1.安装及测试环境
OS:Centos7.9
database:Oracle Database 12c Enterprise Edition Release 12.2.0.1.0
2.BBED安装
BBED(Block Browerand EDitor Tool)用来直接查看和修改数据文件数据的一个工具，是 Oracle 一款内部工具，可以直接修改 Oracle 数据文件块的内容，在一些极端恢复场景下比较有用。
2.1拷贝bbed文件到相应目录下
cp ssbbded.o $ORACLE_HOME/rdbms/lib/ssbbded.o
cp sbbdpt.o $ORACLE_HOME/rdbms/lib/sbbdpt.o
cp bbedus.msg $ORACLE_HOME/rdbms/mesg/bbedus.msg
cp bbedus.msb $ORACLE_HOME/rdbms/mesg/bbedus.msb
2.2编译
cd $ORACLE_HOME/rdbms/lib
make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk BBED=$ORACLE_HOME/bin/bbed $ORACLE_HOME/bin/bbed
2.3 创建 filelist.txt
SYS@EVA>select file#||' '||name||' '||bytes from v$datafile;
[oracle@oracledb bbed]$ vi filelist.txt
1 /u01/app/oracle/oradata/EVA/system01.dbf 922746880
2 /u01/app/oracle/oradata/EVA/sysaux01.dbf 713031680
3 /u01/app/oracle/oradata/EVA/undotbs01.dbf 1074790400
4 /u01/app/oracle/oradata/EVA/users01.dbf 5242880
5 /u01/app/oracle/oradata/EVA/tbs1.dbf 10485760
2.4.运行BBED
[oracle@oracledb ~]$ bbed password=blockedit listfile=/home/oracle/bbed/filelist.txt blocksize=8192 mode=edit
BBED> info
File# Name Size(blks)
----- ---- ----------
1 /u01/app/oracle/oradata/EVA/system01.dbf 112640
2 /u01/app/oracle/oradata/EVA/sysaux01.dbf 87040
3 /u01/app/oracle/oradata/EVA/undotbs01.dbf 131200
4 /u01/app/oracle/oradata/EVA/users01.dbf 640
5 /u01/app/oracle/oradata/EVA/tbs1.dbf 1280
2.5常用命令
set、find、dump、print、modify、map、sum apply、verify
set file 1 block 1 --第一号文件第一号块
set offset 20 --偏移量即代表第一号文件第一号块第20字节
set count 8192 --显示字节长度,默认512字节
map /v --查看块详细结构
print kcvfh --显示文件头
find /x 6865e2de --查找指定的字符串 /x表示16进制
dump /v 查看16进制内容并显示对应文本
modify /x abcd offset 20 --将第20,21字节修改为abcd(2个16进制位为一个字节)
sum apply --应用修改
verify --校验数据
3.BBED使用小案例
3.1使用BBED解析DB_NAME
BBED> set file 1 block 1 --设置1号文件1号块即SYSTEM.DBF文件的第一号块
FILE# 1
BLOCK# 1
BBED> map /v --查看块的详细结构
File: /u01/app/oracle/oradata/EVA/system01.dbf (1)
Block: 1 Dba:0x00400001
------------------------------------------------------------
Data File Header
struct kcvfh, 1248 bytes @0
struct kcvfhbfh, 20 bytes @0
struct kcvfhhdr, 76 bytes @20
ub4 kcvfhrdb @96
struct kcvfhcrs, 8 bytes @100
ub4 kcvfhcrt @108
ub4 kcvfhrlc @112
struct kcvfhrls, 8 bytes @116
ub4 kcvfhbti @124
struct kcvfhbsc, 8 bytes @128
ub2 kcvfhbth @136
ub2 kcvfhsta @138
struct kcvfhckp, 36 bytes @484
ub4 kcvfhcpc @140
ub4 kcvfhrts @144
ub4 kcvfhccc @148
struct kcvfhbcp, 36 bytes @152
ub4 kcvfhbhz @312
struct kcvfhxcd, 16 bytes @316
sword kcvfhtsn @332
ub2 kcvfhtln @336
text kcvfhtnm[30] @338
ub4 kcvfhrfn @368
struct kcvfhrfs, 8 bytes @372
ub4 kcvfhrft @380
struct kcvfhafs, 8 bytes @384
ub4 kcvfhbbc @392
ub4 kcvfhncb @396
ub4 kcvfhmcb @400
ub4 kcvfhlcb @404
ub4 kcvfhbcs @408
ub2 kcvfhofb @412
ub2 kcvfhnfb @414
ub4 kcvfhprc @416
struct kcvfhprs, 8 bytes @420
struct kcvfhprfs, 8 bytes @428
ub4 kcvfhtrt @444
ub4 tailchk @8188
