You can't simulate M forever on any one input string, because M might
never halt on that string. However, you can simulate the i-th string
for j moves of M and then abandon that simulation. If you do this for
all i and j in the right order, you will eventually discover all strings
that M accepts. When you find two of them, you are done.
However, you need to explain (among other things)
what the right order for pairs i and j is.