Random notes about reverse engineering, security research, Oracle RDBMS internals, and so on...

Intel(R) C++?

I'm not sure, which C compiler was used to compile Oracle 11.1.0.6.0 win32 (maybe Intel(R) C++ 9.1, which is used for 11.1.0.6.0 Linux), but it generate some strange things:

.text:0051FBF8 85 C0                             test    eax, eax
.text:0051FBFA 0F 84 8F 00 00 00                 jz      loc_51FC8F
.text:0051FC00 74 1D                             jz      short loc_51FC1F

(This code is from Oracle 11.1.0.6.0 Win32 CPUjul2008)

Network trace in Oracle RDBMS

There're well-known parameters trace_level_server and trace_level_client in sqlnet.ora, which are defining debugging level of trace files.
A lot of network functions may call a special trace writer function which put passed information into trace file.
Usually, software developer with common sense makes trace writer function checking current debug level and let this tracer writer decide if to write any information to file. In this case his code is relatively clean and clear.

malloc() comments

It is clever idea used in Oracle RDBMS, where, in complex memory control environment, there are a presence of different malloc()-like functions.
Major portion of these malloc()-like functions also have comment-parameter, where caller pass short human-readable parameter, describing, for what this memory will be used.
After that, at any point of program execution, it is possible to see statistics, what are major memory consumers.
Also, in case of memory leakage, it is possible to see, what memory were not freed.

Solving Oracle passwords hashes using FPGA.

I tried to use FPGA in quick search of original Oracle RDBMS account passwords extracting their hash values from database.
Relatively simple hashing algorithm used there, involving DES crypto algorithm.
I used three FPGA developer kits for this.

Evolution

It seems, Oracle written in C with rich use of global variables.

Evolution of oracle.exe executable for win32:

8.0.5: ~16k functions and ~600 global variables.
8.1.5: ~18k functions and ~4k global variables.
8.1.7.4: ~22k functions and ~4.5k global variables.
9.0.1.1.1: ~31k functions and ~6k global variables.
9.2.0.4: ~45k functions and ~8k global variables.
10.1.0.5: ~60k functions and ~11k global variables.
10.2.0.3: ~72k functions and ~11k gloval variables.
11.1.0.6.0: ~113k functions and ~17k global variables.

_disable_txn_alert undocumented parameter in Oracle 11g

About _disable_txn_alert undocumented parameter - at least as for Oracle 11g win32.

This parameter is connected with ktsmgd_ global variable.

This variable is actually bitmap.
Default value is 0.
Bits which are checked within Oracle 11g processes: 1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200.

0x1: if it is set, ktuilqa() function will not execute.
0x2: if it is set, ktrsiosa() function will not execute.
0x4: if set: write some debug info to trace file using ksdwrf() function.

Oracle V$TIMER

On different OS, Oracle V$TIMER system value shows different values.
On Microsoft Windows (we tested Oracle 8.0.5, 8.1.5, 9.0.1.1.1, 9.2.0.1, 10.1.0.2, 10.2.0.1, 10.2.0.1 x64, 11.1.0.6.0 and 11.1.0.6.0 x64) this value is exactly what system call GetTickCount() returning divided by 10.
On GNU/Linux (we tested 10.1.0.3, 10.2.0.1, 11.1.0.6.0 and 11.1.0.6.0 x64) this is exactly what times() system call returning.

Syndicate content