Z3python XOR sum? | 易学教程

问题

I'm currently trying to solve some equation with z3python, and I am coming across a situation I could not deal with.

I need to xor certain BitVecs with specific non ascii char values, and sum them up to check a checksum. Here is an example :

pbInput = [BitVec("{}".format(i), 8) for i in range(KEY_LEN)]
password = "\xff\xff\xde\x8e\xae"
solver.add(Xor(pbInput[0], password[0]) + Xor(pbInput[3], password[3]) == 300)

It results in a z3 type exception : z3.z3types.Z3Exception: Value cannot be converted into a Z3 Boolean value.

I found this post and tried to apply a function to my password string, adding this line to my script : password = Function(password, StringSort(), IntSort(), BitVecSort(8)) But of course it fails as the string isn't an ASCII string. I don't care about it being a string, I tried to just do Xor(pbInput[x] ^ 0xff), but this doesn't work either. I could not find any documentation on this particular situation.

EDIT : Here is the full traceback.

Traceback (most recent call last):
  File "solve.py", line 18, in <module>
    (Xor(pbInput[0], password[0]) 
  File "/usr/local/lib/python2.7/dist-packages/z3/z3.py", line 1555, in Xor
    a = s.cast(a)
  File "/usr/local/lib/python2.7/dist-packages/z3/z3.py", line 1310, in cast
    _z3_assert(self.eq(val.sort()), "Value cannot be converted into a Z3 Boolean value")
  File "/usr/local/lib/python2.7/dist-packages/z3/z3.py", line 91, in _z3_assert
    raise Z3Exception(msg)
z3.z3types.Z3Exception: Value cannot be converted into a Z3 Boolean value

Thanks in advance if you have any idea about how I could do this operation!

回答1:

There are two problems in your code.

Xor is for Bool values only; for bit-vectors simply use ^
Use the function ord to convert characters to integers before passing to xor

You didn't give your full program (which is always helpful!), but here's how you'd write that section in z3py as a full program:

from z3 import *

solver = Solver()
KEY_LEN = 10

pbInput = [BitVec("c_{}".format(i), 8) for i in range(KEY_LEN)]
password = "\xff\xff\xde\x8e\xae"
solver.add((pbInput[0] ^ ord(password[0])) + (pbInput[3] ^ ord(password[3])) == 300)

print solver.check()
print solver.model()

This prints: