NXS Overview
Post-event existence scripts: enable, sets, rate limits, async reaper.
NXS (Nexsiz Existence Scripts) are post-event executable actors — not passive handlers. After discovery (crash, hang, interesting, coverage/state), Nexsiz can spawn them asynchronously to deepen, confirm, or notify.
Nexsiz (discovery) → crash / hang / interesting → NXS (existence & depth)
Default off
NXS is disabled until --nxs / NEXSIZ_NXS / config nxs= enables a set. Zero behaviour change when off.
Enable
nexsiz -h 10.0.0.5 -p 21 -m ftp --nxs default -v
nexsiz --nxs default --nxs-list
nexsiz ... --nxs intrusive --nxs-cooldown 60 --nxs-max-per-event 20 -v
nexsiz ... --nxs crash/auto-repro -v
export NEXSIZ_NXS=default
export NEXSIZ_NXS_PATH=$HOME/.nexsiz/nxs/bin:./nxs/bin
Sets (from categories.toml)
| Expression | Members (summary) |
|---|---|
default / safe | crash/auto-repro, crash/save-notify |
crash | Full crash family including intrusive probes |
hang | hang/timeout-analyzer |
intrusive | differential, state-diff, coverage-probe, auth-*, chain-repro |
external | external/notify-webhook |
| Concrete id | e.g. crash/chain-repro |
Rate limits
| Flag | Default | Meaning |
|---|---|---|
--nxs-cooldown | 30s | Per (event, crash_id, nxs_id) |
--nxs-max-per-event | 0 (∞) | Cap per event type |
--nxs-max-total | 0 (∞) | Cap total spawns |
Default events: crash, hang (override with config nxs_events=).
Async spawn & reaper
Spawn is non-blocking. A background reaper (src/nxs/reaper.rs) polls children with try_wait:
- Every exit logged:
[nexsiz/nxs] exit <id> → <code> - Exit 2 escalated as secondary finding → status
nxs_sec, JSONL under{output}/nxs-findings/secondary.jsonl, optional sidecar under NXS--out - Fuzzer hot-path never waits on NXS; zombies reaped only by the reaper thread
Search path
- Absolute path in
--nxs NEXSIZ_NXS_PATH/--nxs-path~/.nexsiz/nxs/bin/./nxs/bin/- Relative to nexsiz install / source tree
Build official binaries
cd nxs && ./build.sh
# → nxs/bin/nxs-*
cd nxs && ./tests/e2e.sh