Protocol Models

Protocol models describe structure — field types, dictionaries, message templates, optional sequences — so mutation stays semantic instead of pure random bytes. Built-in models cover common protocols; JSON models (feature json-model) and offline inference extend the surface without core changes.

Pipeline position

src/input/ — models feed the hierarchical mutator; integrity repair runs post-mutation, pre-encrypt. See Mutation and Integrity Repair.

Selecting a model

nexsiz -h 127.0.0.1 -p 21 -m ftp -s seeds/ftp -v
nexsiz -h 10.0.0.5 -p 53 -m dns -P tcp -v
nexsiz -h 10.0.0.5 -p 1883 -m mqtt -v
nexsiz -m models/custom-example.json -h 10.0.0.5 -p 9000 -v   # needs --features json-model

CLI: -m / --model. Config: model= or protocol_model=. Paths ending in .json or containing / are treated as file paths; bare names are lowercased built-ins.

Built-in models

Name	Notes	Typical integrity auto-map
`ftp`	Text commands, login sequences	`ftp` (CRLF)
`smtp`	Text + DATA terminator awareness	`smtp`
`http`	Request structure, Content-Length	`http`
`dns`	TCP length prefix + query layout	`binary`
`mqtt`	Fixed header, remaining length, CONNECT/PUBLISH	`binary`
`smb`	Binary / CIFS-oriented	`binary`
`binary-lp`	Generic BE length-prefix + CRC	`binary`
`binary-lp-le`	Little-endian length-prefix variant	`binary-le`
`generic`	Minimal structure; dictionary + opaque payloads	`default`

JSON model schema

Shipped examples: models/dns.json, models/mqtt.json, models/binary-lp.json, models/custom-example.json. Requires build feature json-model.

Field	Description
`name`	Model identifier
`length_prefixed`	Whether frames use length prefixes
`length_width`	1 / 2 / 4 byte length fields
`endian`	`be` \| `le`
`delimiter`	Optional delimiter byte / null
`checksum`	e.g. `crc32`
`dictionary`	Tokens (strings or `\xNN` escapes)
`messages[]`	Named message specs with typed fields
`desocket`	Optional reset sequences (see Snapshot & Desocket)

Field types in message specs

Type	Role
`Command`	Opcodes / verbs; high mutation weight
`String`	Text payloads
`Binary` / `Payload`	Opaque bytes
`Numeric`	Fixed-width numbers
`Length`	Repaired to match following payload size
`Checksum`	Repaired after length (CRC/XOR/etc.)

// models/binary-lp.json (excerpt)
{
  "name": "binary-lp",
  "length_prefixed": true,
  "length_width": 2,
  "endian": "be",
  "checksum": "crc32",
  "dictionary": ["\\x00", "\\xff", "\\x00\\x00", "\\xff\\xff"],
  "messages": [{
    "name": "frame",
    "fields": [
      { "name": "len", "type": "Length", "size": 2, "endian": "be" },
      { "name": "payload", "type": "Binary" },
      { "name": "crc", "type": "Checksum", "size": 4 }
    ]
  }]
}

Offline inference

Derive a model sketch from a seed directory without starting a campaign:

nexsiz --infer-model -s seeds/ftp -v
nexsiz --infer-model -s seeds/custom --infer-out models/inferred.json

Infers delimiter, length-prefix heuristics, endian, and dictionary tokens. With json-model, --infer-out writes JSON; otherwise a human-readable dump. Refine the result into a formal model before production campaigns.

Previous← Architecture NextIntegrity Repair →