【BBED】 SYSTEM文件头损坏的恢复
一.1 BLOG文档结构图
一.2 前言部分
一.2.1 导读和注意事项
各位技术爱好者，看完本文后，你可以掌握如下的技能，也可以学到一些其它你所不知道的知识，~O(∩_∩)O~：
① BBED恢复SYSTEM文件头
② BBED查看文件头的信息
Tips：
① 若文章代码格式有错乱，推荐使用QQ、搜狗或360浏览器，也可以下载pdf格式的文档来查看，pdf文档下载地址：http://yunpan.cn/cdEQedhCs2kFz （提取码：ed9b）
② 本篇BLOG中命令的输出部分需要特别关注的地方我都用灰色背景和粉红色字体来表示，比如下边的例子中，thread 1的最大归档日志号为33，thread 2的最大归档日志号为43是需要特别关注的地方；而命令一般使用黄色背景和红色字体标注；对代码或代码输出部分的注释一般采用蓝色字体表示。
List of Archived Logs in backup set 11
Thrd Seq Low SCN Low Time Next SCN Next Time
---- ------- ---------- ------------------- ---------- ---------
1 32 1621589 2015-05-29 11:09:52 1625242 2015-05-29 11:15:48
1 33 1625242 2015-05-29 11:15:48 1625293 2015-05-29 11:15:58
2 42 1613951 2015-05-29 10:41:18 1625245 2015-05-29 11:15:49
2 43 1625245 2015-05-29 11:15:49 1625253 2015-05-29 11:15:53
[ZFXXDB1:root]:/>lsvg -o
T_XDESK_APP1_vg
rootvg
[ZFXXDB1:root]:/>
00:27:22 SQL> alter tablespace idxtbs read write;
====》2097152*512/1024/1024/1024=1G
本文如有错误或不完善的地方请大家多多指正，ITPUB留言或QQ皆可，您的批评指正是我写作的最大动力。
一.2.2 相关参考文章链接
【推荐】 【BBED】 sys.bootstrap$ 对象的恢复：http://blog.itpub.net/26736162/viewspace-2083621/
【推荐】 【BBED】丢失归档文件情况下的恢复：http://blog.itpub.net/26736162/viewspace-2079337/
【推荐】 【BBED】编译及基本命令(1)：http://blog.itpub.net/26736162/viewspace-2075216/
一.2.3 本文简介
本文的实验过程主要是为了学习BBED，大家学完做完这1篇还有之前的3篇blog，那么BBED基本算是入门了，恭喜。
一.3 相关知识点扫盲(摘自网络)
---------------------------------------------------------------------------------------------------------------------
第二章 实验部分
二.1 实验环境介绍
项目 |
db |
db 类型 |
单实例 |
db version |
11.2.0.4.0 |
db 存储 |
FS |
主机IP地址/hosts配置 |
192.168.59.129 |
OS版本及kernel版本 |
AIX 7.1 64位 |
归档模式 |
Archive Mode |
ORACLE_SID |
oralhr |
二.2 实验目标
破坏SYSTEM的文件头，然后利用SYSAUX文件的文件头来恢复SYSTEM文件头。
二.3 实验过程
二.3.1 冷备system文件
[ZHLHRDB2:oracle]:/oracle>sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Thu Apr 14 16:10:07 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, Real Application Clusters, OLAP, Data Mining
and Real Application Testing options
SYS@oralhr> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SYS@oralhr> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, Real Application Clusters, OLAP, Data Mining
and Real Application Testing options
[ZHLHRDB2:oracle]:/oracle>cp /oracle/app/oracle/datafile/oralhr/system01.dbf /oracle/app/oracle/datafile/oralhr/system01.dbf_bk
[ZHLHRDB2:oracle]:/oracle>
[ZHLHRDB2:oracle]:/oracle>sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Thu Apr 14 16:34:04 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to an idle instance.
SYS@oralhr> startup
ORACLE instance started.
Total System Global Area 3089920000 bytes
Fixed Size 2250360 bytes
Variable Size 721422728 bytes
Database Buffers 2348810240 bytes
Redo Buffers 17436672 bytes
Database mounted.
Database opened.
SYS@oralhr>
SYS@oralhr> set line 9999 pagesize 9999
SYS@oralhr> col name format a80
SYS@oralhr> select file#||' '||name||' '||bytes name from v$datafile;
NAME
--------------------------------------------------------------------------------
1 /oracle/app/oracle/datafile/oralhr/system01.dbf 786432000
2 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf 576716800
3 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf 78643200
4 /oracle/app/oracle/datafile/oralhr/users01.dbf 310640640
SYS@oralhr>
二.3.2 模拟故障
[ZHLHRDB2:oracle]:/home/oracle>l
total 208
-rwxrwxrwx 1 oracle dba 57 Apr 05 17:01 bbed.par
-rwxrwxrwx 1 oracle dba 52224 Apr 14 15:55 bifile.bbd
-rwxrwxrwx 1 oracle asmadmin 5715 Apr 06 15:34 ctl.sql
-rwxrwxrwx 1 oracle dba 302 Apr 14 10:32 file.txt
drwxrwxrwx 8 oracle dba 4096 Apr 13 17:16 gdul
-rwxrwxrwx 1 oracle dba 21008 Apr 14 16:35 log.bbd
drwxrwxrwx 4 oracle dba 256 Apr 12 15:52 oracle_bk
drwxrwxrwx 4 oracle dba 256 Apr 05 16:54 rman_bak
-rwxrwxrwx 1 oracle dba 757 Apr 11 10:02 rman_bk_db_archive_lhr.sh
-rwxrwxrwx 1 oracle dba 1023 Apr 08 11:25 rman_bk_db_lhr.sh
[ZHLHRDB2:oracle]:/home/oracle>cat file.txt
1 /oracle/app/oracle/datafile/oralhr/system01.dbf 786432000
2 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf 566231040
3 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf 78643200
4 /oracle/app/oracle/datafile/oralhr/users01.dbf 310640640
5 /oracle/app/oracle/datafile/oralhr/system01.dbf_bk 786432000
[ZHLHRDB2:oracle]:/home/oracle>bbed PASSWORD=blockedit mode=edit blocksize=8192 listfile=/home/oracle/file.txt
BBED: Release 2.0.0.0.0 - Limited Production on Thu Apr 14 16:36:00 2016
Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved.
************* !!! For Oracle Internal Use only !!! ***************
BBED> info
File# Name Size(blks)
----- ---- ----------
1 /oracle/app/oracle/datafile/oralhr/system01.dbf 96000
2 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf 69120
3 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf 9600
4 /oracle/app/oracle/datafile/oralhr/users01.dbf 37920
5 /oracle/app/oracle/datafile/oralhr/system01.dbf_bk 96000
BBED> help copy
COPY [ DBA | FILE | FILENAME | BLOCK ] TO [ DBA | FILE | FILENAME | BLOCK ]
BBED> set count 128
COUNT 128
BBED> copy file 1 block 111 to file 1 block 1
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) Y
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 377 Offsets: 0 to 127 Dba:0x00400179
------------------------------------------------------------------------
1ea20000 0040006f 000000e2 00000104 fa4c0000 00000001 03450080 00000000
00000000 0000f800 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 380:
current = 0xfa4c, required = 0xfa4c
BBED>
BBED>
重启数据库：
SYS@oralhr> startup force
ORACLE instance started.
Total System Global Area 3089920000 bytes
Fixed Size 2250360 bytes
Variable Size 721422728 bytes
Database Buffers 2348810240 bytes
Redo Buffers 17436672 bytes
Database mounted.
