新型Oracle 攻击勒索又来了……

前几天接到某客户的请求;数据库重启就无法启动了;我们先来看看报错:

Sat May 02 06:00:02 2020
Begin automatic SQL Tuning Advisor run for special tuning task  "SYS_AUTO_SQL_TUNING_TASK"
Sat May 02 06:00:03 2020
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_j001_6188.trc  (incident=38793):
ORA-00600: internal error code, arguments: [16659], [kqldtu], [INS], [0], [80833], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38793\orcl_j001_6188_i38793.trc
End automatic SQL Tuning Advisor run for special tuning task  "SYS_AUTO_SQL_TUNING_TASK"
......
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_j001_6188.trc:
ORA-00600: internal error code, arguments: [16659], [kqldtu], [INS], [0], [80833], [], [], [], [], [], [], []
ORA-06512: at "SYS.DBMS_STATS", line 31692
Sat May 02 06:00:52 2020
Dumping diagnostic data in directory=[cdmp_20200502060052], requested by (instance=1, osid=6188 (J001)), summary=[incident=38795].
Sat May 02 06:01:25 2020
Sweep [inc][38795]: completed
Sweep [inc2][38795]: completed
Sweep [inc2][38794]: completed
Sat May 02 07:16:50 2020
Thread 1 advanced to log sequence 2555 (LGWR switch)
Current log# 2 seq# 2555 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO02.LOG
Sat May 02 08:18:14 2020
Thread 1 advanced to log sequence 2556 (LGWR switch)
Current log# 3 seq# 2556 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO03.LOG
Thread 1 advanced to log sequence 2557 (LGWR switch)
Current log# 1 seq# 2557 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO01.LOG
Sat May 02 08:48:17 2020
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_m000_800.trc  (incident=38817):
ORA-00600: internal error code, arguments: [kkpo_rcinfo_defstg:delseg], [84328], [], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38817\orcl_m000_800_i38817.trc
Sat May 02 08:48:25 2020
Sweep [inc][38817]: completed
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Sat May 02 08:48:26 2020
Sweep [inc2][38817]: completed
Sat May 02 08:48:26 2020
Dumping diagnostic data in directory=[cdmp_20200502084826], requested by (instance=1, osid=800 (M000)), summary=[incident=38817].
Sat May 02 10:08:18 2020
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_j001_2876.trc  (incident=38796):
ORA-00600: internal error code, arguments: [16659], [kqldtu], [INS], [0], [80830], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38796\orcl_j001_2876_i38796.trc
Sat May 02 10:08:34 2020
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Sat May 02 10:08:35 2020
Dumping diagnostic data in directory=[cdmp_20200502100835], requested by (instance=1, osid=2876 (J001)), summary=[incident=38796].
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_j001_2876.trc  (incident=38797):
ORA-00600: internal error code, arguments: [], [], [], [], [], [], [], [], [], [], [], []
ORA-00600: internal error code, arguments: [16659], [kqldtu], [INS], [0], [80830], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38797\orcl_j001_2876_i38797.trc
......
Thread 1 advanced to log sequence 2579 (LGWR switch)
Current log# 2 seq# 2579 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO02.LOG
Wed May 06 10:18:16 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x30A] [PC:0x145002345, qknSetParent()+7]
ERROR: Unable to normalize symbol name for the following short stack (at offset 213):
dbgexProcessError()+200<-dbgeExecuteForError()+65<-dbgePostErrorKGE()+2269<-dbkePostKGE_kgsf()+77<-kgeade()+562<-kgerelv()+151<-kgerev()+45<-kgerec5()+60<-sss_xcpt_EvalFilterEx()+1862<-sss_xcpt_EvalFilter()+174<-.1.6_8+59<-00007FFDB5381E26<-00007FFDB53934AD<-00007FFDB53548D7<-00007FFDB539263A<-qknSetParent()+7<-qknAllocate()+240<-qkninpAllocate()+57<-qkadml()+604<-qkastmt()+11<-qkadrv()+1937<-opitca()+3087<-PGOSF507_kksFullTypeCheck()+95<-rpiswu2()+3039<-kksSetBindType()+11726<-kksfbc()+12649<-opiexe()+3001<-opipls()+2496<-opiodr()+1630<-rpidrus()+862<-rpidru()+157<-rpiswu2()+3039<-rpidrv()+6520<-psddr0()+621<-psdnal()+500<-pevm_EXECC()+378<-pfrinstr_EXECC()+90<-pfrrun_no_tool()+77<-pfrrun()+1241<-plsql_run()+903<-peicnt()+328<-peiet_execute_trigger()+47<-kkxtexe()+471<-kxtExecuteTriggerRecursive()+625<-rpiswu2()+3039<-kxtExecuteTriggerReal()+1216<-kxtexe()+14<-PGOSF526_upduaw()+4026<-kdusru()+671<-kauupd()+523
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_2052.trc  (incident=38665):
