利用BBED恢复数据文件头

转载请注明出处：http://blog.csdn.net/guoyjoe/article/details/31018075

@@@@@@@利用BBED模拟损坏5文件1号块（文件头）

BBED> copy file 4 block 4 to file 5 block 1  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:    0 to   19           Dba:0x01400001 ------------------------------------------------------------------------  1ea20000 04000001 1a4b0000 00000104 99810000    <32 bytes per line>   sys@PROD> shutdown abort; ORACLE instance shut down. sys@PROD> starup SP2-0042: unknown command "starup" - rest of line ignored. sys@PROD> startup ORACLE instance started. Total System Global Area  939495424 bytes Fixed Size                  2233960 bytes Variable Size             251660696 bytes Database Buffers          679477248 bytes Redo Buffers                6123520 bytes Database mounted. ORA-01122: database file 5 failed verification check ORA-01110: data file 5: '/u01/app/oracle/oradata/PROD/tp01.dbf' ORA-01210: data file header is media corrupt

1、找个文件头覆盖

BBED> copy file 4 block 1 to file 5 block 1  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:    0 to   19           Dba:0x01400001 ------------------------------------------------------------------------  0ba20000 01000001 00000000 00000104 edbc0000    <32 bytes per line> 

BBED> set file 5 block 1         FILE#           5         BLOCK#          1

（1）改块的地址5文件1号块，rdba_kcbh

BBED> p kcvfhbfh struct kcvfhbfh, 20 bytes                   @0           ub1 type_kcbh                            @0        0x0b    ub1 frmt_kcbh                            @1        0xa2    ub1 spare1_kcbh                          @2        0x00    ub1 spare2_kcbh                          @3        0x00    ub4 rdba_kcbh                            @4        0x01000001    ub4 bas_kcbh                             @8        0x00000000    ub2 wrp_kcbh                             @12       0x0000    ub1 seq_kcbh                             @14       0x01    ub1 flg_kcbh                             @15       0x04 (KCBHFCKV)    ub2 chkval_kcbh                          @16       0xbced    ub2 spare3_kcbh                          @18       0x0000 

BBED> d /v offset 4  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:    4 to   23  Dba:0x01400001 -------------------------------------------------------  01000001 00000000 00000104 edbc0000 l ............í?..  00000000     BBED> m /x  01004001 offset 4  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:    4 to   23           Dba:0x01400001 ------------------------------------------------------------------------  01004001 00000000 00000104 edbc0000 00000000 

(2)文件的大小kccfhfsz

BBED> p kcvfhhdr struct kcvfhhdr, 76 bytes                   @20          ub4 kccfhswv                             @20       0x00000000    ub4 kccfhcvn                             @24       0x0b200000    ub4 kccfhdbi                             @28       0x0f302c3e    text kccfhdbn[0]                         @32      P    text kccfhdbn[1]                         @33      R    text kccfhdbn[2]                         @34      O    text kccfhdbn[3]                         @35      D    text kccfhdbn[4]                         @36           text kccfhdbn[5]                         @37           text kccfhdbn[6]                         @38           text kccfhdbn[7]                         @39           ub4 kccfhcsq                             @40       0x00000d3d    ub4 kccfhfsz                             @44       0x00003200    s_blkz kccfhbsz                          @48       0x00    ub2 kccfhfno                             @52       0x0004    ub2 kccfhtyp                             @54       0x0003    ub4 kccfhacid                            @56       0x00000000    ub4 kccfhcks                             @60       0x00000000    text kccfhtag[0]                         @64         ....................     sys@PROD> select name from v$dbfile where file#=5;  NAME -------------------------------------------------- /u01/app/oracle/oradata/PROD/tp01.dbf  [oracle@jfdb PROD]$ ls -lFtr |grep tp01 -rw-r-----. 1 oracle oinstall  524296192 Jun  8 18:58 tp01.dbf  sys@PROD> select 524296192/8192 from dual;  524296192/8192 --------------          64001

BBED> d /v offset 44  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:   44 to   63  Dba:0x01400001 -------------------------------------------------------  00320000 00200000 04000300 00000000 l .2... ..........  00000000  BBED> m /x 00fa0000 44  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:   44 to   63           Dba:0x01400001 ------------------------------------------------------------------------  00fa0000 00200000 04000300 00000000 00000000 

