Shulou(Shulou.com)06/01 Report--

Please indicate the source of the reprint: http://blog.csdn.net/guoyjoe/article/details/31018075

@ using BBED to simulate damage to 5 file block 1 (file header)

BBED > copy file 4 block 4 to file 5 block 1 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01400001-- -1ea20000 04000001 1a4b0000 00000104 99810000 sys@PROD > shutdown abort ORACLE instance shut down. Sys@PROD > starup SP2-0042: unknown command "starup"-rest of line ignored. Sys@PROD > startup ORACLE instance started. Total System Global Area 939495424 bytes Fixed Size 2233960 bytes Variable Size 251660696 bytes Database Buffers 679477248 bytes Redo Buffers 6123520 bytes Database mounted. ORA-01122: database file 5 failed verification check ORA-01110: data file 5:'/ u01 ORA-01210 append oradata ORA-01210: data file header is media corrupt

BBED begins to recover

1. Find a file header to overwrite

BBED > copy file 4 block 1 to file 5 block 1 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01400001-- -0ba20000 01000001 00000000 00000104 edbc0000

2. Enter Block 1 of document 5

BBED > set file 5 block 1 FILE# 5 BLOCK# 1

(1) change the address of the block 5 file Block 1, rdba_kcbh

BBED > p kcvfhbfh struct kcvfhbfh 20 bytes @ 0 ub1 type_kcbh @ 0 0x0b ub1 frmt_kcbh @ 1 0xa2 ub1 spare1_kcbh @ 2 0x00 ub1 spare2_kcbh @ 3 0x00 ub4 rdba_kcbh @ 4 0x01000001 ub4 bas_kcbh @ 8 0x00000000 ub2 wrp_kcbh @ 12 0x0000 ub1 seq_kcbh @ 14 0x01 ub1 flg_kcbh @ 15 0x04 (KCBHFCKV) ub2 chkval_kcbh @ 16 0xbced ub2 spare3_kcbh @ 18 0x0000

0x01000001blocks = "0000 0001 00001blocks" = "100blocks =" document No. 4 Block 1

Modify it to Block 5 and Block 1 = "0x01400001"

BBED > d / v offset 4 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 4 to 23 Dba:0x01400001-01000001 00000000 00000104 edbc0000 l. í?. 00000000 BBED > m / x 01004001 offset 4 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 4 to 23 Dba:0x01400001- -01004001 00000000 00000104 edbc0000 00000000

(2) kccfhfsz of file size

BBED > p kcvfhhdr struct kcvfhhdr 76 bytes @ 20 ub4 kccfhswv @ 20 0x00000000 ub4 kccfhcvn @ 24 0x0b200000 ub4 kccfhdbi @ 28 0x0f302c3e text kccfhdbn [0] @ 32 P text kccfhdbn [1] @ 33 R text kccfhdbn [2] @ 34 O text kccfhdbn [3] @ 35 D text kccfhdbn [4] @ 36 text kccfhdbn [5] @ 37 text kccfhdbn [6] @ 38 text kccfhdbn [7] @ 39 ub4 kccfhcsq @ 40 0x00000d3d ub4 kccfhfsz @ 44 0x00003200 s_blkz kccfhbsz @ 48 0x00 ub2 kccfhfno 52 0x0004 ub2 kccfhtyp @ 54 0x0003 ub4 kccfhacid @ 56 0x00000000 ub4 kccfhcks @ 60 0x00000000 text kccfhtag [0] @ 64. Sys@PROD > select name from v$dbfile where file#=5; NAME-/ u01/app/oracle/oradata/PROD/tp01.dbf [oracle@jfdb PROD] $ls-lFtr | grep tp01-rw-r-. 1 oracle oinstall 524296192 Jun 8 18:58 tp01.dbf sys@PROD > select 524296192 select 8192 from dual; 524296192 19x8192-64001

Note: block 0 is the operating system head and is not controlled by ORACLE.

