转载请注明出处:
@@@@@@@利用BBED模拟损坏5文件1号块(文件头)
BBED> copy file 4 block 4 to file 5 block 1 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01400001------------------------------------------------------------------------ 1ea20000 04000001 1a4b0000 00000104 99810000 <32 bytes per line>sys@PROD> shutdown abort;ORACLE instance shut down.sys@PROD> starupSP2-0042: unknown command "starup" - rest of line ignored.sys@PROD> startupORACLE instance started.Total System Global Area 939495424 bytesFixed Size 2233960 bytesVariable Size 251660696 bytesDatabase Buffers 679477248 bytesRedo Buffers 6123520 bytesDatabase mounted.ORA-01122: database file 5 failed verification checkORA-01110: data file 5: '/u01/app/oracle/oradata/PROD/tp01.dbf'ORA-01210: data file header is media corruptBBED開始恢复
1、找个文件头覆盖
BBED> copy file 4 block 1 to file 5 block 1 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01400001------------------------------------------------------------------------ 0ba20000 01000001 00000000 00000104 edbc0000 <32 bytes per line>2、进入5文件1号块
BBED> set file 5 block 1 FILE# 5 BLOCK# 1
(1)改块的地址5文件1号块,rdba_kcbh
BBED> p kcvfhbfhstruct kcvfhbfh, 20 bytes @0 ub1 type_kcbh @0 0x0b ub1 frmt_kcbh @1 0xa2 ub1 spare1_kcbh @2 0x00 ub1 spare2_kcbh @3 0x00 ub4 rdba_kcbh @4 0x01000001 ub4 bas_kcbh @8 0x00000000 ub2 wrp_kcbh @12 0x0000 ub1 seq_kcbh @14 0x01 ub1 flg_kcbh @15 0x04 (KCBHFCKV) ub2 chkval_kcbh @16 0xbced ub2 spare3_kcbh @18 0x00000x01000001===》0000 0001 0000==》100==》4号文件1号块改动成5号1块 ===》0x01400001
BBED> d /v offset 4 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 4 to 23 Dba:0x01400001------------------------------------------------------- 01000001 00000000 00000104 edbc0000 l ............í?.. 00000000 BBED> m /x 01004001 offset 4 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 4 to 23 Dba:0x01400001------------------------------------------------------------------------ 01004001 00000000 00000104 edbc0000 00000000
(2)文件的大小kccfhfsz
BBED> p kcvfhhdrstruct kcvfhhdr, 76 bytes @20 ub4 kccfhswv @20 0x00000000 ub4 kccfhcvn @24 0x0b200000 ub4 kccfhdbi @28 0x0f302c3e text kccfhdbn[0] @32 P text kccfhdbn[1] @33 R text kccfhdbn[2] @34 O text kccfhdbn[3] @35 D text kccfhdbn[4] @36 text kccfhdbn[5] @37 text kccfhdbn[6] @38 text kccfhdbn[7] @39 ub4 kccfhcsq @40 0x00000d3d ub4 kccfhfsz @44 0x00003200 s_blkz kccfhbsz @48 0x00 ub2 kccfhfno @52 0x0004 ub2 kccfhtyp @54 0x0003 ub4 kccfhacid @56 0x00000000 ub4 kccfhcks @60 0x00000000 text kccfhtag[0] @64 .................... sys@PROD> select name from v$dbfile where file#=5;NAME--------------------------------------------------/u01/app/oracle/oradata/PROD/tp01.dbf[oracle@jfdb PROD]$ ls -lFtr |grep tp01-rw-r-----. 1 oracle oinstall 524296192 Jun 8 18:58 tp01.dbfsys@PROD> select 524296192/8192 from dual;524296192/8192-------------- 64001注:0号块他是操作系头不为ORACLE所控制64001-1=64000个块(10进制)64000(10)==fa00(16)=====>bbed存储:00fa0000
BBED> d /v offset 44 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 44 to 63 Dba:0x01400001------------------------------------------------------- 00320000 00200000 04000300 00000000 l .2... .......... 00000000 BBED> m /x 00fa0000 44 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 44 to 63 Dba:0x01400001------------------------------------------------------------------------ 00fa0000 00200000 04000300 00000000 00000000
(3)改动文件号(4--->5)
ub2 kccfhfno @52 0x0004
BBED> d /v offset 52 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 52 to 71 Dba:0x01400001------------------------------------------------------- 04000300 00000000 00000000 00000000 l ................ 00000000 BBED> m /x 05 offset 52 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 52 to 71 Dba:0x01400001------------------------------------------------------------------------ 05000300 00000000 00000000 00000000 00000000
(4)改动文件创建时SCN
BBED> p kcvfhcrsstruct kcvfhcrs, 8 bytes @100 ub4 kscnbas @100 0x00004b14 ub2 kscnwrp @104 0x0000sys@PROD> select file#,CREATION_CHANGE# from v$datafile where file#=5; FILE# CREATION_CHANGE#---------- ---------------- 5 363921sys@PROD> select to_char('363921','xxxxxxxxxxxxx') from dual;TO_CHAR('36392-------------- 58d91 ===(倒:918d0500)==》00058d91BBED> d /v offset 100 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 100 to 119 Dba:0x01400001------------------------------------------------------- 144b0000 00000000 30cf3e32 a41da532 l .K......0?
