从底向上第八篇--伪造基于ASSM表空间的数据块

sundog315 · 发表于 2010-6-25 14:47

从底向上第一篇--了解DML操作
从底向上第二篇--了解行迁移
从底向上第三篇--了解index的compress
从底向上第四篇--了解行链接
从底向上第五篇--了解表的压缩属性
从底向上第六篇--compress for oltp真正压缩的阈值触发条件
从底向上第七篇--超255列表的存储
从底向上第八篇--伪造基于ASSM表空间的数据块

突发奇想，既然Oracle数据块的格式我们基本都能了解，那么，伪造一个数据块也应该是可行的，做个实验，测试一下

SQL> conn test/test
已连接。
SQL> create table t as select * from dba_objects where rownum=1;

表已创建。

SQL> select count(*) from t;

  COUNT(*)
----------
      1

SQL> alter system checkpoint;

系统已更改。

SQL> select header_file,header_block from dba_segments where segment_name='T';

HEADER_FILE HEADER_BLOCK
----------- ------------
      4       130

SQL> alter system dump datafile 4 block min 128 block max 131;

系统已更改。

Dump of First Level Bitmap Block
--------------------------------
nbits : 4 nranges: 1       parent dba:  0x01000081 poffset: 0
unformatted: 4    total: 8       first useful block: 3
owning instance : 1
instance ownership changed at
Last successful Search
Freeness Status:  nf1 0    nf2 0    nf3 0    nf4 0

Extent Map Block Offset: 4294967295
First free datablock : 4
Bitmap block lock opcode 0
Locker xid:    :  0x0000.000.00000000
Inc #: 0 Objd: 68305
  HWM Flag: HWM Set
   Highwater::  0x01000084  ext#: 0    blk#: 4    ext size: 8
  #blocks in seg. hdr's freelists: 0
  #blocks below: 4
  mapblk  0x00000000  offset: 0
  --------------------------------------------------------
  DBA Ranges :
  --------------------------------------------------------
0x01000080  Length: 8    Offset: 0

0:Metadata 1:Metadata 2:Metadata 3:FULL
4:unformatted 5:unformatted 6:unformatted 7:unformatted
  --------------------------------------------------------

  Extent Control Header
  -----------------------------------------------------------------
  Extent Header:: spare1: 0    spare2: 0    #extents: 1    #blocks: 8
               last map  0x00000000  #maps: 0    offset: 2716
   Highwater::  0x01000084  ext#: 0    blk#: 4    ext size: 8
  #blocks in seg. hdr's freelists: 0
  #blocks below: 4
  mapblk  0x00000000  offset: 0
               Unlocked
  --------------------------------------------------------
  Low HighWater Mark :
   Highwater::  0x01000084  ext#: 0    blk#: 4    ext size: 8
  #blocks in seg. hdr's freelists: 0
  #blocks below: 4
  mapblk  0x00000000  offset: 0
  Level 1 BMB for High HWM block: 0x01000080
  Level 1 BMB for Low HWM block: 0x01000080
  --------------------------------------------------------
  Segment Type: 1 nl2: 1    blksz: 8192 fbsz: 0
  L2 Array start offset:  0x00001434
  First Level 3 BMB:  0x00000000
  L2 Hint for inserts:  0x01000081
  Last Level 1 BMB:  0x01000080
  Last Level II BMB:  0x01000081
  Last Level III BMB:  0x00000000
   Map Header:: next  0x00000000  #extents: 1 obj#: 68305  flag: 0x10000000
  Inc # 0
  Extent Map
  -----------------------------------------------------------------
0x01000080  length: 8

  Auxillary Map
  --------------------------------------------------------
Extent 0    :  L1 dba:  0x01000080 Data dba:  0x01000083
  --------------------------------------------------------

Second Level Bitmap block DBAs
--------------------------------------------------------
DBA 1: 0x01000081

