the simplified equation . This equation modulo $N$, gives $
\lambda^2 p\,f(z_0,w_0) = \ell^e \bmod N,
$ and since $\ell$ is a quadratic nonresidue modulo $N$, we choose the parity of $e$ depending on whether $p\,f(z_0,w_0)$ is a quadratic residue modulo $N$ or not, and solve for a square root modulo $N$ to find $\lambda$, in $0 < \lambda < N$.

Now for fixed $z_0$, $w_0$, and $\lambda$, Equation  implies a linear equation in $z_1$ and $w_1$: $$\label{eq:linear-normequation}
2\lambda p L((z_0,w_0),(z_1,w_1)) = \frac{\ell^e-\lambda^2 p f(z_0,w_0)}{N}\bmod N,$$ where $L$ is the bilinear polynomial $$L((z_0,w_0),(z_1,w_1)) = \langle{z_0 + w_0\omega,z_1 + w_1\omega}\rangle
                   = 2 z_0z_1 + {\mathrm{Trd}}(\omega)(z_0w_1 + w_0z_1) + 2{\mathrm{Nrd}}(\omega)w_0w_1.$$ Since $N$ is a large prime, such that $\gcd(x_0w_0|D|p,N)=1$, there are exactly $N$ solutions $(z_1,w_1)$ to the linear equation . We choose a random solution satisfying $$|\lambda z_0 + N z_1| < N^2 \text{ and } 
|\lambda w_0 + N w_1| < N^2,$$ and equation  now leads to a problem of representation of an integer by a binary quadratic form: $$\label{eq:cornaccia-normequation}
f(x_1,y_1) = r := \frac{\ell^e- p f(\lambda z_0 + N z_1, \lambda w_0 + N w_1)}{N^2}\cdot$$ We assume that $e$ was chosen sufficiently large so that $r$ is positive. If $r$ 