>2¤.¥2 ec4f1900 BBED> m /x 918d offset 100 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 100 to 119 Dba:0x01400001 ------------------------------------------------------------------------ 918d0000 00000000 30cf3e32 a41da532 ec4f1900 BBED> m /x 0500 offset 102 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 102 to 121 Dba:0x01400001 ------------------------------------------------------------------------ 05000000 000030cf 3e32a41d a532ec4f 19000000 BBED> d /v offset 100 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 100 to 119 Dba:0x01400001 ------------------------------------------------------- 918d0500 00000000 30cf3e32 a41da532 l ........0?>2¤.¥2 ec4f1900
(5)改动文件创建时间ub4 kcvfhcrt @108 0x323ecf30BBED> p kcvfhcrtub4 kcvfhcrt @108 0x323ecf30sys@PROD> select file#,to_char(CREATION_TIME,'yyyy-mm-dd hh24:mi:ss') createTime, 2 (to_char(CREATION_TIME,'yyyy')-1988)*12*31*24*3600+ 3 (to_char(CREATION_TIME,'mm')-1)*31*24*3600+ 4 (to_char(CREATION_TIME,'dd')-1)*24*3600+ 5 to_char(CREATION_TIME,'hh24')*3600+ 6 to_char(CREATION_TIME,'mi')*60+ 7 to_char(CREATION_TIME,'ss') createTimeSCN 8 from v$datafile WHERE file# in(4,5); FILE# CREATETIME CREATETIMESCN---------- ------------------- ------------- 4 2014-03-23 16:17:52 842977072 5 2014-03-29 10:32:22 843474742sys@PROD> select '4' file#, to_char('842977072','xxxxxxxxxxxxxx') from dual;F TO_CHAR('842977- ---------------4 323ecf30 ===>倒:30cf3e32sys@PROD> select '5' file#,to_char('843474742','xxxxxxxxxxxxxx') from dual;sys@PROD> select '5' file#,to_char('843474742','xxxxxxxxxxxxxx') from dual;F TO_CHAR('843474- ---------------5 32466736 ==》36674632BBED> d /v offset 108 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 108 to 127 Dba:0x01400001------------------------------------------------------- 30cf3e32 a41da532 ec4f1900 00000000 l 0?>2¤.¥2ìO...... d713a532BBED> m /x 36674632 offset 108 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 108 to 127 Dba:0x01400001------------------------------------------------------------------------ 36674632 a41da532 ec4f1900 00000000 d713a532(6)改动表空间号
sword kcvfhtsn @332 4sys@PROD> select file#,TS# from v$datafile where file# in(4,5); FILE# TS#---------- ---------- 4 4 5 5BBED> d /v offset 332 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 332 to 351 Dba:0x01400001------------------------------------------------------- 04000000 05005553 45525300 00000000 l ......USERS..... 00000000 l .... <16 bytes per line>BBED> m /x 05 offset 332 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 332 to 351 Dba:0x01400001------------------------------------------------------------------------ 05000000 05005553 45525300 00000000 00000000(7)改动相对文件号
ub4 kcvfhrfn @368 0x00000004
BBED> d /v offset 368 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 368 to 387 Dba:0x01400001------------------------------------------------------- 04000000 00000000 00000000 00000000 l ................ 00000000 l .... <16 bytes per line>BBED> m /x 05 offset 368 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 368 to 387 Dba:0x01400001------------------------------------------------------------------------ 05000000 00000000 00000000 00000000 00000000(8)改动表空间的名称
