Qwen 3.8 27B reverse-engineers a commercial app's license check in 30 minutes
I gave Qwen 3.8 27B a reverse-engineering job and it finished in 30 minutes
Adam Conway, XDA's Lead Technical Editor, put the open-weights Qwen 3.8 27B to the test on a Lenovo ThinkStation PGX, challenging it to reverse-engineer a commercial app's license check—a task he assumed would need a frontier model. Despite initially refusing and spotting his jailbreak attempt, the model completed the job in 30 minutes using static analysis alone, recovering a deliberately obscured RSA key and even self-correcting its first wrong guess. Conway highlights the implications for threat models: a 27B model running locally on consumer hardware can now perform sophisticated reverse engineering, with privacy cutting both ways.
A model that fits in 17 GB of VRAM recovered a key the vendor had deliberately obscured, proving that it had deconstructed that entire chain effectively.
- djoldman
> I gave it the hardest real task that fits on one machine: reverse-engineering a commercial app's license check...
Respectfully, tasks that allow for explicit straightforward true/false or done/not-done tests are not the "hardest real task[s]." In fact, those are the ones that see the most gains from AI-assisted coding.
Testable tasks are where the largest opportunity is.
- VulgarExigency
> The first attempt at recovering the key was wrong in a very specific way; it produced a working key and the signature check passed, but a hash the binary computes as an integrity check didn't match. In my experience, most models would have called it done and left it at that, but Qwen 3.8 27B didn't do that. Instead, it highlighted the mismatch, went back to the drawing board, and kept going until the value matched byte for byte.
This seems to be a pattern in the more recently released models that I think accounts for an increase in the quality of their work. They are very persistent in verifying that their work is actually correct, so even if they're not as "smart" as bigger models that get it right the first time, they have the ability to follow through to ensure that the work is actually done.
- mdp2021
> As it turns out, probably unsurprisingly, Qwen recognizes common jailbreak attempts, and one of the first things it told me was that it wasn't going to fall for the jailbreak prompt
Now also see latest submission, https://news.ycombinator.com/item?id=49409073 :
# I spent $266 and four AI models to own my tablet. GLM-5.3 finished it in a day
> Quick context: the tablet is a 2021 Fire HD 10 that ran my Home Assistant dashboard and kept powering itself off: the logs showed Amazon's own software issuing the shutdowns, and the only permanent fix was root, which has never existed publicly for this model. Anthropic's and OpenAI's cyber safeguards wouldn't touch the project
Why should Anthropic and OpenAI thrive: they do not work on real problems.
- exceptione
Local models would be even better if they did not ship with all the refusal shenanigans built-in. You can safely bet organized crime has access to the best models without these hoops, which makes the case that the average user (=non-criminal) should have access too. As I understood from an ex-Anthropic employee, some orgs got access to Mythos based on their high enough spending level, not on other grounds.
Either we are in command over the software, or the corp is in command over us via the software. I can on a theoretical level understand the concerns, but either we ban all LLMs or we have a level playing field for everybody. Let's not forget: defense and offense are different sides of the same coin in software. I guess this wouldn't apply to bio weapons, but I am not in the know about that.
- pi-victor
i'm not good with paper work, in fact, i'm horrible with anything that's paperwork related.
for the past few days, i ran this model on my rtx 4090 + rtx 3070 and told it to check all the bills, invoices, contracts for me and my small company.
i used pi with llama and the pi-llama plugin.
oh, boy - i hooked it to my email, told it to download all of the invoices and bills i had for both me and my company and organize them by company/date/ and then merge them with the ones i have locally.
it did ocr, wrote scripts, organized everything neatly. i am now the most organized i've ever been in my life. Next: RAG on all the documents and bills i have.
if you connect staan-search (there is a pi plugin for that) and ctx7 to this it almost does miracles.
the downside is i have to sit next to my noisy threadripper as the magic happens and pay for the electricity, but that's about it, i'll gladly do that.
and as i finished this paragraph, it also finished organizing all my personal documents on my san.
i don't use the expression "game changer" easily, but it's hard to resist in this case. out of all the models i've used locally qwen3.8:27b blows everything out of the water.
my setup
# Logical CUDA0 = RTX 4090, logical CUDA1 = RTX 3070
export CUDA_VISIBLE_DEVICES=0,1
cd ~/projects/misc/llama.cpp/
exec ./build/bin/llama-server -hf ggml-org/Qwen3.8-27B-GGUF:Q4_K_M --mmproj /xx/xx/xx/xx/xx/mmproj-Qwen3.8-27B-Q8_0.gguf --host 0.0.0.0 --port 8080 --jinja --parallel 1 --split-mode layer --tenso […]
- saidinesh5
Lately I genuinely believe that the future will be large frontier models generating and updating inputs/skills for "good enough" local models to solve our daily problems.
A lot of tasks which need a bit of intelligence don't really need that much compute. Just good enough documentation / skills, tool calling and a good enough local model.
Not sure what exactly this means for all those data centers that are getting built... But exciting times.
- __alexander
In my benchmark Deepseek-v4-flash did much better than Qwen 3.8 27B at reverse engineering.
- geye1234
I'm far from being an engineer, but I can code a bit and have an engineering-adjacent role, and 3.8 27B "seems" -- purely subjectively -- miles ahead of 3.6 for the medium-difficulty tasks I give it. In particular, it's only started looping once in the 2 weeks or so I've had it. 3.6 did so every day.
I normally run with thinking low but it's still miles ahead.
I had been annoyed at not being able to run 0731 locally, but now I'm not sure I need it. I think I could leave 3.8 running overnight without waking up to find my office sweltering at 80F and seeing eternal loops on my screen.