Docs/Advanced/Frida Agent

Frida Agent

External grey-box instrumentation — AFL-style 64 KiB edge map via shared memory.

The Frida agent injects coverage into a platform shared-memory region that Nexsiz’s SharedMapCoverage provider (-C map) owns. Nexsiz clears the map before every execution and harvests hits afterward. One script works on both Linux and Windows.

Location

agents/frida/nexsiz_cov.js + agents/README.md. Pairs with coverage provider map in src/coverage/.

SHM protocol

FieldValue
Size65536 bytes
Cellu8 saturating hit count
Edge(prev >> 1) ^ cur (AFL classic)
PlatformDefault nameWith id
Linux/nexsiz-cov/nexsiz-cov-<id>
WindowsLocal\nexsiz-covLocal\nexsiz-cov-<id>

Quick start (Linux)

export NEXSIZ_SHM_ID=demo
export NEXSIZ_COV_MODULE=mydaemon   # optional module filter
frida -l agents/frida/nexsiz_cov.js -f ./mydaemon --no-pause

# in another terminal
export NEXSIZ_SHM_ID=demo
./target/release/nexsiz -h 127.0.0.1 -p 21 -m ftp -C map -S demo -v

Quick start (Windows)

$env:NEXSIZ_SHM_ID = "demo"
$env:NEXSIZ_COV_MODULE = "mydaemon"
frida -l agents/frida/nexsiz_cov.js -f .\mydaemon.exe

$env:NEXSIZ_SHM_ID = "demo"
.\target\release\nexsiz.exe -h 127.0.0.1 -p 21 -m ftp -C map -S demo -v

Modes

NEXSIZ_COV_MODEBehaviour
stalker (default)Basic-block edge coverage via Frida Stalker
exportsInterceptor on recv/read/send/parse-like exports (includes WSARecv/WSASend on Windows)

Prefer exports when throughput matters more than block-level resolution.

Environment variables

VariableMeaning
NEXSIZ_SHM_IDSHM suffix or full name (must match -S)
NEXSIZ_COV_MODULESubstring filter for Stalker (module name)
NEXSIZ_COV_MODEstalker | exports

Operational notes

  • Linux: POSIX SHM under /dev/shm/. Clean with rm /dev/shm/nexsiz-cov* or make clean-shm.
  • Windows: Named File Mapping in the Local\ namespace (no elevation required). Object survives process exit so both sides can reattach.
  • Remote-only targets without a local process cannot use this agent; fall back to -C software.
  • The agent and the fuzzer must agree on the same NEXSIZ_SHM_ID.
Precision over noise

The map only records what the target actually touches. See also Coverage.