BBED> p kcvfhtnmtext kcvfhtnm[0] @338 Utext kcvfhtnm[1] @339 Stext kcvfhtnm[2] @340 Etext kcvfhtnm[3] @341 Rtext kcvfhtnm[4] @342 Stext kcvfhtnm[5] @343 text kcvfhtnm[6] @344 text kcvfhtnm[7] @345 text kcvfhtnm[8] @346 text kcvfhtnm[9] @347 text kcvfhtnm[10] @348 text kcvfhtnm[11] @349 text kcvfhtnm[12] @350 sys@PROD> select file#,TS# from v$datafile where file# in(4,5); FILE# TS#---------- ---------- 4 4 5 5sys@PROD> select TS#,NAME from v$tablespace where ts# in(4,5); TS# NAME---------- -------------------------------------------------- 4 USERS 5 TP1BBED> d /v offset 338 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 338 to 357 Dba:0x01400001------------------------------------------------------- 55534552 53000000 00000000 00000000 l USERS........... 00000000sys@PROD> select dump('USERS',16) from dual;DUMP('USERS',16)----------------------------Typ=96 Len=5: 55,53,45,52,53sys@PROD> select dump('TP1',16) from dual;DUMP('TP1',16)----------------------Typ=96 Len=3: 54,50,31BBED> m /x 54503100 offset 338 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 338 to 357 Dba:0x01400001------------------------------------------------------------------------ 54503100 53000000 00000000 00000000 00000000 <32 bytes per line>BBED> m /x 00 offset 342 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 342 to 361 Dba:0x01400001------------------------------------------------------------------------ 00000000 00000000 00000000 00000000 00000000 <32 bytes per line>BBED> d /v offset 338 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 338 to 357 Dba:0x01400001------------------------------------------------------- 54503100 00000000 00000000 00000000 l TP1............. 00000000(9)改动表空间的长度
ub2 kcvfhtln @336 0x0005
BBED> d /v offset 336 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 336 to 355 Dba:0x01400001------------------------------------------------------- 05005450 31000000 00000000 00000000 l ..TP1........... 00000000 l .... <16 bytes per line>BBED> m /x 03 offset 336 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 336 to 355 Dba:0x01400001------------------------------------------------------------------------ 03005450 31000000 00000000 00000000 00000000 <32 bytes per line>
(10)检查点
BBED> p kcvfhckpstruct kcvfhckp, 36 bytes @484 struct kcvcpscn, 8 bytes @484 ub4 kscnbas @484 0x0019b1a1 --->1683873 ub2 kscnwrp @488 0x0000 ub4 kcvcptim @492 0x32a59921 -->849713441 ub2 kcvcpthr @496 0x0001 union u, 12 bytes @500 struct kcvcprba, 12 bytes @500 ub4 kcrbaseq @500 0x00000002 ub4 kcrbabno @504 0x000002e0 ub2 kcrbabof @508 0x0010 ub1 kcvcpetb[0] @512 0x02 ub1 kcvcpetb[1] @513 0x00 ub1 kcvcpetb[2] @514 0x00 ub1 kcvcpetb[3] @515 0x00 ub1 kcvcpetb[4] @516 0x00 ub1 kcvcpetb[5] @517 0x00 ub1 kcvcpetb[6] @518 0x00 ub1 kcvcpetb[7] @519 0x00sys@PROD> select file#,rfile#,CREATION_TIME,checkpoint_change#,unrecoverable_change#,offline_change# from v$datafile; FILE# RFILE# CREATION_ CHECKPOINT_CHANGE# UNRECOVERABLE_CHANGE# OFFLINE_CHANGE#---------- ---------- --------- ------------------ --------------------- --------------- 1 1 23-MAR-14 1683873 0 1658859 2 2 23-MAR-14 1683873 0 1658859 3 3 23-MAR-14 1683873 0 1658859 4 4 23-MAR-14 1683873 0 1658859 5 5 29-MAR-14 1684251 0 1658859sys@PROD> select to_number('19b1a1','xxxxxxxxxxxx') from