Block 128 First Level Bitmap，可以看到，现在只格式化了0-3的块，我准备构造一个新块，放入块6中
用dd来实现：
C:\Users\Administrator>dd if=C:\oracle\app\Administrator\oradata\TEST\USERS01.DB
F of=aaa.block bs=8192 count=1 skip=131
1+0 records in
1+0 records out

C:\Users\Administrator>dd of=C:\oracle\app\Administrator\oradata\TEST\USERS01.DB
F if=aaa.block bs=8192 count=1 seek=134 conv=notrunc
1+0 records in
1+0 records out

这样，构造了一个与131完全相同的新块，并放入134中。

然后，用BBED修改块128如下内容：
unformatted、Highwater、blk#、#blocks below，以及将6:unformatted修改为format状态。

修改完毕的块128：

Dump of First Level Bitmap Block
--------------------------------
nbits : 4 nranges: 1       parent dba:  0x01000081 poffset: 0
unformatted: 3    total: 8       first useful block: 3
owning instance : 1
instance ownership changed at
Last successful Search
Freeness Status:  nf1 0    nf2 0    nf3 0    nf4 0

Extent Map Block Offset: 4294967295
First free datablock : 4
Bitmap block lock opcode 0
Locker xid:    :  0x0000.000.00000000
Inc #: 0 Objd: 68305
  HWM Flag: HWM Set
   Highwater::  0x01000087  ext#: 0    blk#: 7    ext size: 8
  #blocks in seg. hdr's freelists: 0
  #blocks below: 7
  mapblk  0x00000000  offset: 0
  --------------------------------------------------------
  DBA Ranges :
  --------------------------------------------------------
0x01000080  Length: 8    Offset: 0

0:Metadata 1:Metadata 2:Metadata 3:FULL
4:unformatted 5:unformatted 6:75-100% free 7:unformatted
  --------------------------------------------------------

同样的，用BBED修改块130(Extent Control Header)的Highwater相关内容。

由于我们是将块131拷贝到134中，还需要修改134的DBA值。由01000083修改为01000086

Dump of memory from 0x0E2E8200 to 0x0E2EA200
E2E8200 0000A206 01000086 007A91B0 04020000  [..........z.....]
E2E8210 0000CC7F 00000001 00010AD1 007A91AE  [..............z.]
E2E8220 00000000 00320003 01000080 0000FFFF  [......2.........]
E2E8230 00000000 00000000 00000000 00008000  [................]
E2E8240 007A91AE 00000000 00000000 00000000  [..z.............]
E2E8250 00000000 00000000 00000000 00000000  [................]
      Repeat 1 times
E2E8270 00000000 00000000 00000000 00010100  [................]
E2E8280 0014FFFF 1F1F1F33 00001F1F 1F330001  [....3.........3.]
E2E8290 00000000 00000000 00000000 00000000  [................]
      Repeat 496 times
E2EA1A0 00000000 00000000 00000000 2C000000  [...............,]
E2EA1B0 53030E00 49055359 244C4F43 15C102FF  [...SYS.ICOL$....]
E2EA1C0 0503C102 4C424154 6E780745 3A0D1905  [....TABLE.xn...:]
E2EA1D0 6E78071C 3A0D1905 3032131C 302D3031  [..xn...:..2010-0]
E2EA1E0 35322D35 3A32313A 323A3735 41560537  [5-25:12:57:27.VA]
E2EA1F0 0144494C 014E014E 02C1024E 91B00602  [LID.N.N.N.......]

至此，修改完毕。我们来看看效果：

SQL> alter system flush buffer_cache;

系统已更改。
SQL> alter session set events '10202 trace name context forever';

会话已更改。

SQL> select count(*) from t;

  COUNT(*)
----------
      2

成功了。

SQL> alter session set events '10202 trace name context off';

会话已更改。

Consistent read complete...
Block header dump:  0x01000083
Object id on Block? Y
seg/obj: 0x10ad1  csc: 0x00.7a91ae  itc: 3  flg: E  typ: 1 - DATA
   brn: 0  bdba: 0x1000080 ver: 0x01 opc: 0
   inc: 0  exflg: 0