(3)修改文件号（4--->5）

ub2 kccfhfno                          @52       0x0004

BBED> d /v offset 52  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:   52 to   71  Dba:0x01400001 -------------------------------------------------------  04000300 00000000 00000000 00000000 l ................  00000000   BBED> m /x 05 offset 52  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:   52 to   71           Dba:0x01400001 ------------------------------------------------------------------------  05000300 00000000 00000000 00000000 00000000  

(4)修改文件创建时SCN

BBED> p kcvfhcrs struct kcvfhcrs, 8 bytes                    @100         ub4 kscnbas                              @100      0x00004b14    ub2 kscnwrp                              @104      0x0000   sys@PROD> select file#,CREATION_CHANGE# from v$datafile where file#=5;       FILE# CREATION_CHANGE# ---------- ----------------          5           363921  sys@PROD> select to_char('363921','xxxxxxxxxxxxx') from dual;  TO_CHAR('36392 --------------          58d91   ===（倒：918d0500）==》00058d91  BBED> d /v offset 100  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  100 to  119  Dba:0x01400001 -------------------------------------------------------  144b0000 00000000 30cf3e32 a41da532 l .K......0?>2¤.￥2  ec4f1900   BBED> m /x 918d offset 100  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  100 to  119           Dba:0x01400001 ------------------------------------------------------------------------  918d0000 00000000 30cf3e32 a41da532 ec4f1900   BBED>  m /x 0500 offset 102  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  102 to  121           Dba:0x01400001 ------------------------------------------------------------------------  05000000 000030cf 3e32a41d a532ec4f 19000000   BBED> d /v offset 100  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  100 to  119  Dba:0x01400001 -------------------------------------------------------  918d0500 00000000 30cf3e32 a41da532 l ........0?>2¤.￥2  ec4f1900

ub4 kcvfhcrt                             @108      0x323ecf30 BBED> p kcvfhcrt ub4 kcvfhcrt                                @108      0x323ecf30  sys@PROD> select file#,to_char(CREATION_TIME,'yyyy-mm-dd hh34:mi:ss') createTime,   2      (to_char(CREATION_TIME,'yyyy')-1988)*12*31*24*3600+   3       (to_char(CREATION_TIME,'mm')-1)*31*24*3600+   4     (to_char(CREATION_TIME,'dd')-1)*24*3600+   5     to_char(CREATION_TIME,'hh34')*3600+   6     to_char(CREATION_TIME,'mi')*60+   7     to_char(CREATION_TIME,'ss') createTimeSCN   8    from v$datafile WHERE file# in(4,5);       FILE# CREATETIME          CREATETIMESCN ---------- ------------------- -------------          4 2014-03-23 16:17:52     842977072          5 2014-03-29 10:32:22     843474742   sys@PROD> select '4' file#, to_char('842977072','xxxxxxxxxxxxxx') from dual;  F TO_CHAR('842977 - --------------- 4        323ecf30    ===>倒：30cf3e32   sys@PROD> select '5' file#,to_char('843474742','xxxxxxxxxxxxxx') from dual;  sys@PROD>  select '5' file#,to_char('843474742','xxxxxxxxxxxxxx') from dual;  F TO_CHAR('843474 - --------------- 5        32466736  ==》36674632  BBED> d /v offset 108  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  108 to  127  Dba:0x01400001 -------------------------------------------------------  30cf3e32 a41da532 ec4f1900 00000000 l 0?>2¤.￥2ìO......  d713a532  BBED> m /x 36674632 offset 108  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  108 to  127           Dba:0x01400001 ------------------------------------------------------------------------  36674632 a41da532 ec4f1900 00000000 d713a532 

sword kcvfhtsn                           @332      4  sys@PROD> select file#,TS# from  v$datafile where file# in(4,5);       FILE#        TS# ---------- ----------          4          4          5          5  BBED> d /v offset 332  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  332 to  351  Dba:0x01400001 -------------------------------------------------------  04000000 05005553 45525300 00000000 l ......USERS.....  00000000                            l ....   <16 bytes per line>  BBED> m /x 05 offset 332  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  332 to  351           Dba:0x01400001 ------------------------------------------------------------------------  05000000 05005553 45525300 00000000 00000000 

ub4 kcvfhrfn                             @368      0x00000004

BBED> d /v offset 368  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  368 to  387  Dba:0x01400001 -------------------------------------------------------  04000000 00000000 00000000 00000000 l ................  00000000                            l ....   <16 bytes per line>  BBED> m /x 05 offset 368  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  368 to  387           Dba:0x01400001 ------------------------------------------------------------------------  05000000 00000000 00000000 00000000 00000000 

