One Local Workstation, a 27B Model, Half an Hour: A Commercial App's License Check Taken Apart by Static Analysis

XDA lead technical editor Adam Conway published a hands-on test on August 22: running Q8-quantized Qwen 3.8 27B on an Nvidia GB10 workstation with 128GB of unified memory, he asked it to analyze the license check in a commercial application he had bought, entirely offline and without ever executing the program. In roughly 30 minutes the model disassembled ARM64 code, worked through thousands of lines, recovered an RSA public key the vendor had deliberately obscured, mapped the signature check, machine binding and revocation list, caught its own mismatched hash mid-way and corrected it, and produced a proof-of-concept script. Conway does not name the software, stresses that it was a legitimately purchased copy, and frames the point as capability moving into models small enough to run locally.

The Story Isn't the Crack, It's Where It Ran

Reverse-engineering a license check is not new work; a professional with IDA or Ghidra and enough experience gets there too. What changed in this test are the quantities around it — **where it happened, how long it took, and whether anything left the machine**. The box was a Lenovo ThinkStation PGX (GB10 Grace Blackwell, 128GB unified memory, 273 GB/s of bandwidth), the model was Qwen 3.8 27B at Q8, served through SGLang with NVFP4 and speculative decoding, running around 50 tokens per second on code and reasoning. The whole run was static analysis: the application was never executed, and no data left the workstation. The detail that says the most about the model's state is the self-correction. After its first attempt at recovering the key, the resulting hash didn't match; the model flagged the inconsistency and went back to fix it rather than carrying a wrong conclusion forward. That is the expensive part of long reverse-engineering chains.

What It Means for Vendors and Security Teams

First, "obscurity buys time" is getting worse as a strategy. A deliberately hidden public key came out of a single workstation in half an hour, which says obfuscation stops the person poking around casually, not the person with local compute. Protecting licensing still comes down to server-side validation, keys that never sit in the binary, and a revocation path that actually works. Second, this happened **offline**, which removes a control layer enterprises have been leaning on. Auditing cloud API calls and filtering on prompt content does nothing about a disconnected workstation. Internal red teams and DFIR groups can treat this as a baseline update: static analysis that used to need an outside specialist and several days now starts with 27B of weights and some VRAM. Third, don't read it as "models will crack anything." This is one application, one path through it, guided by someone who knows the work — a sample size of one. Conway keeps his own conclusion at "the capability threshold moved down," not a claim that general reverse-engineering is now automated. And for anyone tempted to reproduce it: touching software you don't own is a separate matter, and the legal line doesn't move because the tooling got better.

via: XDA, "I gave Qwen 3.8 27B a reverse-engineering job and it finished in 30 minutes", Hacker News discussion