IBM i Password Hashes Cracked: QSYRUPWD's Hidden Cipher

The Cipher Behind Qsyrupwd: Reconstructing IBM i Password Hashes

During a penetration test, the author found that IBM i's QSYRUPWD API, which returns encrypted password data, produces output incompatible with existing cracking tools like John the Ripper for QPWDLVL 2–4. By tracing the API and disassembling system code, they uncovered a supervisor call (SCV 10) that delegates cryptographic operations to a hidden LIC routine. This analysis reveals the internal cipher behind QSYRUPWD, enabling password recovery on modern IBM i systems.