dual;TO_NUMBER('19B1A1','XXXXXXXXXXXX')---------------------------------- 1683873sys@PROD> select to_number('32a59921','xxxxxxxxxxxx') from dual;TO_NUMBER('32A59921','XXXXXXXXXXXX')------------------------------------ 849713441sys@PROD> select file#,to_char(CHECKPOINT_TIME,'yyyy-mm-dd hh24:mi:ss') createTime, 2 (to_char(CHECKPOINT_TIME,'yyyy')-1988)*12*31*24*3600+ 3 (to_char(CHECKPOINT_TIME,'mm')-1)*31*24*3600+ 4 (to_char(CHECKPOINT_TIME,'dd')-1)*24*3600+ 5 to_char(CHECKPOINT_TIME,'hh24')*3600+ 6 to_char(CHECKPOINT_TIME,'mi')*60+ 7 to_char(CHECKPOINT_TIME,'ss') createTimeSCN 8 from v$datafile WHERE file# in(4,5); FILE# CREATETIME CREATETIMESCN---------- ------------------- ------------- 4 2014-06-08 15:30:41 849713441 5 2014-06-08 15:38:33 849713913sys@PROD> sys@PROD> select to_char('1684251','xxxxxxxxxxxxxxx') from dual;TO_CHAR('1684251---------------- 19b31b ====>真正5号文件的检查点SCNsys@PROD> select to_char('849713913','xxxxxxxxxxxxxxx') from dual;TO_CHAR('8497139---------------- 32a59af9 ====>真正5号文件的检查点时间ub4 kscnbas @484 0x0019b1a1 ====>真正5号文件的检查点SCN 19b31b (倒:1bb319)ub4 kcvcptim @492 0x32a59921 ====>真正5号文件的检查点时间32a59af9(倒:f99aa532)BBED> d /v offset 484 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 484 to 503 Dba:0x01400001------------------------------------------------------- a1b11900 00000000 2199a532 01000000 l ?
±......!.¥2.... 02000000 BBED> m /x 1bb319 offset 484 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 484 to 503 Dba:0x01400001 ------------------------------------------------------------------------ 1bb31900 00000000 2199a532 01000000 02000000 BBED> d /v offset 492 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 492 to 511 Dba:0x01400001 ------------------------------------------------------- 2199a532 01000000 02000000 e0020000 l !.¥2........à... 10007261 BBED> m /x f99a offset 492 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 492 to 511 Dba:0x01400001 ------------------------------------------------------------------------ f99aa532 01000000 02000000 e0020000 10007261
##################校验块BBED> sum applyCheck value for File 5, Block 1:current = 0x4a10, required = 0x4a10BBED> verifyDBVERIFY - Verification startingFILE = /u01/app/oracle/oradata/PROD/tp01.dbfBLOCK = 1DBVERIFY - Verification completeTotal Blocks Examined : 1Total Blocks Processed (Data) : 0Total Blocks Failing (Data) : 0Total Blocks Processed (Index): 0Total Blocks Failing (Index): 0Total Blocks Empty : 0Total Blocks Marked Corrupt : 0Total Blocks Influx : 0Message 531 not found; product=RDBMS; facility=BBED
######################检查物理坏块
[oracle@jfdb PROD]$ dbv file=tp01.dbf start=1 end=2DBVERIFY: Release 11.2.0.3.0 - Production on Sun Jun 8 21:48:37 2014Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved.DBVERIFY - Verification starting : FILE = /u01/app/oracle/oradata/PROD/tp01.dbfDBVERIFY - Verification completeTotal Pages Examined : 2Total Pages Processed (Data) : 0Total Pages Failing (Data) : 0Total Pages Processed (Index): 0Total Pages Failing (Index): 0Total Pages Processed (Other): 2Total Pages Processed (Seg) : 0Total Pages Failing (Seg) : 0Total Pages Empty : 0Total Pages Marked Corrupt : 0Total Pages Influx : 0Total Pages Encrypted : 0Highest block SCN : 1687542 (0.1687542)