ORA-07445: 出现异常错误: 核心转储 [qknSetParent()+7] [ACCESS_VIOLATION] [ADDR:0x30A] [PC:0x145002345] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38665\orcl_ora_2052_i38665.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:18:25 2020
Dumping diagnostic data in directory=[cdmp_20200506101825], requested by (instance=1, osid=2052), summary=[incident=38665].
Wed May 06 10:18:28 2020
Sweep [inc][38665]: completed
Sweep [inc2][38665]: completed
Wed May 06 10:18:41 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x30A] [PC:0x145002345, qknSetParent()+7]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_32.trc  (incident=38625):
ORA-07445: 出现异常错误: 核心转储 [qknSetParent()+7] [ACCESS_VIOLATION] [ADDR:0x30A] [PC:0x145002345] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38625\orcl_ora_32_i38625.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:18:48 2020
Dumping diagnostic data in directory=[cdmp_20200506101848], requested by (instance=1, osid=32), summary=[incident=38625].
Wed May 06 10:19:28 2020
Sweep [inc][38625]: completed
Sweep [inc2][38625]: completed
Wed May 06 10:22:17 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x0] [PC:0x143CCFB81, qksxaMoveList()+123]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_5376.trc  (incident=38569):
ORA-07445: 出现异常错误: 核心转储 [qksxaMoveList()+123] [ACCESS_VIOLATION] [ADDR:0x0] [PC:0x143CCFB81] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38569\orcl_ora_5376_i38569.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:22:24 2020
Dumping diagnostic data in directory=[cdmp_20200506102224], requested by (instance=1, osid=5376), summary=[incident=38569].
Wed May 06 10:22:25 2020
Sweep [inc][38569]: completed
Sweep [inc2][38569]: completed
Wed May 06 10:22:53 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x30A] [PC:0x145002345, qknSetParent()+7]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_2732.trc  (incident=38681):
ORA-07445: 出现异常错误: 核心转储 [qknSetParent()+7] [ACCESS_VIOLATION] [ADDR:0x30A] [PC:0x145002345] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38681\orcl_ora_2732_i38681.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:23:01 2020
Dumping diagnostic data in directory=[cdmp_20200506102301], requested by (instance=1, osid=2732), summary=[incident=38681].
Wed May 06 10:23:25 2020
Sweep [inc][38681]: completed
Sweep [inc2][38681]: completed
Wed May 06 10:25:27 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x0] [PC:0x143CCFB81, qksxaMoveList()+123]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_6780.trc  (incident=38657):
ORA-07445: 出现异常错误: 核心转储 [qksxaMoveList()+123] [ACCESS_VIOLATION] [ADDR:0x0] [PC:0x143CCFB81] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38657\orcl_ora_6780_i38657.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:25:34 2020
Dumping diagnostic data in directory=[cdmp_20200506102534], requested by (instance=1, osid=6780), summary=[incident=38657].
Wed May 06 10:25:37 2020
Sweep [inc][38657]: completed
Sweep [inc2][38657]: completed
Wed May 06 10:39:08 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x0] [PC:0x143CCFB81, qksxaMoveList()+123]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_144.trc  (incident=38585):
ORA-07445: 出现异常错误: 核心转储 [qksxaMoveList()+123] [ACCESS_VIOLATION] [ADDR:0x0] [PC:0x143CCFB81] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38585\orcl_ora_144_i38585.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:39:15 2020
Dumping diagnostic data in directory=[cdmp_20200506103915], requested by (instance=1, osid=144), summary=[incident=38585].
Wed May 06 10:39:16 2020
Sweep [inc][38585]: completed
Sweep [inc2][38585]: completed
Wed May 06 10:43:51 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x0] [PC:0x143CCFB81, qksxaMoveList()+123]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_6176.trc  (incident=38593):
ORA-07445: 出现异常错误: 核心转储 [qksxaMoveList()+123] [ACCESS_VIOLATION] [ADDR:0x0] [PC:0x143CCFB81] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_38593\orcl_ora_6176_i38593.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:43:58 2020
Dumping diagnostic data in directory=[cdmp_20200506104358], requested by (instance=1, osid=6176), summary=[incident=38593].
Wed May 06 10:43:58 2020
Sweep [inc][38593]: completed
Sweep [inc2][38593]: completed
