[20170412]bbed隱藏資料記錄.txt
[20170412]bbed隱藏資料記錄.txt
--上午做了bbed恢復修改記錄(不等長)的情況，http://blog.itpub.net/267265/viewspace-2137082/
--下午做一個隱藏資料記錄的情況，實際上這樣做有點多餘，就是刪除命令，看看bbed是否可以完成。
1.環境：
SCOTT@book> @ &r/ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.4.0 Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
SCOTT@book> create table t as select * from dept ;
Table created.
SCOTT@book> @ &r/qq t 1
ROWID OBJECT FILE BLOCK ROW ROWID_DBA DEPTNO DNAME LOC
------------------ ------------ ------------ ------------ ------------ -------------------- ------------ -------------- -------------
AAAWGvAAEAAAAIjAAA 90543 4 547 0 0x1000223 10 ACCOUNTING NEW YORK
--//假設隱藏這條記錄。
SCOTT@book> alter system checkpoint ;
System altered.
2.bbed操作，實際上就是修改對應flag =0x3c.
BBED> x /rncc dba 4,547 *kdbr[0]
rowdata[66] @8162
-----------
flag@8162: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8163: 0x00
cols@8164: 3
col 0[2] @8165: 10
col 1[10] @8168: ACCOUNTING
col 2[8] @8179: NEW YORK
BBED> assign offset 8162=0x3c;
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) y
ub1 rowdata[0] @8162 0x3c
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48a5, required = 0x48a5
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
Block Checking: DBA = 16777763, Block Type = KTB-managed data block
data header at 0x7f25fb24a27c
kdbchk: the amount of space used is not equal to block size
used=94 fsc=0 avsp=7946 dtl=8064
Block 547 failed with check code 6110
--dtl - used - fsc = avsp
--8064-94-0=7970
BBED> assign kdbh.kdbhavsp=7970
sb2 kdbhavsp @134 7970
BBED> sum apply
Check value for File 4, Block 547:
current = 0x488d, required = 0x488d
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
Block Checking: DBA = 16777763, Block Type = KTB-managed data block
data header at 0xce0e7c
kdbchk: avsp(7970) > tosp(7946)
Block 547 failed with check code 6128
BBED> assign kdbh.kdbhtosp=kdbh.kdbhavsp
sb2 kdbhtosp @136 7970
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48a5, required = 0x48a5
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
Block Checking: DBA = 16777763, Block Type = KTB-managed data block
data header at 0xce0e7c
kdbchk: space available on commit is incorrect
tosp=7970 fsc=0 stb=2 avsp=7970
Block 547 failed with check code 6111
BBED> assign kdbh.kdbhtosp=7972
sb2 kdbhtosp @136 7968
--//依舊不理解stb 什麼意思。是否指flag,lock這2個位元組。
--//猜測tosp - fsc - stb = avsp.
BBED> p kdbh
struct kdbh, 14 bytes @124
ub1 kdbhflag @124 0x00 (NONE)
sb1 kdbhntab @125 1
sb2 kdbhnrow @126 4
sb2 kdbhfrre @128 -1
sb2 kdbhfsbo @130 26
sb2 kdbhfseo @132 7972
sb2 kdbhavsp @134 7970
sb2 kdbhtosp @136 7972
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48a3, required = 0x48a3
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
3.檢查修改情況：
SCOTT@book> alter system flush buffer_cache ;
System altered.
SCOTT@book> select rowid,t.* from t;
ROWID DEPTNO DNAME LOC
------------------ ------------ -------------- -------------
AAAWGvAAEAAAAIjAAB 20 RESEARCH DALLAS
AAAWGvAAEAAAAIjAAC 30 SALES CHICAGO
AAAWGvAAEAAAAIjAAD 40 OPERATIONS BOSTON
--OK!!
4.重複測試隱藏3條看看。
SCOTT@book> drop table t purge ;
Table dropped.
SCOTT@book> create table t as select * from dept ;
Table created.
SCOTT@book> @ &r/qq t 1
ROWID OBJECT FILE BLOCK ROW ROWID_DBA DEPTNO DNAME LOC
------------------ ------------ ------------ ------------ ------------ -------------------- ------------ -------------- -------------
AAAWGwAAEAAAAIjAAA 90544 4 547 0 0x1000223 10 ACCOUNTING NEW YORK
SCOTT@book> alter system checkpoint ;
System altered.
