利用BBED恢復UPDATE修改前的值

轉載請注明出處：http://blog.csdn.net/guoyjoe/article/details/30615151

實驗過程如下：

1、創建表guo_test1

gyj@PROD> create table guoyJoe_t1(id int,name varchar2(10));  Table created.  gyj@PROD> insert into guoyJoe_t1 values(1,'guoyJoe');  1 row created.  gyj@PROD> insert into guoyJoe_t1 values(1,'tom');  1 row created.  gyj@PROD> COMMIT;  Commit complete. 

2、查出這行記錄的DBA

gyj@PROD> select name,dbms_rowid.rowid_relative_fno(rowid) file#,dbms_rowid.rowid_block_number(rowid) block#,dbms_rowid.rowid_row_number(rowid)    row# from guoyJoe_t1;  NAME            FILE#     BLOCK#       ROW# ---------- ---------- ---------- ---------- guoyJoe             5      20877          0 tom                 5      20877          1 

3、刷數據緩存

gyj@PROD> alter system flush buffer_cache;  System altered. 

4、利用BBED找到這行記錄（修改前的值：guoyJoe）

BBED> BBED> set file 5    block 20877         FILE#           5         BLOCK#          20877 

--觀察行頭
BBED> p kdbr
sb2 kdbr[0]                                 @118      8074
sb2 kdbr[1]                                 @120      8064


BBED> p *kdbr[0]
rowdata[10]
-----------
ub1 rowdata[10]                             @8174     0x2c


--觀察事務
BBBED> x /rnc
rowdata[10]                                 @8174    
-----------
flag@8174: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8175: 0x01
cols@8176:    2


col    0[2] @8177: 1 
col    1[7] @8180: guoyJoe


---觀察空間
BBED> p kdbhavsp
sb2 kdbhavsp                                @110      8042


BBED> p kdbhtosp
sb2 kdbhtosp                                @112      8042

5、發生UPDATE語句，把原來的值guoyJoe修改成oracledba

gyj@PROD> update guoyJoe_t1 set name='oracledba' where name='guoyJoe';  1 row updated.  gyj@PROD> commit;  Commit complete

6、刷數據緩存

gyj@PROD> alter system flush buffer_cache;  System altered.

7、利用BBED找到這行被修改后的記錄（修改后的值上：oracledba）

BBED> set file 5    block 20877         FILE#           5         BLOCK#          20877

--觀察行頭
BBED> p kdbr
sb2 kdbr[0]                                 @118      8048
sb2 kdbr[1]                                 @120      8064


BBED> p *kdbr[0]
rowdata[0]
----------
ub1 rowdata[0]                              @8148     0x2c


--觀察事務
BBED> x /rnc
rowdata[0]                                  @8148    
----------
flag@8148: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8149: 0x01
cols@8150:    2


col    0[2] @8151: 1 
col    1[9] @8154: oracledba


---觀察空間
BBED> p kdbhavsp
sb2 kdbhavsp                                @110      8040


BBED> p kdbhtosp  
sb2 kdbhtosp                                @112      8040

8、對比修改前與修改后的數據

BBED> d /v offset 8174 count 16  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 20877   Offsets: 8174 to 8189  Dba:0x0140518d -------------------------------------------------------  2c000202 c1020767 756f794a 6f650106 l ,...á..guoyJoe..   BBED> d /v offset 8148 count 16  File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)  Block: 20877   Offsets: 8148 to 8163  Dba:0x0140518d -------------------------------------------------------  2c010202 c102096f 7261636c 65646261 l ,...á..oracledba

9、開始恢復
（1）修改row directory指針位置（@118）
--修改前
BBED> p kdbr
sb2 kdbr[0]                                 @118      8074
--修改后
BBED> p kdbr
sb2 kdbr[0]                                 @118      8048
gyj@PROD> select to_char('8074','xxxxxxxxxxxxxx') from dual;


TO_CHAR('8074',
---------------
           1f8a


gyj@PROD> select to_char('8048','xxxxxxxxxxxxxx') from dual;


TO_CHAR('8048',
---------------
           1f70


BBED> d /v offset 118 count 16
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20877   Offsets:  118 to  133  Dba:0x0140518d
-------------------------------------------------------
 701f801f 00000000 00000000 00000000 l p...............