Wed May 06 10:44:56 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x30A] [PC:0x145002345, qknSetParent()+7]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\trace\xxxxxx_ora_6184.trc  (incident=38713):
ORA-07445: 出现异常错误: 核心转储 [qknSetParent()+7] [ACCESS_VIOLATION] [ADDR:0x30A] [PC:0x145002345] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\incident\incdir_38713\xxxxxx_ora_6184_i38713.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 10:45:02 2020
Dumping diagnostic data in directory=[cdmp_20200506104502], requested by (instance=1, osid=6184), summary=[incident=38713].
Wed May 06 10:45:04 2020
Sweep [inc][38713]: completed
Sweep [inc2][38713]: completed
Wed May 06 11:09:15 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x0] [PC:0x143CCFB81, qksxaMoveList()+123]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\trace\xxxxxx_ora_5444.trc  (incident=38714):
ORA-07445: 出现异常错误: 核心转储 [qksxaMoveList()+123] [ACCESS_VIOLATION] [ADDR:0x0] [PC:0x143CCFB81] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\incident\incdir_38714\xxxxxx_ora_5444_i38714.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 11:09:22 2020
Dumping diagnostic data in directory=[cdmp_20200506110922], requested by (instance=1, osid=5444), summary=[incident=38714].
Wed May 06 11:09:23 2020
Sweep [inc][38714]: completed
Sweep [inc2][38714]: completed
Wed May 06 11:32:13 2020
Exception [type: ACCESS_VIOLATION, UNABLE_TO_WRITE] [ADDR:0x0] [PC:0x143CCFB81, qksxaMoveList()+123]
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\trace\xxxxxx_ora_6756.trc  (incident=38721):
ORA-07445: 出现异常错误: 核心转储 [qksxaMoveList()+123] [ACCESS_VIOLATION] [ADDR:0x0] [PC:0x143CCFB81] [UNABLE_TO_WRITE] []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\incident\incdir_38721\xxxxxx_ora_6756_i38721.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Wed May 06 11:32:19 2020
Dumping diagnostic data in directory=[cdmp_20200506113219], requested by (instance=1, osid=6756), summary=[incident=38721].
Wed May 06 11:32:21 2020
Sweep [inc][38721]: completed
Sweep [inc2][38721]: completed
Wed May 06 11:42:40 2020
......
Wed May 06 11:50:38 2020
Adjusting the default value of parameter parallel_max_servers
from 640 to 120 due to the value of parameter processes (150)
Starting ORACLE instance (normal)
......
Completed: alter database mount exclusive
alter database open
Beginning crash recovery of 1 threads
parallel recovery started with 15 processes
Started redo scan
Completed redo scan
read 63 KB redo, 39 data blocks need recovery
Started redo application at
Thread 1: logseq 2579, block 34702
Recovery of Online Redo Log: Thread 1 Group 2 Seq 2579 Reading mem 0
Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\xxxxxx\REDO02.LOG
Completed redo application of 0.02MB
Completed crash recovery at
Thread 1: logseq 2579, block 34828, scn 22794608
39 data blocks read, 39 data blocks written, 63 redo k-bytes read
Thread 1 advanced to log sequence 2580 (thread open)
Thread 1 opened at log sequence 2580
Current log# 3 seq# 2580 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\xxxxxx\REDO03.LOG
Successful open of redo thread 1
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
SMON: enabling cache recovery
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\trace\xxxxxx_ora_6864.trc  (incident=39811):
ORA-00600: ??????, ??: [kkdlcob-objn-exists], [37], [], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\incident\incdir_39811\xxxxxx_ora_6864_i39811.trc
Wed May 06 11:51:11 2020
Dumping diagnostic data in directory=[cdmp_20200506115111], requested by (instance=1, osid=6864), summary=[incident=39811].
Wed May 06 11:51:12 2020
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\trace\xxxxxx_ora_6864.trc:
ORA-00704: ????????
ORA-00600: ??????, ??: [kkdlcob-objn-exists], [37], [], [], [], [], [], [], [], [], [], []
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\xxxxxx\xxxxxx\trace\xxxxxx_ora_6864.trc:
ORA-00704: ????????
ORA-00600: ??????, ??: [kkdlcob-objn-exists], [37], [], [], [], [], [], [], [], [], [], []
Error 704 happened during db open, shutting down database
USER (ospid: 6864): terminating the instance due to error 704
Instance terminated by USER, pid = 6864
ORA-1092 signalled during: alter database open...
opiodr aborting process unknown ospid (6864) as a result of ORA-1092

