Method for analyzing and recovering backup of Oracle data pump

Abstract

The invention discloses a method for analyzing and recovering an Oracle data pump backup. The method is characterized by comprising the following steps that S100, the Oracle data pump backup is obtained; s200, judging whether a keyword is found or not, if yes, executing the step S300, and if not, executing the step SA00; s300, according to the first offset, the second offset, the third offset, the fourth offset and the fourth offset, content with the length of 4 bytes is read; s400, judging whether the values of the four read bytes are all 0 or not, if yes, executing the step S500, and if not, executing the step S200; s500: according to the fifth offset to the eighth offset, respectively reading contents with the length of 4 bytes according to a large end format, and respectively taking the contents as byte lengths and offsets of a table information area and a table data area; s600, reading the meter information; s700, reading the meter data; s800, analyzing the table data to obtain table records; s900, addressing the tail of the current object block, and executing the step S200; and SA00, outputting the recovered Oracle data according to a result of analyzing the backup of the Oracle data pump, and ending the process.

Description

Technical Field

[0001] The invention belongs to the field of data recovery and electronic data forensics, and relates to a method for parsing and recovering an Oracle data pump backup. Background Art

[0002] Oracle Database is a relational database developed by Oracle Corporation. It is an efficient and reliable database system suitable for small, medium, and large environments. Due to its excellent performance, Oracle Database is used by many enterprises and institutions to store large amounts of important data.

[0003] Backing up data is a common practice throughout a database's lifecycle. Oracle Data Pump backups are a widely used format. Because Oracle Data Pump backups store large amounts of data, retrieving the data without an Oracle database environment or if the backup is unexpectedly corrupted becomes challenging. Therefore, developing a method that can parse healthy and / or corrupted backups and extract data from them, independent of any database environment, is highly valuable. Summary of the Invention

[0004] In view of the shortcomings of the prior art, the present invention provides a method for parsing and restoring an Oracle data pump backup by parsing the Oracle data pump backup data structure, comprising the following steps:

[0005] S100: Get Oracle Data Pump backup;

[0006] S200: Search for the keyword 0xFFFF2424 in the Oracle Data Pump backup and determine whether the keyword 0xFFFF2424 is found. If so, execute step S300; otherwise, execute step SA00.

[0007] S300: With the starting address of the keyword 0xFFFF2424 as the first address, shift the first offset, second offset, third offset, and fourth offset bytes in the direction of the higher address and read 4-byte content from each of them;

[0008] S400: Determine whether the values of the read 4 bytes are all 0x00000000. If so, it means that the keyword 0xFFFF2424 and the data after it are the object block header, and execute step S500; otherwise, execute step S200;

[0009] S500: Taking the starting address of the current keyword 0xFFFF2424 as the first address, offset the fifth offset, sixth offset, seventh offset, and eighth offset bytes in the direction of the higher address respectively, and read 4 bytes of content in each of the bytes in big-endian format, and use them as the byte length of the table information area, the offset of the table information area relative to the starting address of the current keyword 0xFFFF2424, the byte length of the table data area, and the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 respectively;

[0010] S600: Using the starting address of the current keyword 0xFFFF2424 as the first address and the offset of the table information area relative to the starting address of the current keyword 0xFFFF2424 as the offset, addressing in the direction of higher addresses and reading data as table information; wherein the byte length of the read data is the byte length of the table information area, the table information includes table field information, and the field information includes field type;

[0011] S700: Using the starting address of the current keyword 0xFFFF2424 as the first address and the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 as the offset, addressing in the direction of higher addresses and reading data as table data, wherein the byte length of the read data is the byte length of the table data area;

[0012] S800: Parse table data and obtain table records;

[0013] S900: Address the end of the current object block and execute step S200;

[0014] SA00: Based on the results of parsing the Oracle Data Pump backup, output the restored Oracle data and end the process.

[0015] Preferably, the first offset, the second offset, the third offset and the fourth offset are 0x06, 0x0E, 0x26 and 0x2E bytes respectively.

