通過修改SCN來騙過ORACLE啟動驗證

wei-xh發表於2012-05-11

Oracle

實驗過程的整理，還沒有新增解釋說明，後面有時間再整理。

sys>create tablespace users datafile '/data1/oracle/crmd/users01.dbf' size 20m;

Tablespace created.

sys>shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.

cp /data1/oracle/crmd/users01.dbf /data1/oracle/crmd/users01.dbf.bak

@>startup
ORACLE instance started.

test>create table test(id number) tablespace users;

Table created.

sys>shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.

cp /data1/oracle/crmd/users01.dbf.bak /data1/oracle/crmd/users01.dbf

@>startup
ORACLE instance started.

Total System Global Area 1.5049E+10 bytes
Fixed Size                  2110032 bytes
Variable Size            2281704880 bytes
Database Buffers         1.2751E+10 bytes
Redo Buffers               14663680 bytes
Database mounted.
ORA-01113: file 4 needs media recovery
ORA-01110: data file 4: '/data1/oracle/crmd/users01.dbf'

一般資料庫啟動會校驗如下4個地方來驗證資料庫一致性：
1.kscnbas(在偏移量484處) 資料檔案最後一次檢查點的SCN
2.kcvcptim(在偏移量492處)資料檔案最後一次檢查點的時間
3.kcvfhcpc(在偏移量140處),檢查點計數
4.kcvfhccc(在偏移量148處),總是比檢查點計數小1

BBED> set dba 1,1
DBA 0x00400001 (4194305 1,1)

BBED> p kcvfhcpc
ub4 kcvfhcpc @140 0x000006b1

BBED> p kcvfhccc
ub4 kcvfhccc @148 0x000006b0

BBED> p kcvfhckp
struct kcvfhckp, 36 bytes                   @484
   struct kcvcpscn, 8 bytes                 @484
      ub4 kscnbas                           @484      0x001b1d78
      ub2 kscnwrp                           @488      0x0000
   ub4 kcvcptim                             @492      0x2eaaf271
   ub2 kcvcpthr                             @496      0x0001
   union u, 12 bytes                        @500
      struct kcvcprba, 12 bytes             @500
         ub4 kcrbaseq                       @500      0x00000320
         ub4 kcrbabno                       @504      0x000001a2
         ub2 kcrbabof                       @508      0x0010
   ub1 kcvcpetb[0]                          @512      0x02
   ub1 kcvcpetb[1]                          @513      0x00
   ub1 kcvcpetb[2]                          @514      0x00
   ub1 kcvcpetb[3]                          @515      0x00
   ub1 kcvcpetb[4]                          @516      0x00
   ub1 kcvcpetb[5]                          @517      0x00
   ub1 kcvcpetb[6]                          @518      0x00
   ub1 kcvcpetb[7]                          @519      0x00

BBED> set dba 4,1
DBA 0x01000001 (16777217 4,1)

BBED> p kcvfhckp
struct kcvfhckp, 36 bytes                   @484
   struct kcvcpscn, 8 bytes                 @484
      ub4 kscnbas                           @484      0x001b1c02
      ub2 kscnwrp                           @488      0x0000
   ub4 kcvcptim                             @492      0x2eaaf213
   ub2 kcvcpthr                             @496      0x0001
   union u, 12 bytes                        @500
      struct kcvcprba, 12 bytes             @500
         ub4 kcrbaseq                       @500      0x0000031f
         ub4 kcrbabno                       @504      0x000000ec
         ub2 kcrbabof                       @508      0x0010
   ub1 kcvcpetb[0]                          @512      0x02
   ub1 kcvcpetb[1]                          @513      0x00
   ub1 kcvcpetb[2]                          @514      0x00
   ub1 kcvcpetb[3]                          @515      0x00
   ub1 kcvcpetb[4]                          @516      0x00
   ub1 kcvcpetb[5]                          @517      0x00
   ub1 kcvcpetb[6]                          @518      0x00
   ub1 kcvcpetb[7]                          @519      0x00

BBED> dump /v offset 484
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 484 to 995 Dba:0x01000001
-------------------------------------------------------
021c1b00 00000000 13f2aa2e 01000160 l ...............`

BBED> m /x 781d
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) Y
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 484 to 995 Dba:0x01000001
------------------------------------------------------------------------
781d1b00 00000000 13f2aa2e 01000160 1f030000 ec000000 10000000 02000000

BBED> d /v offset 492
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 492 to 1003 Dba:0x01000001
-------------------------------------------------------
13f2aa2e 01000160 1f030000 ec000000 l .......`........

