--session 1
sqlplus scott/oracle
select header_file,header_block from dba_segments where segment_name='SYSTEM';
HEADER_FILE HEADER_BLOCK
----------- ------------
1 128
drop table t1;
create table t1 as select * from dba_objects where rownum <10;
select dbms_rowid.rowid_relative_fno(rowid) fno,dbms_rowid.rowid_block_number(rowid) blk#,dbms_rowid.rowid_row_number(rowid) row#,object_id from t1;
FNO BLK# ROW# OBJECT_ID
---------- ---------- ---------- ----------
7 387 0 16
7 387 1 20
7 387 2 8
7 387 3 37
7 387 4 22
7 387 5 33
7 387 6 40
7 387 7 31
7 387 8 41
9 rows selected.
delete from t1 where rownum <5;
set linesize 1000
select XIDUSN,xidslot,xidsqn,ubablk,ubafil,ubarec,xid from v$transaction;
XIDUSN XIDSLOT XIDSQN UBABLK UBAFIL UBAREC XID
---------- ---------- ---------- ---------- ---------- ---------- ----------------
1 10 996 1557 4 4 01000A00E4030000
--session 2:
alter system checkpoint;
shutdown abort
--session 3:
BBED> set dba 1,128
DBA 0x00400080 (4194432 1,128)
BBED> p ktuxc
struct ktuxc, 104 bytes @4148
struct ktuxcscn, 8 bytes @4148
ub4 kscnbas @4148 0x00223b63
ub2 kscnwrp @4152 0x0000
ub2 kscnwrp2 @4154 0x0000
struct ktuxcuba, 8 bytes @4156
ub4 kubadba @4156 0x00400225
ub2 kubaseq @4160 0x002e
ub1 kubarec @4162 0x1b
sb2 ktuxcflg @4164 1 (KTUXCFSK)
ub2 ktuxcseq @4166 0x002e
sb2 ktuxcnfb @4168 1
ub4 ktuxcinc @4172 0x00000000
sb2 ktuxcchd @4176 33
sb2 ktuxcctl @4178 37
ub2 ktuxcmgc @4180 0x8002
ub4 ktuxcopt @4188 0x7ffffffe
struct ktuxcfbp[0], 12 bytes @4192
struct ktufbuba, 8 bytes @4192
ub4 kubadba @4192 0x00400225 --查看看这个
ub2 kubaseq @4196 0x002e
ub1 kubarec @4198 0x1b
sb2 ktufbext @4200 4
sb2 ktufbspc @4202 3060
.........
BBED> set dba 0x00400225
DBA 0x00400225 (4194853 1,549)
BBED> p ktubh
struct ktubh, 70 bytes @20
struct ktubhxid, 8 bytes @20
ub2 kxidusn @20 0x0000
ub2 kxidslt @22 0x0025
ub4 kxidsqn @24 0x0000001e
ub2 ktubhseq @28 0x002e
ub1 ktubhcnt @30 0x1b
ub1 ktubhirb @31 0x1b
ub1 ktubhicl @32 0x00
ub1 ktubhflg @33 0x00
modify /x 3e offset 28
sum apply
--启动报错
ORA-00603: ORACLE server session terminated by fatal error
ORA-01092: ORACLE instance terminated. Disconnection forced
ORA-00600: internal error code, arguments: [4193], [62], [46], [], [], [], [],
[], [], [], [], []
Process ID: 6743
Session ID: 261 Serial number: 61411
--10046跟踪：
SQL> startup mount
ORACLE instance started.
Total System Global Area 3724540384 bytes
Fixed Size 8903136 bytes
Variable Size 721420288 bytes
Database Buffers 2986344448 bytes
Redo Buffers 7872512 bytes
Database mounted.
SQL> oradebug setmypid
Statement processed.
SQL> oradebug tracefile_name
/home/oracle/19c/diag/rdbms/ora19c/ora19c/trace/ora19c_ora_7311.trc
SQL> oradebug event 10046 trace name context forever,level 12;
Statement processed.
SQL> alter database open;
--查看10046,搜索undo$：
cat ora19c_ora_7311.trc | grep 'undo\$'
select us#, status$ from undo$ where status$ in (3, 5, 6) and us# > 0
select /*+ rule */ name,file#,block#,status$,user#,undosqn,xactsqn,scnbas,scnwrp,DECODE(inst#,0,NULL,inst#),ts#,spare1 from undo$ where us#=:1
update /*+ rule */ undo$ set name=:2,file#=:3,block#=:4,status$=:5,user#=:6,undosqn=:7,xactsqn=:8,scnbas=:9,scnwrp=:10,inst#=:11,ts#=:12,spare1=:13 where us#=:1
--cat 10046 trc:
update /*+ rule */ undo$ set name=:2,file#=:3,block#=:4,status$=:5,user#=:6,undosqn=:7,xactsqn=:8,scnbas=:9,scnwrp=:10,inst#=:11,ts#=:12,spare1=:13 where us#=:1
END OF STMT
PARSE #140402489361296:c=8855,e=9224,p=14,cr=181,cu=0,mis=1,r=0,dep=1,og=3,plh=0,tim=2563408484
BINDS #140402489361296:
Bind#0
oacdty=01 mxl=32(20) mxlc=00 mal=00 scl=00 pre=00
oacflg=18 fl2=0001 frm=01 csi=873 siz=32 off=0
kxsbbbfp=7dc7328a bln=32 avl=20 flg=09
value="_SYSSMU1_1261223759$" --这里的bind#0就是上面的 :2
Bind#1
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=1000001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7fb2008cba80 bln=24 avl=02 flg=05
value=4
Bind#2
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=1000001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7fb2008cba50 bln=24 avl=03 flg=05
value=128
.....