BBED> p kcvfhtnm text kcvfhtnm[0]                            @338     U text kcvfhtnm[1]                            @339     S text kcvfhtnm[2]                            @340     E text kcvfhtnm[3]                            @341     R text kcvfhtnm[4]                            @342     S text kcvfhtnm[5]                            @343       text kcvfhtnm[6]                            @344       text kcvfhtnm[7]                            @345       text kcvfhtnm[8]                            @346       text kcvfhtnm[9]                            @347       text kcvfhtnm[10]                           @348       text kcvfhtnm[11]                           @349       text kcvfhtnm[12]                           @350   sys@PROD> select file#,TS# from  v$datafile where file# in(4,5);       FILE#        TS# ---------- ----------          4          4          5          5  sys@PROD> select TS#,NAME from v$tablespace where ts# in(4,5);         TS# NAME ---------- --------------------------------------------------          4 USERS          5 TP1  BBED> d /v offset 338  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  338 to  357  Dba:0x01400001 -------------------------------------------------------  55534552 53000000 00000000 00000000 l USERS...........  00000000  sys@PROD> select dump('USERS',16) from dual;  DUMP('USERS',16) ---------------------------- Typ=96 Len=5: 55,53,45,52,53   sys@PROD> select dump('TP1',16) from dual;  DUMP('TP1',16) ---------------------- Typ=96 Len=3: 54,50,31  BBED> m /x 54503100 offset 338  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  338 to  357           Dba:0x01400001 ------------------------------------------------------------------------  54503100 53000000 00000000 00000000 00000000    <32 bytes per line>  BBED> m /x 00 offset 342  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  342 to  361           Dba:0x01400001 ------------------------------------------------------------------------  00000000 00000000 00000000 00000000 00000000    <32 bytes per line>  BBED> d /v offset 338  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  338 to  357  Dba:0x01400001 -------------------------------------------------------  54503100 00000000 00000000 00000000 l TP1.............  00000000         

ub2 kcvfhtln                             @336      0x0005

BBED> d /v offset 336  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  336 to  355  Dba:0x01400001 -------------------------------------------------------  05005450 31000000 00000000 00000000 l ..TP1...........  00000000                            l ....   <16 bytes per line>  BBED> m /x 03 offset 336  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  336 to  355           Dba:0x01400001 ------------------------------------------------------------------------  03005450 31000000 00000000 00000000 00000000    <32 bytes per line>

