Docs/Reference
/CLI Reference
Complete CLI for Nexsiz v0.1.0. Source of truth: src/main.rs (print_usage + parse_args) and nexsiz-command.md.
Target
| Flag | Description | Default |
|---|
-h, --host <ADDR> | Target host | 127.0.0.1 |
-p, --port <PORT> | Target port | 80 |
-P, --proto, --protocol <PROTO> | Transport: tcp | udp | tcp |
-t, --cmd, --target-cmd <CMD> | Spawn target for crash monitor / snapshot | — |
-T, --timeout, --timeout-ms <MS> | Per-operation timeout (ms) | 500 |
Protocol & plugins
| Flag | Description |
|---|
-m, --model <NAME> | ftp | smtp | http | generic | dns | mqtt | smb | binary-lp | binary-lp-le | path/to/model.json |
-O, --oracle <NAME> | default | strict | crash | hang | coverage | differential | sanitizer | diffsan | expanded |
-i, --int, --integrity <NAME> | default | http | ftp | smtp | binary | binary-le | null |
-e, --enc, --encryptor <NAME> | null | xor | chacha20 | tls-record | chacha20+tls | xor+tls |
-k, --key, --enc-key <KEY> | Encryptor key (hex 0x… or raw string) |
Oracle notes
| Name | Behaviour |
|---|
differential | Multi-dimensional behavioural divergence |
sanitizer | ASan/UBSan patterns, length anomaly, null-byte, protocol violation |
diffsan | differential + sanitizer + coverage (recommended deep campaigns) |
expanded | diffsan + error oracle (maximum sensitivity) |
Model inference (offline)
| Flag | Description |
|---|
--infer-model | Infer protocol model from -s seed directory and exit |
--infer-out <PATH> | Write inferred model (JSON with json-model, else human dump) |
nexsiz --infer-model -s seeds/ftp -v
nexsiz --infer-model -s seeds/custom --infer-out models/inferred.json
Coverage
| Flag | Description | Default |
|---|
-C, --cov, --coverage <NAME> | null | map | software | null |
-S, --shm, --coverage-shm <ID> | SHM id for Frida (/nexsiz-cov-<ID>) | — |
Environment: NEXSIZ_SHM_ID.
Campaign control
| Flag | Description | Default |
|---|
-w, --workers <N> | Worker threads | #cores |
-s, --seed, --seed-dir <DIR> | Seed directory | seeds |
-o, --out, --output-dir <DIR> | Output directory | output |
-c, --config <FILE> | Load key=value config file | — |
-Y, --rpc, --python-rpc <PATH> | Unix socket for Python/RPC | — |
-n, --no-reuse | Disable connection reuse | reuse on |
-r, --rng, --rng-seed <N> | Deterministic RNG seed | — |
-L, --libafl | LibAFL path (needs --features libafl) | native |
Snapshot
| Flag | Description | Default |
|---|
-Z, --snapshot | Enable process snapshot / restore | off |
--snapshot-backend <B> | null | process | criu | process when -Z |
process — kill + respawn (requires -t)criu — needs --features criu and criu on PATH
Execution limits
| Flag | Description |
|---|
-x, --execs, --max-execs <N> | Stop after N executions |
-R, --runtime, --max-runtime <SECS> | Stop after SECS seconds |
NXS
| Flag | Description | Default |
|---|
--nxs <EXPR> | Set: default, crash, hang, safe, intrusive, external, or concrete ids | disabled |
--nxs-path <DIRS> | Extra colon-separated search paths | — |
--nxs-cooldown <SECS> | Cooldown per (event, crash, nxs) | 30 |
--nxs-max-per-event <N> | Cap per event (0 = unlimited) | 0 |
--nxs-max-total <N> | Cap total spawns (0 = unlimited) | 0 |
--nxs-list | Resolve set, print found/missing, exit | — |
Env: NEXSIZ_NXS, NEXSIZ_NXS_PATH. Default events: crash, hang.
General
| Flag | Description |
|---|
-v, --verbose | Verbose logging |
-?, --help | Show help |
-V, --version | Show version |
Examples
# Basic FTP
nexsiz -h 127.0.0.1 -p 21 -m ftp -s seeds/ftp -o out/ftp -v
# DNS / MQTT / SMB
nexsiz -h 10.0.0.5 -p 53 -m dns -P tcp -v
nexsiz -h 10.0.0.5 -p 1883 -m mqtt -v
nexsiz -h 10.0.0.5 -p 445 -m smb -v
# NXS
nexsiz -h 127.0.0.1 -p 21 -m ftp --nxs default -v
nexsiz --nxs default --nxs-list
# Coverage + RPC
nexsiz -h 127.0.0.1 -p 21 -m ftp -C map --shm demo -Y /tmp/nexsiz.sock -v
# Snapshot
nexsiz -t "./target_daemon" -Z --snapshot-backend process -m ftp -v
# LibAFL (needs --features libafl)
nexsiz -h 127.0.0.1 -p 21 -m ftp -L -v