ORA-01092: ORACLE instance terminated. Disconnection forced
ORA-01122: database file 1 failed verification check
ORA-01110: data file 1: '/oracle/app/oracle/datafile/oralhr/system01.dbf'
ORA-01210: data file header is media corrupt
SYS@oralhr>
告警日志：
Fri Apr 15 08:52:22 2016
ALTER DATABASE OPEN
Read of datafile '/oracle/app/oracle/datafile/oralhr/system01.dbf' (fno 1) header failed with ORA-01210
Hex dump of (file 1, block 1) in trace file /oracle/app/oracle/diag/rdbms/oralhr/oralhr/trace/oralhr_ora_7602280.trc
Corrupt block relative dba: 0x00400001 (file 1, block 1)
Bad header found during datafile header read
Data in bad block:
type: 30 format: 2 rdba: 0x0040006f
last change scn: 0x0000.000000e2 seq: 0x1 flg: 0x04
spare1: 0x0 spare2: 0x0 spare3: 0x0
consistency value in tail: 0x00e21e01
check value in block header: 0xfa4c
computed block checksum: 0x0
Rereading datafile 1 header failed with ORA-01210
Errors in file /oracle/app/oracle/diag/rdbms/oralhr/oralhr/trace/oralhr_ora_7602280.trc:
ORA-01122: database file 1 failed verification check
ORA-01110: data file 1: '/oracle/app/oracle/datafile/oralhr/system01.dbf'
ORA-01210: data file header is media corrupt
ORA-1122 signalled during: ALTER DATABASE OPEN...
Fri Apr 15 08:52:23 2016
Checker run found 1 new persistent data failures
ORA-01210: data file header is media corrupt 文件头有介质损坏，下边用BBED来恢复。
二.3.3 故障恢复
[ZHLHRDB2:oracle]:/home/oracle>bbed PASSWORD=blockedit mode=edit blocksize=8192 listfile=/home/oracle/file.txt
BBED: Release 2.0.0.0.0 - Limited Production on Thu Apr 14 16:42:59 2016
Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved.
************* !!! For Oracle Internal Use only !!! ***************
BBED> info
File# Name Size(blks)
----- ---- ----------
1 /oracle/app/oracle/datafile/oralhr/system01.dbf 96000
2 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf 69120
3 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf 9600
4 /oracle/app/oracle/datafile/oralhr/users01.dbf 37920
5 /oracle/app/oracle/datafile/oralhr/system01.dbf_bk 96000
BBED> set count 128
COUNT 128
BBED>
BBED> set dba 1,1
DBA 0x00400001 (4194305 1,1)
BBED> map /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Dba:0x00400001
------------------------------------------------------------
BBED-00400: invalid blocktype (30)
BBED>
可以看到dba 1，1是一个非法的块类型，下边利用BBED将SYSAUX上的FILE HEADER拷贝到SYSTEM上，然后修改文件头相关的内容：
BBED> copy file 2 block 1 to file 1 block 1
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 0 to 511 Dba:0x00400001
------------------------------------------------------------------------
0ba20000 00800001 00000000 00000104 ed220000 00000000 0b200400 1793c969
4f52414c 48520000 0000093b 00011300 00002000 00020003 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000716 00000000 3155becc 362e0deb 000e20dc 00007f18 00000000
00000000 00000000 00000004 000000a6 3630b88e 000000a5 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000001 00065359 53415558 00000000 00000000
00000000 00000000 00000000 00000000 00000002 00000000 00000000 00000000
00000000 0000b7e0 00000000 00000000 00000000 00000000 00000000 00000000
3155bebd 00000001 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 0013e5a8 0000c388 363142ec 00010000 0000002d 00000002 00100000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0xed22, required = 0xed22
BBED> map /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Dba:0x00400001
------------------------------------------------------------
Data File Header
struct kcvfh, 860 bytes @0
struct kcvfhbfh, 20 bytes @0
struct kcvfhhdr, 76 bytes @20
ub4 kcvfhrdb @96
struct kcvfhcrs, 8 bytes @100
ub4 kcvfhcrt @108
ub4 kcvfhrlc @112
struct kcvfhrls, 8 bytes @116
ub4 kcvfhbti @124
struct kcvfhbsc, 8 bytes @128
ub2 kcvfhbth @136
ub2 kcvfhsta @138
struct kcvfhckp, 160 bytes @484
ub4 kcvfhcpc @140
ub4 kcvfhrts @144
ub4 kcvfhccc @148
struct kcvfhbcp, 160 bytes @152
ub4 kcvfhbhz @312
struct kcvfhxcd, 16 bytes @316
sword kcvfhtsn @332
ub2 kcvfhtln @336
text kcvfhtnm[30] @338
ub4 kcvfhrfn @368
struct kcvfhrfs, 8 bytes @372
ub4 kcvfhrft @380
struct kcvfhafs, 8 bytes @384
ub4 kcvfhbbc @392
ub4 kcvfhncb @396
ub4 kcvfhmcb @400
ub4 kcvfhlcb @404
ub4 kcvfhbcs @408
ub2 kcvfhofb @412
ub2 kcvfhnfb @414
ub4 kcvfhprc @416
struct kcvfhprs, 8 bytes @420
struct kcvfhprfs, 8 bytes @428
ub4 kcvfhtrt @444
ub4 tailchk @8188
BBED>
BBED> p kcvfh
struct kcvfh, 860 bytes @0
struct kcvfhbfh, 20 bytes @0
ub1 type_kcbh @0 0x0b
ub1 frmt_kcbh @1 0xa2
ub1 spare1_kcbh @2 0x00
ub1 spare2_kcbh @3 0x00
ub4 rdba_kcbh @4 0x00800001
ub4 bas_kcbh @8 0x00000000
ub2 wrp_kcbh @12 0x0000
ub1 seq_kcbh @14 0x01
ub1 flg_kcbh @15 0x04 (KCBHFCKV)
ub2 chkval_kcbh @16 0xed22
ub2 spare3_kcbh @18 0x0000
struct kcvfhhdr, 76 bytes @20
ub4 kccfhswv @20 0x00000000
ub4 kccfhcvn @24 0x0b200400
ub4 kccfhdbi @28 0x1793c969
text kccfhdbn[0] @32 O
text kccfhdbn[1] @33 R
text kccfhdbn[2] @34 A
text kccfhdbn[3] @35 L
text kccfhdbn[4] @36 H
text kccfhdbn[5] @37 R
text kccfhdbn[6] @38
text kccfhdbn[7] @39
ub4 kccfhcsq @40 0x0000093b
ub4 kccfhfsz @44 0x00011300
s_blkz kccfhbsz @48 0x00
ub2 kccfhfno @52 0x0002
ub2 kccfhtyp @54 0x0003
ub4 kccfhacid @56 0x00000000
