[20260901]建立完善md5sum.bt脚本.txt

[20260901]建立完善md5sum.bt脚本.txt

--//拿以前别人写的md5.gdb脚本，抽取计算MD5的字符串，根据其脚本写一个bpftrace脚本。

1.环境：
SCOTT@book01p> @ ver2
==============================
PORT_STRING                   : x86_64/Linux 2.4.xx
VERSION                       : 21.0.0.0.0
BANNER                        : Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
BANNER_FULL                   : Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0
BANNER_LEGACY                 : Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
CON_ID                        : 0
PL/SQL procedure successfully completed.

2.建立bpftrace脚本：
--//主要部分，gdb脚本如下：
break kggmd5Update
  commands
    printf "Length: %d\n",$rdx
    x/40xc $rsi
    c
  end

按 x86-64 System V ABI：

参数位置       寄存器
第 1 个        RDI
第 2 个        RSI
第 3 个        RDX
第 4 个        RCX
第 5 个        R8
第 6 个        R9
第 7 个及以上  栈(从右向左依次压入)

--//$ rdx对应arg2 ,$rsi对应参数1, bpftrace参数从0开始。

--//建立脚本如下,后续补充增加hash值的显示，后面的输出没有显示出来：
$ cat md5sum.bt
BEGIN
{
    printf("Tracing Oracle kggmd5Update... Target PID: %d\n", $1);
    printf("Hit Ctrl-C to stop.\n\n");
}

uprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:kggmd5Finish
/ $1 == 0 || pid == $1 /
{
    @is_fin[pid] = 1;
//    printf("\nkggmd5Finish Begin\n");
}

uretprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:kggmd5Finish
/ $1 == 0 || pid == $1 /
{
    delete(@is_fin[pid]);
//    printf("kggmd5Finish End\n");
}

uprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:kglComputeHash0
/ $1 == 0 || pid == $1 /
{
    printf("\nkglComputeHash0 Begin\n");
}

uretprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:kglComputeHash0
/ $1 == 0 || pid == $1 /
{
    printf("\033[1;31m[%s] kglComputeHash0 #%02d pid=%d return hash_valuer=%08lx %lu \033[0m\n", strftime("%H:%M:%S", nsecs), @kgg, pid,retval,retval);
    //printf("[%s] kglComputeHash0 #%02d pid=%d return hash_valuer=%08lx %lu\n", strftime("%H:%M:%S", nsecs), @kgg, pid,retval,retval);
    printf("kglComputeHash0 End\n");
}

uprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:kggmd5Update
/ $1 == 0 || pid == $1 /
{
    @kgg++;
    @is_kgg[pid] = 1;
    if (@is_fin[pid] != 1 ){
        printf("[%s] kggmd5Update #%02d pid=%d ptr=%016lx hash_text=%s length=%d\n", strftime("%H:%M:%S", nsecs), @kgg, pid,arg1,buf(arg1,arg2), arg2);
    }
}

// uretprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:kggmd5Update
// / $1 == 0 || pid == $1 /
// {
//     if (@is_kgg[pid] == 1) {
//         printf("[%s] kggmd5Update #%02d pid=%d return hash_value=%016lx %lu\n", strftime("%H:%M:%S", nsecs), @kgg,pid, retval, retval);
//         delete(@is_kgg[pid]);
//     }
// }

END
{
    printf("\nTotal kggmd5Update: %d\n", @kgg);
    delete(@kgg);

}

3.测试:
SCOTT@book01p> seLECT * FROM DEPT where deptno=20;

    DEPTNO DNAME                          LOC
---------- ------------------------------ -------------
        20 RESEARCH                       DALLAS


# bpftrace md5sum.bt 3106
Attached 7 probes
Tracing Oracle kggmd5Update... Target PID: 3106
Hit Ctrl-C to stop.

[16:16:29] kggmd5Update #01 pid=3106 ptr=00007fff4200b6c8 hash_text=seLECT * FROM DEPT where deptno=20\x00 length=35
--//sql语句的计算就是在原来基础上加\x00.

kglComputeHash0 Begin
[16:16:29] kggmd5Update #04 pid=3106 ptr=00007fff42008530 hash_text=6dfe47c3aab33ebe7601ce726269ac88 length=32
[16:16:29] kggmd5Update #05 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #06 pid=3106 ptr=00000000169340b0 hash_text=$BUILD$ length=7
[16:16:29] kggmd5Update #07 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #08 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #09 pid=3106 ptr=00007fff42007cf0 hash_text=R\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #12 pid=3106 ptr=00007fff42006730 hash_text=6dfe47c3aab33ebe7601ce726269ac88 length=32
[16:16:29] kggmd5Update #13 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #14 pid=3106 ptr=00007fff4200675c hash_text=Child:0 length=7
[16:16:29] kggmd5Update #15 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #16 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #17 pid=3106 ptr=00007fff420055a0 hash_text=K\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #20 pid=3106 ptr=00007fff420065a6 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #21 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #22 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #23 pid=3106 ptr=00007fff42005cc0 hash_text=I\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #26 pid=3106 ptr=00007fff42007266 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #27 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #28 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #29 pid=3106 ptr=00007fff42006980 hash_text=I\x00\x00\x00 length=4
kglComputeHash0 End
--//计算2次,为什么?

