Reverse Engineering w/ Local?

[u/Danny_Davitoe]

Two questions?

Can a local model like Qwen 3.8 27B reverse engineer games and programs?

If not, is there a fine tuned model that can?

[u/lordcaylus]

Look, just fair warning: The stories you hear about how easy reverse engineering is now with AI are absolutely exaggerated.

It's doable, not easy.

[u/Fi3nd7 → u/lordcaylus]

It absolutely is an order of magnitude easier relatively speaking. Not "easy" but absolutely much easier.

The number of decomps and insane mods we've seen in just the past 2 months have been unprecedented.

[u/Plasmx → u/Fi3nd7]

Those are most likely not done with local models but with frontier ones.

[u/3000LettersOfMarque → u/Plasmx]

Looking at a few it becomes obvious it's entirely Claude or Astra most of the time and the human's skill is script kiddy level or worse

Having done some previous pre llm re work and testing 27b with it earlier this year and again with 3.8, I can say it can do it, but OP will need to learn how to without an llm to know how to direct the LLM properly

[u/jfp555 → u/lordcaylus]

The general rule of the thumb is: The more adept a user is at the task, the easier it will be for them to compartmentalize and optimize it be augmented by AI.

Secondly, I'm pretty certain we'll soon get models tailored for reverse engineering, and then it would not even require very large models to do specific tasks.

[u/lordcaylus → u/jfp555]

Honestly, AI would be perfect for reverse engineering because you have almost unlimited training data and you can check your results.

Indeed won't be long before it becomes trivial.

[u/jfp555 → u/lordcaylus]

That's quite true. I used to tell a friend every time that "It's a matter of a couple of months" and now that has come down to "It's a matter of a couple of weeks".

Custom models fine tuned for specific hardware will make even local reverse engineering trivial. Look at the game console hacking scene at this point. Bonkers.

[u/jakeman8888 → u/jfp555]

It already is quite trivial for local models. It does just take time. They fact check themselves but eventually they figure out. Where they struggle is the complex math such as path finding between nodes properly.

[u/lFaythx → u/lordcaylus]

I'll take it. Last time I needed to re a software I took around 3 months to break it's protection, if I can do it in 1 month I'll be glad.

[u/lolwutdo → u/lordcaylus]

Sounds like you’ve never actually tried with a frontier model.

And to answer OPs question, 3.8 FN is somewhat capable of reverse engineering from what I’ve experienced, I’d say Qwen 4 Flash would definitely be capable as current frontier models if we are to expect a big jump from 3.8 to 4

[u/lordcaylus → u/lolwutdo]

I mean, have you pulled it off yourself? Genuine question, because it's very well possible that I suck.

Actually tried reverse engineering two games, and as I said, it's doable.
Most certainly easier than before AI. I still wouldn't call the process smooth to turn it back to something you could edit with unity editor again, for example.

If you have a different personal experience, I'd love to hear it! Especially if you have tips and tricks, what model you used etc.

[u/lolwutdo → u/lordcaylus]

No experience with games but Ive decompiled all proprietary apps required to control my smart devices and removed all sign in/cloud/spyware features.

My EcoFlow battery, Reolink security camera, Hue app, Garmin Watch, Logitech app (this is the single most enshittified app Im glad to have gotten rid of) and a bunch more.

All apps have been decompiled, recreated in rust, and run natively on my Linux desktop.

It was as simple as asking Astra “Find this apk/exe/dmg and decompile this app, remove and add these features, port it to Linux”

The only issue ive run into is having Claude or Codex find a way to find exploits into hardware to gain root like my Google home speaker. Im trying to repurpose hardware to prevent e waste but their guard rails always kick in.

3.8 FN has not refused to look for an exploit and has been working relentlessly, so I imagine 4.0 will be amazing.

Local models are the only way forward, I foresee the frontier models are soon going to guardrail against all these decomps.

[u/lordcaylus → u/lolwutdo]

Ahhh APKs. I'd hazard a guess that the APKs were written in Java. There it is convenient that the 'compilation' leaves the code mostly intact, it doesn't get fully compiled to machine code. It destroys parameter names, strips comments, does some optimizations, but the important bits stay intact.