64001-1 million 64000 blocks (decimal)

64000 (10) = = fa00 (16) = > bbed storage: 00fa0000

BBED > d / v offset 44 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 44 to 63 Dba:0x01400001-00320000 00200000 04000300 00000000 L.2. . 00000000 BBED > m / x 00fa0000 44 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 44 to 63 Dba:0x01400001-00fa0000 00200000 04000300 00000000 00000000

(3) modify the file number (4murmuri-> 5)

Ub2 kccfhfno @ 52 0x0004

BBED > d / v offset 52 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 52 to 71 Dba:0x01400001-04000300 00000000 00000000 00000000 l. 00000000 BBED > m / x 05 offset 52 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 52 to 71 Dba:0x01400001- -05000300 00000000 00000000 00000000

(4) modify SCN when the file is created

BBED > p kcvfhcrs struct kcvfhcrs, 8 bytes @ 100 ub4 kscnbas @ 100 0x00004b14 ub2 kscnwrp @ 104 0x0000 sys@PROD > select file#,CREATION_CHANGE# from v$datafile where file#=5 FILE# CREATION_CHANGE#-- 5 363921 sys@PROD > select to_char ('363921) from dual TO_CHAR ('36392-58d91 = = (inverted: 918d0500) = "00058d91 BBED > d / v offset 100File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 100to 119Dba:0x01400001-- -144b0000 00000000 30cf3e32 a41da532 l. K.0? > 2. ¥2 ec4f1900 BBED > m / x 918d offset 100 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 100 to 119 Dba:0x01400001-- -- 918d0000 00000000 30cf3e32 a41da532 ec4f1900 BBED > m / x 0500 offset 102 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 102 to 121Dba:0x01400001- -05000000 000030cf 3e32a41d a532ec4f 19000000 BBED > d / v offset 19000000 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 100 to 119 Dba:0x01400001- -- 918d0500 00000000 30cf3e32 a41da532 l. 0? > 2. ¥2 ec4f1900

(5) modify the creation time of the file ub4 kcvfhcrt @ 108 0x323ecf30 BBED > p kcvfhcrt ub4 kcvfhcrt @ 108 0x323ecf30 sys@PROD > select file#,to_char (CREATION_TIME,'yyyy-mm-dd hh34:mi:ss') createTime, 2 (to_char (CREATION_TIME,'yyyy')-1988) * 12 "31" 24 "3600 + 3 (to_char (CREATION_TIME) 'mm')-1) * 31' 24 '3600 + 4 (to_char (CREATION_TIME,'dd')-1) * 24' 3600 + 5 to_char (CREATION_TIME,'hh34') * 3600 + 6 to_char (CREATION_TIME,'mi') * 60 + 7 to_char (CREATION_TIME,'ss') createTimeSCN 8 from v$datafile WHERE file# in (4) FILE# CREATETIME CREATETIMESCN-4 2014-03-23 16:17:52 842977072 5 2014-03-29 10:32:22 843474742 sys@PROD > select'4' file#, to_char F TO_CHAR ('842977-- 4 323ecf30 = = > inverted: 30cf3e32 sys@PROD > select' 5' file#,to_char ('843474742) from dual; sys@PROD > select' 5' file#,to_char ('843474742) from dual F TO_CHAR ('843474-- 5 32466736 = = "36674632 BBED > d / v offset 108 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 108 to 32466736 Dba:0x01400001- -30cf3e32 a41da532 ec4f1900 00000000 l 0? > 2. ¥2 0. D713a532 BBED > m / x 36674632 offset 108 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 108 to 127 Dba:0x01400001-36674632 a41da532 ec4f1900 00000000 d713a532

(6) modify the tablespace number sword kcvfhtsn @ 3324 sys@PROD > select file#,TS# from v$datafile where file# in (4jue 5) FILE# TS#-4 455 BBED > d / v offset 332 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 332 to 351Dba:0x01400001 -- 04000000 05005553 45525300 00000000 l. Users. 00000000 l. BBED > m / x 05 offset 332 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 332 to 351 Dba:0x01400001-05000000 05005553 45525300 0000000000000000

