Oracle勒索病毒故障恢复的案例分析

原创已于 2025-06-05 10:51:43 修改 · 607 阅读

7 ·

CC 4.0 BY-SA版权

文章标签：

#oracle #数据库 #勒索病毒 #灾难恢复

于 2025-06-05 10:18:38 首次发布

oracle 同时被 3 个专栏收录

27 篇文章

订阅专栏

Oracle案例分享

24 篇文章

订阅专栏

备份恢复

3 篇文章

订阅专栏

问题发现

近期一个客户的数据库实例不能连接，帮忙查看之后发现是实例有如下报错：

Fri Apr 05 11:32:24 2024
Starting background process SMCO
Fri Apr 05 11:32:24 2024
SMCO started with pid=24, OS id=5520 
Completed: alter database open
Fri Apr 05 11:32:27 2024
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_m004_5452.trc  (incident=99831):
ORA-00600: internal error code, arguments: [kgmfvmi#3], [], [], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_99831\orcl_m004_5452_i99831.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_m004_5452.trc  (incident=99832):
ORA-00600: internal error code, arguments: [kgmfvmi#3], [], [], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_99832\orcl_m004_5452_i99832.trc
Fri Apr 05 11:32:29 2024
Dumping diagnostic data in directory=[cdmp_20240405113229], requested by (instance=1, osid=5452 (M004)), summary=[incident=99831].
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Exception [type: ACCESS_VIOLATION, UNABLE_TO_READ] [ADDR:0x10] [PC:0x1CBF7F9, kgmdelsis()+121]
ERROR: Unable to normalize symbol name for the following short stack (at offset 213):
dbgexProcessError()+200<-dbgeExecuteForError()+65<-dbgePostErrorKGE()+2269<-dbkePostKGE_kgsf()+77<-kgeade()+562<-kgerelv()+151<-kgerev()+45<-kgerec5()+60<-sss_xcpt_EvalFilterEx()+1862<-sss_xcpt_EvalFilter()+174<-.1.4_5+59<-00007FFCD1106506<-00007FFCD111A49D<-00007FFCD10AFD43<-00007FFCD111960A<-kgmdelsis()+121<-pfrouidc_inst_del_cleanup()+29<-pliodl()+726<-kgidlt()+265<-kgiCleanSessionState()+247<-PGOSF776_ksuxds()+1265<-kssdel()+191<-kssdch()+8182<-ksudlc()+325<-kssdel()+191<-ksupop()+831<-ksvrdp()+4559<-opirip()+904<-opidrv()+906<-sou2o()+98<-opimai_real()+280<-opimai()+191<-BackgroundThreadStart()+646<-00007FFCD0EC84D4<-00007FFCD10DE871
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_m004_5452.trc  (incident=99833):
ORA-07445: exception encountered: core dump [kgmdelsis()+121] [ACCESS_VIOLATION] [ADDR:0x10] [PC:0x1CBF7F9] [UNABLE_TO_READ] []
ORA-00600: internal error code, arguments: [kgmfvmi#3], [], [], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_99833\orcl_m004_5452_i99833.trc
Use ADRCI or Support Workbench to package the incident.

当发现如上报错后，客户尝试启动实例，结果报错如下：

Started redo scan
Completed redo scan
 read 0 KB redo, 0 data blocks need recovery
Started redo application at
 Thread 1: logseq 1367, block 2, scn 22801945
Recovery of Online Redo Log: Thread 1 Group 2 Seq 1367 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO02.LOG
Completed redo application of 0.00MB
Completed crash recovery at
 Thread 1: logseq 1367, block 3, scn 22821947
 0 data blocks read, 0 data blocks written, 0 redo k-bytes read
Thread 1 advanced to log sequence 1368 (thread open)
Thread 1 opened at log sequence 1368
  Current log# 3 seq# 1368 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO03.LOG
Successful open of redo thread 1
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
SMON: enabling cache recovery
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_5872.trc  (incident=171810):
ORA-00600: ??????, ??: [16703], [1403], [20], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_171810\orcl_ora_5872_i171810.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_5872.trc:
ORA-00704: ????????
ORA-00704: ????????
ORA-00600: ??????, ??: [16703], [1403], [20], [], [], [], [], [], [], [], [], []
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_5872.trc:
ORA-00704: ????????
ORA-00704: ????????
ORA-00600: ??????, ??: [16703], [1403], [20], [], [], [], [], [], [], [], [], []
Error 704 happened during db open, shutting down database
USER (ospid: 5872): terminating the instance due to error 704
Instance terminated by USER, pid = 5872
ORA-1092 signalled during: alter database open...
opiodr aborting process unknown ospid (5872) as a result of ORA-1092
Sun Apr 07 08:15:39 2024
ORA-1092 : opitsk aborting process