ub4 kccfhcks @60 0x00000000
text kccfhtag[0] @64
text kccfhtag[1] @65
text kccfhtag[2] @66
text kccfhtag[3] @67
text kccfhtag[4] @68
text kccfhtag[5] @69
text kccfhtag[6] @70
text kccfhtag[7] @71
text kccfhtag[8] @72
text kccfhtag[9] @73
text kccfhtag[10] @74
text kccfhtag[11] @75
text kccfhtag[12] @76
text kccfhtag[13] @77
text kccfhtag[14] @78
text kccfhtag[15] @79
text kccfhtag[16] @80
text kccfhtag[17] @81
text kccfhtag[18] @82
text kccfhtag[19] @83
text kccfhtag[20] @84
text kccfhtag[21] @85
text kccfhtag[22] @86
text kccfhtag[23] @87
text kccfhtag[24] @88
text kccfhtag[25] @89
text kccfhtag[26] @90
text kccfhtag[27] @91
text kccfhtag[28] @92
text kccfhtag[29] @93
text kccfhtag[30] @94
text kccfhtag[31] @95
ub4 kcvfhrdb @96 0x00000000
struct kcvfhcrs, 8 bytes @100
ub4 kscnbas @100 0x00000716
ub2 kscnwrp @104 0x0000
ub4 kcvfhcrt @108 0x3155becc
ub4 kcvfhrlc @112 0x362e0deb
struct kcvfhrls, 8 bytes @116
ub4 kscnbas @116 0x000e20dc
ub2 kscnwrp @120 0x0000
ub4 kcvfhbti @124 0x00000000
struct kcvfhbsc, 8 bytes @128
ub4 kscnbas @128 0x00000000
ub2 kscnwrp @132 0x0000
ub2 kcvfhbth @136 0x0000
ub2 kcvfhsta @138 0x0004 (KCVFHOFZ)
struct kcvfhckp, 160 bytes @484
struct kcvcpscn, 8 bytes @484
ub4 kscnbas @484 0x0013e5a8
ub2 kscnwrp @488 0x0000
ub4 kcvcptim @492 0x363142ec
ub2 kcvcpthr @496 0x0001
union u, 12 bytes @500
struct kcvcprba, 12 bytes @500
ub4 kcrbaseq @500 0x0000002d
ub4 kcrbabno @504 0x00000002
ub2 kcrbabof @508 0x0010
ub1 kcvcpetb[0] @512 0x02
ub1 kcvcpetb[1] @513 0x00
ub1 kcvcpetb[2] @514 0x00
ub1 kcvcpetb[3] @515 0x00
ub1 kcvcpetb[4] @516 0x00
ub1 kcvcpetb[5] @517 0x00
ub1 kcvcpetb[6] @518 0x00
ub1 kcvcpetb[7] @519 0x00
ub1 kcvcpetb[8] @520 0x00
ub1 kcvcpetb[9] @521 0x00
ub1 kcvcpetb[10] @522 0x00
ub1 kcvcpetb[11] @523 0x00
ub1 kcvcpetb[12] @524 0x00
ub1 kcvcpetb[13] @525 0x00
ub1 kcvcpetb[14] @526 0x00
ub1 kcvcpetb[15] @527 0x00
ub1 kcvcpetb[16] @528 0x00
ub1 kcvcpetb[17] @529 0x00
ub1 kcvcpetb[18] @530 0x00
ub1 kcvcpetb[19] @531 0x00
ub1 kcvcpetb[20] @532 0x00
ub1 kcvcpetb[21] @533 0x00
ub1 kcvcpetb[22] @534 0x00
ub1 kcvcpetb[23] @535 0x00
ub1 kcvcpetb[24] @536 0x00
ub1 kcvcpetb[25] @537 0x00
ub1 kcvcpetb[26] @538 0x00
ub1 kcvcpetb[27] @539 0x00
ub1 kcvcpetb[28] @540 0x00
ub1 kcvcpetb[29] @541 0x00
ub1 kcvcpetb[30] @542 0x00
ub1 kcvcpetb[31] @543 0x00
ub1 kcvcpetb[32] @544 0x00
ub1 kcvcpetb[33] @545 0x00
ub1 kcvcpetb[34] @546 0x00
ub1 kcvcpetb[35] @547 0x00
ub1 kcvcpetb[36] @548 0x00
ub1 kcvcpetb[37] @549 0x00
ub1 kcvcpetb[38] @550 0x00
ub1 kcvcpetb[39] @551 0x00
ub1 kcvcpetb[40] @552 0x00
ub1 kcvcpetb[41] @553 0x00
ub1 kcvcpetb[42] @554 0x00
ub1 kcvcpetb[43] @555 0x00
ub1 kcvcpetb[44] @556 0x00
ub1 kcvcpetb[45] @557 0x00
ub1 kcvcpetb[46] @558 0x00
ub1 kcvcpetb[47] @559 0x00
ub1 kcvcpetb[48] @560 0x00
ub1 kcvcpetb[49] @561 0x00
ub1 kcvcpetb[50] @562 0x00
ub1 kcvcpetb[51] @563 0x00
ub1 kcvcpetb[52] @564 0x00
ub1 kcvcpetb[53] @565 0x00
ub1 kcvcpetb[54] @566 0x00
ub1 kcvcpetb[55] @567 0x00
ub1 kcvcpetb[56] @568 0x00
ub1 kcvcpetb[57] @569 0x00
ub1 kcvcpetb[58] @570 0x00
ub1 kcvcpetb[59] @571 0x00
ub1 kcvcpetb[60] @572 0x00
ub1 kcvcpetb[61] @573 0x00
ub1 kcvcpetb[62] @574 0x00
ub1 kcvcpetb[63] @575 0x00
ub1 kcvcpetb[64] @576 0x00
ub1 kcvcpetb[65] @577 0x00
ub1 kcvcpetb[66] @578 0x00
ub1 kcvcpetb[67] @579 0x00
ub1 kcvcpetb[68] @580 0x00
ub1 kcvcpetb[69] @581 0x00
ub1 kcvcpetb[70] @582 0x00
ub1 kcvcpetb[71] @583 0x00
ub1 kcvcpetb[72] @584 0x00
ub1 kcvcpetb[73] @585 0x00
ub1 kcvcpetb[74] @586 0x00
ub1 kcvcpetb[75] @587 0x00
ub1 kcvcpetb[76] @588 0x00
ub1 kcvcpetb[77] @589 0x00
ub1 kcvcpetb[78] @590 0x00
ub1 kcvcpetb[79] @591 0x00
ub1 kcvcpetb[80] @592 0x00
ub1 kcvcpetb[81] @593 0x00
ub1 kcvcpetb[82] @594 0x00
ub1 kcvcpetb[83] @595 0x00
ub1 kcvcpetb[84] @596 0x00
ub1 kcvcpetb[85] @597 0x00
ub1 kcvcpetb[86] @598 0x00
ub1 kcvcpetb[87] @599 0x00
ub1 kcvcpetb[88] @600 0x00
ub1 kcvcpetb[89] @601 0x00
ub1 kcvcpetb[90] @602 0x00
ub1 kcvcpetb[91] @603 0x00
ub1 kcvcpetb[92] @604 0x00
ub1 kcvcpetb[93] @605 0x00
ub1 kcvcpetb[94] @606 0x00
ub1 kcvcpetb[95] @607 0x00
ub1 kcvcpetb[96] @608 0x00
ub1 kcvcpetb[97] @609 0x00
ub1 kcvcpetb[98] @610 0x00
ub1 kcvcpetb[99] @611 0x00
ub1 kcvcpetb[100] @612 0x00
ub1 kcvcpetb[101] @613 0x00
ub1 kcvcpetb[102] @614 0x00
ub1 kcvcpetb[103] @615 0x00
ub1 kcvcpetb[104] @616 0x00
ub1 kcvcpetb[105] @617 0x00
ub1 kcvcpetb[106] @618 0x00
ub1 kcvcpetb[107] @619 0x00
ub1 kcvcpetb[108] @620 0x00
ub1 kcvcpetb[109] @621 0x00
ub1 kcvcpetb[110] @622 0x00
ub1 kcvcpetb[111] @623 0x00
ub1 kcvcpetb[112] @624 0x00
ub1 kcvcpetb[113] @625 0x00
ub1 kcvcpetb[114] @626 0x00
ub1 kcvcpetb[115] @627 0x00
ub1 kcvcpetb[116] @628 0x00
ub1 kcvcpetb[117] @629 0x00
ub1 kcvcpetb[118] @630 0x00
ub1 kcvcpetb[119] @631 0x00
ub1 kcvcpetb[120] @632 0x00
ub1 kcvcpetb[121] @633 0x00
ub1 kcvcpetb[122] @634 0x00
ub1 kcvcpetb[123] @635 0x00
ub1 kcvcpetb[124] @636 0x00
ub1 kcvcpetb[125] @637 0x00
ub1 kcvcpetb[126] @638 0x00
ub1 kcvcpetb[127] @639 0x00
ub1 kcvcpetb[128] @640 0x00
ub4 kcvfhcpc @140 0x000000a6
ub4 kcvfhrts @144 0x3630b88e
ub4 kcvfhccc @148 0x000000a5
struct kcvfhbcp, 160 bytes @152
struct kcvcpscn, 8 bytes @152