(10)检查点

BBED> p kcvfhckp struct kcvfhckp, 36 bytes                   @484         struct kcvcpscn, 8 bytes                 @484            ub4 kscnbas                           @484      0x0019b1a1   --->1683873       ub2 kscnwrp                           @488      0x0000    ub4 kcvcptim                             @492      0x32a59921   -->849713441    ub2 kcvcpthr                             @496      0x0001    union u, 12 bytes                        @500            struct kcvcprba, 12 bytes             @500               ub4 kcrbaseq                       @500      0x00000002          ub4 kcrbabno                       @504      0x000002e0          ub2 kcrbabof                       @508      0x0010    ub1 kcvcpetb[0]                          @512      0x02    ub1 kcvcpetb[1]                          @513      0x00    ub1 kcvcpetb[2]                          @514      0x00    ub1 kcvcpetb[3]                          @515      0x00    ub1 kcvcpetb[4]                          @516      0x00    ub1 kcvcpetb[5]                          @517      0x00    ub1 kcvcpetb[6]                          @518      0x00    ub1 kcvcpetb[7]                          @519      0x00  sys@PROD> select file#,rfile#,CREATION_TIME,checkpoint_change#,unrecoverable_change#,offline_change# from v$datafile;       FILE#     RFILE# CREATION_ CHECKPOINT_CHANGE# UNRECOVERABLE_CHANGE# OFFLINE_CHANGE# ---------- ---------- --------- ------------------ --------------------- ---------------          1          1 23-MAR-14            1683873                     0         1658859          2          2 23-MAR-14            1683873                     0         1658859          3          3 23-MAR-14            1683873                     0         1658859          4          4 23-MAR-14            1683873                     0         1658859          5          5 29-MAR-14            1684251                     0         1658859  sys@PROD> select to_number('19b1a1','xxxxxxxxxxxx') from dual;  TO_NUMBER('19B1A1','XXXXXXXXXXXX') ----------------------------------                            1683873 sys@PROD> select to_number('32a59921','xxxxxxxxxxxx') from dual;  TO_NUMBER('32A59921','XXXXXXXXXXXX') ------------------------------------                            849713441 sys@PROD> select file#,to_char(CHECKPOINT_TIME,'yyyy-mm-dd hh34:mi:ss') createTime,   2    (to_char(CHECKPOINT_TIME,'yyyy')-1988)*12*31*24*3600+   3     (to_char(CHECKPOINT_TIME,'mm')-1)*31*24*3600+   4   (to_char(CHECKPOINT_TIME,'dd')-1)*24*3600+   5   to_char(CHECKPOINT_TIME,'hh34')*3600+   6    to_char(CHECKPOINT_TIME,'mi')*60+   7   to_char(CHECKPOINT_TIME,'ss') createTimeSCN   8    from v$datafile WHERE file# in(4,5);        FILE# CREATETIME          CREATETIMESCN ---------- ------------------- -------------          4 2014-06-08 15:30:41     849713441          5 2014-06-08 15:38:33     849713913  sys@PROD> sys@PROD> select to_char('1684251','xxxxxxxxxxxxxxx') from dual;  TO_CHAR('1684251 ----------------           19b31b   ====>真正5号文件的检查点SCN  sys@PROD> select to_char('849713913','xxxxxxxxxxxxxxx') from dual;  TO_CHAR('8497139 ----------------         32a59af9  ====>真正5号文件的检查点时间  ub4 kscnbas                           @484      0x0019b1a1     ====>真正5号文件的检查点SCN 19b31b (倒：1bb319) ub4 kcvcptim                          @492      0x32a59921     ====>真正5号文件的检查点时间32a59af9（倒：f99aa532）  BBED> d /v offset 484  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  484 to  503  Dba:0x01400001 -------------------------------------------------------  a1b11900 00000000 2199a532 01000000 l ?±......!.￥2....  02000000   BBED> m /x 1bb319 offset 484  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  484 to  503           Dba:0x01400001 ------------------------------------------------------------------------  1bb31900 00000000 2199a532 01000000 02000000   BBED> d /v offset 492  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  492 to  511  Dba:0x01400001 -------------------------------------------------------  2199a532 01000000 02000000 e0020000 l !.￥2........à...  10007261   BBED> m /x f99a offset 492  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  492 to  511           Dba:0x01400001 ------------------------------------------------------------------------  f99aa532 01000000 02000000 e0020000 10007261  

BBED> sum apply Check value for File 5, Block 1: current = 0x4a10, required = 0x4a10  BBED> verify DBVERIFY - Verification starting FILE = /u01/app/oracle/oradata/PROD/tp01.dbf BLOCK = 1   DBVERIFY - Verification complete  Total Blocks Examined         : 1 Total Blocks Processed (Data) : 0 Total Blocks Failing   (Data) : 0 Total Blocks Processed (Index): 0 Total Blocks Failing   (Index): 0 Total Blocks Empty            : 0 Total Blocks Marked Corrupt   : 0 Total Blocks Influx           : 0 Message 531 not found;  product=RDBMS; facility=BBED

######################检查物理坏块

[oracle@jfdb PROD]$ dbv file=tp01.dbf start=1 end=2  DBVERIFY: Release 11.2.0.3.0 - Production on Sun Jun 8 21:48:37 2014  Copyright (c) 1982, 2011, Oracle and/or its affiliates.  All rights reserved.  DBVERIFY - Verification starting : FILE = /u01/app/oracle/oradata/PROD/tp01.dbf   DBVERIFY - Verification complete  Total Pages Examined         : 2 Total Pages Processed (Data) : 0 Total Pages Failing   (Data) : 0 Total Pages Processed (Index): 0 Total Pages Failing   (Index): 0 Total Pages Processed (Other): 2 Total Pages Processed (Seg)  : 0 Total Pages Failing   (Seg)  : 0 Total Pages Empty            : 0 Total Pages Marked Corrupt   : 0 Total Pages Influx           : 0 Total Pages Encrypted        : 0 Highest block SCN            : 1687542 (0.1687542)