Itl          Xid                Uba       Flag  Lck       Scn/Fsc
0x01 0xffff.000.00000000  0x00000000.0000.00  C--- 0  scn 0x0000.007a91ae
0x02 0x0000.000.00000000  0x00000000.0000.00  ---- 0  fsc 0x0000.00000000
0x03 0x0000.000.00000000  0x00000000.0000.00  ---- 0  fsc 0x0000.00000000
Consistent read complete...
Block header dump:  0x01000086
Object id on Block? Y
seg/obj: 0x10ad1  csc: 0x00.7a9138  itc: 2  flg: E  typ: 1 - DATA
   brn: 0  bdba: 0x1000080 ver: 0x01 opc: 0
   inc: 0  exflg: 0

Itl          Xid                Uba       Flag  Lck       Scn/Fsc
0x01 0x000d.01c.000002c2  0x03422891.03b0.1e  --U- 1  fsc 0x0000.007a913a
0x02 0x0000.000.00000000  0x00000000.0000.00  ---- 0  fsc 0x0000.00000000

模拟测试完成，我们直接从底层伪造了一个合法的数据块。

[ 本帖最后由 sundog315 于 2010-6-25 14:49 编辑 ]

Yong Huang · 发表于 2010-6-26 04:24

Good. Instead of select count(*), why not select * and see if there's any difference between the two rows? And/or compare with a block dump (just look at the data part of the dump).

If you alter table t move, will the new block be moved to closer to the first one?

Yong Huang

newdelete · 发表于 2010-6-27 09:24

我觉得应当改extent map block吧？为什么改first level bitmap？

sundog315 · 发表于 2010-6-28 10:18

原帖由 newdelete 于 2010-6-27 09:24 发表
我觉得应当改extent map block吧？为什么改first level bitmap？

ASSM在全表扫描时会查询高高水位线以下format的块，而我的测试是跳跃的存储模式，需要修改一下状态。

just_dba · 发表于 2010-6-28 13:47

全表扫描是扫高低水位以下的...高高水位~高低水位这些块里边没数据,不扫描..

Yong Huang · 发表于 2010-6-29 00:16

> 高高水位~高低水位这些块里边没数据,不扫描..

That's not correct. See
http://download.oracle.com/docs/ ... /e10713/logical.htm

There may be formatted blocks between the low HWM and the high HWM (or just call it HWM). When Oracle reads these blocks, it has to check the L1 bitmap to see exactly which of those blocks are formatted and therefore have to be read.

Yong Huang

just_dba · 发表于 2010-6-29 12:34

刚才测试了一下,是扫描已FORMAT的块

sundog315 · 发表于 2010-7-1 20:30

原帖由 Yong Huang 于 2010-6-26 04:24 发表
Good. Instead of select count(*), why not select * and see if there's any difference between the two rows? And/or compare with a block dump (just look at the data part of the dump).

If you alter table t move, will the new block be moved to closer to the first one?

Yong Huang

SQL> select count(*) from t;

  COUNT(*)
----------
      2

SQL> col owner format a5
SQL> col OBJECT_NAME format a15
SQL> col OBJECT_ID format 99
SQL> select owner,object_name,object_id from t;

OWNER OBJECT_NAME    OBJECT_ID
----- --------------- ---------
SYS ICOL$                20
SYS ICOL$                20

SQL> alter table t move;

表已更改。

SQL> select count(*) from t;

  COUNT(*)
----------
      2

SQL> select header_file,header_block from dba_segments where segment_name='T';

HEADER_FILE HEADER_BLOCK
----------- ------------
      4       138

SQL> alter system dump datafile 4 block 139;