ub4 kscnbas @152 0x00000000
ub2 kscnwrp @156 0x0000
ub4 kcvcptim @160 0x00000000
ub2 kcvcpthr @164 0x0000
union u, 12 bytes @168
struct kcvcprba, 12 bytes @168
ub4 kcrbaseq @168 0x00000000
ub4 kcrbabno @172 0x00000000
ub2 kcrbabof @176 0x0000
ub1 kcvcpetb[0] @180 0x00
ub1 kcvcpetb[1] @181 0x00
ub1 kcvcpetb[2] @182 0x00
ub1 kcvcpetb[3] @183 0x00
ub1 kcvcpetb[4] @184 0x00
ub1 kcvcpetb[5] @185 0x00
ub1 kcvcpetb[6] @186 0x00
ub1 kcvcpetb[7] @187 0x00
ub1 kcvcpetb[8] @188 0x00
ub1 kcvcpetb[9] @189 0x00
ub1 kcvcpetb[10] @190 0x00
ub1 kcvcpetb[11] @191 0x00
ub1 kcvcpetb[12] @192 0x00
ub1 kcvcpetb[13] @193 0x00
ub1 kcvcpetb[14] @194 0x00
ub1 kcvcpetb[15] @195 0x00
ub1 kcvcpetb[16] @196 0x00
ub1 kcvcpetb[17] @197 0x00
ub1 kcvcpetb[18] @198 0x00
ub1 kcvcpetb[19] @199 0x00
ub1 kcvcpetb[20] @200 0x00
ub1 kcvcpetb[21] @201 0x00
ub1 kcvcpetb[22] @202 0x00
ub1 kcvcpetb[23] @203 0x00
ub1 kcvcpetb[24] @204 0x00
ub1 kcvcpetb[25] @205 0x00
ub1 kcvcpetb[26] @206 0x00
ub1 kcvcpetb[27] @207 0x00
ub1 kcvcpetb[28] @208 0x00
ub1 kcvcpetb[29] @209 0x00
ub1 kcvcpetb[30] @210 0x00
ub1 kcvcpetb[31] @211 0x00
ub1 kcvcpetb[32] @212 0x00
ub1 kcvcpetb[33] @213 0x00
ub1 kcvcpetb[34] @214 0x00
ub1 kcvcpetb[35] @215 0x00
ub1 kcvcpetb[36] @216 0x00
ub1 kcvcpetb[37] @217 0x00
ub1 kcvcpetb[38] @218 0x00
ub1 kcvcpetb[39] @219 0x00
ub1 kcvcpetb[40] @220 0x00
ub1 kcvcpetb[41] @221 0x00
ub1 kcvcpetb[42] @222 0x00
ub1 kcvcpetb[43] @223 0x00
ub1 kcvcpetb[44] @224 0x00
ub1 kcvcpetb[45] @225 0x00
ub1 kcvcpetb[46] @226 0x00
ub1 kcvcpetb[47] @227 0x00
ub1 kcvcpetb[48] @228 0x00
ub1 kcvcpetb[49] @229 0x00
ub1 kcvcpetb[50] @230 0x00
ub1 kcvcpetb[51] @231 0x00
ub1 kcvcpetb[52] @232 0x00
ub1 kcvcpetb[53] @233 0x00
ub1 kcvcpetb[54] @234 0x00
ub1 kcvcpetb[55] @235 0x00
ub1 kcvcpetb[56] @236 0x00
ub1 kcvcpetb[57] @237 0x00
ub1 kcvcpetb[58] @238 0x00
ub1 kcvcpetb[59] @239 0x00
ub1 kcvcpetb[60] @240 0x00
ub1 kcvcpetb[61] @241 0x00
ub1 kcvcpetb[62] @242 0x00
ub1 kcvcpetb[63] @243 0x00
ub1 kcvcpetb[64] @244 0x00
ub1 kcvcpetb[65] @245 0x00
ub1 kcvcpetb[66] @246 0x00
ub1 kcvcpetb[67] @247 0x00
ub1 kcvcpetb[68] @248 0x00
ub1 kcvcpetb[69] @249 0x00
ub1 kcvcpetb[70] @250 0x00
ub1 kcvcpetb[71] @251 0x00
ub1 kcvcpetb[72] @252 0x00
ub1 kcvcpetb[73] @253 0x00
ub1 kcvcpetb[74] @254 0x00
ub1 kcvcpetb[75] @255 0x00
ub1 kcvcpetb[76] @256 0x00
ub1 kcvcpetb[77] @257 0x00
ub1 kcvcpetb[78] @258 0x00
ub1 kcvcpetb[79] @259 0x00
ub1 kcvcpetb[80] @260 0x00
ub1 kcvcpetb[81] @261 0x00
ub1 kcvcpetb[82] @262 0x00
ub1 kcvcpetb[83] @263 0x00
ub1 kcvcpetb[84] @264 0x00
ub1 kcvcpetb[85] @265 0x00
ub1 kcvcpetb[86] @266 0x00
ub1 kcvcpetb[87] @267 0x00
ub1 kcvcpetb[88] @268 0x00
ub1 kcvcpetb[89] @269 0x00
ub1 kcvcpetb[90] @270 0x00
ub1 kcvcpetb[91] @271 0x00
ub1 kcvcpetb[92] @272 0x00
ub1 kcvcpetb[93] @273 0x00
ub1 kcvcpetb[94] @274 0x00
ub1 kcvcpetb[95] @275 0x00
ub1 kcvcpetb[96] @276 0x00
ub1 kcvcpetb[97] @277 0x00
ub1 kcvcpetb[98] @278 0x00
ub1 kcvcpetb[99] @279 0x00
ub1 kcvcpetb[100] @280 0x00
ub1 kcvcpetb[101] @281 0x00
ub1 kcvcpetb[102] @282 0x00
ub1 kcvcpetb[103] @283 0x00
ub1 kcvcpetb[104] @284 0x00
ub1 kcvcpetb[105] @285 0x00
ub1 kcvcpetb[106] @286 0x00
ub1 kcvcpetb[107] @287 0x00
ub1 kcvcpetb[108] @288 0x00
ub1 kcvcpetb[109] @289 0x00
ub1 kcvcpetb[110] @290 0x00
ub1 kcvcpetb[111] @291 0x00
ub1 kcvcpetb[112] @292 0x00
ub1 kcvcpetb[113] @293 0x00
ub1 kcvcpetb[114] @294 0x00
ub1 kcvcpetb[115] @295 0x00
ub1 kcvcpetb[116] @296 0x00
ub1 kcvcpetb[117] @297 0x00
ub1 kcvcpetb[118] @298 0x00
ub1 kcvcpetb[119] @299 0x00
ub1 kcvcpetb[120] @300 0x00
ub1 kcvcpetb[121] @301 0x00
ub1 kcvcpetb[122] @302 0x00
ub1 kcvcpetb[123] @303 0x00
ub1 kcvcpetb[124] @304 0x00
ub1 kcvcpetb[125] @305 0x00
ub1 kcvcpetb[126] @306 0x00
ub1 kcvcpetb[127] @307 0x00
ub1 kcvcpetb[128] @308 0x00
ub4 kcvfhbhz @312 0x00000000
struct kcvfhxcd, 16 bytes @316
ub4 space_kcvmxcd[0] @316 0x00000000
ub4 space_kcvmxcd[1] @320 0x00000000
ub4 space_kcvmxcd[2] @324 0x00000000
ub4 space_kcvmxcd[3] @328 0x00000000
sword kcvfhtsn @332 1
ub2 kcvfhtln @336 0x0006
text kcvfhtnm[0] @338 S
text kcvfhtnm[1] @339 Y
text kcvfhtnm[2] @340 S
text kcvfhtnm[3] @341 A
text kcvfhtnm[4] @342 U
text kcvfhtnm[5] @343 X
text kcvfhtnm[6] @344
text kcvfhtnm[7] @345
text kcvfhtnm[8] @346
text kcvfhtnm[9] @347
text kcvfhtnm[10] @348
text kcvfhtnm[11] @349
text kcvfhtnm[12] @350
text kcvfhtnm[13] @351
text kcvfhtnm[14] @352
text kcvfhtnm[15] @353
text kcvfhtnm[16] @354
text kcvfhtnm[17] @355
text kcvfhtnm[18] @356
text kcvfhtnm[19] @357
text kcvfhtnm[20] @358
text kcvfhtnm[21] @359
text kcvfhtnm[22] @360
text kcvfhtnm[23] @361
text kcvfhtnm[24] @362
text kcvfhtnm[25] @363
text kcvfhtnm[26] @364
text kcvfhtnm[27] @365
text kcvfhtnm[28] @366
text kcvfhtnm[29] @367
ub4 kcvfhrfn @368 0x00000002
struct kcvfhrfs, 8 bytes @372
ub4 kscnbas @372 0x00000000
ub2 kscnwrp @376 0x0000
ub4 kcvfhrft @380 0x00000000
struct kcvfhafs, 8 bytes @384
ub4 kscnbas @384 0x00000000
ub2 kscnwrp @388 0x0000
ub4 kcvfhbbc @392 0x00000000
ub4 kcvfhncb @396 0x00000000
ub4 kcvfhmcb @400 0x00000000
ub4 kcvfhlcb @404 0x00000000
ub4 kcvfhbcs @408 0x00000000
ub2 kcvfhofb @412 0x0000
ub2 kcvfhnfb @414 0x0000
