0:00The question: how far down can reverse-engineering scale? Last time NetworkCoder ran the biggest model that fits a consumer GPU — 125B parameters — and it "crushed it." This time: Qwen 27B, less than a quarter the size, driving REA + Ghidra through the Hermes agent, all on a single RTX 3090, completely offline. The verdict up front: it cracks a save file and writes a working license keygen, self-correcting along the way.
The stack
2:41One RTX 3090 (24 GB VRAM) is the entire budget. llama.cpp runs the model locally; Qwen3.8-27B, quantized to ~17.5 GB on disk so it fits (the full model never would). 3:28The server settings matter: a 128K context window (RE eats context), an 8-bit KV cache (halves context memory), and a single slot so the whole 128K goes to one agent. The honest trade-off: llama.cpp grabs all that memory up front, so it's at ~21 GB of 24 the moment it starts, holding flat the whole session. A quick test prompt returns ~41 tokens/sec. Underneath REA: Java (Ghidra runs on it), Node, and Ghidra itself — the free reverse-engineering suite originally released by the NSA. The agent driving it all is Hermes (Nous Research), pointed at the local server.
Tool search
5:37The part that genuinely surprised him: REA ships 207 tools, and normally every tool's description loads into context up front. In his last video, a tool-heavy setup blew context to ~150,000 tokens and the agent drowned. This time the context meter sits at ~9,000 empty, and switching on REA with all 207 tools only takes it to 11,000 — about 2,000 tokens for the whole toolkit. The trick is tool search: instead of loading every tool up front, the agent pulls in the one tool it needs the moment it needs it. That's a big part of why this works on a small model.
Challenge 1: the save file
7:07Both targets were built by him, then stripped of symbols and source — just raw binaries. First: a terminal game, prompt "reverse engineer this save file, set my gold to 999,999, don't touch the game, explain every part with evidence." The agent loads the REA skill, picks the right 5 tools out of 200, and reads the binary. Its first read of the save layout is wrong (gold at offset 14); it tests against the real bytes, sees the values don't line up, and corrects itself — gold is at offset 21. Then it reconstructs the entire 57-byte format — header, XOR key stream, CRC checksum — and finds all four tamper checks. ~40 minutes in, context filled and it compacted itself in under 3 minutes; a dropped connection, a "continue," and it picked up exactly where it left off. Result: a fresh save, 61 gold → 999,999, loaded in the unmodified game. Five for five.
Challenge 2: the keygen
8:57Harder: "Note Pro," a notes app locked behind a license key — and this time the goal is a keygen, not a crack. It reads the strings and finds the key alphabet plus a license key already baked in (and revoked). It decompiles the validator: 20 characters from that alphabet, two characters that cancel out, another pair summing to a specific value, and the hard one — the last four characters are a 20-bit hash of everything before them. It doesn't trust the decompiler on the hash; it drops to assembly and traces the hash loop instruction by instruction. Then the detail he liked most: that baked-in revoked key passes every mathematical check — it's a perfectly valid key that's been blacklisted — and the model notices and makes sure its keygen never generates it, "nobody asked it to." Five fresh keys, all five unlock Pro; the revoked key is correctly refused.
Where it struggles
10:35The scoreboard: 5/5 on the save hack, 5/5 on the keygen, bonus caught both times, on a 27B model, one 24 GB card, zero cloud bill. Speed ~40 tokens/sec — not instant, but enough to watch it reason in real time. Two real limits: memory (context is the ceiling on local setups — the save hack filled up and had to compact its own history; bigger binaries need more context) and time (save hack ~50 minutes, keygen under 20; bigger software takes much longer).
The ethics
11:22The disclaimer is explicit and worth keeping: use this only on binaries you own or have clear permission to inspect — many licenses forbid reverse engineering and the law varies by country. The legitimate uses are real: your own lost code, old internal tools nobody maintains, authorized security research, and plain learning.
Claims checked
The tools are real. morluto/rea (MIT, "reverse engineer anything with agents") — now ~375k★ (it was ~28.5k stars earlier this month; the repo exploded). Qwen 27B = Qwen/Qwen3.8-27B (7.85M downloads, with GGUF builds like unsloth/Qwen3.8-27B-GGUF). Ghidra is the NSA's open-source reverse-engineering suite. Hermes is Nous Research's agent.
The 5/5 save hack and 5/5 keygen, the 57-byte format, the 20-bit hash, the ~40 t/s, and the ~50-min/~20-min times are the creator's own runs on his own binaries — not independently reproduced.
Reverse engineering is legally restricted against many licensed binaries; the creator's "own binaries or clear permission" caveat is the correct frame and is preserved here.