BBED> print kcvfh --打印文件头结构,offset32-39为DB_NAME所占的字节,由此可以看出DB_NAME不能超过8个字符
struct kcvfh, 1248 bytes @0
struct kcvfhbfh, 20 bytes @0
ub1 type_kcbh @0 0x0b
ub1 frmt_kcbh @1 0xa2
ub2 wrp2_kcbh @2 0x0000
ub4 rdba_kcbh @4 0x00400001
ub4 bas_kcbh @8 0x00000000
ub2 wrp_kcbh @12 0x0000
ub1 seq_kcbh @14 0x01
ub1 flg_kcbh @15 0x04 (KCBHFCKV)
ub2 chkval_kcbh @16 0x0b61
ub2 spare3_kcbh @18 0x0000
struct kcvfhhdr, 76 bytes @20
ub4 kccfhswv @20 0x00000000
ub4 kccfhcvn @24 0x0c200000
ub4 kccfhdbi @28 0xdee26568
text kccfhdbn[0] @32 E --数
text kccfhdbn[1] @33 V --据
text kccfhdbn[2] @34 A --库
text kccfhdbn[3] @35 --名
text kccfhdbn[4] @36
text kccfhdbn[5] @37
text kccfhdbn[6] @38
text kccfhdbn[7] @39
ub4 kccfhcsq @40 0x000001c9
ub4 kccfhfsz @44 0x0001b800
s_blkz kccfhbsz @48 0x00
ub2 kccfhfno @52 0x0001
ub2 kccfhtyp @54 0x0003
ub4 kccfhacid @56 0x00000000
ub4 kccfhcks @60 0x00000000
BBED> dump offset 32 --查看数据库名的16进制显示
File: /u01/app/oracle/oradata/EVA/system01.dbf (1)
Block: 1 Offsets: 32 to 95 Dba:0x00400001
------------------------------------------------------------------------
45564100 00000000 c9010000 00b80100 00200000 01000300 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
--使用函数转换后正好与DB_NAME对应
SYS@EVA>select chr(to_number('455641','xxxxxxxxxxxxxx')) from dual;
EVA
3.2模拟ORA-01207报错并处理
出现这个的原因是由于kcvfhcpc(检查点计数)小于kcvfhccc(控制文件检查点计数)，正常情况是kcvfhcpc=kcvfhccc+1
处理步骤:
1.将kcvfhccc修改为大于kcvfhcpc的值(模拟)
2.关库报错，查看alert日志
3.dump相关文件头
4.根据dump信息使用bbed修改相关信息
5.修改完成后可以正常关库启库
BBED> p kcvfh
struct kcvfh, 1248 bytes @0
struct kcvfhbfh, 20 bytes @0
.............省略部分内容
ub4 kcvfhcpc @140 0x0000001c --检查点计数
ub4 kcvfhrts @144 0x00000000
ub4 kcvfhccc @148 0x0000001b --控制文件检查点计数
BBED> set file 1 block 1 offset 148
BBED> dump
File: /u01/app/oracle/oradata/EVA/system01.dbf (1)
Block: 1 Offsets: 148 to 659 Dba:0x00400001
------------------------------------------------------------------------
1b000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BBED> m /x 1d --将1b改为1d 此时kcvfhccc将大于kcvfhcpc
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) y
File: /u01/app/oracle/oradata/EVA/system01.dbf (1)
Block: 1 Offsets: 148 to 659 Dba:0x00400001
------------------------------------------------------------------------
1d000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BBED> sum apply --应用修改
SYS@EVA>shut immediate --数据库关闭,出现ORA-01207报错
ORA-01122: database file 1 failed verification check
ORA-01110: data file 1: '/u01/app/oracle/oradata/EVA/system01.dbf'
ORA-01207: file is more recent than control file - old control file
--查看alert日志
2024-07-03 14:53:36.667000 +08:00
Shutting down instance (immediate) (OS id: 31024)
2024-07-03 14:53:38.327000 +08:00
Stopping background process SMCO
2024-07-03 14:53:39.385000 +08:00
Shutting down instance: further logons disabled
Read of datafile '/u01/app/oracle/oradata/EVA/system01.dbf' (fno 1) header failed with ORA-01207