ub4 kcvfhprc @416 0x3155bebd
struct kcvfhprs, 8 bytes @420
ub4 kscnbas @420 0x00000001
ub2 kscnwrp @424 0x0000
struct kcvfhprfs, 8 bytes @428
ub4 kscnbas @428 0x00000000
ub2 kscnwrp @432 0x0000
ub4 kcvfhtrt @444 0x00000000
BBED>
二.3.3.1 修改文件头的信息
我们需要修改的地方有十个，分别是：
ub4 rdba_kcbh @4 0x00800001
ub4 kccfhfsz @44 0x00011300
ub2 kccfhfno @52 0x0002
ub4 kcvfhrdb @96 0x00000000
struct kcvfhcrs, 8 bytes @100
ub4 kscnbas @100 0x00000716
ub2 kscnwrp @104 0x0000
ub4 kcvfhcrt @108 0x3155becc
ub2 kcvfhsta @138 0x0004 (KCVFHOFZ)
sword kcvfhtsn @332 1
text kcvfhtnm[3] @341 A
text kcvfhtnm[4] @342 U
text kcvfhtnm[5] @343 X
ub4 kcvfhrfn @368 0x00000002
一、 ub4 rdba_kcbh 相对数据块地址
ub4 rdba_kcbh @4 0x00800001
原信息：
BBED> set dba 1,1
DBA 0x00400001 (4194305 1,1)
BBED> p kcvfhbfh
struct kcvfhbfh, 20 bytes @0
ub1 type_kcbh @0 0x0b
ub1 frmt_kcbh @1 0xa2
ub1 spare1_kcbh @2 0x00
ub1 spare2_kcbh @3 0x00
ub4 rdba_kcbh @4 0x00800001
ub4 bas_kcbh @8 0x00000000
ub2 wrp_kcbh @12 0x0000
ub1 seq_kcbh @14 0x01
ub1 flg_kcbh @15 0x04 (KCBHFCKV)
ub2 chkval_kcbh @16 0xed22
ub2 spare3_kcbh @18 0x0000
BBED>
BBED> d count 128 offset 4
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 4 to 131 Dba:0x00400001
------------------------------------------------------------------------
00800001 00000000 00000104 ed220000 00000000 0b200400 1793c969 4f52414c
48520000 0000093b 00011300 00002000 00020003 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000716 00000000 3155becc 362e0deb 000e20dc 00007f18 00000000 00000000
<32 bytes per line>
BBED>
该参数值代表当前数据块在数据库中的位置，转换为2进制后前10位代表文件号，后22位代表块号，转换表格如下：
|
原值 |
新值 |
存储16进制 |
0x00800001 |
0x00400001 |
可读16进制 |
0x00800001 |
0x00400001 |
2进制 |
0123456789 0123456789012345678901 --------------------------------- 0000000010 0000000000000000000001 |
0123456789 0123456789012345678901 --------------------------------- 0000000001 0000000000000000000001 |
表示意义 |
FILE 2 BLOCK 1 |
FILE 1 BLOCK 1 |
我们用计算器可以算得需要修改后的16进制，由于是AIX平台，存储和可读的顺序是一致的，这里很惭愧，第一次看到这的时候实在看不懂文件2是如何得到的，因为源资料不是这样写的，后来在公司老猫的帮助下，我才弄懂了这里的转换关系，所以我分享给大家，也感谢老猫的帮助。
转换：
BBED> set dba 1,1 offset 4
DBA 0x00400001 (4194305 1,1)
OFFSET 4
BBED> modify /x 00400001
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 4 to 131 Dba:0x00400001
------------------------------------------------------------------------
00400001 00000000 00000104 ed220000 00000000 0b200400 1793c969 4f52414c
48520000 0000093b 00011300 00002000 00020003 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000716 00000000 3155becc 362e0deb 000e20dc 00007f18 00000000 00000000
<32 bytes per line>
BBED> p kcvfhbfh
struct kcvfhbfh, 20 bytes @0
ub1 type_kcbh @0 0x0b
ub1 frmt_kcbh @1 0xa2
ub1 spare1_kcbh @2 0x00
ub1 spare2_kcbh @3 0x00
ub4 rdba_kcbh @4 0x00400001
ub4 bas_kcbh @8 0x00000000
ub2 wrp_kcbh @12 0x0000
ub1 seq_kcbh @14 0x01
ub1 flg_kcbh @15 0x04 (KCBHFCKV)
ub2 chkval_kcbh @16 0xed22
ub2 spare3_kcbh @18 0x0000
BBED>
BBED> sum apply
Check value for File 1, Block 1:
current = 0xede2, required = 0xede2
二、 文件大小和文件号
BBED> p kcvfhhdr
struct kcvfhhdr, 76 bytes @20
ub4 kccfhswv @20 0x00000000
ub4 kccfhcvn @24 0x0b200400
ub4 kccfhdbi @28 0x1793c969
text kccfhdbn[0] @32 O
text kccfhdbn[1] @33 R
text kccfhdbn[2] @34 A
text kccfhdbn[3] @35 L
text kccfhdbn[4] @36 H
text kccfhdbn[5] @37 R
text kccfhdbn[6] @38
text kccfhdbn[7] @39
ub4 kccfhcsq @40 0x0000093b
ub4 kccfhfsz @44 0x00011300
s_blkz kccfhbsz @48 0x00
ub2 kccfhfno @52 0x0002
ub2 kccfhtyp @54 0x0003
ub4 kccfhacid @56 0x00000000
ub4 kccfhcks @60 0x00000000
text kccfhtag[0] @64
text kccfhtag[1] @65
text kccfhtag[2] @66
text kccfhtag[3] @67
text kccfhtag[4] @68
text kccfhtag[5] @69
text kccfhtag[6] @70
text kccfhtag[7] @71
text kccfhtag[8] @72
text kccfhtag[9] @73
text kccfhtag[10] @74
text kccfhtag[11] @75
text kccfhtag[12] @76
text kccfhtag[13] @77
text kccfhtag[14] @78
text kccfhtag[15] @79
text kccfhtag[16] @80
text kccfhtag[17] @81
text kccfhtag[18] @82
text kccfhtag[19] @83
text kccfhtag[20] @84
text kccfhtag[21] @85
text kccfhtag[22] @86
text kccfhtag[23] @87
text kccfhtag[24] @88
text kccfhtag[25] @89
text kccfhtag[26] @90
text kccfhtag[27] @91
text kccfhtag[28] @92
text kccfhtag[29] @93
text kccfhtag[30] @94
text kccfhtag[31] @95
BBED>
1、 ub4 kccfhfsz 文件大小
ub4 kccfhfsz @44 0x00011300
具体转换过程参考如下表格：
|
原值 |
新值 |
存储16进制 |
0x00011300 |
0x00017700 |
可读16进制 |
0x00011300 |
0x00017700 |
可读10进制(blocks) |
70400 |
96000 |
DB FILE SIZE |
576716800 |
786432000 |
OS FILE SIZE |
576724992 |
786440192 |
算法 |
十六进制11300转换10进制为70400，代表块数，70400*8192=576716800byte ，加上一个数据块代表OS文件的大小：576716800+8192=576724992
|
从OS获取文件大小，从而反推DB基本的文件大小，OS文件大小786440192，786440192-8192=786432000为DB基本文件大小，786432000/8192=96000为数据库的blocks数，转换16进制为0x00017700 |
文件大小 |
[ZHLHRDB2:oracle]:/oracle>cd /oracle/app/oracle/datafile/oralhr [ZHLHRDB2:oracle]:/oracle/app/oracle/datafile/oralhr>l sys* -rw-r----- 1 oracle asmadmin 576724992 Apr 15 08:45 sysaux01.dbf -rw-r----- 1 oracle asmadmin 786440192 Apr 15 09:31 system01.dbf -rw-r----- 1 oracle dba 786440192 Apr 14 10:02 system01.dbf_bk |
修改：
[ZHLHRDB2:oracle]:/oracle>cd /oracle/app/oracle/datafile/oralhr
[ZHLHRDB2:oracle]:/oracle/app/oracle/datafile/oralhr>l sys*