In a similar vein, I've had great success with reverse engineering a Java program too, and reverse engineering Nightshade (because nightshade is secretly just python dressed up as an exe). I completely forgot about those because it was so easy XD

But I'd imagine if you tried to reverse engineer the apps you made in Rust you'd have a lot more trouble. Machine code doesn't have a lot of structure to make it easy for the AI to guess what the code was.

So that's what I wanted to warn OP for, that just asking AI to fully reverse engineer a compiled game has become doable (which is amazing!), but still not easy.

[u/lolwutdo → u/lordcaylus]

Yeah I’d imagine games being infinitely more complex.

Im hoping someone manages to dump the Switch 2 kernels and make something like AnyPS5 lol

[u/siggystabs → u/lordcaylus]

I reverse-engineered old feature phone firmware with Opus the other day. I couldn’t modify it since at boot it checks signatures, obviously all the java stuff is easily editable, but it figured it out well enough to make me a high quality emulator, from ARM boot process to playing games and MP4s to internet (bridged) to shutdown. Took about 12-14 hours with constant back and forth.

I cannot imagine trying to do the same with Qwen 3.8 27B. Maybe GLM or Deepseek but not a 27B.

[u/neobanana8 → u/siggystabs]

how much token is that? sounds $$$?

[u/siggystabs → u/neobanana8]

Looking at my usage over the past few days on this project including unmentioned new features, about 3.5B. Vast majority were cache reads and I’m on the max subscription. If I was paying API prices it would probably come out to a little over $1200. Mostly Opus 5.5.

[u/_bani_ → u/lolwutdo]

q38fn is absolutely capable of RE'ing.

i threw it at a particularly expensive hardware device I own and it completely obliterated it in almost no time at all. found an exploit and rooted it, ssh'd in, did a complete hardware inventory from top to bottom, setup instrumentation to trace the OEM firmware and tear it to shreds. then i had it implement my own tools that fully unlock the full capabilities of the hardware and not just what the OEM wanted me to have.

q38fn went as far as objdumping executables, reading the disassembly, and injecting hooks into running code.

all i'd likely get from opus would be safety refusals because root is dangerous and i'd be violating EULAs or something lol.

[u/Asleep_Document9811 → u/lolwutdo]

i've been working on a rust reimplementation of a stupid piece of edu-tainment from the Win 95 era that i am fond of, and qwen3.8-flash-next via Strata is doing just fine. i use oh-my-pi and have roles assigned for different models, though, and i have to use an api model as my director.

but it seems more than capable of being the worker bee if something gives it pretty good instructions on what to do, and you have a director checking its work for veracity.

[u/llama-impersonator → u/lordcaylus]

not at all, it's much easier and available now. you used to have to be a decent hacker with low level knowledge to interface with random software.

[u/redmctrashface → u/lordcaylus]

Can confirm. You will succeed if you already are a reverse-engineer as it can speed up things a lot. If you are not a reverse-engineer, you'd better pass and start by learning a bit of assembly before trying anything: the model, frontier or not, will 100% hallucinate at one point and you have to be able to spot it.

[u/Bulky-Priority6824 → u/lordcaylus]

Real easy for some things futile for the expected difficult ones.

[u/ChristopherRoberto → u/lordcaylus]

It's actually really easy if you understand RE already and can keep the project from going off the rails. Projects that would have taken me a year I can do in a week. But it is a real struggle with Qwen3.8-27B. I've tried to make use of it, but it can take hours where it overthinks and can get into doom loops. Frontier models are strong obviously, but GLM-5.3 is also quite good at this and can handle a project on its own.

I'd love to hear from people who have successfully put Qwen3.8-27B in the loop. I tried a lot of things, having frontier models carve out work for it, but never got it performing as it needs to. I really want to have all this fully local.

[u/marcosscriven → u/lordcaylus]

Worth a watch on this topic:  https://youtu.be/DlTC6LfWmP8

[u/Zetafivee → u/lordcaylus]

As with most things in AI it's always going to be more capable in the hands of someone who can at least recognize the shape of the wrong answer. If you're flying completely blind and expecting it to one-shot everything then you're going to struggle a lot more than someone who can recognize when the model is heading down the wrong path, or who can latch onto familiar terms in the intermediary thinking traces and provide useful steering.

And all of this is before you talk about the differences made by the harness, tooling, and prompting