利用BBED恢复数据文件头
- WBOYOriginal
- 2016-06-07 15:57:22891browse
转载请注明出处：http://blog.csdn.net/guoyjoe/article/details/31018075 @@@@@@@利用BBED模拟损坏5文件1号块（文件头） BBED copy file 4 block 4 to file 5 block 1 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01
转载请注明出处：http://blog.csdn.net/guoyjoe/article/details/31018075
@@@@@@@利用BBED模拟损坏5文件1号块（文件头）
BBED> copy file 4 block 4 to file 5 block 1 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01400001 ------------------------------------------------------------------------ 1ea20000 04000001 1a4b0000 00000104 99810000 <32 bytes per line> sys@PROD> shutdown abort; ORACLE instance shut down. sys@PROD> starup SP2-0042: unknown command "starup" - rest of line ignored. sys@PROD> startup ORACLE instance started. Total System Global Area 939495424 bytes Fixed Size 2233960 bytes Variable Size 251660696 bytes Database Buffers 679477248 bytes Redo Buffers 6123520 bytes Database mounted. ORA-01122: database file 5 failed verification check ORA-01110: data file 5: '/u01/app/oracle/oradata/PROD/tp01.dbf' ORA-01210: data file header is media corrupt
BBED开始恢复
1、找个文件头覆盖
<strong>BBED> copy file 4 block 1 to file 5 block 1 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 0 to 19 Dba:0x01400001 ------------------------------------------------------------------------ 0ba20000 01000001 00000000 00000104 edbc0000 <32 bytes per line> </strong>2、进入5文件1号块
BBED> set file 5 block 1
FILE# 5
BLOCK# 1
（1）改块的地址5文件1号块，rdba_kcbh
BBED> p kcvfhbfh struct kcvfhbfh, 20 bytes @0 ub1 type_kcbh @0 0x0b ub1 frmt_kcbh @1 0xa2 ub1 spare1_kcbh @2 0x00 ub1 spare2_kcbh @3 0x00 ub4 rdba_kcbh @4 0x01000001 ub4 bas_kcbh @8 0x00000000 ub2 wrp_kcbh @12 0x0000 ub1 seq_kcbh @14 0x01 ub1 flg_kcbh @15 0x04 (KCBHFCKV) ub2 chkval_kcbh @16 0xbced ub2 spare3_kcbh @18 0x0000
BBED> d /v offset 4 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 4 to 23 Dba:0x01400001 ------------------------------------------------------- 01000001 00000000 00000104 edbc0000 l ............í?.. 00000000 BBED> m /x 01004001 offset 4 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 4 to 23 Dba:0x01400001 ------------------------------------------------------------------------ 01004001 00000000 00000104 edbc0000 00000000
(2)文件的大小kccfhfsz
BBED> p kcvfhhdr
struct kcvfhhdr, 76 bytes @20
ub4 kccfhswv @20 0x00000000
ub4 kccfhcvn @24 0x0b200000
ub4 kccfhdbi @28 0x0f302c3e
text kccfhdbn[0] @32 P
text kccfhdbn[1] @33 R
text kccfhdbn[2] @34 O
text kccfhdbn[3] @35 D
text kccfhdbn[4] @36
text kccfhdbn[5] @37
text kccfhdbn[6] @38
text kccfhdbn[7] @39
ub4 kccfhcsq @40 0x00000d3d
ub4 kccfhfsz @44 0x00003200
s_blkz kccfhbsz @48 0x00
ub2 kccfhfno @52 0x0004
ub2 kccfhtyp @54 0x0003
ub4 kccfhacid @56 0x00000000
ub4 kccfhcks @60 0x00000000
text kccfhtag[0] @64
....................
