Coverage
Optional grey-box providers: null, map (AFL SHM), software.
Grey-box instrumentation is optional. Default provider is null — zero overhead, zero behaviour change until -C is set.
Module
src/coverage/ — CoverageProvider trait, CoverageFeedback, backends: null / map / software / SHM bridge. Classic map size: MAP_SIZE = 64 KiB (AFL-style).
CLI
nexsiz -h 127.0.0.1 -p 21 -m ftp -C null -v # default
nexsiz -h 127.0.0.1 -p 21 -m ftp -C map -S demo -v # SHM + Frida agent
nexsiz -h 127.0.0.1 -p 21 -m ftp -C software -v
# env
export NEXSIZ_SHM_ID=demo
Flags: -C / --cov / --coverage, -S / --shm / --coverage-shm. Config: coverage, coverage_shm.
Providers
| Name | Role |
|---|---|
null | No-op feedback; default |
map | AFL-style 64 KiB shared edge map; pairs with external agent via SHM id |
software | Pure software edge tracking (no external agent) |
Lifecycle
reset()— clear ephemeral state before send- Target executes
collect(&ExecutionResult) → CoverageFeedback
CoverageFeedback: new_edges, hit_edges, map_hash, interesting. Engine and state tracker consume this for scheduling and oracle signals.
Frida / SHM
POSIX SHM name pattern: /nexsiz-cov-<ID>. Agent script: agents/frida/nexsiz_cov.js (Stalker + exports modes). See Frida Agent.
# cleanup after campaigns
rm -f /dev/shm/nexsiz-cov*
# or
make clean-shm