BBED> x /rncc dba 4,547 *kdbr[0]
rowdata[66] @8162
-----------
flag@8162: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8163: 0x00
cols@8164: 3
col 0[2] @8165: 10
col 1[10] @8168: ACCOUNTING
col 2[8] @8179: NEW YORK
BBED> x /rncc dba 4,547 *kdbr[1]
rowdata[44] @8140
-----------
flag@8140: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8141: 0x00
cols@8142: 3
col 0[2] @8143: 20
col 1[8] @8146: RESEARCH
col 2[6] @8155: DALLAS
BBED> x /rncc dba 4,547 *kdbr[2]
rowdata[24] @8120
-----------
flag@8120: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8121: 0x00
cols@8122: 3
col 0[2] @8123: 30
col 1[5] @8126: SALES
col 2[7] @8132: CHICAGO
BBED> assign offset 8162=0x3c;
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) y
ub1 rowdata[0] @8162 0x3c
BBED> assign offset 8140=0x3c;
ub1 rowdata[0] @8140 0x3c
BBED> assign offset 8120=0x3c;
ub1 rowdata[0] @8120 0x3c
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48ba, required = 0x48ba
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
Block Checking: DBA = 16777763, Block Type = KTB-managed data block
data header at 0x7fa16f64b27c
kdbchk: the amount of space used is not equal to block size
used=56 fsc=0 avsp=7946 dtl=8064
Block 547 failed with check code 6110
--dtl - used - fsc = avsp
-- 8064-56-0=8008
BBED> assign kdbh.kdbhavsp=8008
sb2 kdbhavsp @134 8008
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48f8, required = 0x48f8
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
Block Checking: DBA = 16777763, Block Type = KTB-managed data block
data header at 0x198ce7c
kdbchk: avsp(8008) > tosp(7946)
Block 547 failed with check code 6128
BBED> assign kdbh.kdbhtosp=kdbh.kdbhavsp
sb2 kdbhtosp @136 8008
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48ba, required = 0x48ba
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
Block Checking: DBA = 16777763, Block Type = KTB-managed data block
data header at 0x198ce7c
kdbchk: space available on commit is incorrect
tosp=8008 fsc=0 stb=6 avsp=8008
Block 547 failed with check code 6111
--//感覺stb=6,猜測正常。
--//猜測tosp - fsc - stb = avsp.
--//8014-0-6=8008
BBED> assign kdbh.kdbhtosp=8014
sb2 kdbhtosp @136 8014
BBED> sum apply
Check value for File 4, Block 547:
current = 0x48bc, required = 0x48bc
BBED> verify
DBVERIFY - Verification starting
FILE = /mnt/ramdisk/book/users01.dbf
BLOCK = 547
SCOTT@book> alter system flush buffer_cache ;
System altered.
SCOTT@book> select rowid,t.* from t;
ROWID DEPTNO DNAME LOC
------------------ ------------ -------------- -------------
AAAWGwAAEAAAAIjAAD 40 OPERATIONS BOSTON
--OK!!
來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/267265/viewspace-2137121/，如需轉載，請註明出處，否則將追究法律責任。
相關文章
- [20140624]bbed修改資料記錄.txt
- [20160526]bbed修改資料記錄(不等長).txt
- [20140624]bbed修改資料記錄(不等長).txt
- 資料隱藏技術資料隱藏
- 隱藏資料夾怎麼取消隱藏 關閉隱藏檔案的辦法
- [20170412]op code列表.txt
- [20180604]在記憶體修改資料(bbed).txt記憶體
- [20170419]bbed探究資料塊.txt
- [20170412]分析重做日誌.txt
- Windows XP 清除工作列隱藏圖示記錄(轉)Windows
- 隱藏的資料夾怎麼找出來 恢復隱藏資料夾的辦法
- [20210906]bbed讀取資料塊(bbed-wrap.sh).txt
- win10資料夾如何隱藏_win10系統的資料夾怎麼隱藏Win10
- win10要如何隱藏資料夾_win10怎麼徹底隱藏資料夾Win10
- win10隱藏的資料夾怎麼找出來 顯示隱藏資料夾步驟Win10
- 如何在指標中隱藏資料？指標
- IDEA 隱藏 .idea 目錄Idea
- 利用登錄檔隱藏檔案
- win10 如何顯示隱藏資料夾_win10 如何顯示隱藏的資料夾Win10
- win10如何顯示隱藏資料夾 win10開啟隱藏資料夾的方法Win10
- win10怎麼檢視隱藏資料夾 window10隱藏資料夾如何檢視Win10
- nginx下目錄瀏覽及其驗證功能、版本隱藏等配置記錄Nginx
- [20190104]bbed手工插入資料.txt
- win10怎麼顯示隱藏資料夾 win10顯示隱藏資料夾的方法Win10
- mac隱藏資料夾怎麼顯示？Mac
- 資料夾隱藏加密工具：Secret Folder for Mac加密Mac
- 資料夾的隱藏（十）終極篇
- 光碟目錄隱藏原理及破解方法
- win10怎樣檢視隱藏的資料夾_win10怎麼開啟隱藏資料夾Win10
- Win10檔案和資料夾如何隱藏 win10隱藏檔案及資料夾的方法Win10
- 隱藏任意程式，目錄檔案，登錄檔，埠
- [20210318]bbed讀取資料塊.txt
- [20190104]bbed手動修改資料.txt
- MongoDB隱藏技能：如何重新命名資料庫MongoDB資料庫
- Linux中隱藏檔案與資料夾Linux
- Typora 隱藏側邊欄圖片資料夾
- 獲取資料庫中所有隱藏引數資料庫
- 記憶體分配的隱藏成本記憶體