(7) modify the relative file number

Ub4 kcvfhrfn @ 368 0x00000004

BBED > d / v offset 368 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 368 to 387 Dba:0x01400001-04000000 00000000 00000000 00000000 l. 00000000 l.... BBED > m / x 05 offset 368 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 368 to 387 Dba:0x01400001-05000000 00000000 00000000 0000000000000000

(8) modify the name of the tablespace

BBED > p kcvfhtnm text kcvfhtnm [0] @ 338 U text kcvfhtnm [1] @ 339 S text kcvfhtnm [2] @ 340 E text kcvfhtnm [3] @ 341 R text kcvfhtnm [4] @ 342 S text kcvfhtnm [5] @ 343 text kcvfhtnm [6] @ 344 text kcvfhtnm [7] @ 345 text kcvfhtnm [8] @ 346 text kcvfhtnm [9] @ 347 Text kcvfhtnm [10] @ 348 text kcvfhtnm [11] @ 349 text kcvfhtnm [12] @ 350 sys@PROD > select file# TS# from v$datafile where file# in (4 and 5) FILE# TS#-- 4 4 5 5 sys@PROD > select TS#,NAME from v$tablespace where ts# in (4 5) TS# NAME-4 USERS 5 TP1 BBED > d / v offset 338 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 338 to 357 Dba:0x01400001-55534552 53000000 00000000 00000000 l USERS. 00000000 sys@PROD > select dump ('USERS',16) from dual; DUMP (' USERS',16)-- Typ=96 Len=5: 53 sys@PROD > select dump ('TP1',16) from dual DUMP ('TP1' Typ=96 Len=3: 54 to 50 Dba:0x01400001 31 BBED > m / x 54503100 offset 338 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 338 to 357 Dba:0x01400001-- -- 54503100 53000000 00000000 00000000 00000000 BBED > m / x 00 offset 342File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 342to 361000000 Dba:0x01400001-- -00000000 00000000 00000000 BBED > d / v offset 338 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 338 to 357 Dba:0x01400001- 54503100 00000000 00000000 00000000 l TP1. 00000000

(9) modify the length of the tablespace

Ub2 kcvfhtln @ 336 0x0005

BBED > d / v offset 336 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 336 to 355 Dba:0x01400001-05005450 31000000 00000000 00000000 l.. TP1. 00000000 l.... BBED > m / x 03 offset 336 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 336 to 355 Dba:0x01400001-03005450 31000000 00000000 0000000000000000

