Why this matters IBM i does not treat an application program as a normal file that happens to contain POWER instructions. A compiler produces Machine Interface (MI) code, IBM i’s stable instruction-level boundary, and the system translates it into a native form. The generated native code contains checks that support...
2026-11-10 — 18 minute readThe Rijndael key builder in Part 1 worked for the first set of samples, but its split-buffer model was wrong. QSYS/QZLSRTPW builds one 32-byte value, 00×5 ‖ des_plaintext_16 ‖ format_byte ‖ username_cp037_10, and insertion-sorts all 32 bytes in ascending order. I tested the corrected decoder against almost 900 QSYRUPWD API...
2026-10-29 — 14 minute readIntro What exactly must be recalculated when bytes inside an IBM i save file are modified? IBM i save files, usually called SAVFs, use two container-consistency checksum mechanisms. Every 512-byte payload has a 16-byte trailer, and the logical stream also carries a 16-byte global checksum in its final payload. I...
2026-10-12 — 35 minute readThis is a write-up of a bug chain in the IBM Db2 Mirror for i web interface. The chain starts without authentication, reaches arbitrary Java/JSP execution in the Liberty application server, and can then cross into QSECOFR on the local IBM i system. I am not publishing the JSP payload...
2026-09-14 — 24 minute readIntro QSYRUPWD (Retrieve Encrypted User Password) is an IBM i API that returns password-related data for a specified user profile in encrypted form to authorized callers. IBM i is IBM’s integrated enterprise platform, originating from the AS/400 line, and is still widely used for business-critical workloads such as ERP, finance,...
2026-07-28 — 41 minute readIntro We discovered and developed an exploit for a pre-authentication remote code execution vulnerability in IBM i Management Central (MGTC). The vulnerability allows an unauthenticated attacker to execute arbitrary CL commands as QSECOFR – the root-equivalent profile on IBM i – by abusing the MGTC packet protocol on port 5555....
2026-06-05 — 13 minute readIntro At the end of last year and the beginning of this one, I focused on IBM i library list (LIBL) based privilege escalation vulnerabilities — a subtle but critical class of issues that can quietly undermine the security of both the core operating system and 3rd party applications. While...
2025-10-22 — 5 minute readIntro At TROOPERS24, we demonstrated how IBM i systems – still widely used in enterprise environments – can be compromised in both authenticated and unauthenticated scenarios, using only built-in services and a basic understanding of the underlying mechanisms. Despite being labeled “legacy,” these systems remain active in finance, logistics, and...
2025-09-04 — 8 minute read