Configuration
Config file format, environment variables, and precedence.
Nexsiz accepts configuration from three sources. Loading -c / --config replaces the in-memory Config from the file. Environment variables apply for NXS, RPC, SHM, and encryptor keys when the corresponding CLI field is unset. Prefer campaign defaults in a conf file and one-off overrides on the CLI.
Practical precedence
- Built-in defaults
- Config file via
-c / --config(key=value) - Environment variables (NXS, RPC, SHM, encryptor keys when CLI not set)
- CLI flags that set fields after file load (flags processed in order;
-cresets Config from file at that point)
Config file format
Plaintext key=value. Lines starting with # are comments. Empty lines ignored. Unknown keys are silently ignored (forward-compatible).
# config/example.conf — shipped with the repo
host=127.0.0.1
port=21
protocol=tcp
model=ftp
timeout_ms=400
max_reuse_messages=24
integrity=default
oracle=default
encryptor=null
workers=4
connection_reuse=true
seed_dir=seeds/ftp
output_dir=output/ftp
verbose=true
# max_execs=100000
# rng_seed=42
# target_cmd=./target_daemon
./target/release/nexsiz -c config/example.conf
./target/release/nexsiz -c campaign.conf -v
Key reference
| Key | Default | Description |
|---|---|---|
host | 127.0.0.1 | Target IP |
port | 80 | Target port |
protocol | tcp | tcp or udp |
model / protocol_model | — | Protocol model name or path to .json |
timeout_ms | 500 | Per-operation timeout |
target_cmd | — | Local process to spawn (snapshot / crash monitor) |
max_reuse_messages | 32 | Messages before forced reconnect on reused TCP |
integrity | — | default | http | ftp | smtp | binary | binary-le | null |
oracle | — | default | strict | crash | hang | coverage | differential | sanitizer | diffsan | expanded |
encryptor | — | null | xor | chacha20 | tls-record | chacha20+tls | xor+tls |
enc_key / key | — | Encryptor key material |
coverage | — | null | map | software |
coverage_shm / shm | — | SHM id for Frida agent |
workers | #cores | Worker thread count |
connection_reuse | true | true/1 or false |
snapshot | false | Enable process snapshot |
snapshot_backend | process | null | process | criu |
seed_dir | seeds | Seed corpus directory |
output_dir | output | Campaign output root |
max_execs | — | Stop after N executions |
rng_seed | — | Deterministic RNG seed |
verbose | false | true/1 |
use_libafl / libafl | false | LibAFL path (needs feature) |
rpc_sock | — | Unix socket for Python RPC |
nxs / nxs_set | — | Enable NXS + set expression |
nxs_path | — | Extra colon-separated search paths |
nxs_events | crash,hang | Comma-separated event types |
nxs_cooldown | 30 | Seconds per (event,crash,nxs) tuple |
nxs_max_per_event | 0 | Cap per event (0 = unlimited) |
nxs_max_total | 0 | Cap total NXS spawns (0 = unlimited) |
hierarchical_prob | 0.15 | Mutator hierarchy probability |
field_prob | 0.70 | Field-level mutation probability |
dict_prob | 0.25 | Dictionary mutation probability |
template_prob | 0.12 | Template splice probability |
max_mutations | 8 | Max mutations per input |
Environment variables
| Variable | Purpose |
|---|---|
NEXSIZ_ENC_KEY / NEXSIZ_ENC_NONCE | Encryptor key material |
NEXSIZ_SHM_ID | Coverage shared-memory id (Frida) |
NEXSIZ_RPC_SOCK | RPC control socket path |
NEXSIZ_NXS | Equivalent to --nxs |
NEXSIZ_NXS_PATH | Equivalent to --nxs-path |
NEXSIZ_NONCE_MODE | fixed | incrementing | random |