(10) checkpoint

BBED > p kcvfhckp struct kcvfhckp, 36 bytes @ 484struct kcvcpscn 8 bytes @ 484 ub4 kscnbas @ 484 0x0019b1a1-> 1683873 ub2 kscnwrp @ 488 0x0000 ub4 kcvcptim @ 492 0x32a59921-> 849713441 ub2 kcvcpthr @ 496 0x0001 union u 12 bytes @ 500 struct kcvcprba 12 bytes @ 500 ub4 kcrbaseq @ 500 0x00000002 ub4 kcrbabno @ 504 0x000002e0 ub2 kcrbabof @ 508 0x0010 ub1 kcvcpetb [0] @ 512 0x02 ub1 kcvcpetb [1] @ 513 0x00 ub1 kcvcpetb [2] @ 514 0x00 ub1 kcvcpetb [3] @ 515 0x00 ub1 kcvcpetb [4] @ 516 0x00 ub1 kcvcpetb [5] @ 517 0x00 ub1 kcvcpetb [6] @ 518 0x00 ub1 kcvcpetb [7] @ 519 0x00 sys@PROD > select file# Rfile#,CREATION_TIME,checkpoint_change#,unrecoverable_change#,offline_change# from v$datafile FILE# RFILE# CREATION_ CHECKPOINT_CHANGE# UNRECOVERABLE_CHANGE# OFFLINE_CHANGE#-- 1 1 23-MAR-14 1683873 0 1658859 2 2 23-MAR-14 1683873 0 1658859 3 3 23-MAR-14 1683873 0 1658859 4 4 23-MAR-14 1683873 0 1658859 55 29-MAR-14 1684251 0 1658859 sys@PROD > select to_number ('19b1a1' 'xxxxxxxxxxxx') from dual TO_NUMBER ('19B1A1')-- 1683873 sys@PROD > select to_number ('32a59921') from dual TO_NUMBER ('32A59921))-- 849713441 sys@PROD > select file#,to_char (CHECKPOINT_TIME,'yyyy-mm-dd hh34:mi:ss') createTime, 2 (to_char (CHECKPOINT_TIME) 'yyyy')-1988) * 12' 31'24 '3600 + 3 (to_char (CHECKPOINT_TIME,'mm')-1) * 31' 24 '3600 + 4 (to_char (CHECKPOINT_TIME,'dd')-1) * 24' 3600 + 5 to_char (CHECKPOINT_TIME,'hh34') * 3600 + 6 to_char (CHECKPOINT_TIME,'mi') * 60 + 7 to_char (CHECKPOINT_TIME,'ss') createTimeSCN 8 from v$datafile WHERE file# in (4) FILE# CREATETIME CREATETIMESCN-4 2014-06-08 15:30:41 849713441 5 2014-06-08 15:38:33 849713913 sys@PROD > sys@PROD > select to_char TO_CHAR ('1684251-19b31b = > checkpoint SCN sys@PROD > select to_char for real document 5 (' 849713913) from dual TO_CHAR ('8497139-32a59af9 = > checkpoint time of real file 5 ub4 kscnbas @ 4840x0019b1a1 = = > checkpoint SCN 19b31b (upside down: 1bb319) ub4 kcvcptim @ 4920x32a59921 = > checkpoint time 32a59af9 of real file 5 (upside down : f99aa532) BBED > d / v offset 484File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 484to 503 Dba:0x01400001-a1b11900 00000000 2199a532 01000000 l? ±. 02000000 BBED > m / x 1bb319 offset 484 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 484 to 503 Dba:0x01400001- -1bb31900 00000000 2199a532 01000000 02000000 BBED > d / v offset 492File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 492to 511Dba:0x01400001-2199a532 0100000002000000 e0020000l! .¥ 2 ... 10007261 BBED > m / x f99a offset 492 File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 492 to 511 Dba:0x01400001 -f99aa532 01000000 02000000 e0020000 10007261

# check block

BBED > sum apply Check value for File 5, Block 1: current = 0x4a10, required = 0x4a10 BBED > verify DBVERIFY-Verification starting FILE = / u01/app/oracle/oradata/PROD/tp01.dbf BLOCK = 1 DBVERIFY-Verification complete Total Blocks Examined: 1 Total Blocks Processed (Data): 0 Total Blocks Failing (Data): 0 Total Blocks Processed (Index): 0 Total Blocks Failing (Index): 0 Total Blocks Empty: 0 Total Blocks Marked Corrupt: 0 Total Blocks Influx: 0 Message 531 not found; product=RDBMS; facility=BBED

# # check physical Bad Block

[oracle@jfdb PROD] $dbv file=tp01.dbf start=1 end=2 DBVERIFY: Release 11.2.0.3.0-Production on Sun Jun 8 21:48:37 2014 Copyright (c) 1982, 2011, Oracle and/or its affiliates All rights reserved. DBVERIFY-Verification starting: FILE = / u01/app/oracle/oradata/PROD/tp01.dbf DBVERIFY-Verification complete Total Pages Examined: 2 Total Pages Processed (Data): 0 Total Pages Failing (Data): 0 Total Pages Processed (Index): 0 Total Pages Failing (Index): 0 Total Pages Processed (Other): 2 Total Pages Processed (Seg): 0 Total Pages Failing (Seg): 0 Total Pages Empty: 0 Total Pages Marked Corrupt: 0 Total Pages Influx : 0 Total Pages Encrypted: 0 Highest block SCN: 1687542 (0.1687542)

