``` (lldb) c Process 49269 resuming Process 49269 ...
# core
t
Copy code
(lldb) c
Process 49269 resuming
Process 49269 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 5.1
    frame #0: 0x000000010088de8e osqueryd`sqlite3InitCallback(pInit=0x0000000000000003, argc=3, argv=0x0000000101fb5a78, NotUsed=0x0000000101fb5a60) at sqlite3.c:122765:3 [opt]
   122762	  sqlite3 *db = pData->db;
   122763	  int iDb = pData->iDb;
   122764	
-> 122765	  assert( argc==3 );
   122766	  UNUSED_PARAMETER2(NotUsed, argc);
   122767	  assert( sqlite3_mutex_held(db->mutex) );
   122768	  DbClearProperty(db, iDb, DB_Empty);
Target 0: (osqueryd) stopped.
(lldb) p argv[2]
(char *) $14 = 0x0000000101fb55b0 "CREATE VIEW le_bin_leak AS SELECT hex(fts3_tokenizer(\"simple\")) AS col;"
(lldb)
oh yes, this is definitely possible 😄