512 bytes at a time: reconstructing IBM i save-file checksums
To reconstruct IBM i save-file checksums, one must consider two container-consistency checksum mechanisms used by IBM i save files, also known as SAVFs. Each 512-byte payload within a SAVF has a 16-byte trailer, and the logical stream carries a 16-byte global checksum in its final payload. Both mechanisms were reconstructed, modified, and repaired by creating a small SAVF containing a disposable program named USERB1/CALLAES.
The original SAVF was transferred as a binary file for inspection byte by byte. After modifying three payload bytes and a stale global checksum, repairing the container changed only the global-checksum field and the final record trailer. The global algorithm's table and constants were found in IBM i Licensed Internal Code (LIC) installation media.
The reconstructed format allowed removing one complete object from a two-object SAVF. The SAVF's deterministic, unkeyed checksum values provide internal consistency checks but do not authenticate the source or prevent modification.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