对应的trc日志如下：

Trace file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_5872.trc
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
Windows NT Version V6.2  
CPU                 : 4 - type 8664, 2 Physical Cores
Process Affinity    : 0x0x0000000000000000
Memory (Avail/Total): Ph:12217M/16383M, Ph+PgF:7342M/16399M 
Instance name: orcl
Redo thread mounted by this instance: 1
Oracle process number: 19
Windows thread id: 5872, image: ORACLE.EXE (SHAD)


*** 2024-04-07 08:15:35.548
*** SESSION ID:(3394.3) 2024-04-07 08:15:35.548
*** CLIENT ID:() 2024-04-07 08:15:35.548
*** SERVICE NAME:() 2024-04-07 08:15:35.548
*** MODULE NAME:(oradim.exe) 2024-04-07 08:15:35.548
*** ACTION NAME:() 2024-04-07 08:15:35.548
 
Successfully allocated 3 recovery slaves
Using 45 overflow buffers per recovery slave
Thread 1 checkpoint: logseq 1367, block 2, scn 22801945
    on-disk rba: logseq 1365, block 6245, scn 22761936
  start recovery at logseq 1367, block 2, scn 22801945

*** 2024-04-07 08:15:35.595
Started writing zeroblks thread 1 seq 1367 blocks 3-10

*** 2024-04-07 08:15:35.595
Completed writing zeroblks thread 1 seq 1367
==== Redo read statistics for thread 1 ====
Total physical reads (from disk and memory): 4096Kb
-- Redo read_disk statistics --
Read rate (ASYNC): 0Kb in 0.04s => 0.01 Mb/sec
Longest record: 0Kb, moves: 0/1 (0%)
Longest LWN: 0Kb, moves: 0/1 (0%), moved: 0Mb
Last redo scn: 0x0000.015bee1a (22801946)
----------------------------------------------
----- Recovery Hash Table Statistics ---------
Hash table buckets = 262144
Longest hash chain = 0
Average hash chain = 0/0 = 0.0
Max compares per lookup = 0
Avg compares per lookup = 0/0 = 0.0
----------------------------------------------

*** 2024-04-07 08:15:35.611
KCRA: start recovery claims for 0 data blocks

*** 2024-04-07 08:15:35.611
KCRA: blocks processed = 0/0, claimed = 0, eliminated = 0

*** 2024-04-07 08:15:35.611
Recovery of Online Redo Log: Thread 1 Group 2 Seq 1367 Reading mem 0

*** 2024-04-07 08:15:35.611
Completed redo application of 0.00MB

*** 2024-04-07 08:15:35.626
Completed recovery checkpoint
----- Recovery Hash Table Statistics ---------
Hash table buckets = 262144
Longest hash chain = 0
Average hash chain = 0/0 = 0.0
Max compares per lookup = 0
Avg compares per lookup = 0/0 = 0.0
----------------------------------------------
Recovery sets nab of thread 1 seq 1367 to 3 with 8 zeroblks

*** 2024-04-07 08:15:36.173
Incident 171810 created, dump file: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_171810\orcl_ora_5872_i171810.trc
ORA-00600: ??????, ??: [16703], [1403], [20], [], [], [], [], [], [], [], [], []

