适用范围

Oracle Database - Enterprise Edition - Version 11.2.0.4

问题概述

ORA-00600: internal error code, arguments: [16703], [1403], [20]

问题原因

1). 非官方途径下载的数据库软件
2). 破解版plsql/toad运维工具
数据库软件被注入恶意代码，定期删除数据库基表 tab$

解决方案

### 1. delete boorstrap i_tab1
startup mount
set linesize 200 pagesize 9999
col name for a60
select file#,name from v$datafile_header where ts#=0 order by file# asc;
shutdown abort
cat listfile.txt

set dba 1,523
p *kdbr[9]
x /rnnc
m /x 3c offset 4910
assign kdbh.kdbhavsp=3722
assign kdbh.kdbhtosp=3724
sum apply 
v
p *kdbr[9]
x /rnnc

### 2. undel tab
[root@orcldb xdul]# cat control.txt 
/oradata/orcl/system01.dbf
/oradata/orcl/system02.dbf
/oradata/orcl/system03.dbf
[root@orcldb xdul]# ./xdul
XDUL>undel tab

dbv file=/oradata/orcl/system01.dbf
dbv file=/oradata/orcl/system02.dbf
dbv file=/oradata/orcl/system03.dbf

### 3. open db
### 禁用trigger参数
*._system_trig_enabled=false
*.job_queue_processes=0

sqlplus / as sysdba
SQL> startup pfile='/home/oracle/pfile.ora'
ORACLE instance started.

Total System Global Area 3123322880 bytes
Fixed Size                  2257312 bytes
Variable Size             721423968 bytes
Database Buffers         2382364672 bytes
Redo Buffers               17276928 bytes
Database mounted.
Database opened.
SQL>

drop procedure DBMS_SUPPORT_DBMONITORP;
drop trigger DBMS_SUPPORT_DBMONITOR;
drop PACKAGE DBMS_SUPPORT;
replace $ORACLE_HOME/rdbms/admin/prvtsupp.plb

select obj#,dataobj#,owner#,name from obj$ where name like 'ORACHK%';

insert into tab$ select * from  (
select * from ORACHK2BE4B6ABB3416B12BE4B6AB 
where obj# in (select obj# from ORACHK2BE4B6ABB3416B12BE4B6AB where obj#<>23750 minus select obj# from tab$)
);

参考文档

### 数据恢复：被注入的软件及 ORA-600 16703 灾难的恢复
https://www.modb.pro/db/19154