[20260715]对象RECO.ORACLE.COM的FULL_HASH_VALUE.txt
--//后记:链接 https://www.anbob.com/archives/9706.html =》High 'latch: shared pool' and 'library cache: mutex X' in
--//Oracle 19c(19.13),我没遇到这类问题，开始仅仅想在21c上查询是否通过hash_value蔡查询找到对应对象,发现无法查询,接着直接
--//通过name='RECO.ORACLE.COM',查询发现hash_value与对方的对不上,不过马上明白问题在那里,因为对方数据库不是cdb,当使用自己
--//写的查询脚本查询时,发现OBJECT_STR=RECO.ORACLE.COM. .CDB$ROOT\x45\0\0\0,(显示含有4个空格),这才想起以前我拿该对象计
--//算过FULL_HASH_VALUE,无论如何组合猜测计算都对不上,或许owner真是4个空格.才有下面详细的分析测试.
--//更正：看了以前的笔记，实际上2017/12/28号就使用hashcat破解过。
--//参考链接 :https://blog.itpub.net/267265/viewspace-2149494/ =>20171228db_link的full_hash_value值的计算
--//链接的查询结果如下:
> select hash_value, addr, owner, name, namespace, type from v$db_object_cache where hash_value in (991821498)
HASH_VALUE ADDR OWNER NAME NAMESPACE TYPE
---------- ---------------- ----- --------------- --------- ----------
991821498 00000000FA5A4168 RECO.ORACLE.COM DBLINK CURSOR
--//按照道理我的测试环境应该也能查询到,并且HASH_VALUE一样.
1.环境：
SYS@book> @ ver2
==============================
PORT_STRING : x86_64/Linux 2.4.xx
VERSION : 21.0.0.0.0
BANNER : Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
BANNER_FULL : Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0
BANNER_LEGACY : Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
CON_ID : 0
PL/SQL procedure successfully completed.
2.问题提出：
SYS@book> select hash_value, addr, owner, name, namespace, type from v$db_object_cache where hash_value =991821498;
no rows selected
--//奇怪无法查询到结果。
SYS@book> select hash_value, addr, owner, name, namespace, type from v$db_object_cache where name='RECO.ORACLE.COM';
HASH_VALUE ADDR OWNER NAME NAMESPACE TYPE
---------- ---------------- ------- --------------- --------- -------
3961707784 00000000707FA920 RECO.ORACLE.COM DBLINK CURSOR
--//很明显19c与21c计算的HASH_VALUE值不同。仔细看发现对方的数据库不是cdb.
3.分析：
SYS@book> @ kglob '' 3961707784 ''
==============================
INST_ID : 1
OWNER :
NAME : RECO.ORACLE.COM
DB_LINK :
NAMESPACE : DBLINK
TYPE : CURSOR
NAMESPACE_NUM : 69
NAMESPACE_HEX : 45
SHARABLE_MEM : 0
PERSISTENT_MEM : 0
RUNTIME_MEM : 0
LOADS : 0
EXECUTIONS : 0
LOCKS : 0
PINS : 0
KEPT : NO
CHILD_LATCH : 56584
INVALIDATIONS : 0
HASH_VALUE : 3961707784
HASH_HEX : ec22dd08
LOCK_MODE : NONE
PIN_MODE : NONE
STATUS : UNKOWN
TIMESTAMP :
PREVIOUS_TIMESTAMP :
LOCKED_TOTAL : 5
PINNED_TOTAL : 0
PROPERTY :
FULL_HASH_VALUE : e9227ddff117c872f0ff6b77ec22dd08
CON_ID : 1
CON_NAME : CDB$ROOT
ADDR : 00000000707FA920
PAR_ADDR : 00000000707FA920
HANDLE_TYPE : parent handle address
KGLOBHD0 : 00
KGLOBHD6 : 00
EDITION :
SQL_ID :
KGL_BUCKET : 56584
OBJECT_STR : RECO.ORACLE.COM. .CDB$ROOT\x45\0\0\0
PL/SQL procedure successfully completed.
--//生成的OBJECT_STR字符串中间有4个空格?到这里才想起以前拿来计算过FULL_HASH_VALUE,总是不对,是否真含有4个空格参与运算.
--//做了几种组合尝试都没有猜对,仔细看看owner到底记录是什么?