BBED> modify /x 8a offset 118
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) Y
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20877            Offsets:  118 to  133           Dba:0x0140518d
------------------------------------------------------------------------
 8a1f801f 00000000 00000000 00000000 


 <32 bytes per line>


BBED> sum apply
Check value for File 5, Block 20877:
current = 0x8a00, required = 0x8a00


BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 20877


Block Checking: DBA = 20992397, Block Type = KTB-managed data block
data header at 0x7f76ff66e264
kdbchk: xaction header lock count mismatch  ----事務鎖報錯
        trans=1 ilk=1 nlo=0
Block 20877 failed with check code 6108


DBVERIFY - Verification complete


Total Blocks Examined         : 1
Total Blocks Processed (Data) : 1
Total Blocks Failing   (Data) : 1
Total Blocks Processed (Index): 0
Total Blocks Failing   (Index): 0
Total Blocks Empty            : 0
Total Blocks Marked Corrupt   : 0
Total Blocks Influx           : 0
Message 531 not found;  product=RDBMS; facility=BBED




（2）接下來修改事務鎖
---把更新前值的事務鎖標記從00改為01
BBBED> x /rnc
rowdata[10]                                 @8174    
-----------
flag@8174: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8175: 0x01
cols@8176:    2


BBED> d /v offset 8175 count 16
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20877   Offsets: 8175 to 8190  Dba:0x0140518d
-------------------------------------------------------
 000202c1 02076775 6f794a6f 6501066f l ...á..guoyJoe..o


BBED> modify /x 01 offset 8175
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20861            Offsets: 8175 to 8190           Dba:0x0140517d
------------------------------------------------------------------------
 010202c1 02076775 6f794a6f 650106ed 




--把更新后值的事務鎖標識01改為00
BBED> x /rnc
rowdata[0]                                  @8148    
----------
flag@8148: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8149: 0x01
cols@8150:    2


BBED> d /v offset 8149 count 16
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20877   Offsets: 8149 to 8164  Dba:0x0140518d
-------------------------------------------------------
 010202c1 02096f72 61636c65 6462612c l ...á..oracledba,


BBED> modify /x 00 offset 8149
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20861            Offsets: 8159 to 8174           Dba:0x0140517d
------------------------------------------------------------------------
 000202c1 02096f72 61636c65 6462612c 


BBED> sum apply
Check value for File 5, Block 20877:
current = 0x8a00, required = 0x8a00


BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 20877


Block Checking: DBA = 20992397, Block Type = KTB-managed data block
data header at 0x7cb464
kdbchk: the amount of space used is not equal to block size
        used=46 fsc=0 avsp=8040 dtl=8088 
    ---提示數據塊的空間使用不正確（dtl-used=kdbhavsp=kdbhtosp）
       8088-46=8042 與 avsp=8040相關2,也就是說我要恢復到8042
     
 (3)修改空間，把空間修改為6a1f,以dtl-used=kdbhavsp為主
  gyj@PROD> select to_char('8042','xxxxxxxxxxxxxx') from dual;


      TO_CHAR('8042',
       ---------------
           1f6a
  BBED> modify /x 6a1f  offset 110
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20877            Offsets:  110 to  125           Dba:0x0140518d
------------------------------------------------------------------------
 6a1f681f 00000200 8a1f801f 00000000 


 <32 bytes per line>


BBED> modify /x 6a1f  offset 112
 File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
 Block: 20877            Offsets:  112 to  127           Dba:0x0140518d
------------------------------------------------------------------------
 6a1f0000 02008a1f 801f0000 00000000 


 <32 bytes per line>


BBED> sum apply
Check value for File 5, Block 20877:
current = 0x8a00, required = 0x8a00


BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 20877




DBVERIFY - Verification complete


Total Blocks Examined         : 1
Total Blocks Processed (Data) : 1
Total Blocks Failing   (Data) : 0
Total Blocks Processed (Index): 0
Total Blocks Failing   (Index): 0
Total Blocks Empty            : 0
Total Blocks Marked Corrupt   : 0
Total Blocks Influx           : 0
Message 531 not found;  product=RDBMS; facility=BBED

10、恢復成功（oracledba--->guoyJoe）

gyj@PROD> alter system flush buffer_cache;  System altered.  gyj@PROD> select name,dbms_rowid.rowid_relative_fno(rowid) file#,dbms_rowid.rowid_block_number(rowid) block#,dbms_rowid.rowid_row_number(rowid)    row# from guoyJoe_t1 where id=1;  NAME            FILE#     BLOCK#       ROW# ---------- ---------- ---------- ---------- guoyJoe             5      20877          0 tom                 5      20877          1 

實際上用BBED恢復UPDATE前的值不難，主要是要了解內部原理和塊格式
總結如下：
 （1）修改行頭
 （2）修改事務
 （3）修改空間