sys@PROD> select name from v$dbfile where file#=5;
NAME
--------------------------------------------------
/u01/app/oracle/oradata/PROD/tp01.dbf
[oracle@jfdb PROD]$ ls -lFtr |grep tp01
-rw-r-----. 1 oracle oinstall 524296192 Jun 8 18:58 tp01.dbf
sys@PROD> select 524296192/8192 from dual;
524296192/8192
--------------
64001
BBED> d /v offset 44 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 44 to 63 Dba:0x01400001 ------------------------------------------------------- 00320000 00200000 04000300 00000000 l .2... .......... 00000000 BBED> m /x 00fa0000 44 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 44 to 63 Dba:0x01400001 ------------------------------------------------------------------------ 00fa0000 00200000 04000300 00000000 00000000
(3)修改文件号（4--->5）
ub2 kccfhfno @52 0x0004
BBED> d /v offset 52 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 52 to 71 Dba:0x01400001 ------------------------------------------------------- 04000300 00000000 00000000 00000000 l ................ 00000000 BBED> m /x 05 offset 52 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 52 to 71 Dba:0x01400001 ------------------------------------------------------------------------ 05000300 00000000 00000000 00000000 00000000
(4)修改文件创建时SCN
BBED> p kcvfhcrs
struct kcvfhcrs, 8 bytes @100
ub4 kscnbas @100 0x00004b14
ub2 kscnwrp @104 0x0000
sys@PROD> select file#,CREATION_CHANGE# from v$datafile where file#=5;
FILE# CREATION_CHANGE#
---------- ----------------
5 363921
sys@PROD> select to_char('363921','xxxxxxxxxxxxx') from dual;
TO_CHAR('36392
--------------
58d91 ===（倒：918d0500）==》00058d91
BBED> d /v offset 100
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 100 to 119 Dba:0x01400001
-------------------------------------------------------
144b0000 00000000 30cf3e32 a41da532 l .K......0?>2¤.￥2
ec4f1900
BBED> m /x 918d offset 100
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 100 to 119 Dba:0x01400001
------------------------------------------------------------------------
918d0000 00000000 30cf3e32 a41da532 ec4f1900
BBED> m /x 0500 offset 102
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 102 to 121 Dba:0x01400001
------------------------------------------------------------------------
05000000 000030cf 3e32a41d a532ec4f 19000000
BBED> d /v offset 100
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 100 to 119 Dba:0x01400001
-------------------------------------------------------
918d0500 00000000 30cf3e32 a41da532 l ........0?>2¤.￥2
ec4f1900
(5)修改文件创建时间
ub4 kcvfhcrt @108 0x323ecf30
BBED> p kcvfhcrt
ub4 kcvfhcrt @108 0x323ecf30
sys@PROD> select file#,to_char(CREATION_TIME,'yyyy-mm-dd hh24:mi:ss') createTime,
2 (to_char(CREATION_TIME,'yyyy')-1988)*12*31*24*3600+
3 (to_char(CREATION_TIME,'mm')-1)*31*24*3600+
4 (to_char(CREATION_TIME,'dd')-1)*24*3600+
5 to_char(CREATION_TIME,'hh24')*3600+
6 to_char(CREATION_TIME,'mi')*60+
7 to_char(CREATION_TIME,'ss') createTimeSCN
8 from v$datafile WHERE file# in(4,5);
FILE# CREATETIME CREATETIMESCN
---------- ------------------- -------------
4 2014-03-23 16:17:52 842977072
5 2014-03-29 10:32:22 843474742
sys@PROD> select '4' file#, to_char('842977072','xxxxxxxxxxxxxx') from dual;
F TO_CHAR('842977
- ---------------
4 323ecf30 ===>倒：30cf3e32
sys@PROD> select '5' file#,to_char('843474742','xxxxxxxxxxxxxx') from dual;
sys@PROD> select '5' file#,to_char('843474742','xxxxxxxxxxxxxx') from dual;
F TO_CHAR('843474
- ---------------
5 32466736 ==》36674632
BBED> d /v offset 108
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 108 to 127 Dba:0x01400001
-------------------------------------------------------
30cf3e32 a41da532 ec4f1900 00000000 l 0?>2¤.￥2ìO......
d713a532
BBED> m /x 36674632 offset 108
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 108 to 127 Dba:0x01400001
------------------------------------------------------------------------
36674632 a41da532 ec4f1900 00000000 d713a532
sword kcvfhtsn @332 4
sys@PROD> select file#,TS# from v$datafile where file# in(4,5);
FILE# TS#
---------- ----------
4 4
5 5
BBED> d /v offset 332
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 332 to 351 Dba:0x01400001
-------------------------------------------------------
04000000 05005553 45525300 00000000 l ......USERS.....
00000000 l ....
