Extending
Trait-based plugins, JSON models, coverage providers, and NXS actors — extend without touching the engine core.
Nexsiz is deliberately modular. Most extension points are selected by name from CLI/config; custom implementations can be registered at compile time or injected at runtime via the Python/RPC control plane.
src/plugin/ — Protocol, Integrity, Oracle, Encryptor traits + PluginRegistry and composition pipelines. Default implementations preserve original behaviour.
Extension points
| Surface | How to extend | Runtime switch |
|---|---|---|
| Protocol model | Built-in name or JSON file (--features json-model) | -m / RPC protocol bridge |
| Integrity repair | Implement repairer; register by name | -i / RPC integrity bridge |
| Encryptor | Implement encryptor; register by name | -e -k / RPC encryptor bridge |
| Oracle | Implement is_interesting; register by name | -O / RPC oracle (live Python) |
| Coverage | CoverageProvider trait (null / map / software) | -C / -S |
| Snapshot | SnapshotProvider (null / process / CRIU) | -Z --snapshot-backend |
| Desocket | Builtin sequences or model desocket field | auto from model / config |
| NXS actors | Standalone binary + categories.toml entry | --nxs / --nxs-path |
| Mutator dictionary | Model dictionary or live push | RPC mutator bridge |
JSON protocol models
With --features json-model you can ship operator-defined models without recompiling:
nexsiz -m models/custom-example.json -h 10.0.0.5 -p 9000 -v
Schema fields: name, length_prefixed, length_width, endian, delimiter, checksum, dictionary, messages[] (typed fields), optional desocket. See Protocol Models.
Offline model inference
nexsiz --infer-model -s seeds/custom --infer-out models/inferred.json
Produces a sketch (delimiter, length-prefix heuristics, endian, dictionary). Refine into a formal model before production campaigns.
Custom NXS
Any executable that respects the NXS contract (meta JSON + exit codes) can be added to a search path and selected via --nxs. Official set lives under nxs/src/; categories are declared in categories.toml. See Custom NXS and Contract.
Live injection (RPC)
When the Unix RPC socket is active (-Y), a Python client can push models, strategies, dictionary tokens, and a live oracle without restarting the campaign. See Python / RPC.
Design principle
- Defaults preserve zero behaviour change.
- Selection is by name from CLI → env → config (CLI wins).
- Hot path stays free of reverse-RPC except the optional bounded oracle query.
- Compile-time features (
libafl,json-model,criu) gate optional dependencies so the default binary stays lean.