上面报了很多一系列ora-00600错误,本质上来讲很多都跟数据字典有关;这里我们重点分析最后一个错误,也就是数据库重启后无法启动的报错。

CREATE UNIQUE INDEX I_OBJ2 ON OBJ$(OWNER#,NAME,NAMESPACE,REMOTEOWNER,LINKNAME,SUBNAME,TYPE#,SPARE3,OBJ#)
PCTFREE 10 INITRANS 2 MAXTRANS 255
STORAGE (  INITIAL 16K NEXT 104K MINEXTENTS 1 MAXEXTENTS 2147483645
PCTINCREASE 0 OBJNO 37 EXTENTS (FILE 1 BLOCK 344))

从上述的trace文件中分析是上面的Index创建失败,导致数据库无法启动。因为这是bootstrap$核心对象,bootstrap内容初始化失败,Oracle自然是无法启动的。

下面我们进一步简单分析一下trace内容,看下为什么会报错:

9CB5ECAF0 03012C00 0205C102 3CFE05C1 45524303 [.,.........<.CRE]
9CB5ECB00 20455441 4C424154 41542045 22282442 [ATE TABLE TAB$("]
9CB5ECB10 234A424F 554E2022 5245424D 544F4E20 [OBJ#" NUMBER NOT]
9CB5ECB20 4C554E20 44222C4C 4F415441 22234A42 [ NULL,"DATAOBJ#"]
9CB5ECB30 4D554E20 2C524542 23535422 554E2022 [ NUMBER,"TS#" NU]
9CB5ECB40 5245424D 544F4E20 4C554E20 46222C4C [MBER NOT NULL,"F]
9CB5ECB50 23454C49 554E2022 5245424D 544F4E20 [ILE#" NUMBER NOT]
9CB5ECB60 4C554E20 42222C4C 4B434F4C 4E202223 [ NULL,"BLOCK#" N]
9CB5ECB70 45424D55 4F4E2052 554E2054 222C4C4C [UMBER NOT NULL,"]
9CB5ECB80 4A424F42 4E202223 45424D55 54222C52 [BOBJ#" NUMBER,"T]
9CB5ECB90 22234241 4D554E20 2C524542 4C4F4322 [AB#" NUMBER,"COL]
9CB5ECBA0 4E202253 45424D55 4F4E2052 554E2054 [S" NUMBER NOT NU]
9CB5ECBB0 222C4C4C 43554C43 22534C4F 4D554E20 [LL,"CLUCOLS" NUM]
9CB5ECBC0 2C524542 54435022 45455246 4E202224 [BER,"PCTFREE$" N]
9CB5ECBD0 45424D55 4F4E2052 554E2054 222C4C4C [UMBER NOT NULL,"]
9CB5ECBE0 55544350 24444553 554E2022 5245424D [PCTUSED$" NUMBER]
9CB5ECBF0 544F4E20 4C554E20 49222C4C 5254494E [ NOT NULL,"INITR]
9CB5ECC00 22534E41 4D554E20 20524542 20544F4E [ANS" NUMBER NOT ]
9CB5ECC10 4C4C554E 414D222C 41525458 2022534E [NULL,"MAXTRANS" ]
9CB5ECC20 424D554E 4E205245 4E20544F 2C4C4C55 [NUMBER NOT NULL,]
9CB5ECC30 414C4622 20225347 424D554E 4E205245 ["FLAGS" NUMBER N]
9CB5ECC40 4E20544F 2C4C4C55 44554122 22245449 [OT NULL,"AUDIT$"]
9CB5ECC50 52415620 52414843 38332832 4F4E2029 [ VARCHAR2(38) NO]
9CB5ECC60 554E2054 222C4C4C 43574F52 2022544E [T NULL,"ROWCNT" ]
9CB5ECC70 424D554E 222C5245 434B4C42 2022544E [NUMBER,"BLKCNT" ]
9CB5ECC80 424D554E 222C5245 43504D45 2022544E [NUMBER,"EMPCNT" ]
9CB5ECC90 424D554E 222C5245 53475641 20224350 [NUMBER,"AVGSPC" ]
9CB5ECCA0 424D554E 222C5245 434E4843 2022544E [NUMBER,"CHNCNT" ]
9CB5ECCB0 424D554E 222C5245 52475641 20224E4C [NUMBER,"AVGRLN" ]
9CB5ECCC0 424D554E 222C5245 53475641 465F4350 [NUMBER,"AVGSPC_F]
9CB5ECCD0 2022424C 424D554E 222C5245 43424C46 [LB" NUMBER,"FLBC]
9CB5ECCE0 2022544E 424D554E 222C5245 4C414E41 [NT" NUMBER,"ANAL]