-rw-r----- 1 oracle asmadmin 576724992 Apr 15 08:45 sysaux01.dbf
-rw-r----- 1 oracle asmadmin 786440192 Apr 15 09:31 system01.dbf
-rw-r----- 1 oracle dba 786440192 Apr 14 10:02 system01.dbf_bk
BBED> set dba 1,1 offset 44 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 44
COUNT 64
BBED> d
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 44 to 107 Dba:0x00400001
------------------------------------------------------------------------
00011300 00002000 00020003 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000716 00000000
<32 bytes per line>
BBED> m /x 00017700
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 44 to 107 Dba:0x00400001
------------------------------------------------------------------------
00017700 00002000 00020003 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000716 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0x89e2, required = 0x89e2
BBED> d
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 44 to 107 Dba:0x00400001
------------------------------------------------------------------------
00017700 00002000 00020003 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000716 00000000
<32 bytes per line>
BBED>
2、 ub2 kccfhfno 文件号
ub2 kccfhfno @52 0x0002
比较简单，原sysaux为2号文件，我们需要修改为1号文件：
BBED> set dba 1,1 offset 52 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 52
COUNT 64
BBED> d
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 52 to 115 Dba:0x00400001
------------------------------------------------------------------------
00020003 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000716 00000000 3155becc 362e0deb
<32 bytes per line>
BBED> m /x 00010003
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 52 to 115 Dba:0x00400001
------------------------------------------------------------------------
00010003 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000716 00000000 3155becc 362e0deb
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0x89e1, required = 0x89e1
BBED>
三、 ub4 kcvfhrdb bootstrap$ 对象的地址
ub4 kcvfhrdb @96 0x00000000
该部分信息为sys.bootstrap$ 对象的地址，在10g中固定DBA为1,377， 但在11g中dba为1,520，这里看到为0，说明2号文件上不存在该对象， 其转换形式和rdba_kcbh部分是一样的，不再赘述。
11g中存储在1号文件520块：
BBED> info
File# Name Size(blks)
----- ---- ----------
1 /oracle/app/oracle/datafile/oralhr/system01.dbf 96000
2 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf 69120
3 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf 9600
4 /oracle/app/oracle/datafile/oralhr/users01.dbf 37920
5 /oracle/app/oracle/datafile/oralhr/system01.dbf_bk 96000
BBED>
BBED>
BBED> set dba 5,1 offset 96 count 64
DBA 0x01400001 (20971521 5,1)
OFFSET 96
COUNT 64
BBED> print kcvfhrdb
ub4 kcvfhrdb @96 0x00400208
====》 0000000001 0000000000001000001000， 1号文件520块，下边我们进行修改：
BBED> set dba 1,1 offset 96 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 96
COUNT 64
BBED> d
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 96 to 159 Dba:0x00400001
------------------------------------------------------------------------
00000000 00000716 00000000 3155becc 362e0deb 000e20dc 00007f18 00000000
00000000 00000000 00000004 000000a6 3630b88e 000000a5 00000000 00000000
<32 bytes per line>
BBED> modify /x 00400208
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 96 to 159 Dba:0x00400001
------------------------------------------------------------------------
00400208 00000716 00000000 3155becc 362e0deb 000e20dc 00007f18 00000000
00000000 00000000 00000004 000000a6 3630b88e 000000a5 00000000 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0x8ba9, required = 0x8ba9
BBED>
四、 ub4 kscnbas 文件创建SCN号
struct kcvfhcrs, 8 bytes @100
ub4 kscnbas @100 0x00000716
ub2 kscnwrp @104 0x0000
SYS@oralhr> set line 9999
SYS@oralhr> col name format a60
SYS@oralhr> SELECT d.FILE#,d.CREATION_CHANGE#,to_char(d.CREATION_CHANGE#,'xxxxxxxxxxxx') scn_hx,d.NAME FROM v$datafile d ;
FILE# CREATION_CHANGE# SCN_HX NAME
---------- ---------------- -------------------------- ------------------------------------------------------------
1 8 8 /oracle/app/oracle/datafile/oralhr/system01.dbf
2 1814 716 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf
3 923586 e17c2 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf
4 16050 3eb2 /oracle/app/oracle/datafile/oralhr/users01.dbf
SYS@oralhr>
====》 2号文件的scn为1814转换为16进制后就是716，和bbed查询出来的一致，下边修改1号文件的scn
BBED> p kcvfhcrs
struct kcvfhcrs, 8 bytes @100
ub4 kscnbas @100 0x00000716
ub2 kscnwrp @104 0x0000
BBED> set dba 1,1 offset 100 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 100
COUNT 64
BBED> m /x 00000008
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 100 to 163 Dba:0x00400001
------------------------------------------------------------------------
00000008 00000000 3155becc 362e0deb 000e20dc 00007f18 00000000 00000000
00000000 00000004 000000a6 3630b88e 000000a5 00000000 00000000 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0x8cb7, required = 0x8cb7
BBED> p kcvfhcrs
struct kcvfhcrs, 8 bytes @100
ub4 kscnbas @100 0x00000008
ub2 kscnwrp @104 0x0000
BBED>
五、 ub4 kcvfhcrt 文件创建时间
BBED> p kcvfhcrt
ub4 kcvfhcrt @108 0x3155becc
BBED>
SYS@oralhr> set line 9999
SYS@oralhr> col name format a60