<16 bytes per line>
BBED> m /x 05 offset 332
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 332 to 351 Dba:0x01400001
------------------------------------------------------------------------
05000000 05005553 45525300 00000000 00000000
ub4 kcvfhrfn @368 0x00000004
BBED> d /v offset 368 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 368 to 387 Dba:0x01400001 ------------------------------------------------------- 04000000 00000000 00000000 00000000 l ................ 00000000 l .... <16 bytes per line> BBED> m /x 05 offset 368 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 368 to 387 Dba:0x01400001 ------------------------------------------------------------------------ 05000000 00000000 00000000 00000000 00000000
BBED> p kcvfhtnm
text kcvfhtnm[0] @338 U
text kcvfhtnm[1] @339 S
text kcvfhtnm[2] @340 E
text kcvfhtnm[3] @341 R
text kcvfhtnm[4] @342 S
text kcvfhtnm[5] @343
text kcvfhtnm[6] @344
text kcvfhtnm[7] @345
text kcvfhtnm[8] @346
text kcvfhtnm[9] @347
text kcvfhtnm[10] @348
text kcvfhtnm[11] @349
text kcvfhtnm[12] @350
sys@PROD> select file#,TS# from v$datafile where file# in(4,5);
FILE# TS#
---------- ----------
4 4
5 5
sys@PROD> select TS#,NAME from v$tablespace where ts# in(4,5);
TS# NAME
---------- --------------------------------------------------
4 USERS
5 TP1
BBED> d /v offset 338
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 338 to 357 Dba:0x01400001
-------------------------------------------------------
55534552 53000000 00000000 00000000 l USERS...........
00000000
sys@PROD> select dump('USERS',16) from dual;
DUMP('USERS',16)
----------------------------
Typ=96 Len=5: 55,53,45,52,53
sys@PROD> select dump('TP1',16) from dual;
DUMP('TP1',16)
----------------------
Typ=96 Len=3: 54,50,31
BBED> m /x 54503100 offset 338
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 338 to 357 Dba:0x01400001
------------------------------------------------------------------------
54503100 53000000 00000000 00000000 00000000
<32 bytes per line>
BBED> m /x 00 offset 342
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 342 to 361 Dba:0x01400001
------------------------------------------------------------------------
00000000 00000000 00000000 00000000 00000000
<32 bytes per line>
BBED> d /v offset 338
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 338 to 357 Dba:0x01400001
-------------------------------------------------------
54503100 00000000 00000000 00000000 l TP1.............
00000000
ub2 kcvfhtln @336 0x0005
BBED> d /v offset 336 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 336 to 355 Dba:0x01400001 ------------------------------------------------------- 05005450 31000000 00000000 00000000 l ..TP1........... 00000000 l .... <16 bytes per line> BBED> m /x 03 offset 336 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5) Block: 1 Offsets: 336 to 355 Dba:0x01400001 ------------------------------------------------------------------------ 03005450 31000000 00000000 00000000 00000000 <32 bytes per line>
(10)检查点
BBED> p kcvfhckp
struct kcvfhckp, 36 bytes @484
struct kcvcpscn, 8 bytes @484
ub4 kscnbas @484 0x0019b1a1 --->1683873
ub2 kscnwrp @488 0x0000
ub4 kcvcptim @492 0x32a59921 -->849713441
ub2 kcvcpthr @496 0x0001
union u, 12 bytes @500
struct kcvcprba, 12 bytes @500
ub4 kcrbaseq @500 0x00000002
ub4 kcrbabno @504 0x000002e0
ub2 kcrbabof @508 0x0010
ub1 kcvcpetb[0] @512 0x02
ub1 kcvcpetb[1] @513 0x00
ub1 kcvcpetb[2] @514 0x00
ub1 kcvcpetb[3] @515 0x00
ub1 kcvcpetb[4] @516 0x00
ub1 kcvcpetb[5] @517 0x00
ub1 kcvcpetb[6] @518 0x00
ub1 kcvcpetb[7] @519 0x00
sys@PROD> select file#,rfile#,CREATION_TIME,checkpoint_change#,unrecoverable_change#,offline_change# from v$datafile;
FILE# RFILE# CREATION_ CHECKPOINT_CHANGE# UNRECOVERABLE_CHANGE# OFFLINE_CHANGE#
---------- ---------- --------- ------------------ --------------------- ---------------
1 1 23-MAR-14 1683873 0 1658859
2 2 23-MAR-14 1683873 0 1658859
3 3 23-MAR-14 1683873 0 1658859
4 4 23-MAR-14 1683873 0 1658859
5 5 29-MAR-14 1684251 0 1658859
