我试图将9个字符的数组表示为Z3中的数组，以枚举那些满足特定约束（由KLEE生成）的字符的所有组合。
生成的表达式如下：
(set-logic QF_AUFBV)
(declare-fun ascii_buf () (Array (_ BitVec 32) (_ BitVec 8) ) )
(assert
(let (
(?B1 ((_ sign_extend 24) (select ascii_buf (_ bv8 32) ) ) )
(?B2 ((_ sign_extend 24) (select ascii_buf (_ bv6 32) ) ) )
(?B3 ((_ sign_extend 24) (select ascii_buf (_ bv7 32) ) ) )
(?B4 ((_ sign_extend 24) (select ascii_buf (_ bv1 32) ) ) )
(?B5 ((_ sign_extend 24) (select ascii_buf (_ bv2 32) ) ) )
(?B6 ((_ sign_extend 24) (select ascii_buf (_ bv0 32) ) ) )
(?B7 ((_ sign_extend 24) (select ascii_buf (_ bv5 32) ) ) )
(?B8 ((_ sign_extend 24) (select ascii_buf (_ bv3 32) ) ) )
(?B9 ((_ sign_extend 24) (select ascii_buf (_ bv4 32) ) ) ))
(let (
(?B11 (bvadd (_ bv4294967248 32) ?B5 ) )
(?B10 (bvadd (_ bv4294967248 32) ?B4 ) ) )
(and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and (and
(= false (bvslt ?B6 (_ bv48 32) ) ) # ASCII number constraints ("0" = 48, "9" = 57)
(= false (bvslt (_ bv57 32) ?B6 ) ) )
(= false (bvslt ?B4 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B4 ) ) )
(= false (bvslt ?B5 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B5 ) ) )
(= false (bvslt ?B8 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B8 ) ) )
(= false (bvslt ?B9 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B9 ) ) )
(= false (bvslt ?B7 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B7 ) ) )
(= false (bvslt ?B2 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B2 ) ) )
(= false (bvslt ?B3 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B3 ) ) )
(= false (bvslt ?B1 (_ bv48 32) ) ) )
(= false (bvslt (_ bv57 32) ?B1 ) ) )
(bvslt ?B10 (_ bv9 32) ) ) # other constraints (autogenerated)
(= false (bvslt ?B11 ?B10 ) ) )
(bvslt (bvadd (_ bv4294967248 32) ?B8 ) (_ bv9 32) ) )
(= false (bvslt (bvadd (_ bv4294967200 32) (bvadd ?B4 ?B8 ) ) (bvadd (_ bv4294967248 32) ?B6 ) ) ) )
(= false (bvslt (bvadd (_ bv4294967248 32) ?B9 ) (_ bv9 32) ) ) )
(bvslt (bvadd (_ bv4294967248 32) ?B7 ) (_ bv9 32) ) )
(= false (bvslt (bvadd (_ bv4294967200 32) (bvadd ?B4 ?B7 ) ) ?B11 ) ) )
(= false (bvslt ?B11 (_ bv9 32) ) )
) # outer and
) # end inner let
) # end outer let
) # end assert
当我尝试使用描述的方法here枚举不同的解决方案时，我开始得到这样的意外模型（前两个与约束索引<9一样是预期的）：
[ascii_buf = Lambda(k!0,
If(k!0 == 3,
56,
If(k!0 == 0,
51,
If(k!0 == 4,
57,
If(k!0 == 1,
56,
If(k!0 == 5,
56,
If(k!0 == 2, 57, 50)))))))]
[ascii_buf = Lambda(k!0,
If(k!0 == 3,
56,
If(k!0 == 4,
57,
If(k!0 == 1,
56,
If(k!0 == 5,
56,
If(k!0 == 2, 57, 50))))))]
[ascii_buf = Lambda(k!0,
If(k!0 == 3,
56,
If(k!0 == 1073741824,
48,
If(k!0 == 4,
57,
If(k!0 == 1,
56,
If(k!0 == 5,
56,
If(k!0 == 2, 57, 50)))))))]
[ascii_buf = Lambda(k!0,
If(k!0 == 3,
56,
If(k!0 == 1073741824,
48,
If(k!0 == 4,
57,
If(k!0 == 1,
56,
If(k!0 == 5,
56,
If(k!0 == 32768,
51,
If(k!0 == 2, 57, 50))))))))]
我对Z3不太熟悉，但是我的猜测是，如果我可以限制数组的索引排序（而不是从32位位向量获取），则可以解决此问题。但任何/所有建议将不胜感激！