Rereading datafile 1 header failed with ORA-01207
Errors in file /u01/app/oracle/diag/rdbms/eva/EVA/trace/EVA_m000_31528.trc:
ORA-01110: data file 1: '/u01/app/oracle/oradata/EVA/system01.dbf'
ORA-01207: file is more recent than control file - old control file
Errors in file /u01/app/oracle/diag/rdbms/eva/EVA/trace/EVA_m000_31528.trc:
ORA-01110: data file 1: '/u01/app/oracle/oradata/EVA/system01.dbf'
ORA-01207: file is more recent than control file - old control file
--将文件头dump后观察相关信息
SYS@EVA>oradebug setmypid
SYS@EVA>alter session set events 'immediate trace name FILE_HDRS level 3';
SYS@EVA>oradebug tracefile_name
SYS@EVA>oradebug close_trace
SYS@EVA>!vi /u01/app/oracle/diag/rdbms/eva/EVA/trace/EVA_ora_6949.trc
............省略部分内容...............
Tablespace #0 - SYSTEM rel_fn:1
Creation at scn: 0x0000000000000007 07/03/2024 10:17:21
Backup taken at scn: 0x0000000000000000 01/01/1988 00:00:00 thread:0
reset logs count:0x45efe2a8 scn: 0x0000000000000001
prev reset logs count:0x0 scn: 0x0000000000000000
recovered at 01/01/1988 00:00:00
status:0x2004 root dba:0x00400208 chkpt cnt: 28 ctl cnt:29 --异常的system文件的ctl cnt大于chkpt cnt的值
begin-hot-backup file size: 0
Checkpointed at scn: 0x00000000000b4b15 07/03/2024 14:52:17
thread:1 rba:(0x16.23149.10)
............省略部分内容...............
Tablespace #1 - SYSAUX rel_fn:2
Creation at scn: 0x0000000000000a64 07/03/2024 10:17:25
Backup taken at scn: 0x0000000000000000 01/01/1988 00:00:00 thread:0
reset logs count:0x45efe2a8 scn: 0x0000000000000001
prev reset logs count:0x0 scn: 0x0000000000000000
recovered at 01/01/1988 00:00:00
status:0x4 root dba:0x00000000 chkpt cnt: 28 ctl cnt:27 --正常的sysaux文件的ctl cnt小于chkpt cnt的值
begin-hot-backup file size: 0
Checkpointed at scn: 0x00000000000b4b15 07/03/2024 14:52:17
thread:1 rba:(0x16.23149.10)
--使用BBED修改ctl cnt:29的值为27
BBED> set file 1 block 1 offset 148
FILE# 1
BLOCK# 1
OFFSET 148
BBED> d
File: /u01/app/oracle/oradata/EVA/system01.dbf (1)
Block: 1 Offsets: 148 to 659 Dba:0x00400001
------------------------------------------------------------------------
1d000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BBED> m /x 1b
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) y
File: /u01/app/oracle/oradata/EVA/system01.dbf (1)
Block: 1 Offsets: 148 to 659 Dba:0x00400001
------------------------------------------------------------------------
1b000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BBED> sum apply
--修改后可以正常关库启库
SYS@EVA>shut immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SYS@EVA>startup
ORACLE instance started.
Total System Global Area 2516582400 bytes
Fixed Size 8623832 bytes
Variable Size 822085928 bytes
Database Buffers 1677721600 bytes
Redo Buffers 8151040 bytes
Database mounted.
Database opened.
SYS@EVA>select status from v$instance;
STATUS
------------
OPEN
至此,数据库修复成功!