ORA-00704: ????????
ORA-00704: ????????
ORA-00600: ??????, ??: [16703], [1403], [20], [], [], [], [], [], [], [], [], []
ORA-00704: ????????
ORA-00704: ????????
ORA-00600: ??????, ??: [16703], [1403], [20], [], [], [], [], [], [], [], [], []

*** 2024-04-07 08:15:37.064
USER (ospid: 5872): terminating the instance due to error 704

问题分析：

好家伙，又是经典的ORA-600 16703 1403 20 这个报错，这个报错只会在中国地区出现，这是那个数据库安装介质被植入了木马病毒，数据库创建时间超过300天，重启数据库时就会清空tab$基表。

解决思路：

备份恢复：

对于这种问题，有备份是最好的处理的，如果是逻辑备份，直接恢复到其他数据库，这样恢复出来的实例可能会丢失一些数据；如果是rman介质备份，可以先尝试恢复system表空间，恢复之后做recover操作，recover操作完成之后重建控制文件，做完以上操作之后再打开数据库。

BBED替换块：

如果没有备份，那就需要用bbed工具进行修复，客户出问题的库是在windows平台，10G开始windows平台上的bbed安装比较麻烦，这里选择把system表空间文件传输到linux平台，然后在linux平台上编译bbed，最终完整损坏文件的修复。

编译bbed

可以先在linux平台上编译bbed，编译之前需要先从10G安装介质中提取库文件（因为从11g开始，安装目录不带这些文件），抽取方式如下：

[root@centos7 ~]# su - ora10G
Last login: Sun Apr  7 11:11:51 CST 2024 on pts/2
[ora10G@centos7 ~]$ cd database
[ora10G@centos7 database]$ for jar in $(find . -type f -name "*.jar"|grep rdbms);do
> jar -tvf $jar | grep sbbd && echo $jar
> done
  1863 Sat Sep 17 19:59:24 CST 2005 rdbms/lib/sbbdpt.o
  1191 Sat Sep 17 19:59:28 CST 2005 rdbms/lib/ssbbded.o
./stage/Components/oracle.rdbms/10.2.0.1.0/1/DataFiles/filegroup33.jar
  3043 Thu Sep 08 03:43:08 CST 2005 rdbms/lib32/sbbdpt.o
  2721 Thu Sep 08 03:43:08 CST 2005 rdbms/lib32/ssbbded.o
./stage/Components/oracle.rdbms.hybrid/10.2.0.1.0/1/DataFiles/filegroup1.jar
[ora10G@centos7 database]$ ls
doc  install  response  runInstaller  stage  welcome.html
[ora10G@centos7 database]$ jar -xvf ./stage/Components/oracle.rdbms/10.2.0.1.0/1/DataFiles/filegroup33.jar
 inflated: rdbms/lib/dmndm.o
 inflated: rdbms/lib/dmndmse.o
 inflated: rdbms/lib/hoaoci.o
 inflated: rdbms/lib/hoat.o
 inflated: rdbms/lib/hoax.o
 inflated: rdbms/lib/homts.o
 inflated: rdbms/lib/horm.o
 inflated: rdbms/lib/hormc.o
 inflated: rdbms/lib/hormd.o
 inflated: rdbms/lib/hormt.o
 inflated: rdbms/lib/hout.o
