new execsnoop, register based