kglComputeHash0 Begin
[16:16:29] kggmd5Update #32 pid=3106 ptr=00007fe643f935de hash_text=DEPT length=4
[16:16:29] kggmd5Update #33 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #34 pid=3106 ptr=00007fff41ffca72 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #35 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #36 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #37 pid=3106 ptr=00007fff41ffb530 hash_text=\x01\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #40 pid=3106 ptr=00000000696165b0 hash_text=DEPT length=4
[16:16:29] kggmd5Update #41 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #42 pid=3106 ptr=00000000696165b4 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #43 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #44 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #45 pid=3106 ptr=00007fff41ffbe10 hash_text=\x01\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #48 pid=3106 ptr=00000000696165b0 hash_text=DEPT length=4
[16:16:29] kggmd5Update #49 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #50 pid=3106 ptr=00000000696165b4 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #51 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #52 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #53 pid=3106 ptr=00007fff41ffbe10 hash_text=\x01\x00\x00\x00 length=4
kglComputeHash0 End
--//拼接在一起字符串就是DEPT.SCOTT.BOOK01P\x01\x00\x00\x00
$ sql_idz.sh "DEPT.SCOTT.BOOK01P\x01\x00\x00\x00" 3
sql_text = DEPT.SCOTT.BOOK01P\x01\x00\x00\x00
full_hash_value(16) = 05DB243908B3C797B99628590EDB820C or 05db243908b3c797b99628590edb820c
xxxxx_matching_signature(10) = -5073823567219817972 or  13372920506489733644
hash_value(10) = 249266700 or hash_value(16) = 0EDB820C or 0edb820c
kgl_backet(10) = 98828 or kgl_bucket(16) =  1820C or 1820c
sql_id(16) = B99628590EDB820C or b99628590edb820c
sql_id(32) = bm5j8b47dr0hc
sql_id(32) = bm5j8b47dr0hc
sql_id(32) = bm5j8b47dr0hc

SYS@book> @ sharepool/shp4 '' 249266700
HANDLE_TYPE            KGLHDADR         KGLHDPAR         C40          KGLHDLMD   KGLHDPMD   KGLHDIVC KGLOBHD0         KGLOBHD6           KGLOBHS0   KGLOBHS6   KGLOBT16   N0_6_16                   N20   KGLNAHSH KGLOBT03        KGLHDBID   KGLOBT09
---------------------- ---------------- ---------------- ---------- ---------- ---------- ---------- ---------------- ---------------- ---------- ---------- ---------- --------- --------------------- ---------- ------------- ---------- ----------
parent handle address  00000000696163E8 00000000696163E8 DEPT.SCOTT          0          0          0 0000000069615CF8 00                     4064          0          0      4064                  4064  249266700                    98828          0
--//对应的对象就是表的chunk.

kglComputeHash0 Begin
[16:16:29] kggmd5Update #56 pid=3106 ptr=00000000696165b0 hash_text=DEPT length=4
[16:16:29] kggmd5Update #57 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #58 pid=3106 ptr=00000000696165b4 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #59 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #60 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #61 pid=3106 ptr=00007fff41ffbe10 hash_text=\x01\x00\x00\x00 length=4
kglComputeHash0 End
[16:16:29] kggmd5Update #64 pid=3106 ptr=00007fe640fe80d0 hash_text=SELECT * FROM DEPT WHERE DEPTNO = 20 length=36
[16:16:29] kggmd5Update #67 pid=3106 ptr=00007fe643f9d750 hash_text=SELECT * FROM DEPT WHERE DEPTNO = :"SYS_B_0" length=44
--//这里应该用于计算EXACT_MATCHING_SIGNATURE,FORCE_MATCHING_SIGNATURE.

kglComputeHash0 Begin
[16:16:29] kggmd5Update #70 pid=3106 ptr=00007fff41ffdc60 hash_text=DEPT length=4
[16:16:29] kggmd5Update #71 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #72 pid=3106 ptr=00007fff41ffddc6 hash_text=SCOTT length=5
[16:16:29] kggmd5Update #73 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #74 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #75 pid=3106 ptr=00007fff41ffced0 hash_text=\x01\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #78 pid=3106 ptr=00007fff42006810 hash_text=356430430180546253 length=18
[16:16:29] kggmd5Update #79 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #80 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #81 pid=3106 ptr=00007fff42005ba0 hash_text=h\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #84 pid=3106 ptr=00007fff42005f38 hash_text=7574277674127661070 length=19
[16:16:29] kggmd5Update #85 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #86 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #87 pid=3106 ptr=00007fff42005660 hash_text=\x89\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #90 pid=3106 ptr=00007fff42006008 hash_text=4204170303842060717 length=19
[16:16:29] kggmd5Update #91 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #92 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #93 pid=3106 ptr=00007fff42005730 hash_text=\x89\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #96 pid=3106 ptr=00007fff42006008 hash_text=5467474030038125289 length=19
[16:16:29] kggmd5Update #97 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #98 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #99 pid=3106 ptr=00007fff42005730 hash_text=\x89\x00\x00\x00 length=4
kglComputeHash0 End

kglComputeHash0 Begin
[16:16:29] kggmd5Update #102 pid=3106 ptr=00007fff42006478 hash_text=7574277674127661070 length=19
[16:16:29] kggmd5Update #103 pid=3106 ptr=00000000154f4ffc hash_text=. length=1
[16:16:29] kggmd5Update #104 pid=3106 ptr=000000007e745ccc hash_text=BOOK01P length=7
[16:16:29] kggmd5Update #105 pid=3106 ptr=00007fff42005ba0 hash_text=\x89\x00\x00\x00 length=4
kglComputeHash0 End