 inflated: rdbms/lib/hsxaora.o
 inflated: rdbms/lib/jox.o
 inflated: rdbms/lib/joxoff.o
 inflated: rdbms/lib/kciwcx.o
 inflated: rdbms/lib/kcsm.o
 inflated: rdbms/lib/kfod.o
 inflated: rdbms/lib/kkxntp.o
 inflated: rdbms/lib/kkxwtp.o
 inflated: rdbms/lib/kopc.o
 inflated: rdbms/lib/kprnts.o
 inflated: rdbms/lib/kprwts.o
 inflated: rdbms/lib/kpucb.o
 inflated: rdbms/lib/ksms.o
 inflated: rdbms/lib/ksnkcs.o
 inflated: rdbms/lib/ksnktd.o
 inflated: rdbms/lib/ksnnni.o
 inflated: rdbms/lib/ksnnt2.o
 inflated: rdbms/lib/ktd.o
 inflated: rdbms/lib/kzlnlbac.o
 inflated: rdbms/lib/libknlopt.a
 inflated: rdbms/lib/libperfsrv10.a
 inflated: rdbms/lib/libdsga10.a
 inflated: rdbms/lib/libskgxns.a
 inflated: rdbms/lib/libodm10.a
 inflated: rdbms/lib/libqsmashr.a
 inflated: rdbms/lib/opimai.o
 inflated: rdbms/lib/s0kudbv.o
 inflated: rdbms/lib/s0kuzr.o
 inflated: rdbms/lib/sbbdpt.o
 inflated: rdbms/lib/shou.o
 inflated: rdbms/lib/shorm.o
 inflated: rdbms/lib/skfedpt.o
 inflated: rdbms/lib/skfodpt.o
 inflated: rdbms/lib/skrspt.o
 inflated: rdbms/lib/ssbbded.o
 inflated: rdbms/lib/sskfeded.o
 inflated: rdbms/lib/sskfoded.o
 inflated: rdbms/lib/sskrned.o
 inflated: rdbms/lib/sskrsed.o
 inflated: rdbms/lib/ssoraed.o
 inflated: rdbms/lib/sstrced.o
 inflated: rdbms/lib/strcpt.o
 inflated: rdbms/lib/ttcoerr.o
 inflated: rdbms/lib/ttcsoi.o
 inflated: rdbms/lib/xsnoolap.o
 inflated: rdbms/lib/genksms.o
[ora10G@centos7 database]$ ls
doc  install  rdbms  response  runInstaller  stage  welcome.html
[ora10G@centos7 database]$ cp rdbms/lib/sbbdpt.o ..
[ora10G@centos7 database]$ cp rdbms/lib/ssbbded.o ..
[ora10G@centos7 database]$ cd ..
[ora10G@centos7 ~]$ cd database
[ora10G@centos7 database]$ for jar in $(find . -type f -name "*.jar"|grep rdbms);do
> jar -tvf $jar | grep bbedus && echo $jar
> done
  8704 Fri Sep 09 09:46:10 CST 2005 rdbms/mesg/bbedus.msb
 10270 Tue Jul 25 19:32:00 CST 2000 rdbms/mesg/bbedus.msg
./stage/Components/oracle.rdbms.util/10.2.0.