############打开数据库报错
sys@PROD> shutdown abort;ORACLE instance shut down.sys@PROD> startupORACLE instance started.Total System Global Area 939495424 bytesFixed Size 2233960 bytesVariable Size 251660696 bytesDatabase Buffers 679477248 bytesRedo Buffers 6123520 bytesDatabase mounted.ORA-01122: database file 5 failed verification checkORA-01110: data file 5: '/u01/app/oracle/oradata/PROD/tp01.dbf'ORA-01207: file is more recent than control file - old control file
###########怀疑检查点计数器。这里我先用BBED(方法1重建控制文件,方法2利用BBED改动计算器)
ub4 kcvfhcpc @140 0x00000102
ub4 kcvfhccc @148 0x00000101idle> alter session set events 'immediate trace name controlf level 8';Session altered.DATA FILE #5: name #4: /u01/app/oracle/oradata/PROD/tp01.dbfcreation size=0 block size=8192 status=0xe head=4 tail=4 dup=1 tablespace 5, index=5 krfil=5 prev_file=0 unrecoverable scn: 0x0000.00000000 01/01/1988 00:00:00 Checkpoint cnt:226 scn: 0x0000.0019b31b 06/08/2014 15:38:33 Stop scn: 0xffff.ffffffff 06/08/2014 07:44:07 Creation Checkpointed at scn: 0x0000.00058d91 03/29/2014 10:32:22 thread:0 rba:(0x0.0.0)sys@PROD> select to_char('226','xxxxxxxxxxxxx') from dual;TO_CHAR('226',-------------- e2sys@PROD> select to_char('225','xxxxxxxxxxxxx') from dual;TO_CHAR('225',-------------- e1BBED> d /v offset 140 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 140 to 159 Dba:0x01400001------------------------------------------------------- 02010000 8bc6a532 01010000 b24f1900 l .....?
¥2....2O.. 00000000 BBED> m /x e200 offset 140 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 140 to 159 Dba:0x01400001 ------------------------------------------------------------------------ e2000000 8bc6a532 01010000 b24f1900 00000000 <32 bytes per line> BBED> d /v offset 148 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 148 to 167 Dba:0x01400001 ------------------------------------------------------- 01010000 b24f1900 00000000 d713a532 l ....2O......×.¥2 01000000 l .... <16 bytes per line> BBED> m /x e100 offset 148 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 148 to 167 Dba:0x01400001 ------------------------------------------------------------------------ e1000000 b24f1900 00000000 d713a532 01000000 <32 bytes per line> BBED> sum apply Check value for File 5, Block 1: current = 0x4a10, required = 0x4a10 BBED> verify DBVERIFY - Verification starting FILE = /u01/app/oracle/oradata/PROD/tp01.dbf BLOCK = 1 DBVERIFY - Verification complete Total Blocks Examined : 1 Total Blocks Processed (Data) : 0 Total Blocks Failing (Data) : 0 Total Blocks Processed (Index): 0 Total Blocks Failing (Index): 0 Total Blocks Empty : 0 Total Blocks Marked Corrupt : 0 Total Blocks Influx : 0 Message 531 not found; product=RDBMS; facility=BBED
##########再次打开库,OK!
sys@PROD> select status from v$instance;STATUS------------MOUNTEDsys@PROD> alter database open;Database altered.
###############################改动数据文件头的注意点:
1、改动数据的DBA,rdba_kcbh2、改动文件的大小,kccfhfsz
3、改动文件号,kccfhfno
4、改动文件创建时SCN,kcvfhcrs
5、改动文件创建时间,kcvfhcrt
6、改动表空间号,kcvfhtsn
7、改动相对文件号,kcvfhrfn
8、改动表空间的名称, kcvfhtnm
9、改动表空间的长度,kcvfhtln
10、改动检查点的SCN,kcvfhckp
11、改动检查点的时间,kcvcptim
12、改动检查点的计数器,kcvfhcpc
13、改动检查点的控制文件备份的计数器, kcvfhccc
14、假设你改动是1号文件的1号块他的root rdba针指向bootstrap$
版权声明:本文博客原创文章。博客,未经同意,不得转载。