SYS@book> select hash_value, addr, owner,dump(owner,16) c20 , name, namespace, type from v$db_object_cache where hash_value =3961707784;
HASH_VALUE ADDR OWNER C20 NAME NAMESPACE TYPE
---------- ---------------- ------- -------------------- --------------- --------- -------
3961707784 00000000707FA920 Typ=1 Len=4: 0,0,0,0 RECO.ORACLE.COM DBLINK CURSOR
--//实际owner实际上保存的不是空格，而是ascii码 chr(0),并且是4个.
SYS@book> select '1'||chr(0)||'2' c10 from dual ;
C10
----------
1 2
$ ~/sqllaji/bin/ext_kglob.sh 00000000707FA920
0x707faae8: "RECO.ORACLE.COM"
--//因为后面跟着chr(0),写的执行脚本输出被截断了。
SYS@book> @ sharepool/shp4 '' 3961707784
SYS@book> @ pr
==============================
HANDLE_TYPE : parent handle address
KGLHDADR : 00000000707FA920
KGLHDPAR : 00000000707FA920
C40 : RECO.ORACLE.COM.
KGLHDLMD : 0
KGLHDPMD : 0
KGLHDIVC : 0
KGLOBHD0 : 00
KGLOBHD6 : 00
KGLOBHS0 : 0
KGLOBHS6 : 0
KGLOBT16 : 0
N0_6_16 : 0
N20 : 0
KGLNAHSH : 3961707784
KGLOBT03 :
KGLHDBID : 56584
KGLOBT09 : 0
PL/SQL procedure successfully completed.
SYS@book> @ ksmsp 00000000707FA920 ''
LOC KSMCHPTR KSMCHIDX KSMCHDUR KSMCHCOM KSMCHSIZ KSMCHCLS KSMCHTYP KSMCHPAR KSMCHPTR_BEGIN KSMCHPTR_END+1 HEAP_DESC
--- ---------------- ---------- ---------- ---------------- ---------- -------- ---------- ---------------- ---------------- ----------------- -------------------------
SGA 00000000707FA8F0 1 1 KGLHD 3888 recr 80 00 00000000707FA8F0 00000000707FB820
--//到处对象的chunk,看看具体的内容.
SYS@book> @ opeekz 00000000707FA8F0 3888 1
New tracefile_identifier = /u01/app/oracle/diag/rdbms/book/book/trace/book_ora_4203_0001.trc
[0707FA8F0, 0707FB820) = 00000F31 80B38F00 707FA5C0 00000000 69AF8738 00000000 6896D470 00000000 7E11E130 00000000 00000001 00000050 752D7C90 00000000 ...
--//查看跟踪文件，发现如下内容：
....
0707FAAE0 00000000 00000000 4F434552 41524F2E [........RECO.ORA]
0707FAAF0 2E454C43 004D4F43 43000000 52244244 [CLE.COM....CDB$R]
0707FAB00 00544F4F 00000000 00000000 00000000 [OOT.............]
0707FAB10 00000000 00000000 00000000 00000000 [................]
--//参与运算的字符串改写如下,注意使用单引号,因为字符串里面存在$ROOT,否则当作bash shell变量处理.
$ sql_idz.sh 'RECO.ORACLE.COM.\0\0\0\0.CDB$ROOT\x45\0\0\0' 3
sql_text = RECO.ORACLE.COM.\0\0\0\0.CDB$ROOT\x45\0\0\0
full_hash_value(16) = E9227DDFF117C872F0FF6B77EC22DD08 or e9227ddff117c872f0ff6b77ec22dd08
xxxxx_matching_signature(10) = -1081027222738641656 or 17365716850970909960
hash_value(10) = 3961707784 or hash_value(16) = EC22DD08 or ec22dd08
kgl_backet(10) = 56584 or kgl_bucket(16) = DD08 or dd08
sql_id(16) = F0FF6B77EC22DD08 or f0ff6b77ec22dd08
sql_id(32) = g1zvbfzq25r88
sql_id(32) = g1zvbfzq25r88
sql_id(32) = g1zvbfzq25r88
--//注：\x45\0\0\0 对应NAMESPACE。十进制69.
--//对方的数据库没有使用pdb，要删除con_name.