SYS@oralhr> col scn_hx format a15
SYS@oralhr> col time_hx format a15
SYS@oralhr> select file#,name,CREATION_CHANGE#,scn_hx,CREATION_TIME_N,to_char(CREATION_TIME_N,'xxxxxxxxxxxx') time_hx,CREATION_TIME_D from (
2 SELECT d.FILE#,
3 d.NAME,
4 d.CREATION_CHANGE#,
5 to_char(d.CREATION_CHANGE#,'xxxxxxxxxxxx') scn_hx,
6 ((to_char(d.CREATION_TIME, 'YYYY') - 1988) * 12 * 31 * 24 * 3600 +
7 (to_char(d.CREATION_TIME, 'MM') - 1) * 31 * 24 * 3600 +
8 (to_char(d.CREATION_TIME, 'dd') - 1) * 24 * 3600 +
9 (to_char(d.CREATION_TIME, 'hh24')) * 3600 +
10 (to_char(d.CREATION_TIME, 'mi')) * 60 +
11 to_char(d.CREATION_TIME, 'ss')) CREATION_TIME_N,
12 to_char(d.CREATION_TIME, 'YYYY-MM-DD HH24:MI:SS') CREATION_TIME_D
13 FROM v$datafile d);
FILE# NAME CREATION_CHANGE# SCN_HX CREATION_TIME_N TIME_HX CREATION_TIME_D
---------- ------------------------------------------------------------ ---------------- --------------- --------------- --------------- ------------------------------
1 /oracle/app/oracle/datafile/oralhr/system01.dbf 8 8 827702981 3155bec5 2013-10-01 21:29:41
2 /oracle/app/oracle/datafile/oralhr/sysaux01.dbf 1814 716 827702988 3155becc 2013-10-01 21:29:48
3 /oracle/app/oracle/datafile/oralhr/undotbs01.dbf 923586 e17c2 827712502 3155e3f6 2013-10-02 00:08:22
4 /oracle/app/oracle/datafile/oralhr/users01.dbf 16050 3eb2 827703010 3155bee2 2013-10-01 21:30:10
SYS@oralhr>
BBED> p kcvfhcrt
ub4 kcvfhcrt @108 0x3155becc
BBED> set dba 1,1 offset 108
DBA 0x00400001 (4194305 1,1)
OFFSET 108
BBED>
BBED> m /x 3155BEC5
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 108 to 171 Dba:0x00400001
------------------------------------------------------------------------
3155bec5 362e0deb 000e20dc 00007f18 00000000 00000000 00000000 00000004
000000a6 3630b88e 000000a5 00000000 00000000 00000000 00000000 00000000
<32 bytes per line>
BBED>
BBED> sum apply
Check value for File 1, Block 1:
current = 0x8cbe, required = 0x8cbe
BBED>
六、 ub2 kcvfhsta 文件头部状态
ub2 kcvfhsta @138 0x0004 (KCVFHOFZ)
表示文件的状态，对于文件1，正常关闭的值为8192，16进制为2000
BBED> set dba 1,1 offset 138 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 138
COUNT 64
BBED> d
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 138 to 201 Dba:0x00400001
------------------------------------------------------------------------
00040000 00a63630 b88e0000 00a50000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<32 bytes per line>
BBED> m /x 2000
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 138 to 201 Dba:0x00400001
------------------------------------------------------------------------
20000000 00a63630 b88e0000 00a50000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0xacba, required = 0xacba
BBED>
七、 kcvfhtsn 表空间号
sword kcvfhtsn @332 1
system为0号表空间：
SYS@oralhr> select ts#,name from v$tablespace;
TS# NAME
---------- ------------------------------------------------------------
0 SYSTEM
1 SYSAUX
2 UNDOTBS1
4 USERS
3 TEMP
BBED> p kcvfhtsn
sword kcvfhtsn @332 1
BBED> set dba 1,1 offset 332 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 332
COUNT 64
BBED> m /x 00000000
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 332 to 395 Dba:0x00400001
------------------------------------------------------------------------
00000000 00065359 53415558 00000000 00000000 00000000 00000000 00000000
00000000 00000002 00000000 00000000 00000000 00000000 0000b7e0 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0xacbb, required = 0xacbb
BBED> p kcvfhtsn
sword kcvfhtsn @332 0
BBED>
八、 p kcvfhtnm 表空间名
text kcvfhtnm[3] @341 A
text kcvfhtnm[4] @342 U
text kcvfhtnm[5] @343 X
BBED> p kcvfhtnm
text kcvfhtnm[0] @338 S
text kcvfhtnm[1] @339 Y
text kcvfhtnm[2] @340 S
text kcvfhtnm[3] @341 A
text kcvfhtnm[4] @342 U
text kcvfhtnm[5] @343 X
text kcvfhtnm[6] @344
text kcvfhtnm[7] @345
text kcvfhtnm[8] @346
text kcvfhtnm[9] @347
text kcvfhtnm[10] @348
text kcvfhtnm[11] @349
text kcvfhtnm[12] @350
text kcvfhtnm[13] @351
text kcvfhtnm[14] @352
text kcvfhtnm[15] @353
text kcvfhtnm[16] @354
text kcvfhtnm[17] @355
text kcvfhtnm[18] @356
text kcvfhtnm[19] @357
text kcvfhtnm[20] @358
text kcvfhtnm[21] @359
text kcvfhtnm[22] @360
text kcvfhtnm[23] @361
text kcvfhtnm[24] @362
text kcvfhtnm[25] @363
text kcvfhtnm[26] @364
text kcvfhtnm[27] @365
text kcvfhtnm[28] @366
text kcvfhtnm[29] @367
BBED>
我们需要修改为SYSTEM，可以查询ASCII码表，或者从其它库中获取，注意这个值不存在大小端的转换：
BBED> set dba 1,1 offset 338 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 338
COUNT 64
BBED> d /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 338 to 401 Dba:0x00400001
-------------------------------------------------------
53595341 55580000 00000000 00000000 l SYSAUX..........
00000000 00000000 00000000 00000000 l ................
00020000 00000000 00000000 00000000 l ................
00000000 b7e00000 00000000 00000000 l ................
<16 bytes per line>
BBED> set dba 5,1 offset 338 count 64
DBA 0x01400001 (20971521 5,1)
OFFSET 338
COUNT 64
BBED> d /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf_bk (5)
Block: 1 Offsets: 338 to 401 Dba:0x01400001
-------------------------------------------------------
53595354 454d0000 00000000 00000000 l SYSTEM..........
