THE CIPHER BEHIND QSYRUPWD: RECONSTRUCTING IBM I PASSWORD HASHES

Summary from the TLDR InfoSec newsletter

Silent Signal reverse-engineered IBM i's QSYRUPWD API by tracing SCV 10 CIPHER calls through disassembly and live memory patching, mapping how the system chains SHA-1, MD5, AES-128, and Rijndael-256 operations to protect password verifiers once QPWDLVL moves past the legacy DES/SHA-1 modes. The team reconstructed the full decryption chain and confirmed it recovers crackable DES, SHA-1, and NT hash material even at QPWDLVL 4, despite the API requiring *ALLOBJ and *SECADM authority to call.