使用Python Z3和QWORD

Question

I am new to z3py.

I am reverse engineering a code where I have two QWORDs stored in XMM registers.

And there are different operations performed on it.

Let's say, I have to find 2 qwords, p1 and p2 given the following equations:

x = p1 + p2
y = p1 ^ p2

if x == r1 and y == r2:
    print p1, p2

Note: P1 and P2 are QWORDs which actually represent an 8 character ASCII string. So, P1 is an array of 8 bytes where each byte corresponds to ASCII value of a printable character.

I wrote the following code:

#! /usr/bin/python

from z3 import *

s = Solver()

a = BitVec('a', 64)
b = BitVec('b', 64)

s.add(a + b == result1)
s.add(a ^ b == result2)

if s.check():
    print(s.model())

Question:

I think I should not be using BitVec in my case to represent the QWORDs since I know that each byte of the QWORD corresponds to a printable ASCII character. So, how should I represent my inputs?

Answer 1

It's probably best to use a Python array of 4 8-bit values instead:

#! /usr/bin/python

from z3 import *

s = Solver()

A = [BitVec('a%s' % i, 8) for i in range(4)]
B = [BitVec('b%s' % i, 8) for i in range(4)]

s.add(A[0] <= 128)
s.add(A[0] + B[0] == 12)
s.add(A[1] + B[1] == 5)
s.add(A[2] ^ B[2] == 9)
s.add(A[3] >= 20)

if s.check() == sat:
    print(s.model())

This prints:

[a2 = 0,
 b2 = 9,
 a3 = 20,
 b1 = 0,
 a1 = 5,
 b0 = 140,
 a0 = 128]

This way you can add arbitrary constraints by using the array elements in a natural way.