<]

2 25 92 100 106 103 79 24 36 103 100 100 93 64

Try it here (although the page does not render the newline).

n takes input, trys to split on spaces and cast to ints, these get put on the stack. o prints ordinal points, and 8+ does what one would think. So input needs to be 8 less than the codepoints in reverse order split by spaces.

Answer 18

C (gcc), by Felix Palmen

Original code:

#define O(c)(((char**)v)+c)
#define W(c)*(O(c)-**O(2)+x)
main(x,v){puts(W(42));}

Arguments:

"Hello, World!" ","

Try it online!

Explanation:

W(c) is calculating the address of a string from the argument list to print out. It starts with the address of the cth argument (O(c)), which is the 42nd argument in this case, and then subtracts the first character of the second argument (**O(2)) as an integer offset, and then adds x, which is the number of arguments.

W(c) uses the second argument, so you know there need to be at least 3 of them (0, 1, 2). Then "Hello, World!" can go in the first argument, and then to address that argument you need a character whose ASCII value fits in the equation "42-x+3=1". That happens to be ",".

Answer 19

6502 Assembly (C64) - Felix Palmen

The correct answer is ,52768,23

The explanation is slightly involved.

00 c0                          ;load address
20 fd ae      jsr $aefd        ; checks for comma
20 eb b7      jsr $b7eb        ; reads arguments

The code first checks for a comma (syntax necessity) and then reads in two arguments, the first of which is a WORD, stored little-endian in memory location 0014 and 0015, the latter of which is stored in the X register.

8a              TXA            ;Store second argument into A (default register)
0a              ASL            ; bitshifts the second argument left (doubles it)
45 14           EOR $14        ; XOR that with the low byte of first argument
8d 21 c0        STA $c021      ; Drop that later in the program

That's pretty clever, using our input to rewrite the program. It eventually rewrites the counter for the output loop at the end of the program.

45 15           EOR $15        ; XOR that with the high byte of the first argument
85 15           STA $15        ; Put the result in $15
49 e5           EOR #$e5       ; XOR that with the number $e5
85 14           STA $14        ; Put that in $14

Here comes the devious part:

8e 18 d0        STX $d018      ; stores the original second argument in d018

on the C64, d018 is a very important byte. It stores the reference points for things involving the screen's output. See here for more info. If this gets a wrong value, it will crash your C64. In order to print the requisite mixed upper and lowercase letters, this needs to be $17.

Now we begin our output loop:

a0 00               ldy #$00       ; zeroes out the Y register
b1 14               lda ($14),y    ; puts the memory referenced by the byte
                                   ;   starting at $14 (remember that byte?)
                                   ;   into the default register
20 d2 ff            jsr $ffd2      ; calls the kernal routine to print the char stored in A
c8                  iny            ; increment Y
c0 0e               cpy #$0e       ; test for equality with the constant $0e

That constant is what got written over before. It clearly determines how long the loop runs. It happens to be the right value already, but we need to stick 0e there again.

d0 f6                   bne *-8        ; jump back 8 bytes if y and that constant weren't equal
60                      rts            ; ends the program

The rest is just the information which we need to print out, starting at memory address c025.

So it's just following the math from there.

Answer 20

6502 Machine Code (C64) - Felix Palmen

The correct answer is

8bitsareenough

The code is rather complicated, involving a lot of self modifying. So instead of fully reverse engineering it, you can just use it to crack itself.

Here's a slightly more helpful disassembly of the code, to help understand what happened. The syntax is for KickAssembler.

*=$c000       // LOAD ADDRESS
jsr $aefd     //checks for a comma
jsr $ad9e     /*Reads in an argument. Stores length of it into
                $61, with the address of the stored arg in $62-3*/
jsr $b6a3     /*Evaluates the string, leaving the pointer on $22-3
                and the length on A*/ //I think

ldy #$00
loop: lda thedata,y   
cpy #$01
beq shuffle
cpy #$07
beq shuffle
cpy #$0b
beq shuffle
tricks: jsr output
iny
bne loop
output: eor ($22),y      //XOR's A with the y-eth letter of our input
jmp $ffd2               //good old CHROUT, returns to tricks above
thedata: .byte $f0,$48,$fa,$a2, $1c,$6d,$72,$30
.byte $06,$a9,$03,$48,$7c,$a3
shuffle: sta $c048      //drops A in mystery+4, over the constant
lda $c026,y
sta $c045               //overwrites the low byte of mystery
lda $c027,y
sta $c046               //overwrites the high byte of mystery
ldx #$00
mystery: lda $aefd,x              
eor #$23
jsr output
iny
inx
cpx #$03
bne mystery
cpy #$0e
bne loop
eor #$1a
sta $d018                
rts

Labelling it up like this was enough for me to see that the code XORs a bunch of constants that are hidden around in order to print out what we need. Since XOR is reversible, if you input the desired output, it'll tell you what the key is.

So I switched the last line

/*from sta $d018 
to*/ jsr $ffd2

so it would print the last required input instead of crashing on a wrong input.

And that's that!

If there's any interest, I'll crack the code more.

Answer 21

Explode, Step Hen

@_?&4_-j>5&f^~c>&6\|4>7

Rh/qi?,Wcr+du

Try it online!

• Trying to work out what all the "explorers" are actually doing hurts one's head too much, so I just reverse engineered it (literally :p - starting from the rightmost character I offset each in turn along [and around] the printable character range).

Answer 22

C (tcc) by Joshua

int puts(const char *s)
{
    printf("Hello, World!%s", s);
}

Try it online!

Answer 23

MATL by Luis Mendo

tsZp?x

Try it online!

Answer 24

Jelly by Jonathan Allan

Original code:

œ?“¥ĊɲṢŻ;^»œ?@€⁸ḊFmṪ⁷

Try it online!

Input:

1,2586391,2949273,3312154,3312154,1134001,362881,2223505,766081,1134001,1497601,3312154,1860601,140

Explanation:

Mainly, it is necessary to understand what the code does. The first thing it does is it takes the string "!,Word Hel" (with all the needed characters except newline) and creates a bunch of permutations of them. The inputs specify permutation numbers, and each pair of permutations from the input is applied to the string exluding pairs where the first permutation is applied first. Basically, P2(P1(S)), P2(P2(S), P2(P3(S)), ..., P2(PN(S)), P3(P1(S)), ..., P3(PN(S)), ... ..., PN(P1(S)), ..., PN(PN(S)). These are all concatenated together. Then the last input is reused to take every PNth character from this big string. So, I take PN = len(S)*N = 10*N. This means we'll take the first character of P2(P1(S)), the first character of P3(P1(S)), all the way up to the first character of PN(P1(S)). To simplify further, I let P1 = 1 which is the identity permutation. Then it suffices to choose any P2 that permutes "H" into the first position, a P3 that permutes "e" into the first position and so on. Luckily, small permutation numbers like the one already chosen for PN don't affect the earlier characters in the string, so PN leaves "!" at the beginning of the string. (If this wasn't true, it would still be possible to solve by choosing a different P1.)

Answer 25

C (GCC on TIO) by MD XF

4195875

Try it online!

How?

It tries to print the second argument as a string, which is a pointer we can determine on the input. It just so happens that at location memory 4195875 starts the "Hello, World!\n" string.

The number was determined by adding print("%p", "Hello, World!"); before the printf, converting the hexadecimal number to decimal and tried it out on the original TIO. However, it showed me the printf format string. By trying out some numbers, I found out that the string is located before the format string.

So in memory, it would look like this (as a C string):

Hello, World!\n\0%2$s\0

This also means that any update to the compiler might break the solution.

Answer 26

JavaScript (Node.js) By Voile

['Hello, World!','','','','','','','','','','','','']

Try it online!

Answer 27

Röda by fergusq

[1, "HH", 1, "eellloo", 1, ",,", 1, "  WWoo", 1, "rr", 1, "ll", 1, "dd", 1, "!!"]

Try it online!

Explanation coming in a bit...

Answer 28

JavaScript (ES6), Voile

var i = 0;
var string = `"${t}"`;
var answer = "i++?0:q=string";
console.log( f(answer) );

Try it online!

Answer 29

PHP by LP154

PDO,FETCH_CLASSTYPE

Try it online!

(TIO doesn't have the PDO class defined, so the above demo uses a codepad that does)

Another solution:

ReflectionFunction,IS_DEPRECATED

Try it online!

Answer 30

JavaScript (ES6), Voile

Given the 81 character limit, this probably isn't the intended solution

global.g = ()=>"Hello, World!";
var str = "g";

Try it online!

Answer 31

TeX, by A Gold Man

Original source:

\read16to\x\message{Hello, World!}\bye

This already prints Hello, World!, but the newline is missing. The input is just placed in \x which is never used. In order to be able to modify the output, I guess we need to do some preparations (like, "lay a trap") before calling this code, so \x is actually expanded. It can be done when invoked like this (assuming the original source is in x.tex in the current directory):

tex '\def\vfill{\x}\input./x'

This first redefines \vfill (which is part of the expansion of \bye) to expand to our \x, so now we can provide some input printing the missing newline:

\newlinechar=`@\message{@}

This sets the character used for newlines in \message to @ and immediately uses it.

---

This whole thing modifies the environment the original program will run in, so if there are any objections to this method, I'll retract it.

Answer 32

Brainfuck by 2EZ 4RTZ

Correct input: Gdkkn+\x1fVnqkc \x09\xff, where \xHH indicates non-ASCII-printable hex character.

Explanation:

You just take the character codes of "Hello, World!\n" and subract one from each value. The last character \xff (255) causes the program to exit after you add one (since the 255+1 overflows to 0 and the loop exits).

Answer 33

><> by Not a tree

This was an EPIC puzzle! I loved it!

Example solution:

TIHANICWHITEOCPSEARK

Wish I could upvote Not a tree's post three more times.

Answer 34

Perl 5, by Chris

Original code:

eval<>;END{print$x='x'}

Input:

our $x;package X;require Tie::Scalar;@ISA=qw(Tie::Scalar);sub TIESCALAR{my$v;return bless\$v,'X';}sub STORE{}sub FETCH{return "Hello, World!\n"}tie $x,'X';

I'm not sure this is the intended solution. It works by changing the behavior of $x using a tie. The tie here is very simple, ignoring any STORE access and returning our desired output for any FETCH.

Try it online!

Answer 35

JavaScript (ES6), Voile

Input:

!(v.call=()=>true)||"()=>`Hello, World!\n`"

Cop code:

const e=eval,p=''.split,c=''.slice,v=[].every,f=s=>(t=c.call(s),typeof s=='string'&&t.length<81&&v.call(p.call(t,`\n`),l=>l.length<3)&&e(t)(t))

Try it online

This overwrites the v.call() method to always return true, but that part of the input is falsified and discarded for the string part which passes the string type check and length check, and eval's to the desired output Hello, World!\n.

If Birjolaxew's crack is not accepted, maybe this one will.