Bind#12
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=1000001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7fb2008cbab0 bln=22 avl=02 flg=05
value=1
WAIT #140402489361296: nam='db file sequential read' ela= 5 file#=1 block#=549 blocks=1 obj#=0 tim=2563409168
2025-07-02T21:05:11.617837+08:00
Incident 23329 created, dump file: /home/oracle/19c/diag/rdbms/ora19c/ora19c/incident/incdir_23329/ora19c_ora_7311_i23329.trc
ORA-00600: internal error code, arguments: [4193], [62], [46], [], [], [], [], [], [], [], [], []
--正常情况下，我们遇到的生产环境，可能不像我们模拟的这样，你改回原状态就行了，可能需要对undo 进行一些处理
--实际上当明自undo segment header和undo block的结构之后，我们还可以用其他的方法来欺骗oracle.
--大家可以想一想，既然oracle在open之前会更新undo$基表，需要用通过undo segmnet header中的free block pool中定位undo block.
--发现free block pool中的undo block(uba)的seq值跟 引用的undo block(这个block中的)seq值不匹配，就报错。
--既然是从free blockpool中获得，那么我们就假设free block pool中没有可用的block，让oracle去使用其他的新的undo block,
--当然这样的目的是要丢弃掉当前free block pool 中的这个undo block，哪怕是这个block只用了一丁点。
--如何让oracle 认为当前free block pool中没有可用的undo block了? 很简单，把uba地址改成0x00800080就行了。
BBED> set dba 1,128
BBED> p ktuxc
struct ktuxc, 104 bytes @4148
struct ktuxcscn, 8 bytes @4148
ub4 kscnbas @4148 0x00223b63
ub2 kscnwrp @4152 0x0000
ub2 kscnwrp2 @4154 0x0000
struct ktuxcuba, 8 bytes @4156
ub4 kubadba @4156 0x00400225
ub2 kubaseq @4160 0x002e
ub1 kubarec @4162 0x1b
sb2 ktuxcflg @4164 1 (KTUXCFSK)
ub2 ktuxcseq @4166 0x002e
sb2 ktuxcnfb @4168 1 --这里修改成0
ub4 ktuxcinc @4172 0x00000000
sb2 ktuxcchd @4176 33
sb2 ktuxcctl @4178 37
ub2 ktuxcmgc @4180 0x8002
ub4 ktuxcopt @4188 0x7ffffffe
struct ktuxcfbp[0], 12 bytes @4192
struct ktufbuba, 8 bytes @4192
ub4 kubadba @4192 0x00400225 --这里修改成0
ub2 kubaseq @4196 0x002e
ub1 kubarec @4198 0x1b
sb2 ktufbext @4200 4
sb2 ktufbspc @4202 3060
struct ktuxcfbp[1], 12 bytes @4204
struct ktufbuba, 8 bytes @4204
ub4 kubadba @4204 0x00000000
ub2 kubaseq @4208 0x002d
ub1 kubarec @4210 0x41
sb2 ktufbext @4212 3
sb2 ktufbspc @4214 1280
struct ktuxcfbp[2], 12 bytes @4216
struct ktufbuba, 8 bytes @4216
ub4 kubadba @4216 0x00000000
ub2 kubaseq @4220 0x002a
ub1 kubarec @4222 0x3d
sb2 ktufbext @4224 0
sb2 ktufbspc @4226 1944
struct ktuxcfbp[3], 12 bytes @4228
struct ktufbuba, 8 bytes @4228
ub4 kubadba @4228 0x00000000
ub2 kubaseq @4232 0x0000
ub1 kubarec @4234 0x00
sb2 ktufbext @4236 0
sb2 ktufbspc @4238 0
struct ktuxcfbp[4], 12 bytes @4240
struct ktufbuba, 8 bytes @4240
ub4 kubadba @4240 0x00000000
ub2 kubaseq @4244 0x0000
ub1 kubarec @4246 0x00
sb2 ktufbext @4248 0
sb2 ktufbspc @4250 0
modify /x 00 offset 4168
modify /x 000000 offset 4192 --注意这里是6个0
sum apply
----session 3:
startup
SQL> select count(1) from scott.t1; --之前删除的未提交，数据还是9条
COUNT(1)
----------
9
SQL>
「喜欢这篇文章，您的关注和赞赏是给作者最好的鼓励」
关注作者
【版权声明】本文为墨天轮用户原创内容，转载时必须标注文章的来源（墨天轮），文章链接，文章作者等基本信息，否则作者和墨天轮有权追究责任。如果您发现墨天轮中有涉嫌抄袭或者侵权的内容，欢迎发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。
