0

The output currently looks like this:

2022-09-10 00:09:03.955729-0500 REDACTED[51480:28773370] -openPDFWithPath: /Users/REDACTED/Library/Containers/com.REDACTED/Data/Library/Application Support/REDACTED/REDACTED/issues/-SOMENUMBERS.pdn
Process 51480 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 8.1
    frame #0: 0x0002d409 REDACTED `GetIssueKey(char const*, char const*, char*)
REDACTED`GetIssueKey:
->  0x2d409 <+0>: pushl  %ebp
    0x2d40a <+1>: movl   %esp, %ebp
    0x2d40c <+3>: pushl  %ebx
    0x2d40d <+4>: pushl  %edi
Target 0: (REDACTED) stopped.

This function (whatever it does) takes 3 arguments, each a pointer to a string? If I wanted to see what those strings are, what commands do I use in lldb? I've struggled several hours tonight just figuring out how to set (and delete the ones I got wrong) breakpoints. Please formulate any advice as if you're speaking to a brain-damaged monkey.

1 Answer 1

1

I was about to delete this, but maybe there's someone as newb as myself.

If the binary is x86_64, in theory you can see these three values with the following commands:

po $arg3
po $arg4
po $arg5

Though I'm on a 64bit machine, I think the app is old enough that it was compiled 32 bit, and so the $arg# aliases aren't available. (Anyone's welcome to correct me, I don't know what I'm talking about on this.) The values are (probably) in the stack. So run this command:

m read -c 8 -s 4 -f x $esp

The output will look something like this:

0xbfffbe1c: 0x00012d46 0x0026a124 0x10632399 0xbfffbf70
0xbfffbe2c: 0x00000000 0x00000002 0x11377c30 0xbfffbe68

The first value is the return value or something like that. Every word after that are the arguments to the function. They can be accessed with:

po 0x0026a124
po 0x10632399
po 0xbfffbf70

These gave output of decimal numbers (they're pointers after all, they were just addresses). Something like this:

(lldb) po 0x10632399
274932633

Finally, to see the strings themselves, I did the following:

(lldb) expr ((char *) 2531620)
(char *) $7 = 0x0026a124 "NDPD:CryptHandler"
(lldb) expr ((char *) 274932633)
(char *) $8 = 0x10632399 "/Users/REDACTED/Library/Containers/com.REDACTED/Data/Library/Application Support/REDACTED/REDACTED/issues/-SOMENUMBER.pdn"
(lldb) expr ((char *) 3221208944)
(char *) $9 = 0xbfffbf70 "der"

Not quite the eureka I was hoping for. More likely, I need to wait for the return value to show something. On to more adventures for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.