Program: MobileSafari
regexen=803fe930; regexen_count=9
cred_wanted = default -> 1f
cred_wanted = file* -> 1f
cred_wanted = file-chroot -> 1f
cred_wanted = file-ioctl -> 20
cred_wanted = file-issue-extension -> 1f
cred_wanted = file-mknod -> 1f
cred_wanted = file-read* -> 1e
cred_wanted = file-read-data -> 1e
cred_wanted = file-read-metadata -> 20
cred_wanted = file-read-xattr -> 1d
cred_wanted = file-revoke -> 1f
cred_wanted = file-search -> 1f
cred_wanted = file-write* -> 1c
cred_wanted = file-write-data -> 1c
cred_wanted = file-write-flags -> 1c
cred_wanted = file-write-mode -> 1c
cred_wanted = file-write-mount -> 1c
cred_wanted = file-write-owner -> 1c
cred_wanted = file-write-setugid -> 1c
cred_wanted = file-write-times -> 1c
cred_wanted = file-write-unmount -> 1c
cred_wanted = file-write-xattr -> 1c
cred_wanted = file-unlink -> 1f
cred_wanted = iokit* -> 1f
cred_wanted = iokit-open -> 1b
cred_wanted = iokit-set-properties -> 1f
cred_wanted = ipc* -> 1f
cred_wanted = ipc-posix* -> 1f
cred_wanted = ipc-posix-sem -> 1f
cred_wanted = ipc-posix-shm -> 1a
cred_wanted = ipc-sysv* -> 1f
cred_wanted = ipc-sysv-msg -> 1f
cred_wanted = ipc-sysv-sem -> 1f
cred_wanted = ipc-sysv-shm -> 1f
cred_wanted = job-creation -> 1f
cred_wanted = mach* -> 1f
cred_wanted = mach-bootstrap -> 20
cred_wanted = mach-lookup -> 20
cred_wanted = mach-priv* -> 1f
cred_wanted = mach-priv-host-port -> 1f
cred_wanted = mach-priv-task-port -> 1f
cred_wanted = mach-task-name -> 1f
cred_wanted = network* -> 1f
cred_wanted = network-inbound -> 19
cred_wanted = network-bind -> 19
cred_wanted = network-outbound -> 16
cred_wanted = priv* -> 20
cred_wanted = priv-adjtime -> 20
cred_wanted = priv-netinet* -> 20
cred_wanted = priv-netinet-reservedport -> 20
cred_wanted = process* -> 1f
cred_wanted = process-exec -> 15
cred_wanted = process-fork -> 1f
cred_wanted = signal -> 13
cred_wanted = sysctl* -> 1f
cred_wanted = sysctl-read -> 20
cred_wanted = sysctl-write -> 1f
cred_wanted = system* -> 1f
cred_wanted = system-acct -> 1f
cred_wanted = system-audit -> 1f
cred_wanted = system-chud -> 1f
cred_wanted = system-fsctl -> 1f
cred_wanted = system-lcid -> 1f
cred_wanted = system-mac-label -> 1f
cred_wanted = system-nfssvc -> 1f
cred_wanted = system-reboot -> 1f
cred_wanted = system-sched -> 1f
cred_wanted = system-set-time -> 1f
cred_wanted = system-socket -> 1f
cred_wanted = system-suspend-resume -> 1f
cred_wanted = system-swap -> 1f
cred_wanted = system-write-bootstrap -> 1f
cred_wanted = mach-per-user-lookup -> 1f
1f:
Type 1, [1] = 0, bp2 = 5
20:
Type 1, [1] = 0, bp2 = 0
1e:
Type 0, opcode = 1, arg = 0
Regex: 68e0 bytes @ 803fe94c
/private/var/mobile/Media/com.apple.itdbprep.postprocess.lock
/private/var/mobile/Media/com.apple.itunes.lock_sync
/private/var/mobile/Media/DCIMPhotos
PhotoData
/
/private/var/mobile/Library/Mail/.datOrphanedDraft-com.apple.mobilesafari
/private/var/mobile/Library/Preferences/.dat
/private/var/mobile/Media/Safari
/
/private/var/tmp
/
/private/var/mobile/Library/Preferences/com.apple.mobilesafariwebapp
WebSheet
.plist
/private/var/mobile/Library/CookiesSafari
WebKit
WebClips
AddressBook
Keyboard
/
/private/var/mobile/Library/Caches/Snapshots/com.apple.mobilesafariwebapp
-/
/private/var/mobile/Library/Caches/Snapshots
/private/var/mobile/Library/Mail/.datOrphanedDraft-com.apple.mobilesafari
/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist
/private/var/mobile/Library/Caches/Safaricom.apple.mobilesafari
com.apple.WebAppCache
AccountMigrationInProgress
/
/private/etc/hosts
/private/etc/passwd
/System/Library
/
/usr/lib
/
/usr/share
/
/Developer
/
/private/var/mobile/Library/Preferences/com.apple.mobilemailaccountsettings
WebFoundation
keyboard
preferences.sounds
Preferences
UIKit
aggregated
coremedia
mobileipod
Accessibility
PeoplePicker
youtubeframework
.plist
/private/var/mobile/Library/Preferences/.GlobalPreferences.plistcom.apple.dataaccess.launchd
/private/var/mobile/Library/Caches/com.apple.IconsCacheitunesstored/url-resolution
plist
/
/private/var/mobile/PowerPagesLT
/
/Applications/MobileSafariWebSheet
Web
.app/
/System/Library/Carrier
Bundles/
/carrier.plist
/private/var/mobile/Library/Carrier
Bundles/
/carrier.plist
/private/var/mobile/Library/Preferences/com.apple.carrier.plist
/private/var/mobile/Library/Carrier
Bundles/
.bundle
/Info.plist
/
.lproj/
/System/Library/Carrier
Bundles/
.png
/private/var/mobile/Library/Carrier
Bundles/
.png
/dev/dtracehelper
/dev/ptmxttys
/dev/ttyp
ptyp
/dev/sha
_
aes_
/dev/randomurandom
/dev/zero
/dev/null
M->20 NM->1f

