Abstract Program options provide flexible software functionality control but complicate fuzz testing, as triggering many behaviors require specific option combinations. Although existing option-aware fuzzing approaches attempt to mutate options as inputs or leverage AI technologies to extract option relationships from documentation, these methods have limitations. Documentation is often incomplete, and some option dependencies are embedded deeply within program logic via data or control flows, making these methods challenging to detect all possible dependencies. This paper introduces OSmartPro , an advanced option-fuzzing approach that directly extracts options and infers option dependencies from source code. Given LLM’s capabilities to interpret program semantics, OSmartPro employs LLM-assisted static analysis to handle diverse option-parsing structures and extract comprehensive options. Through control and data dependency analysis, it constructs option impact graph , which it uses to guide fuzzing strategies. The tool successfully extracted complete options from all 59 programs in our test set, uncovering undocumented options in over 66% of them. Additionally, OSmartPro inferred 14,701 option combinations, identified 45.03% more execution paths compared to AFL++, and uncovered 54 zero-day vulnerabilities, of which 18 awarded CVE IDs. Lastly, in a benchmark comparison against four option-aware fuzzers, OSmartPro achieved higher line coverage in 66.7% (20 out of 30) of the programs.

Program options are ubiquitous and serve as a fundamental mechanism for configuring and customizing software behaviors. Given their widespread use, testing program options becomes essential to ensure that the software behaves as expected across various configurations. Existing option-aware fuzzers either mutate options as if they were standard program inputs or employ NLP techniques to deduce relationships among options from the documentation. However, there has not been a whitebox approach that generates option combinations by capturing the inherent execution logic of the program.

Karst rocky desertification is a special kind of land desertification developed under violent human impacts on the vulnerable eco-geo-environment of karst ecosystem. The fractional cover of photosynthetic vegetation (PV), non-photosynthetic vegetation (NPV), bare soil and exposed bedrock are key indicators of the extent and degree of land degradation in karst region. The vegetation fractional cover can be estimated approximately from remote sensing with vegetation indices. However, the vegetation indices cannot be easily applicable to all land cover types. In this study, we developed new spectral indices, karst rocky desertification synthesis indices (KRDSI), were then designed based on tied-spectrum permutation and unique spectral characteristics of main land cover types. Comparing with the use of traditional vegetation indices and LSU, the KRDSI was more consistent with the field measurement of main land cover fractions. Our study indicates that KRDSI is a useful tool for karst rocky desertification monitoring with remotely sensed data.