I gave Qwen 3.8 27B a reverse-engineering job I assumed needed a frontier model, and it finished in 30 minutes
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
An author ran Qwen 3.8 27B locally on a Lenovo ThinkStation PGX (Nvidia GB10 Grace Blackwell chip) and tasked it with reverse-engineering the license verification of a commercial app they had legitimately purchased. The model initially refused a jailbreak attempt, correctly identified the actual developer, then proceeded to statically analyze the binary's arm64 disassembly, extracted the embedded public verification key, and eventually built a working authentication bypass, self-correcting after an initial key failed an integrity hash check. The whole process took roughly 30 minutes and ran fully offline with no cloud involvement. The author frames this as evidence that capable reverse-engineering ability now fits on consumer-grade local hardware, raising dual-use security implications since the same local privacy properties that make such models appealing also expand what a malicious user could attempt offline.
Table of contents
It refused, then talked itself into building a bypass anywayIt was entirely static analysisWhen it made mistakes, it solved them as wellA local 27B is now a real input to threat modelsThis class of capability fits on one machineQuestions this post answers
Can a local 27B parameter model like Qwen 3.8 27B actually reverse-engineer a commercial app's license check?
Yes, a locally-run Qwen 3.8 27B model successfully performed static analysis on a commercial app's arm64 binary, disassembled the licensing framework, extracted the embedded public verification key, and built a working authentication bypass in about 30 minutes, running entirely offline on a Lenovo ThinkStation PGX with no cloud involvement. Developers weighing the security implications of local AI models can track capability shifts like this on daily.dev.
What hardware setup and token throughput does Qwen 3.8 27B get on the Nvidia GB10 Grace Blackwell chip?
On a Lenovo ThinkStation PGX with an Nvidia GB10 Grace Blackwell chip, 128 GB unified memory, and 273 GB/s bandwidth, Qwen 3.8 27B runs at 15-30 tokens per second out of the box, reaching around 50 tokens per second on code and reasoning tasks when using an SGLang, NVFP4, and DFlash2 speculative-decoding setup. Anyone benchmarking local model throughput on Grace Blackwell hardware can follow similar setups on daily.dev.
Does Qwen 3.8 27B correct its own mistakes during a complex reverse-engineering task?
Yes, when its first recovered license key passed the signature check but failed a separate integrity hash comparison, Qwen 3.8 27B identified the mismatch on its own and kept iterating until it produced a key that matched byte for byte, rather than stopping at a partially working result. Developers evaluating self-correcting behavior in local models can keep up with real-world tests on daily.dev.