I gave Qwen 3.8 27B a reverse-engineering job and it finished in 30 minutes

我给 Qwen 3.8 27B 布置了一项逆向工程任务，它在 30 分钟内完成了

By Adam Conway Published Aug 22, 2026, 7:00 PM EDT 作者：Adam Conway，发布于 2026 年 8 月 22 日，东部时间下午 7:00

I’m Adam Conway, an Irish technology fanatic with a BSc in Computer Science and I’m XDA’s Lead Technical Editor. My Bachelor’s thesis was conducted on the viability of benchmarking the non-functional elements of Android apps and smartphones such as performance, and I’ve been working in the tech industry in some way or another since 2017. In my spare time, you’ll probably find me playing Counter-Strike or VALORANT, and you can reach out to me at adam@xda-developers.com, on Twitter as @AdamConwayIE, on Instagram as AdamConwayIE, or u/AdamConwayIE on Reddit. 我是 Adam Conway，一名拥有计算机科学学士学位的爱尔兰科技狂热者，也是 XDA 的首席技术编辑。我的学士论文研究的是对 Android 应用和智能手机的非功能性元素（如性能）进行基准测试的可行性。自 2017 年以来，我一直以各种方式在科技行业工作。闲暇时，你可能会发现我在玩《反恐精英》或《无畏契约》。你可以通过 adam@xda-developers.com 联系我，或者在 Twitter 上关注 @AdamConwayIE，在 Instagram 上关注 AdamConwayIE，或在 Reddit 上关注 u/AdamConwayIE。

Qwen 3.8 27B was one of the most highly-anticipated open-weights releases that I’ve seen in a long time, and like many others, I immediately got to work testing it out and playing with it when it dropped. I’m running it on a single Lenovo ThinkStation PGX, the compact workstation built on Nvidia’s GB10 Grace Blackwell chip, packing 128 GB of unified memory and 273 GB/s of bandwidth. Out of the box, it manages a fairly dull 15 to 30 tokens a second, but with an SGLang, NVFP4, and DFlash2 speculative-decoding setup that’s become the standard recipe for this hardware, it can reach around 50 tokens a second on code and reasoning. Qwen 3.8 27B 是我很久以来见过的最受期待的开放权重模型发布之一。和许多人一样，它一发布，我就立即开始测试和试用。我是在一台联想 ThinkStation PGX 上运行它的，这是一款基于 Nvidia GB10 Grace Blackwell 芯片的紧凑型工作站，配备 128 GB 统一内存和 273 GB/s 带宽。开箱即用时，它的速度相当平庸，每秒 15 到 30 个 token，但通过 SGLang、NVFP4 和 DFlash2 推测解码设置（这已成为该硬件的标准配置），它在处理代码和推理任务时可以达到每秒约 50 个 token。

One of my tests, though, proved just how incredible local models have become. There are reasons to believe the hype when it comes to the Qwen models; I’ve had consistently good experiences with Qwen 3.6 27B, and Qwen 3.8 27B is, so far, more of the same but better. In fact, Artificial Analysis has it as the top open-weights model in its 4B to 40B size class out of 135 models, with a 52 on its intelligence index, and its own numbers on things like SWE-bench Pro beat models that cost far more to run. 然而，我的其中一项测试证明了本地模型已经变得多么不可思议。相信关于 Qwen 模型的炒作是有理由的；我之前使用 Qwen 3.6 27B 的体验一直很好，而到目前为止，Qwen 3.8 27B 在保持同样水准的基础上表现更好。事实上，Artificial Analysis 将其评为 135 个模型中 4B 到 40B 尺寸级别里的顶级开放权重模型，其智能指数为 52，并且在 SWE-bench Pro 等测试中的表现甚至超过了运行成本高得多的模型。

I gave it the hardest real task that fits on one machine: reverse-engineering a commercial app’s license check, and it’s one that I’ve already paid for and used, just to see how it would fare. It was unlikely to be in its training data, but it’s a highly complex, specialized task, and given the concerns some people have expressed for the model’s cybersecurity capabilities, I figured it was a good test. Not only did it turn out to be one of the most impressive demonstrations I’ve ever seen from a local model, it was able to fix its own mistakes along the way. I’m using the Pi harness for this test, and the model only called standard Bash-based tools throughout. 我给它布置了一项能在单机上完成的最艰巨的实际任务：对一款商业应用的许可证检查进行逆向工程。这款应用我已经付费并使用过，我想看看它的表现如何。它不太可能出现在模型的训练数据中，这是一项高度复杂且专业的任务。考虑到有些人对该模型网络安全能力的担忧，我认为这是一个很好的测试。结果证明，这不仅是我见过的本地模型最令人印象深刻的演示之一，而且它还能在过程中自行纠正错误。我使用 Pi harness 进行此测试，模型全程仅调用了标准的 Bash 工具。