抽取完成之后，详细编译方法如下：

[root@centos7 ora10G]# cp sbbdpt.o ssbbded.o  /u01/app/oracle/product/11.2.0/db_1/rdbms/lib/
[root@centos7 ora10G]# chown oracle:oinstall /u01/app/oracle/product/11.2.0/db_1/rdbms/lib/sbbdpt.o 
[root@centos7 ora10G]# chown oracle:oinstall /u01/app/oracle/product/11.2.0/db_1/rdbms/lib/ssbbded.o 
[root@centos7 ora10G]# chown oracle:oinstall bbedus.ms*
[root@centos7 ora10G]# cp bbedus.ms* /u01/app/oracle/product/11.2.0/db_1/rdbms/mesg/
[root@centos7 ora10G]# su - oracle
Last login: Sun Apr  7 11:22:14 CST 2024 on pts/0
[oracle@centos7 ~]$ make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk BBED=$ORACLE_HOME/bin/bbed $ORACLE_HOME/bin/bbed

Linking BBED utility (bbed)
rm -f /u01/app/oracle/product/11.2.0/db_1/bin/bbed
gcc -o /u01/app/oracle/product/11.2.0/db_1/bin/bbed -m64 -z noexecstack -L/u01/app/oracle/product/11.2.0/db_1/rdbms/lib/ -L/u01/app/oracle/product/11.2.0/db_1/lib/ -L/u01/app/oracle/product/11.2.0/db_1/lib/stubs/  /u01/app/oracle/product/11.2.0/db_1/lib/s0main.o /u01/app/oracle/product/11.2.0/db_1/rdbms/lib/ssbbded.o /u01/app/oracle/product/11.2.0/db_1/rdbms/lib/sbbdpt.o `cat /u01/app/oracle/product/11.2.0/db_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -ldbtools11 -lclntsh  `cat /u01/app/oracle/product/11.2.0/db_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnro11 `cat /u01/app/oracle/product/11.2.0/db_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnnz11 -lzt11 -lztkg11 -lclient11 -lnnetd11  -lvsn11 -lcommon11 -lgeneric11 -lmm -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 `cat /u01/app/oracle/product/11.2.0/db_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnro11 `cat /u01/app/oracle/product/11.2.0/db_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lclient11 -lnnetd11  -lvsn11 -lcommon11 -lgeneric11   -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 -lclient11 -lnnetd11  -lvsn11 -lcommon11 -lgeneric11 -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11   `cat /u01/app/oracle/product/11.2.0/db_1/lib/sysliblist` -Wl,-rpath,/u01/app/oracle/product/11.2.0/db_1/lib -lm    `cat /u01/app/oracle/product/11.2.0/db_1/lib/sysliblist` -ldl -lm   -L/u01/app/oracle/product/11.2.0/db_1/lib
[oracle@centos7 ~]$ 


[oracle@server1 ~]$ bbed
Password: blockedit     //默认密码
BBED: Release 2.0.0.0.0 - Limited Production on Wed Jul 29 23:46:35 2020
Copyright (c) 1982, 2011, Oracle and/or its affiliates.  All rights reserved.
************* !!! For Oracle Internal Use only !!! ***************
BBED>

配置bbed

#注意1号文件为损坏的文件，18号文件为同平台正常的文件
[oracle@centos7 hf]$ cat par.bbed
blocksize=8192
listfile=bbedfile.txt
mode=edit
PASSWORD=blockedit
[oracle@centos7 hf]$ cat cmd.par
set count 64
set width 160
[oracle@centos7 hf]$ cat bbedfile.txt 
1	/home/oracle/hf/SYSTEM01.DBF
18	/home/oracle/hf/O1_MF_SYSTEM_M14J9X0K_.DBF

简单查看

[oracle@centos7 hf]$ bbed parfile=par.bbed

BBED: Release 2.0.0.0.0 - Limited Production on Mon Apr 8 10:29:09 2024

Copyright (c) 1982, 2011, Oracle and/or its affiliates.  All rights reserved.

************* !!! For Oracle Internal Use only !!! ***************

BBED> show all
	FILE#          	1
	BLOCK#         	1
	OFFSET         	0
	DBA            	0x00400001 (4194305 1,1)
	FILENAME       	/home/oracle/hf/SYSTEM01.DBF
	BIFILE         	bifile.bbd
	LISTFILE       	bbedfile.txt
	BLOCKSIZE      	8192
	MODE           	Edit
	EDIT           	Unrecoverable
	IBASE          	Dec
	OBASE          	Dec
	WIDTH          	80
	COUNT          	512
	LOGFILE        	log.bbd
	SPOOL          	No

BBED> info 
 File#  Name                                                        Size(blks)
 -----  ----                                                        ----------
     1  /home/oracle/hf/SYSTEM01.DBF                                         0
    18  /home/oracle/hf/O1_MF_SYSTEM_M14J9X0K_.DBF                           0