sys@PROD> select to_number('19b1a1','xxxxxxxxxxxx') from dual;
TO_NUMBER('19B1A1','XXXXXXXXXXXX')
----------------------------------
1683873
sys@PROD> select to_number('32a59921','xxxxxxxxxxxx') from dual;
TO_NUMBER('32A59921','XXXXXXXXXXXX')
------------------------------------
849713441
sys@PROD> select file#,to_char(CHECKPOINT_TIME,'yyyy-mm-dd hh24:mi:ss') createTime,
2 (to_char(CHECKPOINT_TIME,'yyyy')-1988)*12*31*24*3600+
3 (to_char(CHECKPOINT_TIME,'mm')-1)*31*24*3600+
4 (to_char(CHECKPOINT_TIME,'dd')-1)*24*3600+
5 to_char(CHECKPOINT_TIME,'hh24')*3600+
6 to_char(CHECKPOINT_TIME,'mi')*60+
7 to_char(CHECKPOINT_TIME,'ss') createTimeSCN
8 from v$datafile WHERE file# in(4,5);
FILE# CREATETIME CREATETIMESCN
---------- ------------------- -------------
4 2014-06-08 15:30:41 849713441
5 2014-06-08 15:38:33 849713913
sys@PROD> sys@PROD> select to_char('1684251','xxxxxxxxxxxxxxx') from dual;
TO_CHAR('1684251
----------------
19b31b ====>真正5号文件的检查点SCN
sys@PROD> select to_char('849713913','xxxxxxxxxxxxxxx') from dual;
TO_CHAR('8497139
----------------
32a59af9 ====>真正5号文件的检查点时间
ub4 kscnbas @484 0x0019b1a1 ====>真正5号文件的检查点SCN 19b31b (倒：1bb319)
ub4 kcvcptim @492 0x32a59921 ====>真正5号文件的检查点时间32a59af9（倒：f99aa532）
BBED> d /v offset 484
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 484 to 503 Dba:0x01400001
-------------------------------------------------------
a1b11900 00000000 2199a532 01000000 l ?±......!.￥2....
02000000
BBED> m /x 1bb319 offset 484
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 484 to 503 Dba:0x01400001
------------------------------------------------------------------------
1bb31900 00000000 2199a532 01000000 02000000
BBED> d /v offset 492
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 492 to 511 Dba:0x01400001
-------------------------------------------------------
2199a532 01000000 02000000 e0020000 l !.￥2........à...
10007261
BBED> m /x f99a offset 492
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 492 to 511 Dba:0x01400001
------------------------------------------------------------------------
f99aa532 01000000 02000000 e0020000 10007261
##################校验块
BBED> sum apply Check value for File 5, Block 1: current = 0x4a10, required = 0x4a10 BBED> verify DBVERIFY - Verification starting FILE = /u01/app/oracle/oradata/PROD/tp01.dbf BLOCK = 1 DBVERIFY - Verification complete Total Blocks Examined : 1 Total Blocks Processed (Data) : 0 Total Blocks Failing (Data) : 0 Total Blocks Processed (Index): 0 Total Blocks Failing (Index): 0 Total Blocks Empty : 0 Total Blocks Marked Corrupt : 0 Total Blocks Influx : 0 Message 531 not found; product=RDBMS; facility=BBED
######################检查物理坏块
[oracle@jfdb PROD]$ dbv file=tp01.dbf start=1 end=2 DBVERIFY: Release 11.2.0.3.0 - Production on Sun Jun 8 21:48:37 2014 Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved. DBVERIFY - Verification starting : FILE = /u01/app/oracle/oradata/PROD/tp01.dbf DBVERIFY - Verification complete Total Pages Examined : 2 Total Pages Processed (Data) : 0 Total Pages Failing (Data) : 0 Total Pages Processed (Index): 0 Total Pages Failing (Index): 0 Total Pages Processed (Other): 2 Total Pages Processed (Seg) : 0 Total Pages Failing (Seg) : 0 Total Pages Empty : 0 Total Pages Marked Corrupt : 0 Total Pages Influx : 0 Total Pages Encrypted : 0 Highest block SCN : 1687542 (0.1687542)
############打开数据库报错
sys@PROD> shutdown abort; ORACLE instance shut down. sys@PROD> startup ORACLE instance started. Total System Global Area 939495424 bytes Fixed Size 2233960 bytes Variable Size 251660696 bytes Database Buffers 679477248 bytes Redo Buffers 6123520 bytes Database mounted. ORA-01122: database file 5 failed verification check ORA-01110: data file 5: '/u01/app/oracle/oradata/PROD/tp01.dbf' ORA-01207: file is more recent than control file - old control file
###########怀疑检查点计数器，这里我先用BBED（方法1重建控制文件，方法2利用BBED修改计算器）
ub4 kcvfhcpc @140 0x00000102
idle> alter session set events 'immediate trace name controlf level 8';
Session altered.