$ sql_idz.sh 'RECO.ORACLE.COM.\0\0\0\0\x45\0\0\0' 3
sql_text = RECO.ORACLE.COM.\0\0\0\0\x45\0\0\0
full_hash_value(16) = 022BFB39389939832AAA659C3B1DFEBA or 022bfb39389939832aaa659c3b1dfeba
xxxxx_matching_signature(10) = 3074381417314909882 or 21521125491024461498
hash_value(10) = 991821498 or hash_value(16) = 3B1DFEBA or 3b1dfeba
kgl_backet(10) = 130746 or kgl_bucket(16) = 1FEBA or 1feba
sql_id(16) = 2AAA659C3B1DFEBA or 2aaa659c3b1dfeba
sql_id(32) = 2pam5mhxjvzpu
sql_id(32) = 2pam5mhxjvzpu
sql_id(32) = 2pam5mhxjvzpu
--//这样就完全对上了,实际上是4个chr(0).
--//当时11g为什么没有计算正确呢,在11g下的看再次验证看看.
4.补充测试:
--//在11g测试看看.
SCOTT@book> @ ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.4.0 Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
SCOTT@book> select hash_value, owner,dump(owner,16) c20 , name, namespace, type from v$db_object_cache where hash_value =991821498;
HASH_VALUE OWNER C20 NAME NAMESPACE TYPE
---------- --------- ------- ---------------- ---------- --------
991821498 NULL RECO.ORACLE.COM DBLINK CURSOR
--//11g下owner=NULL,怪不得当时什么猜测都是不对.
$ sql_idz.sh 'RECO.ORACLE.COM.\0\0\0\0\x45\0\0\0' 3
sql_text = RECO.ORACLE.COM.\0\0\0\0\x45\0\0\0
full_hash_value(16) = 022BFB39389939832AAA659C3B1DFEBA or 022bfb39389939832aaa659c3b1dfeba
xxxxx_matching_signature(10) = 3074381417314909882 or 21521125491024461498
hash_value(10) = 991821498 or hash_value(16) = 3B1DFEBA or 3b1dfeba
kgl_backet(10) = 130746 or kgl_bucket(16) = 1FEBA or 1feba
sql_id(16) = 2AAA659C3B1DFEBA or 2aaa659c3b1dfeba
sql_id(32) = 2pam5mhxjvzpu
sql_id(32) = 2pam5mhxjvzpu
sql_id(32) = 2pam5mhxjvzpu
--//这样就完全对上了,也就是计算包括owner=NULL,实际上是4个chr(0).
SYS@book> @ kglob '' 991821498 ''
==============================
INST_ID : 1
OWNER :
NAME : RECO.ORACLE.COM
DB_LINK :
NAMESPACE_NUM : DBLINK
NAMESPACE_HEX : 45
TYPE : CURSOR
SHARABLE_MEM : 0
PERSISTENT_MEM : 0
RUNTIME_MEM : 0
LOADS : 0
EXECUTIONS : 0
LOCKS : 0
PINS : 0
KEPT : NO
CHILD_LATCH : 130746
INVALIDATIONS : 0
HASH_VALUE : 991821498
HASH_HEX : 3b1dfeba
LOCK_MODE : NONE
PIN_MODE : NONE
STATUS : UNKOWN
TIMESTAMP :
PREVIOUS_TIMESTAMP :
LOCKED_TOTAL : 10
PINNED_TOTAL : 0
PROPERTY :
FULL_HASH_VALUE : 022bfb39389939832aaa659c3b1dfeba
ADDR : 000000008851FE60
PAR_ADDR : 000000008851FE60
HANDLE_TYPE : parent handle address
KGLOBHD0 : 00
KGLOBHD6 : 00
SQL_ID :
KGL_BUCKET : 130746
OBJECT_STR : RECO.ORACLE.COM
PL/SQL procedure successfully completed.
--//sql_idz.sh的脚本来源源代码看以前的链接，不再贴出。
--//下载链接:https://www.cnblogs.com/lfree/p/18199806
5.疑问：
--//回到21c。
--//为什么存在这样一个dblink的对象RECO.ORACLE.COM，oracle拿它做什么呢？
--//检查其它机器视乎每台机器都有一个RECO.ORACLE.COM的dblink,查询根本看不到.