BBED> m /x 71f2
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 492 to 1003 Dba:0x01000001
------------------------------------------------------------------------
71f2aa2e 01000160 1f030000 ec000000 10000000 02000000 00000000 00000000

BBED> p kcvfhcpc
ub4 kcvfhcpc @140 0x00000005

BBED> d /v offset 140
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 140 to 651 Dba:0x01000001
-------------------------------------------------------
05000000 00000000 04000000 00000000 l ................

BBED> m /x b106
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 140 to 651 Dba:0x01000001
------------------------------------------------------------------------
b1060000 00000000 04000000 00000000 00000000 00000000 00000000 00000000

BBED> d /v offset 148
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 148 to 659 Dba:0x01000001
-------------------------------------------------------
04000000 00000000 00000000 00000000 l ................

BBED> m /x b006
File: /data1/oracle/crmd/users01.dbf (4)
Block: 1 Offsets: 148 to 659 Dba:0x01000001
------------------------------------------------------------------------
b0060000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

BBED> sum dba 4,1 apply
Check value for File 4, Block 1:
current = 0xd1d9, required = 0xd1d9

BBED> p kcvfhckp
struct kcvfhckp, 36 bytes                   @484
   struct kcvcpscn, 8 bytes                 @484
      ub4 kscnbas                           @484      0x001b1d78
      ub2 kscnwrp                           @488      0x0000
   ub4 kcvcptim                             @492      0x2eaaf271
   ub2 kcvcpthr                             @496      0x0001
   union u, 12 bytes                        @500
      struct kcvcprba, 12 bytes             @500
         ub4 kcrbaseq                       @500      0x0000031f
         ub4 kcrbabno                       @504      0x000000ec
         ub2 kcrbabof                       @508      0x0010
   ub1 kcvcpetb[0]                          @512      0x02
   ub1 kcvcpetb[1]                          @513      0x00
   ub1 kcvcpetb[2]                          @514      0x00
   ub1 kcvcpetb[3]                          @515      0x00
   ub1 kcvcpetb[4]                          @516      0x00
   ub1 kcvcpetb[5]                          @517      0x00
   ub1 kcvcpetb[6]                          @518      0x00
   ub1 kcvcpetb[7]                          @519      0x00

BBED> p kcvfhcpc
ub4 kcvfhcpc @140 0x000006b1

BBED> p kcvfhccc
ub4 kcvfhccc @148 0x000006b0

BBED> set dba 1,1
DBA 0x00400001 (4194305 1,1)

BBED> p kcvfhcpc
ub4 kcvfhcpc @140 0x000006b1

BBED> p kcvfhccc
ub4 kcvfhccc @148 0x000006b0

@>startup force
ORACLE instance started.

Total System Global Area 1.5049E+10 bytes
Fixed Size                  2110032 bytes
Variable Size            2281704880 bytes
Database Buffers         1.2751E+10 bytes
Redo Buffers               14663680 bytes
Database mounted.
ORA-01122: database file 4 failed verification check
ORA-01110: data file 4: '/data1/oracle/crmd/users01.dbf'
ORA-01207: file is more recent than control file - old control file

@>alter database backup controlfile to trace;

Database altered.

STARTUP NOMOUNT
CREATE CONTROLFILE REUSE DATABASE "CRMD" NORESETLOGS FORCE LOGGING NOARCHIVELOG
    MAXLOGFILES 60
    MAXLOGMEMBERS 5
    MAXDATAFILES 2000
    MAXINSTANCES 1
    MAXLOGHISTORY 1168
LOGFILE
GROUP 1 '/data1/oracle/crmd/redo7901.log' SIZE 1020M,
GROUP 2 '/data1/oracle/crmd/redo7902.log' SIZE 1020M,
GROUP 3 '/data1/oracle/crmd/redo7903.log' SIZE 1020M
-- STANDBY LOGFILE
DATAFILE
'/data1/oracle/crmd/system01.dbf',
'/data1/oracle/crmd/undotbs01.dbf',
'/data1/oracle/crmd/sysaux01.dbf',
'/data1/oracle/crmd/users01.dbf'
CHARACTER SET UTF8
;

@>alter database open;

Database altered.

