diff --git a/src/tea3/cli.py b/src/tea3/cli.py
index 952b85b..6233250 100644
--- a/src/tea3/cli.py
+++ b/src/tea3/cli.py
@@ -2,7 +2,7 @@ from tea3.pretty_print import pretty_print
 from tea3.tea3model import Tea3Model
 from tea3.variable_search import run_exhaustive
 from tea3.sbox import run_sbox
-
+from tea3.variable_xor import run_variable_xor
 
 def prompt_int(message: str, lo: int, hi: int) -> int:
     while True:
@@ -74,6 +74,44 @@ def run_exhaustive_cli():
     print("\n" + "=" * 50)
     print("Done.")
 
+def run_variable_xor_cli():
+    print("\nR registers are indexed 0–7; bits within each register are 0–7.")
+    print("Enter the bit positions to XOR, e.g. `0 1`.")
+
+    steps = prompt_int("How many steps? (1–100): ", 1, 100)
+    target_reg = prompt_int("Target register (0–7): ", 0, 7)
+
+    while True:
+        raw = input("Bits to XOR (0–7, separated by spaces): ").strip()
+        if not raw:
+            print("Please enter at least one bit index.")
+            continue
+
+        try:
+            bits_to_xor = [int(x) for x in raw.split()]
+        except ValueError:
+            print("Please enter only numbers separated by spaces.")
+            continue
+
+        if any(bit < 0 or bit > 7 for bit in bits_to_xor):
+            print("Each bit must be between 0 and 7.")
+            continue
+
+        seen = set()
+        bits_to_xor = [b for b in bits_to_xor if not (b in seen or seen.add(b))]
+
+        if not bits_to_xor:
+            print("Please enter at least one valid bit.")
+            continue
+
+        break
+
+    print("-" * 50)
+    run_variable_xor(steps, target_reg, bits_to_xor)
+
+    print("\n" + "=" * 50)
+    print("Done.")
+
 
 
 def main():
@@ -85,15 +123,18 @@ def main():
     print("  1) Classic inspection")
     print("  2) Exhaustive variable-change search")
     print("  3) S box analysis")
+    print("  4) variable XOR")
 
-    mode = prompt_choice("Your choice (1, 2 or 3): ", {1, 2, 3})
+    mode = prompt_choice("Your choice (1, 2, 3 or 4): ", {1, 2, 3, 4})
 
     if mode == 1:
         run_classic_cli()
     elif mode == 2:
         run_exhaustive_cli()
-    else:
+    elif mode == 3:
         run_sbox()
+    else:
+        run_variable_xor_cli()
 
 
 main()
diff --git a/src/tea3/variable_xor.py b/src/tea3/variable_xor.py
new file mode 100644
index 0000000..95a7a1a
--- /dev/null
+++ b/src/tea3/variable_xor.py
@@ -0,0 +1,28 @@
+from tea3.tea3model import Tea3Model
+from tea3.pretty_print import pretty_print
+
+def run_variable_xor(steps, target_reg, bits_to_xor):
+    model = Tea3Model()
+
+    if not bits_to_xor:
+        print("No bits selected.")
+        return
+
+    print(f"Target register: R{target_reg}")
+    print(f"Bits to XOR: {bits_to_xor}")
+    print("-" * 50)
+
+    for i in range(steps):
+        model.step()
+
+        xor_poly = model.S.zero()
+        for bit in bits_to_xor:
+            xor_poly += model.R_bits[target_reg][bit]
+
+        print(f"\n[Step {i + 1}]")
+        print(f"XOR of R_bits[{target_reg}][{bits_to_xor}] =")
+        print(pretty_print(xor_poly))
+        print()
+
+    print("\n" + "=" * 50)
+    print("Done.")