BBED>

使用bbed替换块：

生成批量脚本：

在做这个替换之前一定要保留一个原始故障的system文件副本！！！


SQL> SELECT DISTINCT 'copy file 18 block ' || block_id || ' to file ' || FILE_ID ||
  2                  ' block ' || BLOCK_ID
  3    FROM (SELECT a.OBJ#,
  4                 TAB#,
  5                 a.DATAOBJ#,
  6                 BOBJ#,
  7                 NAME,
  8                 DBMS_ROWID.ROWID_RELATIVE_FNO(a.ROWID) FILE_ID,
  9                 DBMS_ROWID.ROWID_BLOCK_NUMBER(a.ROWID) BLOCK_ID
 10            FROM TAB$ a, obj$ b
 11           WHERE a.obj# = b.obj#
 12             AND A.OBJ# IN (10,
 13                    101,
 14                    103,
 15                    104,
 16                    105,
 17                    118,
 18                    12939,
 19                    1297,
 20                    12973,
 21                    1300,
 22                    13003,
 23                    1302,
 24                    1304,
 25                    13059,
 26                    1306,
 27                    1307,
 28                    1309,
 29                    1314,
 30                    13273,
 31                    13298,
 32                    13604,
 33                    14,
 34                    14137,
 35                    15,
 36                    16,
 37                    160,
 38                    161,
 39                    17,
 40                    18,
 41                    19,
 42                    192,
 43                    2,
 44                    20,
 45                    21,
 46                    22,
 47                    221,
 48                    222,
 49                    223,
 50                    225,
 51                    226,
 52                    227,
 53                    228,
 54                    23,
 55                    246,
 56                    248,
 57                    25,
 58                    250,
 59                    252,
 60                    28,
 61                    29,
 62                    294,
 63                    297,
 64                    300,
 65                    301,
 66                    302,
 67                    304,
 68                    307,
 69                    31,
 70                    311,
 71                    32,
 72                    375,
 73                    390,
 74                    4,
 75                    433,
 76                    436,
 77                    438,
 78                    446,
 79                    448,
 80                    451,
 81                    453,
 82                    455,
 83                    463,
 84                    5,
 85                    506,
 86                    514,
 87                    515,
 88                    517,
 89                    5541,
 90                    5582,
 91                    567,
 92                    5780,
 93                    5794,
 94                    5797,
 95                    5804,
 96                    5814,
 97                    587,
 98                    59,
 99                    6,
100                    61,
101                    6571,
102                    6731,
103                    68,
104                    68829,
105                    69,
106                    713,
107                    7144,
108                    717,
109                    721,
110                    74,
111                    75315,
112                    8,
113                    80,
114                    80591,
115                    83,
116                    83746,
117                    86,
118                    87892,
119                    87898,
120                    88,
121                    92,
122                    95,
123                    98,
124                    99))
125   order by 1;

'COPYFILE18BLOCK'||BLOCK_ID||'TOFILE'||FILE_ID||'BLOCK'||BLOCK_ID
-----------------------------------------------------------------------------------------------------------------------------------------------------------
copy file 18 block 13332 to file 1 block 13332
copy file 18 block 13344 to file 1 block 13344
copy file 18 block 13367 to file 1 block 13367
copy file 18 block 145 to file 1 block 145
copy file 18 block 146 to file 1 block 146
copy file 18 block 147 to file 1 block 147
copy file 18 block 148 to file 1 block 148
copy file 18 block 149 to file 1 block 149
copy file 18 block 150 to file 1 block 150
copy file 18 block 152 to file 1 block 152
copy file 18 block 153 to file 1 block 153
copy file 18 block 154 to file 1 block 154
copy file 18 block 155 to file 1 block 155
copy file 18 block 156 to file 1 block 156
copy file 18 block 158 to file 1 block 158
copy file 18 block 159 to file 1 block 159
copy file 18 block 160 to file 1 block 160
copy file 18 block 163 to file 1 block 163
copy file 18 block 165 to file 1 block 165
copy file 18 block 166 to file 1 block 166
copy file 18 block 167 to file 1 block 167
copy file 18 block 22500 to file 1 block 22500
copy file 18 block 22503 to file 1 block 22503
copy file 18 block 22505 to file 1 block 22505
copy file 18 block 22508 to file 1 block 22508
copy file 18 block 22517 to file 1 block 22517
copy file 18 block 22518 to file 1 block 22518
copy file 18 block 31491 to file 1 block 31491
copy file 18 block 31513 to file 1 block 31513
copy file 18 block 31548 to file 1 block 31548
copy file 18 block 3337 to file 1 block 3337
copy file 18 block 3339 to file 1 block 3339
copy file 18 block 3341 to file 1 block 3341
copy file 18 block 4396 to file 1 block 4396
copy file 18 block 66099 to file 1 block 66099
copy file 18 block 74445 to file 1 block 74445
copy file 18 block 78077 to file 1 block 78077
copy file 18 block 7913 to file 1 block 7913
copy file 18 block 94349 to file 1 block 94349
copy file 18 block 9951 to file 1 block 9951
copy file 18 block 9953 to file 1 block 9953
copy file 18 block 9962 to file 1 block 9962
copy file 18 block 9964 to file 1 block 9964