@>conn test/test
Connected.
test>select * from test;
select * from test
*
ERROR at line 1:
ORA-08103: object no longer exists

test>drop table test;

Table dropped.

來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/22034023/viewspace-723340/，如需轉載，請註明出處，否則將追究法律責任。

Oracle資料庫啟動過程驗證檢查點SCN
2014-07-03
Oracle資料庫
oracle mount_open_checkpoint(scn)啟動驗證測試
2010-08-19
Oracle
通過 Grub 來引導啟動 UBUNTU
2018-05-24
Ubuntu
ElasticSearch 通過nginx做HTTP驗證
2018-03-19
ElasticsearchNginxHTTP
SCN與oracle啟動
2012-02-09
Oracle
透過修改控制檔案scn推進資料庫scn
2021-09-09
資料庫
通過DNSLOG回顯驗證漏洞
2021-01-13
DNS
通過驗證訪問ASM例項
2014-05-09
ASM
ordebug 手動修改Oracle sga scn
2023-10-07
Oracle
驗證11gR2 RAC中ASM例項通過gpnp profile獲得spfile資訊來啟動ASM例項
2016-05-09
ASM
WebService通過SOAP頭進行身份驗證
2010-05-20
Web
Oracle的啟動過程
2016-02-19
Oracle
通過oracle 10g ocm 認證
2014-07-23
Oracle 10g
Oracle 通過儲存過程來生成CSV檔案
2016-09-20
Oracle儲存過程
ORACLE 11G通過SCN做增量備份修復standby庫詳細過程
2015-06-03
Oracle
使用10046 來了解oracle的啟動過程
2011-05-03
Oracle
通過selenium突破極驗驗證實現登入
2018-06-20
element-ui表單驗證輸入空格也能驗證通過
2018-01-04
UI
我通過OCP認證的學習經驗
2008-07-24
通過配置檔案來修改WAS控制檯Session過期時間的方法
2010-06-17
Session
GitHub開啟二次驗證後, 通過https方式clone專案
2017-10-27
GithubHTTP
ORACLE啟動過程淺析
2014-05-19
Oracle
ORACLE啟動過程簡析
2015-09-22
Oracle
通過dbms_backup_restore修改oracle的dbid
2017-05-09
RESTOracle
如何通過emca來修改Database Control HTTP 埠
2013-05-27
DatabaseHTTP
通過SQL*Plus遠端啟動Oracle資料庫例項
2014-04-27
SQLOracle資料庫
Oracle啟動的三個過程
2017-05-13
Oracle
深入理解ORACLE啟動過程
2017-05-02
Oracle
Oracle資料庫啟動過程
2014-04-04
Oracle資料庫
oracle的內部啟動過程
2014-12-23
Oracle
通過警報日誌瞭解oracle斷電後重新啟動的恢復過程
2014-09-06
Oracle
Oracle Weblogic叢集啟動通過HTTP等協議進行隧道通訊
2014-02-15
OracleWebHTTP協議
Oracle9i Flashback Query 閃回查詢總結 --- (通過SCN恢復)
2008-01-16
Oracle
jQuery Validate自定義表單元素驗證通過和不通過的樣式
2018-09-10
jQuery
通過shell指令碼批量驗證dataguard的有效性
2016-02-01
指令碼
Kubeadm證書過期問題修復方法之一：通過修改kubeadm原始碼
2019-02-25
原始碼
通過修改jdbc配置檔案方式修改Weblogic資料來源密碼
2017-07-22
JDBCWeb密碼
通過 Oracle_Cloud_Infrastructure oci 雲認證考試
2018-12-19
OracleCloudASTStruct

通過修改SCN來騙過ORACLE啟動驗證

相關文章