--//直接查询x$kglob可以发现KGLNAOBJ=RECO.ORACLE.COM的有3个。
SYS@book> SELECT KGLHDNSP ,kglnaown,dump(kglnaown,16) c20 ,kglnaobj,kglnahsv,kglobtyd,con_id FROM x$kglob where kglhdnsd='DBLINK' and KGLHDNSP=69;
KGLHDNSP KGLNAOWN C20 KGLNAOBJ KGLNAHSV KGLOBTYD CON_ID
---------- -------- -------------------- --------------- -------------------------------- --------- ------
69 Typ=1 Len=4: 0,0,0,0 RECO.ORACLE.COM e9227ddff117c872f0ff6b77ec22dd08 CURSOR 1
69 Typ=1 Len=4: 1,0,0,0 RECO.ORACLE.COM 7f0d14c2cc16340bbedccd722d28ea07 CURSOR 1
69 Typ=1 Len=4: 0,0,0,0 RECO.ORACLE.COM e817d5f576852131f2c7e6d79c7d3a2f CURSOR 3
--//换成pdb name带入。
$ sql_idz.sh 'RECO.ORACLE.COM.\0\0\0\0.BOOK01P\x45\0\0\0' 3
sql_text = RECO.ORACLE.COM.\0\0\0\0.BOOK01P\x45\0\0\0
full_hash_value(16) = E817D5F576852131F2C7E6D79C7D3A2F or e817d5f576852131f2c7e6d79c7d3a2f
xxxxx_matching_signature(10) = -952538982447760849 or 17494205091261790767
hash_value(10) = 2625452591 or hash_value(16) = 9C7D3A2F or 9c7d3a2f
kgl_backet(10) = 80431 or kgl_bucket(16) = 13A2F or 13a2f
sql_id(16) = F2C7E6D79C7D3A2F or f2c7e6d79c7d3a2f
sql_id(32) = g5jz6uyf7ufjg
sql_id(32) = g5jz6uyf7ufjg
sql_id(32) = g5jz6uyf7ufjg
--//cdb下还存在一个kglnaown是\x1\0\0\0的对象。
$ sql_idz.sh 'RECO.ORACLE.COM.\01\0\0\0.CDB$ROOT\x45\0\0\0' 3
sql_text = RECO.ORACLE.COM.\01\0\0\0.CDB$ROOT\x45\0\0\0
full_hash_value(16) = 7F0D14C2CC16340BBEDCCD722D28EA07 or 7f0d14c2cc16340bbedccd722d28ea07
xxxxx_matching_signature(10) = -4693650821359277561 or 13753093252350274055
hash_value(10) = 757656071 or hash_value(16) = 2D28EA07 or 2d28ea07
kgl_backet(10) = 59911 or kgl_bucket(16) = EA07 or ea07
sql_id(16) = BEDCCD722D28EA07 or bedccd722d28ea07
sql_id(32) = bxr6df8qkjuh7
sql_id(32) = bxr6df8qkjuh7
sql_id(32) = bxr6df8qkjuh7
$ sql_idz.sh 'RECO.ORACLE.COM.\x1\0\0\0.CDB$ROOT\x45\0\0\0' 3
sql_text = RECO.ORACLE.COM.\x1\0\0\0.CDB$ROOT\x45\0\0\0
full_hash_value(16) = 7F0D14C2CC16340BBEDCCD722D28EA07 or 7f0d14c2cc16340bbedccd722d28ea07
xxxxx_matching_signature(10) = -4693650821359277561 or 13753093252350274055
hash_value(10) = 757656071 or hash_value(16) = 2D28EA07 or 2d28ea07
kgl_backet(10) = 59911 or kgl_bucket(16) = EA07 or ea07
sql_id(16) = BEDCCD722D28EA07 or bedccd722d28ea07
sql_id(32) = bxr6df8qkjuh7
sql_id(32) = bxr6df8qkjuh7
sql_id(32) = bxr6df8qkjuh7
--//注：16进制写成\x01不对，8进制写成\1也不对.
--// 16进制写成\x1 , 8进制写成\01 , 不然计算结果对不上.
--//看了以前笔记x$kglob的字段KGLNAOWN不是建立的owner,不知道oracle为什么这样设置.
来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/267265/viewspace-3176619/ ，如需转载，请注明出处，否则将追究法律责任。
最新文章
- [20261008]验证Shared Memory Segments key以及Semaphore Arrays Key(11g).txt
- [20261008]gdb引入结构体是否可行.txt
- [20261008]bpftrace定义结构体例子.txt
- [20261007]关于oracle sskgph2函数.txt
- [20261007]oracle Semaphore Arrays Key值的冲突.txt
- [20261004]oracle sskgph2函数等价c以及python脚本.txt
- [20261004]bpftrace查看oracle函数调用堆栈问题.txt
- [20261002]验证sskgphpjw函数参与运算的字符串是否存在规律.txt
- [20261002]oracle Semaphore Arrays Key值的计算2.txt
- [20261001]oracle Semaphore Arrays Key值的计算.txt
