Oracles
Interestingness suites from strict crash to diffsan and expanded.
Oracles decide whether an execution is interesting enough to retain, triage, or deepen. Selectable suites range from crash-only strict mode to multi-dimensional differential + sanitizer composites.
Module
src/plugin/oracle.rs + src/monitor/oracle. Resolve via -O / --oracle or config oracle=.
CLI
nexsiz -m ftp -O default -v
nexsiz -m ftp -O strict -v
nexsiz -m http -O diffsan -v # recommended deep campaigns
nexsiz -m http -O expanded -v # maximum sensitivity
Named suites
| Name | Aliases | Behaviour |
|---|---|---|
default | — | Crash / hang / reset + coverage/state signals + classic composite |
strict | — | Only crash, hang, connection-reset |
crash / hang / coverage / error | — | Single-signal oracles |
differential | diff | Multi-dimensional baseline divergence |
sanitizer | san | ASan/UBSan patterns, length anomaly, null-byte, protocol violation + crash/hang |
diffsan | diff+san | differential + sanitizer + coverage |
expanded | — | diffsan + error oracle |
Differential oracle
- Coarse key: response-code shape + sequence hash
- Baseline dimensions: codes, body fingerprint (first 128 B/response), length class, coverage map hash, optional timing
- First observation establishes baseline (not interesting); later divergence ≥ min_divergence flags
- Bounded map (max_baselines 4096); slow refresh after stable hits
Sanitizer suite components
- Pattern — AddressSanitizer, heap-use-after-free, SEGV, stack smashing, runtime asserts, … in
erroror response body - Length anomaly — sliding median + 16 MiB hard ceiling
- Null-byte — interior NUL in mostly-ASCII responses
- Protocol violation — e.g. mixed 2xx+5xx; 1xx then connection reset
Campaign guidance
Fast noisy passes: strict / default. Deep drift + memory bugs: diffsan or expanded. Pair with coverage map when grey-box feedback is available.