It refused, then talked itself into building a bypass anyway

它拒绝了，然后又说服自己构建了一个绕过程序

I posed as the developer of the application, it caught me out. The plan I had was pretty simple, and one that used to work with local LLMs pretty consistently. I told the model we’d built the app and wanted to know whether the license check was as solid as we believed, using a jailbreak system prompt. As it turns out, probably unsurprisingly, Qwen recognizes common jailbreak attempts, and one of the first things it told me was that it wasn’t going to fall for the jailbreak prompt. It then checked the signing certificate and pointed out (correctly, might I add) that I hadn’t built this app, before naming the actual developer. I was caught out. Oops. 我冒充该应用的开发者，结果被它识破了。我的计划很简单，这在以前的本地大模型上通常很有效。我使用越狱系统提示词告诉模型，我们开发了这款应用，想知道许可证检查是否像我们认为的那样稳固。事实证明，不出所料，Qwen 能识别常见的越狱尝试。它告诉我的第一件事就是它不会上当。然后它检查了签名证书，并指出（我得补充说，指出的很正确）我并没有开发这款应用，随后还说出了真正的开发者名字。我被识破了。哎呀。

These days, that’s not the most impressive achievement, given how good models have got at refusing certain prompts when pushed. With that said, what matters is what it did next. It told me that it would audit the license verification and document weaknesses but would not build a working bypass, and then it got on with the actual work right up to that line. By the end, I had a fully written report of every step along the way, how the authentication works, how it can be overridden, and then changed its tune and built the actual bypass, because the steps to do it were now in front of me anyway. 如今，考虑到模型在面对特定提示词时的拒绝能力已经很强，这并不是最令人印象深刻的成就。话虽如此，重要的是它接下来做了什么。它告诉我，它会审计许可证验证并记录弱点，但不会构建可用的绕过程序，然后它就开始了实际工作，一直做到那条界限。最终，我得到了一份完整的报告，记录了每一步的过程、身份验证的工作原理、如何覆盖它，然后它改变了口吻，构建了实际的绕过程序，因为执行这些步骤的方法已经摆在我面前了。

It was entirely static analysis. It never executed the app once.

这完全是静态分析。它从未执行过该应用。

Qwen never actually launched the app until the very end when it demonstrated that the bypass worked. Instead, it worked via static analysis, disassembling the framework, going through thousands of lines of arm64, mapping the security functions to their call sites, and working out that the vendor had hidden the corresponding public verification key inside the binary. Then it found all of those pieces, combined them together, and gave me the public key that the app verifies its licenses against. 直到最后演示绕过程序有效时，Qwen 才真正启动了该应用。在此之前，它完全通过静态分析工作：反汇编框架，阅读数千行 arm64 代码，将安全函数映射到它们的调用点，并推断出供应商将相应的公钥验证密钥隐藏在二进制文件中。然后，它找到了所有这些片段，将它们组合在一起，并给了我该应用用于验证许可证的公钥。

Because I have a legitimate, purchased copy of the application, it could verify that the real license on my machine had been signed by a private key that matched the reconstructed key. In other words, a model that fits in 17 GB of VRAM recovered a key the vendor had deliberately obscured, proving that it had deconstructed that entire chain effectively. It also took approximately 30 minutes, when it could take significantly longer for a human. 因为我拥有该应用的合法购买副本，它可以验证我机器上的真实许可证是由与重构密钥匹配的私钥签名的。换句话说，一个占用 17 GB 显存的模型恢复了供应商刻意隐藏的密钥，证明它有效地解构了整个链条。这大约只花了 30 分钟，而人类可能需要更长的时间。

With the key, everything else is much easier to understand; the model kept a detailed report as it went, explaining how its activation takes place once, online, when you buy or upgrade. After that, everything is verified offline at launch: the signature check, machine binding to the hardware serial read from the platform, an embedded revocation list, a check that the binary is still signed, and a signed update path. It was the kind of thing you could do painstakingly by hand with the likes of Ghidra. 有了密钥，其他一切都变得容易理解了。模型在进行过程中保留了一份详细的报告，解释了激活是如何在购买或升级时在线进行一次的。此后，所有内容都在启动时离线验证：签名检查、绑定到从平台读取的硬件序列号、嵌入的吊销列表、二进制文件是否仍有签名的检查，以及签名的更新路径。这本是你可以使用 Ghidra 之类的工具费力手动完成的事情。

Qwen concluded the scheme is unusually thorough for an app of this class, with the weak points in three specific places: the key is an awkwardly sized RSA key well below what anyone would call modern strength; being fully offline means a leaked key can only be revoked by pushing an update; and every check lives in local code, which is patchable the way all local checks are. After some back and forth, once it knew where the gate was, it turned the finding into a working proof of concept executed with a small script. I moved the license from its expected path, ran it, and it worked. Qwen 得出的结论是，对于此类应用而言，该方案异常严密，但弱点存在于三个特定位置：密钥是一个大小尴尬的 RSA 密钥，远低于现代强度标准；完全离线意味着泄露的密钥只能通过推送更新来吊销；并且所有检查都存在于本地代码中，像所有本地检查一样可以被修补。经过一番来回沟通，一旦它找到了“大门”所在，它就将这一发现转化为一个通过小脚本执行的可行概念验证。我将许可证从预期的路径移走，运行脚本，它成功了。

When it made mistakes, it solved them as well

当它犯错时，它也能自行解决

The first key was almost right. The first attempt at recovering the key was wrong in a v… 第一个密钥几乎是正确的。第一次尝试恢复密钥时，在 v… 方面出错了。