系统已更改。

E75A160 002C0000 5953030E 43490553 FF244C4F  [..,...SYS.ICOL$.]
E75A170 0215C102 540503C1 454C4241 056E7807  [.......TABLE.xn.]
E75A180 1C3A0D19 056E7807 1C3A0D19 31303213  [..:..xn...:..201]
E75A190 35302D30 3A35322D 353A3231 37323A37  [0-05-25:12:57:27]
E75A1A0 4C415605 4E014449 4E014E01 2C02C102  [.VALID.N.N.N...,]
E75A1B0 53030E00 49055359 244C4F43 15C102FF  [...SYS.ICOL$....]
E75A1C0 0503C102 4C424154 6E780745 3A0D1905  [....TABLE.xn...:]
E75A1D0 6E78071C 3A0D1905 3032131C 302D3031  [..xn...:..2010-0]
E75A1E0 35322D35 3A32313A 323A3735 41560537  [5-25:12:57:27.VA]
E75A1F0 0144494C 014E014E 02C1024E 8B750602  [LID.N.N.N.....u.]
Block header dump:  0x0100008b
Object id on Block? Y
seg/obj: 0x10d41  csc: 0x00.968b73  itc: 3  flg: E  typ: 1 - DATA
   brn: 0  bdba: 0x1000088 ver: 0x01 opc: 0
   inc: 0  exflg: 0

Itl          Xid                Uba       Flag  Lck       Scn/Fsc
0x01 0x000f.00d.0000072c  0x00000000.0000.00  ---- 0  fsc 0x0000.00000000
0x02 0x0000.000.00000000  0x00000000.0000.00  ---- 0  fsc 0x0000.00000000
0x03 0x0000.000.00000000  0x00000000.0000.00  ---- 0  fsc 0x0000.00000000
bdba: 0x0100008b
data_block_dump,data header at 0xe75827c
===============
tsiz: 0x1f80
hsiz: 0x16
pbl: 0x0e75827c
   76543210
flag=--------
ntab=1
nrow=2
frre=-1
fsbo=0x16
fseo=0x1ee6
avsp=0x1ed0
tosp=0x1ed0
0xe:pti[0] nrow=2 offs=0
0x12:pri[0] offs=0x1f33
0x14:pri[1] offs=0x1ee6
block_row_dump:
tab 0, row 0, @0x1f33
tl: 77 fb: --H-FL-- lb: 0x0  cc: 14
col  0: [ 3]  53 59 53
col  1: [ 5]  49 43 4f 4c 24
col  2: *NULL*
col  3: [ 2]  c1 15
col  4: [ 2]  c1 03
col  5: [ 5]  54 41 42 4c 45
col  6: [ 7]  78 6e 05 19 0d 3a 1c
col  7: [ 7]  78 6e 05 19 0d 3a 1c
col  8: [19]  32 30 31 30 2d 30 35 2d 32 35 3a 31 32 3a 35 37 3a 32 37
col  9: [ 5]  56 41 4c 49 44
col 10: [ 1]  4e
col 11: [ 1]  4e
col 12: [ 1]  4e
col 13: [ 2]  c1 02
tab 0, row 1, @0x1ee6
tl: 77 fb: --H-FL-- lb: 0x0  cc: 14
col  0: [ 3]  53 59 53
col  1: [ 5]  49 43 4f 4c 24
col  2: *NULL*
col  3: [ 2]  c1 15
col  4: [ 2]  c1 03
col  5: [ 5]  54 41 42 4c 45
col  6: [ 7]  78 6e 05 19 0d 3a 1c
col  7: [ 7]  78 6e 05 19 0d 3a 1c
col  8: [19]  32 30 31 30 2d 30 35 2d 32 35 3a 31 32 3a 35 37 3a 32 37
col  9: [ 5]  56 41 4c 49 44
col 10: [ 1]  4e
col 11: [ 1]  4e
col 12: [ 1]  4e
col 13: [ 2]  c1 02
end_of_block_dump

sundog315 · 发表于 2010-7-1 20:30

伪造的块目前看来与Oracle自己生成的块没有什么区别，Oracle对这两个块一视同仁。呵呵。

quzhenfang · 发表于 2010-10-23 15:23

well done ，study hard

从底向上第八篇--伪造基于ASSM表空间的数据块

浏览过的版块