9CB5ECCF0 54455A59 22454D49 54414420 53222C45 [YZETIME" DATE,"S]
9CB5ECD00 4C504D41 5A495345 4E202245 45424D55 [AMPLESIZE" NUMBE]
9CB5ECD10 44222C52 45524745 4E202245 45424D55 [R,"DEGREE" NUMBE]
9CB5ECD20 49222C52 4154534E 5345434E 554E2022 [R,"INSTANCES" NU]
9CB5ECD30 5245424D 4E49222C 4C4F4354 4E202253 [MBER,"INTCOLS" N]
9CB5ECD40 45424D55 4F4E2052 554E2054 222C4C4C [UMBER NOT NULL,"]
9CB5ECD50 4E52454B 4F434C45 2022534C 424D554E [KERNELCOLS" NUMB]
9CB5ECD60 4E205245 4E20544F 2C4C4C55 4F525022 [ER NOT NULL,"PRO]
9CB5ECD70 54524550 4E202259 45424D55 4F4E2052 [PERTY" NUMBER NO]
9CB5ECD80 554E2054 222C4C4C 47495254 47414C46 [T NULL,"TRIGFLAG]
9CB5ECD90 554E2022 5245424D 5053222C 31455241 [" NUMBER,"SPARE1]
9CB5ECDA0 554E2022 5245424D 5053222C 32455241 [" NUMBER,"SPARE2]
9CB5ECDB0 554E2022 5245424D 5053222C 33455241 [" NUMBER,"SPARE3]
9CB5ECDC0 554E2022 5245424D 5053222C 34455241 [" NUMBER,"SPARE4]
9CB5ECDD0 41562022 41484352 31283252 29303030 [" VARCHAR2(1000)]
9CB5ECDE0 5053222C 35455241 41562022 41484352 [,"SPARE5" VARCHA]
9CB5ECDF0 31283252 29303030 5053222C 36455241 [R2(1000),"SPARE6]
9CB5ECE00 41442022 20294554 524F5453 20454741 [" DATE) STORAGE ]
9CB5ECE10 4F202028 4F4E4A42 20373320 4E424154 [( OBJNO 37 TABN]
9CB5ECE20 2931204F 554C4320 52455453 4F5F4320 [O 1) CLUSTER C_O]
9CB5ECE30 28234A42 234A424F 03002C29 0239C102 [BJ#(OBJ#),....9.]
......
9CB5EDB90 C10226C1 0102FE26 41455243 55204554 [.&..&...CREATE U]
9CB5EDBA0 5551494E 4E492045 20584544 424F5F49 [NIQUE INDEX I_OB]
9CB5EDBB0 4F20324A 424F204E 4F28244A 52454E57 [J2 ON OBJ$(OWNER]
9CB5EDBC0 414E2C23 4E2C454D 53454D41 45434150 [#,NAME,NAMESPACE]
9CB5EDBD0 4D45522C 4F45544F 52454E57 4E494C2C [,REMOTEOWNER,LIN]
9CB5EDBE0 4D414E4B 55532C45 4D414E42 59542C45 [KNAME,SUBNAME,TY]
9CB5EDBF0 2C234550 52415053 4F2C3345 29234A42 [PE#,SPARE3,OBJ#)]
9CB5EDC00 54435020 45455246 20303120 54494E49 [ PCTFREE 10 INIT]
9CB5EDC10 534E4152 4D203220 52545841 20534E41 [RANS 2 MAXTRANS ]
9CB5EDC20 20353532 524F5453 20454741 49202028 [255 STORAGE ( I]
9CB5EDC30 4954494E 31204C41 4E204B36 20545845 [NITIAL 16K NEXT ]
9CB5EDC40 4B343031 4E494D20 45545845 2053544E [104K MINEXTENTS ]
9CB5EDC50 414D2031 54584558 53544E45 34313220 [1 MAXEXTENTS 214]
9CB5EDC60 33383437 20353436 49544350 4552434E [7483645 PCTINCRE]
9CB5EDC70 20455341 424F2030 204F4E4A 45203733 [ASE 0 OBJNO 37 E]
9CB5EDC80 4E455458 28205354 454C4946 42203120 [XTENTS (FILE 1 B]
9CB5EDC90 4B434F4C 34343320 002C2929 25C10203 [LOCK 344)),....%]
......

