# Encrypting any text without key after padding oracle attack in CBC mode

Suppose the decryption program is already built. Now I want to encrypt an arbitrary plain text given the IV and the decryption program (no key). From the formulas, we have $$Dec(C_i)\oplus C_{i-1}=P_i$$ $$Dec(C_1)\oplus IV=P_1$$. However, given these information, I can only figure out $Dec(C_1)$. I have read this question, but it assumes all $Dec(C_i)$ are known, which is not correct for my case. My question is how can I find out all $C_i$? (Please note there isn't a database of $P_i$, $Dec(C_i)$ pairs to look up collisions).

I thought about using the decryption program to brute force each possibility, but it will take too long time. I also tried applying similar technique for decryption algorithm(tried to reverse the process), but still can't get a result. Any hints would be appreciated.