############打开数据库报错

sys@PROD> shutdown abort; ORACLE instance shut down. sys@PROD> startup ORACLE instance started.  Total System Global Area  939495424 bytes Fixed Size                  2233960 bytes Variable Size             251660696 bytes Database Buffers          679477248 bytes Redo Buffers                6123520 bytes Database mounted. ORA-01122: database file 5 failed verification check ORA-01110: data file 5: '/u01/app/oracle/oradata/PROD/tp01.dbf' ORA-01207: file is more recent than control file - old control file

###########怀疑检查点计数器，这里我先用BBED（方法1重建控制文件，方法2利用BBED修改计算器）

ub4 kcvfhcpc                             @140      0x00000102
 
ub4 kcvfhccc                             @148      0x00000101

idle> alter session set events 'immediate trace name controlf level 8';  Session altered.  DATA FILE #5:    name #4: /u01/app/oracle/oradata/PROD/tp01.dbf creation size=0 block size=8192 status=0xe head=4 tail=4 dup=1  tablespace 5, index=5 krfil=5 prev_file=0  unrecoverable scn: 0x0000.00000000 01/01/1988 00:00:00  Checkpoint cnt:226 scn: 0x0000.0019b31b 06/08/2014 15:38:33  Stop scn: 0xffff.ffffffff 06/08/2014 07:44:07  Creation Checkpointed at scn:  0x0000.00058d91 03/29/2014 10:32:22  thread:0 rba:(0x0.0.0)  sys@PROD> select to_char('226','xxxxxxxxxxxxx') from dual;  TO_CHAR('226', --------------             e2  sys@PROD> select to_char('225','xxxxxxxxxxxxx') from dual;  TO_CHAR('225', --------------             e1  BBED> d /v offset 140  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  140 to  159  Dba:0x01400001 -------------------------------------------------------  02010000 8bc6a532 01010000 b24f1900 l .....?￥2....2O..  00000000   BBED> m /x e200 offset 140  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  140 to  159           Dba:0x01400001 ------------------------------------------------------------------------  e2000000 8bc6a532 01010000 b24f1900 00000000    <32 bytes per line>  BBED> d /v offset 148  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1       Offsets:  148 to  167  Dba:0x01400001 -------------------------------------------------------  01010000 b24f1900 00000000 d713a532 l ....2O......×.￥2  01000000                            l ....   <16 bytes per line>  BBED> m /x e100 offset 148  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 1                Offsets:  148 to  167           Dba:0x01400001 ------------------------------------------------------------------------  e1000000 b24f1900 00000000 d713a532 01000000    <32 bytes per line>  BBED> sum apply Check value for File 5, Block 1: current = 0x4a10, required = 0x4a10  BBED> verify DBVERIFY - Verification starting FILE = /u01/app/oracle/oradata/PROD/tp01.dbf BLOCK = 1   DBVERIFY - Verification complete  Total Blocks Examined         : 1 Total Blocks Processed (Data) : 0 Total Blocks Failing   (Data) : 0 Total Blocks Processed (Index): 0 Total Blocks Failing   (Index): 0 Total Blocks Empty            : 0 Total Blocks Marked Corrupt   : 0 Total Blocks Influx           : 0 Message 531 not found;  product=RDBMS; facility=BBED

##########再次打开库，OK!

sys@PROD> select status from v$instance; STATUS ------------ MOUNTED  sys@PROD> alter database open;  Database altered.

###############################修改数据文件头的注意点：
 1、修改数据的DBA,rdba_kcbh

 2、修改文件的大小，kccfhfsz

 3、修改文件号，kccfhfno

 4、修改文件创建时SCN，kcvfhcrs

 5、修改文件创建时间，kcvfhcrt

 6、修改表空间号，kcvfhtsn 

 7、修改相对文件号，kcvfhrfn  

 8、修改表空间的名称， kcvfhtnm

 9、修改表空间的长度，kcvfhtln     

 10、修改检查点的SCN，kcvfhckp

 11、修改检查点的时间，kcvcptim 

 12、修改检查点的计数器，kcvfhcpc

 13、修改检查点的控制文件备份的计数器， kcvfhccc

 14、如果你修改是1号文件的1号块他的root rdba的地针是指向了bootstrap$