Quick Start — Nexsiz

Scope

All examples assume an isolated, authorised target. Do not point Nexsiz at production systems without explicit ROE.

1. Build

cargo build --release
# binary → ./target/release/nexsiz

2. Seed corpus

Seeds are raw protocol bytes. One file per session transcript is enough to start; the mutator expands coverage from there.

mkdir -p seeds/ftp
printf 'USER anonymous\r\nPASS guest\r\nPWD\r\nQUIT\r\n' > seeds/ftp/login.txt

The repository also ships sample seeds under sample/seeds/{ftp,smtp,http,generic}.

3. First campaign — FTP

./target/release/nexsiz \
  -h 127.0.0.1 -p 21 -m ftp \
  -s seeds/ftp -o output/ftp \
  -v -x 50000

Flag	Role
`-h / -p`	Target host and port
`-m ftp`	Built-in FTP model (CRLF integrity auto-selected)
`-s`	Seed directory
`-o`	Output directory
`-v`	Verbose logging
`-x 50000`	Stop after 50 000 executions

Makefile equivalent:

make release
make campaign-ftp HOST=127.0.0.1

4. Other protocols

# DNS over TCP
./target/release/nexsiz -h 10.0.0.5 -p 53  -m dns  -P tcp -s sample/seeds/generic -o output/dns -v

# MQTT
./target/release/nexsiz -h 10.0.0.5 -p 1883 -m mqtt -s sample/seeds/generic -o output/mqtt -v

# SMB
./target/release/nexsiz -h 10.0.0.5 -p 445  -m smb  -s sample/seeds/generic -o output/smb -v

Or: make campaign-dns, make campaign-mqtt, make campaign-smb (override HOST= as needed).

5. Output layout

output/
├── crashes/          # Crashing inputs (.min when minimisation succeeds)
├── hangs/
├── nxs-meta/         # Metadata JSON written prior to each NXS spawn
├── nxs-out/          # Per-event NXS artefact trees (report.json, …)
├── nxs-findings/     # Secondary findings (NXS exit code 2) as JSONL
└── queue/

6. Optional: NXS deepening

After a crash or hang, NXS binaries can reproduce, differentially probe, or escalate analysis without changing the fuzzer core.

make nxs
./target/release/nexsiz -h 127.0.0.1 -p 21 -m ftp --nxs default -v
./target/release/nexsiz --nxs default --nxs-list   # resolve paths, then exit

7. Optional: local target + snapshot

For in-process crash recovery against a local daemon:

./target/release/nexsiz \
  -t "./target_daemon" \
  -Z --snapshot-backend process \
  -m ftp -s seeds/ftp -o output/snap -v

process = kill + respawn (requires -t). criu needs --features criu and criu on PATH.

8. Cleanup

# Residual coverage shared-memory maps
rm -f /dev/shm/nexsiz-cov*
# or
make clean-shm

# Output tree
make clean-output
# Full wipe
make clean-all

Operational tips

Prefer -C software when the target is remote-only (no local process for Frida).
Use -r <seed> for deterministic replay of interesting runs.
Bound long campaigns with -x or -R until you trust the target stability.

Previous← Installation NextConfiguration →