已选择43行。

编辑parfile文件，批量执行：


bbed parfile=/home/oracle/hf/par.bbed cmdfile=/home/oracle/hf/copy_bbed.txt

sum apply    --执行完成之后记得sum apply

BBED反转删除FLAG

有些时候，可能是出故障时某些块发生了行迁移或者延迟事务，导致上述方法不生效，即使找到了同平台的system文件进行同位置的块替换，但是打开数据库的时候还是一堆报错，再接着处理就更麻烦。

这个时候我们可以根据记录删除的flag标签进行定位，一般被删除（delete）的flag为0x3c

SQL> conn /as sysdba
Connected.
SQL> alter system dump datafile 5 block 3252;

System altered.

SQL> oradebug setmypid
Statement processed.
SQL> oradebug tracefile_name
/u01/app/oracle/admin/orcl/udump/orcl_ora_6106.trc
SQL>!more /u01/app/oracle/admin/orcl/udump/orcl_ora_6106.trc


---有关row的信息如下
block_row_dump:
tab 0, row 0, @0x1db0
tl: 8 fb: --H-FL-- lb: 0x0  cc: 2
col  0: [ 1]  80
col  1: [ 2]  79 79
tab 0, row 1, @0x1db8
tl: 8 fb: --H-FL-- lb: 0x0  cc: 2
col  0: [ 1]  80
col  1: [ 2]  79 79
tab 0, row 2, @0x1dc0
tl: 8 fb: --H-FL-- lb: 0x0  cc: 2
col  0: [ 1]  80
col  1: [ 2]  79 79
tab 0, row 3, @0x1dc8
........
........
tab 0, row 332, @0x152f          --第332条数据
tl: 9 fb: --H-FL-- lb: 0x2  cc: 2
col  0: [ 2]  c1 02
col  1: [ 2]  78 7a              --第332条数据的name值78 7a 为 'xz'
end_of_block_dump


注意这里的fb: --H-FL--。 其有8个选项，每个值分别与bitmask 对应。

如果一个row 没有被删除，那么它的Flag 表示为：--H-FL--. 这里的字母分别代表属性的首字母。其对应的值：32 + 8 + 4 =44 or 0x2c

如果一个row 被delete了，那么它的Flag 表示为：--HDFL--. bitmask里的deleted 被设置为16. 其对应的值：32 + 16 + 8 + 4 = 60 or 0x3c

既然知道有这个特性，接下来我们就需要限定需要扫描的块，然后把所有符合“删除flag”特征的记录偏移给找出来，最后再通过bbed反向修改一下就可以了。

确定需要扫描的块：

一般都是都dba1,144开始

bbed反向修改：

$head recovery.txt

在做这个修改之前一定要保留一个原始故障的system文件副本！！！


assign /x dba 4194449 offset 7833 = 0x5c
assign /x dba 4194449 offset 7745 = 0x5c
assign /x dba 4194449 offset 7632 = 0x5c
assign /x dba 4194449 offset 7512 = 0x5c
assign /x dba 4194449 offset 7378 = 0x5c
assign /x dba 4194449 offset 7266 = 0x5c
assign /x dba 4194449 offset 7138 = 0x5c
assign /x dba 4194450 offset 5678 = 0x5c
assign /x dba 4194450 offset 7882 = 0x5c
assign /x dba 4194450 offset 7790 = 0x5c

最后打开数据库，导出用户的业务数据，最后进行重建即可。