Architecture Overview
Four-layer design, plugin surface, and NXS integration.
Nexsiz is structured as four cooperating layers plus a plugin surface and an optional NXS post-event plane. Defaults keep the surface minimal: zero behaviour change until features are explicitly enabled.
┌─────────────────────────────────────────────────────────────────┐
│ Monitoring · Oracle · NXS │
│ crash / hang detection · differential & sanitizer oracles │
│ minimizer · structured logging · existence-script spawn │
└───────────────────────────────┬─────────────────────────────────┘
│
┌───────────────────────────────┴─────────────────────────────────┐
│ Execution & Efficiency Layer │
│ worker pool · intelligent connection reuse · TCP / UDP │
│ process monitor · optional LibAFL Executor │
│ snapshot / desocket (ProcessRestart · CRIU · ProtocolReset) │
└───────────────────────────────┬─────────────────────────────────┘
│
┌───────────────────────────────┴─────────────────────────────────┐
│ State Awareness + Coverage Feedback │
│ hybrid state tracker · adaptive transition predictor │
│ CoverageProvider (null | map+shm | software) │
└───────────────────────────────┬─────────────────────────────────┘
│
┌───────────────────────────────┴─────────────────────────────────┐
│ Input Construction │
│ semantic field model · hierarchical mutator │
│ protocol-aware integrity repair pipeline │
│ JSON field trees (feature json-model) │
│ offline grammar inference (--infer-model) │
└─────────────────────────────────────────────────────────────────┘
Layer responsibilities
| Layer | Role | Key modules |
|---|---|---|
| Input Construction | Build and mutate structurally valid protocol bytes | src/input/ — model, mutator, integrity, corpus |
| State + Coverage | Track response-derived state; optional grey-box edges | src/state/, src/coverage/ |
| Execution | Worker pool, transport, reuse, snapshot/desocket | src/execution/ |
| Monitoring / NXS | Oracles, minimizer, logging, post-event actors | src/monitor/, src/nxs/, nxs/ |
Plugin surface
Trait-based plugins register without core changes:
- Protocol — ftp, smtp, http, dns, mqtt, smb, binary-lp, generic, JSON models
- Integrity — length/checksum/framing repair (auto-selected from model when possible)
- Oracle — crash, hang, coverage, differential, sanitizer, combined modes
- Encryptor — null, xor, chacha20, tls-record, combinations
- CoverageProvider — null (default), map (AFL-style 64 KiB SHM), software
- SnapshotProvider — null, ProcessRestart, CRIU (feature-gated)
Data path (one execution)
- Select seed / queue entry
- Hierarchical mutation (field / message / sequence)
- Integrity repair (length, checksum, terminators)
- Optional encryptor framing
- Send over TCP/UDP (reuse connection when safe)
- Observe response → state tracker + oracle + coverage
- On crash/hang/interesting: minimise, log, optionally spawn NXS
Design constraints
- Minimal default deps — libc only; LibAFL, JSON models, CRIU behind features
- Zero behaviour change — snapshot, desocket, NXS, coverage map off by default
- Precision over volume — semantic mutation + repair before send
- Operator control — CLI + conf + env; NXS rate limits and cooldowns