1d:
Type 0, opcode = 1, arg = 1
Regex: 1ec bytes @ 80405234
/private/var/mobile/Library/Caches
M->20 NM->1e

1c:
Type 0, opcode = 1, arg = 2
Regex: 36e8 bytes @ 80405424
/private/var/mobile/Media/com.apple.itdbprep.postprocess.lock
/private/var/mobile/Media/com.apple.itunes.lock_sync
/private/var/mobile/Media/DCIMPhotos
PhotoData
/
/private/var/mobile/Library/Mail/.datOrphanedDraft-com.apple.mobilesafari
/private/var/mobile/Library/Preferences/.dat
/private/var/mobile/Media/Safari
/
/private/var/tmp
/
/private/var/mobile/Library/Preferences/com.apple.mobilesafariwebapp
WebSheet
.plist
/private/var/mobile/Library/CookiesSafari
WebKit
WebClips
AddressBook
Keyboard
/
/private/var/mobile/Library/Caches/Snapshots/com.apple.mobilesafariwebapp
-/
/private/var/mobile/Library/Caches/Snapshots
/private/var/mobile/Library/Mail/.datOrphanedDraft-com.apple.mobilesafari
/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist
/private/var/mobile/Library/Caches/Safaricom.apple.mobilesafari
com.apple.WebAppCache
AccountMigrationInProgress
/
/dev/dtracehelper
/dev/ptmxttys
/dev/ttyp
ptyp
/dev/sha
_
aes_
/dev/randomurandom
/dev/zero
/dev/null
M->20 NM->1f

1b:
Type 0, opcode = b, arg = 3
Regex: 588 bytes @ 80408b14
IOMobileFramebufferUserClient
AppleKeyStoreUserClient
IOSurfaceSendRight
IOSurfaceRootUserClient
M->20 NM->1f

1a:
Type 0, opcode = 4, arg = 4
Regex: 3b4 bytes @ 804090a4
apple.shm.notification_center
GSCapabilities
OA-
stack-logs
M->20 NM->1f

19:
Type 0, opcode = 1, arg = 5
Regex: 6c bytes @ 8040945c

M->20 NM->1f

16:
Type 0, opcode = 1, arg = 7
Regex: 39c bytes @ 804099c4
/private/tmp/launchd-
.
/sock
/private/var/tmp/launchd/sock
M->1f NM->17

17:
Type 0, opcode = 1, arg = 6
Regex: 4ec bytes @ 804094d4
/private/var/run/asl_input
/private/var/run/lockdown.sock
/private/var/run/mDNSResponder
M->20 NM->18

18:
Type 0, opcode = 8, arg = 1594
(not a regex?)
M->20 NM->1f

15:
Type 0, opcode = 1, arg = 8
Regex: 5b8 bytes @ 80409d64
/Applications/MobileSafari.app/MobileSafari
/Applications/WebSheet.app/WebSheet
/Applications/Web.app/Web
M->20 NM->1f

13:
Type 0, opcode = a, arg = 1
Regex: 1ec bytes @ 80405234
/private/var/mobile/Library/Caches
M->20 NM->14

14:
Type 0, opcode = a, arg = 1
Regex: 1ec bytes @ 80405234
/private/var/mobile/Library/Caches
M->20 NM->1f