Paused at the right (?) breakpoint, what do I do next?

Question

The output currently looks like this:

2022-09-10 00:09:03.955729-0500 REDACTED[51480:28773370] -openPDFWithPath: /Users/REDACTED/Library/Containers/com.REDACTED/Data/Library/Application Support/REDACTED/REDACTED/issues/-SOMENUMBERS.pdn
Process 51480 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 8.1
    frame #0: 0x0002d409 REDACTED `GetIssueKey(char const*, char const*, char*)
REDACTED`GetIssueKey:
->  0x2d409 <+0>: pushl  %ebp
    0x2d40a <+1>: movl   %esp, %ebp
    0x2d40c <+3>: pushl  %ebx
    0x2d40d <+4>: pushl  %edi
Target 0: (REDACTED) stopped.

This function (whatever it does) takes 3 arguments, each a pointer to a string? If I wanted to see what those strings are, what commands do I use in lldb? I've struggled several hours tonight just figuring out how to set (and delete the ones I got wrong) breakpoints. Please formulate any advice as if you're speaking to a brain-damaged monkey.

Answer 1

I was about to delete this, but maybe there's someone as newb as myself.

If the binary is x86_64, in theory you can see these three values with the following commands:

po $arg3
po $arg4
po $arg5

Though I'm on a 64bit machine, I think the app is old enough that it was compiled 32 bit, and so the $arg# aliases aren't available. (Anyone's welcome to correct me, I don't know what I'm talking about on this.) The values are (probably) in the stack. So run this command:

m read -c 8 -s 4 -f x $esp

The output will look something like this:

0xbfffbe1c: 0x00012d46 0x0026a124 0x10632399 0xbfffbf70
0xbfffbe2c: 0x00000000 0x00000002 0x11377c30 0xbfffbe68

The first value is the return value or something like that. Every word after that are the arguments to the function. They can be accessed with:

po 0x0026a124
po 0x10632399
po 0xbfffbf70

These gave output of decimal numbers (they're pointers after all, they were just addresses). Something like this:

(lldb) po 0x10632399
274932633

Finally, to see the strings themselves, I did the following:

(lldb) expr ((char *) 2531620)
(char *) $7 = 0x0026a124 "NDPD:CryptHandler"
(lldb) expr ((char *) 274932633)
(char *) $8 = 0x10632399 "/Users/REDACTED/Library/Containers/com.REDACTED/Data/Library/Application Support/REDACTED/REDACTED/issues/-SOMENUMBER.pdn"
(lldb) expr ((char *) 3221208944)
(char *) $9 = 0xbfffbf70 "der"

Not quite the eureka I was hoping for. More likely, I need to wait for the return value to show something. On to more adventures for me.