大家不难看出,tab$在创建时被指定了object_id=37,而i_obj2 正常情况下的id也应该时37;自然提示对象已经对此,无法创建。导致数据库无法初始化成功。对于一个正常的Oracle 11gR2数据库你看到的情况应该是这样的;

SQL>  select a.OBJ#,b.name,dbms_rowid.rowid_relative_fno(a.rowid)||'_'||dbms_rowid.rowid_block_number(a.rowid)||'_'||dbms_rowid.rowid_row_number(a.rowid) location
2  from BOOTSTRAP$ a,obj$ b where a.obj#=b.obj#
3  order by a.obj#;
OBJ# NAME                           LOCATION
---------- ------------------------------ ---------------------------------
2 C_OBJ#                         1_523_6
3 I_OBJ#                         1_523_7
4 TAB$                           1_523_8
5 CLU$                           1_522_4
6 C_TS#                          1_521_22
7 I_TS#                          1_521_23
8 C_FILE#_BLOCK#                 1_522_9
9 I_FILE#_BLOCK#                 1_522_10
10 C_USER#                        1_522_11
11 I_USER#                        1_522_12
12 FET$                           1_522_14
13 UET$                           1_521_18
14 SEG$                           1_521_21
15 UNDO$                          1_521_7
16 TS$                            1_522_7
17 FILE$                          1_521_15
18 OBJ$                           1_523_0
19 IND$                           1_521_19
20 ICOL$                          1_521_2
21 COL$                           1_522_0
22 USER$                          1_522_18
23 PROXY_DATA$                    1_522_5
24 I_PROXY_DATA$                  1_522_6
25 PROXY_ROLE_DATA$               1_521_12
26 I_PROXY_ROLE_DATA$_1           1_521_13
27 I_PROXY_ROLE_DATA$_2           1_521_14
28 CON$                           1_521_4
29 C_COBJ#                        1_521_10
30 I_COBJ#                        1_521_11
31 CDEF$                          1_523_10
32 CCOL$                          1_522_15
33 I_TAB1                         1_523_9
34 I_UNDO1                        1_521_8
35 I_UNDO2                        1_521_9
36 I_OBJ1                         1_523_1
37 I_OBJ2                         1_523_2
38 I_OBJ3                         1_523_3
39 I_OBJ4                         1_523_4
40 I_OBJ5                         1_523_5
41 I_IND1                         1_521_20
42 I_ICOL1                        1_521_3
43 I_FILE1                        1_521_16
44 I_FILE2                        1_521_17
45 I_TS1                          1_522_8
46 I_USER1                        1_522_19
47 I_USER2                        1_522_20
48 I_COL1                         1_522_1
49 I_COL2                         1_522_2
50 I_COL3                         1_522_3
51 I_CON1                         1_521_5
52 I_CON2                         1_521_6
53 I_CDEF1                        1_523_11
54 I_CDEF2                        1_523_12
55 I_CDEF3                        1_523_13
56 I_CDEF4                        1_523_14
57 I_CCOL1                        1_522_16
58 I_CCOL2                        1_522_17
59 BOOTSTRAP$                     1_522_13

 

很明显这是Oracle bootstrap$被人为破坏了。。。我们有理由相信这又是一起恶意的攻击或者恶作剧破坏。因此,数据库备份是多么的重要!云和恩墨ZDBM数据库备份一体机值得拥有,实时备份,快速切换!

如果遇到类似问题,请紧急联系我司!


评论

发表回复

您的电子邮箱地址不会被公开。 必填项已用 * 标注