00000000 00000000 00000000 00000000 l ................
00010000 00000000 00000000 00000000 l ................
00000000 b7e00000 00000000 00000000 l ................
BBED> set dba 5,1 offset 341 count 64
DBA 0x01400001 (20971521 5,1)
OFFSET 341
COUNT 64
BBED> d /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf_bk (5)
Block: 1 Offsets: 341 to 404 Dba:0x01400001
-------------------------------------------------------
54454d00 00000000 00000000 00000000 l TEM.............
00000000 00000000 00000000 00000100 l ................
00000000 00000000 00000000 00000000 l ................
00b7e000 00000000 00000000 00000000 l ................
<16 bytes per line>
BBED> set dba 1,1 offset 341 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 341
COUNT 64
BBED> d /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 341 to 404 Dba:0x00400001
-------------------------------------------------------
41555800 00000000 00000000 00000000 l AUX.............
00000000 00000000 00000000 00000200 l ................
00000000 00000000 00000000 00000000 l ................
00b7e000 00000000 00000000 00000000 l ................
<16 bytes per line>
BBED> m /x 54454d00
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 341 to 404 Dba:0x00400001
------------------------------------------------------------------------
54454d00 00000000 00000000 00000000 00000000 00000000 00000000 00000200
00000000 00000000 00000000 00000000 00b7e000 00000000 00000000 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0xbcbb, required = 0xbcbb
BBED> set dba 1,1 offset 338 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 338
COUNT 64
BBED> d /v
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 338 to 401 Dba:0x00400001
-------------------------------------------------------
53595354 454d0000 00000000 00000000 l SYSTEM..........
00000000 00000000 00000000 00000000 l ................
00020000 00000000 00000000 00000000 l ................
00000000 b7e00000 00000000 00000000 l ................
<16 bytes per line>
BBED>
九、 ub4 kcvfhrfn 相对文件号
ub4 kcvfhrfn @368 0x00000002
代表相对文件号，需要修改为1号：
BBED> p kcvfhrfn
ub4 kcvfhrfn @368 0x00000002
BBED> set dba 1,1 offset 368 count 64
DBA 0x00400001 (4194305 1,1)
OFFSET 368
COUNT 64
BBED> m /x 00000001
File: /oracle/app/oracle/datafile/oralhr/system01.dbf (1)
Block: 1 Offsets: 368 to 431 Dba:0x00400001
------------------------------------------------------------------------
00000001 00000000 00000000 00000000 00000000 0000b7e0 00000000 00000000
00000000 00000000 00000000 00000000 3155bebd 00000001 00000000 00000000
<32 bytes per line>
BBED> sum apply
Check value for File 1, Block 1:
current = 0xbcb8, required = 0xbcb8
BBED> p kcvfhrfn
ub4 kcvfhrfn @368 0x00000001
BBED>
二.3.3.2 尝试open数据库
在以上所有修改完毕后就可以尝试启动数据库了：
SYS@oralhr> select open_mode from v$database;
OPEN_MODE
----------------------------------------
MOUNTED
SYS@oralhr> alter database open;
alter database open
*
ERROR at line 1:
ORA-01113: file 1 needs media recovery
ORA-01110: data file 1: '/oracle/app/oracle/datafile/oralhr/system01.dbf'
SYS@oralhr> recover datafile 1;
Media recovery complete.
SYS@oralhr> alter database open;
Database altered.
SYS@oralhr>
由于没有修改文件头与检查点有关的内容，故需要做recover操作，由于归档日志都在，所以直接recover datafile 1恢复即可。
open的过程中的告警日志：
Fri Apr 15 10:51:33 2016
alter database open
Errors in file /oracle/app/oracle/diag/rdbms/oralhr/oralhr/trace/oralhr_ora_7602280.trc:
ORA-01113: file 1 needs media recovery
ORA-01110: data file 1: '/oracle/app/oracle/datafile/oralhr/system01.dbf'
ORA-1113 signalled during: alter database open...
Fri Apr 15 10:51:33 2016
Checker run found 1 new persistent data failures
Fri Apr 15 10:54:28 2016
ALTER DATABASE RECOVER datafile 1
Media Recovery Start
Serial Media Recovery started
Recovery of Online Redo Log: Thread 1 Group 3 Seq 45 Reading mem 0
Mem# 0: /oracle/app/oracle/datafile/oralhr/redo03.log
Media Recovery Complete (oralhr)
Completed: ALTER DATABASE RECOVER datafile 1
Fri Apr 15 10:54:40 2016
alter database open
Beginning crash recovery of 1 threads
parallel recovery started with 7 processes
Started redo scan
Completed redo scan
read 16 KB redo, 15 data blocks need recovery
Started redo application at
Thread 1: logseq 45, block 14177
Recovery of Online Redo Log: Thread 1 Group 3 Seq 45 Reading mem 0
Mem# 0: /oracle/app/oracle/datafile/oralhr/redo03.log
Completed redo application of 0.01MB
Completed crash recovery at
Thread 1: logseq 45, block 14209, scn 1332897
15 data blocks read, 15 data blocks written, 16 redo k-bytes read
Fri Apr 15 10:54:41 2016
LGWR: STARTING ARCH PROCESSES
Fri Apr 15 10:54:41 2016
ARC0 started with pid=33, OS id=23003154
ARC0: Archival started
LGWR: STARTING ARCH PROCESSES COMPLETE
Thread 1 advanced to log sequence 46 (thread open)
ARC0: STARTING ARCH PROCESSES
Thread 1 opened at log sequence 46
Current log# 1 seq# 46 mem# 0: /oracle/app/oracle/datafile/oralhr/redo01.log
Successful open of redo thread 1
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Fri Apr 15 10:54:41 2016
SMON: enabling cache recovery
Fri Apr 15 10:54:41 2016
ARC1 started with pid=34, OS id=39977044
Fri Apr 15 10:54:41 2016
ARC2 started with pid=35, OS id=24707290
Fri Apr 15 10:54:41 2016
ARC3 started with pid=36, OS id=34668790
ARC1: Archival started
ARC2: Archival started
ARC3: Archival started
ARC0: STARTING ARCH PROCESSES COMPLETE
ARC1: Becoming the 'no FAL' ARCH
ARC1: Becoming the 'no SRL' ARCH
ARC2: Becoming the heartbeat ARCH
[7602280] Successfully onlined Undo Tablespace 2.
Undo initialization finished serial:0 start:890311400 end:890311459 diff:59 (0 seconds)
Verifying file header compatibility for 11g tablespace encryption..
Verifying 11g file header compatibility for tablespace encryption completed
SMON: enabling tx recovery
Database Characterset is AL32UTF8
Archived Log entry 40 added for thread 1 sequence 45 ID 0x1793c569 dest 1:
No Resource Manager plan active
replication_dependency_tracking turned off (no async multimaster replication found)
Starting background process QMNC
Fri Apr 15 10:54:41 2016
QMNC started with pid=37, OS id=34537504
Completed: alter database open
Fri Apr 15 10:54:42 2016
Starting background process CJQ0
Fri Apr 15 10:54:42 2016
CJQ0 started with pid=40, OS id=21037310
Fri Apr 15 10:59:43 2016
Starting background process SMCO
Fri Apr 15 10:59:43 2016
SMCO started with pid=41, OS id=28967004
二.4 实验总结
其实重要的不在于恢复的过程，而在于对BBED工具的了解，通过BBED来了解文件头块的内容和格式，对于这个案例我们可以直接将备份的文件头copy到1号文件的文件头实现恢复。