# Open database and report an error

Sys@PROD > shutdown abort; ORACLE instance shut down. Sys@PROD > startup ORACLE instance started. Total System Global Area 939495424 bytes Fixed Size 2233960 bytes Variable Size 251660696 bytes Database Buffers 679477248 bytes Redo Buffers 6123520 bytes Database mounted. ORA-01122: database file 5 failed verification check ORA-01110: data file 5:'/ u01 file is more recent than control file file is more recent than control file old control file

# suspect checkpoint counter, here I first use BBED (method 1 rebuilds the control file, method 2 uses BBED to modify the calculator)

Ub4 kcvfhcpc @ 140 0x00000102

Ub4 kcvfhccc @ 1480x00000101

Idle > alter session set events' immediate trace name controlf level 8 years; Session altered. DATA FILE # 5: name # 4: / u01/app/oracle/oradata/PROD/tp01.dbf creation size=0 block size=8192 status=0xe head=4 tail=4 dup=1 tablespace 5 Index=5 krfil=5 prev_file=0 unrecoverable scn: 0x0000.00000000 01 0x0000.00058d91 01 Checkpoint cnt:226 scn 00:00:00 1988 Checkpoint cnt:226 scn: 0x0000.0019b31b 06 Accord 08 Stop scn 2014 15:38:33 Stop scn: 0xffff.ffffffff 06 Ont08 August 2014 07:44:07 Creation Checkpointed at scn: 0x0000.00058d91 03 Charpy 29 Grey 2004 10:32:22 thread:0 rba: (0x0.0.0) sys@PROD > select to_char ('226 pieces of jewelry xxxxxxxxxxxxx') from dual TO_CHAR ('226,- e2 sys@PROD > select to_char) from dual TO_CHAR ('225' -E1 BBED > d / v offset 140File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 140to 159Dba:0x01400001- 02010000 8bc6a532 01010000 b24f1900 l.? ¥20. 00000000 BBED > m / xe200 offset 140File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 140to 159Dba:0x01400001- -e2000000 8bc6a532 01010000 b24f1900 00000000 BBED > d / v offset 148File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 148 to 167Dba:0x01400001-010000000 b24f1900 00000000 d713a532 l. .2O. ×. ¥2 01000000 l. BBED > m / xe100 offset 148File: / u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 148to 167Dba:0x01400001- -e1000000 b24f1900 00000000 d713a532 01000000 BBED > sum apply Check value for File 5 Block 1: current = 0x4a10, required = 0x4a10 BBED > verify DBVERIFY-Verification starting FILE = / u01/app/oracle/oradata/PROD/tp01.dbf BLOCK = 1 DBVERIFY-Verification complete Total Blocks Examined: 1 Total Blocks Processed (Data): 0 Total Blocks Failing (Data): 0 Total Blocks Processed (Index): 0 Total Blocks Failing (Index): 0 Total Blocks Empty: 0 Total Blocks Marked Corrupt: 0 Total Blocks Influx: 0 Message 531 not found Product=RDBMS; facility=BBED

# Open the library again, OK!

Sys@PROD > select status from vogue instance; STATUS-MOUNTED sys@PROD > alter database open; Database altered.

# # points for attention in modifying data file headers:

1. Modify the DBA,rdba_kcbh of data

2. Modify the file size, kccfhfsz

3. Modify the file number, kccfhfno

4. Modify SCN,kcvfhcrs when the file is created

5. Modify the creation time of the file, kcvfhcrt

6. Modify the table space number, kcvfhtsn

7. Modify the relative file number, kcvfhrfn

8. Modify the name of the tablespace, kcvfhtnm

9. Modify the length of the table space, kcvfhtln

10. Modify the SCN,kcvfhckp of a checkpoint

11. Time when the checkpoint was modified, kcvcptim

12. Modify the checkpoint counter, kcvfhcpc

13. Modify the counter of the checkpoint that controls file backup, kcvfhccc

14. If you modify block 1 of file 1, the ground needle of his root rdba points to bootstrap$.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.