DATA FILE #5:
name #4: /u01/app/oracle/oradata/PROD/tp01.dbf
creation size=0 block size=8192 status=0xe head=4 tail=4 dup=1
tablespace 5, index=5 krfil=5 prev_file=0
unrecoverable scn: 0x0000.00000000 01/01/1988 00:00:00
Checkpoint cnt:226 scn: 0x0000.0019b31b 06/08/2014 15:38:33
Stop scn: 0xffff.ffffffff 06/08/2014 07:44:07
Creation Checkpointed at scn: 0x0000.00058d91 03/29/2014 10:32:22
thread:0 rba:(0x0.0.0)
sys@PROD> select to_char('226','xxxxxxxxxxxxx') from dual;
TO_CHAR('226',
--------------
e2
sys@PROD> select to_char('225','xxxxxxxxxxxxx') from dual;
TO_CHAR('225',
--------------
e1
BBED> d /v offset 140
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 140 to 159 Dba:0x01400001
-------------------------------------------------------
02010000 8bc6a532 01010000 b24f1900 l .....?￥2....2O..
00000000
BBED> m /x e200 offset 140
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 140 to 159 Dba:0x01400001
------------------------------------------------------------------------
e2000000 8bc6a532 01010000 b24f1900 00000000
<32 bytes per line>
BBED> d /v offset 148
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 148 to 167 Dba:0x01400001
-------------------------------------------------------
01010000 b24f1900 00000000 d713a532 l ....2O......×.￥2
01000000 l ....
<16 bytes per line>
BBED> m /x e100 offset 148
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 1 Offsets: 148 to 167 Dba:0x01400001
------------------------------------------------------------------------
e1000000 b24f1900 00000000 d713a532 01000000
<32 bytes per line>
BBED> sum apply
Check value for File 5, Block 1:
current = 0x4a10, required = 0x4a10
BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 1
DBVERIFY - Verification complete
Total Blocks Examined : 1
Total Blocks Processed (Data) : 0
Total Blocks Failing (Data) : 0
Total Blocks Processed (Index): 0
Total Blocks Failing (Index): 0
Total Blocks Empty : 0
Total Blocks Marked Corrupt : 0
Total Blocks Influx : 0
Message 531 not found; product=RDBMS; facility=BBED
##########再次打开库，OK!
sys@PROD> select status from v$instance; STATUS ------------ MOUNTED sys@PROD> alter database open; Database altered.
###############################修改数据文件头的注意点：
1、修改数据的DBA,rdba_kcbh
2、修改文件的大小，kccfhfsz
3、修改文件号，kccfhfno
4、修改文件创建时SCN，kcvfhcrs
5、修改文件创建时间，kcvfhcrt
6、修改表空间号，kcvfhtsn
7、修改相对文件号，kcvfhrfn
8、修改表空间的名称， kcvfhtnm
9、修改表空间的长度，kcvfhtln
10、修改检查点的SCN，kcvfhckp
11、修改检查点的时间，kcvcptim
12、修改检查点的计数器，kcvfhcpc
13、修改检查点的控制文件备份的计数器， kcvfhccc
14、如果你修改是1号文件的1号块他的root rdba的地针是指向了bootstrap$
Statement：
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Previous article：CentOS下配置phpMyAdminNext article：DALFactory有什么作用