> find out all the ways this thing works.

Mmm..aren't LLMs bad at exhaustively iterating all possibilities? So shouldn't the generated possibilities be manually checked?

You can provide the list of possibilities and use LLMs to generate the tests. Then you have to review the generated tests...