[0016] Preferably, the fifth offset, the sixth offset, the seventh offset, and the eighth offset are 0x0A, 0x12, 0x1A, and 0x22 bytes, respectively.

[0017] Preferably, the table information is in an XML structure.

[0018] Preferably, step S800 includes the following steps:

[0019] S801: According to the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 and the byte length of the table data area, obtain the table data and record the starting address of the current table data as the positioning address;

[0020] S802: Read the 1-byte content at the positioning address as an identifier, positioning address = positioning address + 1;

[0021] S803: Determine whether the fifth bit from the lowest to the highest bit of the identifier is 1. If so, execute step S804; otherwise, the location address remains unchanged and execute step S805;

[0022] S804: Positioning address = positioning address + 2;

[0023] S805: Read the 1-byte content at the positioning address as the field quantity, positioning address = positioning address + 1;

[0024] S806: Read the 1-byte content at the positioning address as the field byte length, positioning address = positioning address + 1;

[0025] S807: Determine whether the field byte length is 0xFF. If so, execute step S808; otherwise, execute step S809.

[0026] S808: The field byte length is set to 0, and step S811 is executed;

[0027] S809: Determine whether the field byte length is 0xFE. If so, execute step S810. Otherwise, the field byte length remains unchanged and execute step S811.

[0028] S810: Read the 2-byte content at the positioning address in big-endian format as the field byte length, positioning address = positioning address + 2, and execute step S811;

[0029] S811: Based on the field type in the table information, the data is read with the positioning address as the first address and the field byte length as the offset. The read data is converted into the field value of the corresponding format according to the method of obtaining the field value. The positioning address = positioning address + field byte length;

[0030] S812: Loop through steps S806 to S811, with the number of loops being the same as the number of fields. After the loop is complete, proceed to step 813.

[0031] S813: Determine whether the third bit from the lowest to the highest bit of the identifier is 0. If so, execute step S802; otherwise, execute step S814.

[0032] S814: Merging the field values converted into corresponding formats into a table record, completing the parsing and recovery of the table record;

[0033] S815: Determine whether the addressing reaches the end of the table data. If so, execute step S816; otherwise, execute step S802.

[0034] S816: Output the merged table records.

[0035] Preferably, the method for obtaining the field value in step S811 includes the following steps:

[0036] S81101: Determine whether the field type in the table information is a decimal value 2. If so, execute step S81102; otherwise, execute step S81108.

[0037] S81102: Determine whether the first byte of the data read in step S811 is equal to 0x80. If so, execute step S81103; otherwise, execute step S81104.

[0038] S81103: Set the current field value to zero and execute step S812;

[0039] S81104: Determine whether the first byte of the data read in step S811 is greater than 0x80. If so, execute step S81105; otherwise, execute step S81106.

[0040] S81105: If the current field value is a positive number, execute step S81107;

[0041] S81106: The current field value is negative;

[0042] S81107: After deducting 1 from the second byte to the last byte of the data read in step S811, the contents are sequentially concatenated to generate a digital string, and the value of N is calculated and determined to be greater than 0. If so, N strings of "00" are added to the end of the currently generated digital string, and step S812 is executed. Otherwise, the string of "00" does not need to be added to the end of the currently generated digital string, and step S812 is executed; wherein N is equal to the sum of the difference between the first byte of the data read in step S811 and 0xC1, plus 1, minus the difference between the field byte lengths, plus 1;

[0043] S81108: Determine whether the field type in the table information is a decimal value 100 or 101. If so, execute step S81109; otherwise, execute step S81110.

[0044] S81109: Convert the data format read in step S811 from big-endian to little-endian, then convert it into a digital string and output it as the converted field value, and then execute step S812;

[0045] S81110: Determine whether the field type in the table information is any of the decimal values 12, 180, 181, and 231. If so, execute step S81111; otherwise, execute step S81112.

[0046] S81111: Subtract the decimal value 100 from the first and second bytes of the data read in step S811, and then concatenate the resulting values as the year. The third and fourth bytes are used as the month and day, respectively. The fifth to seventh bytes are each subtracted by 1 as the hour, minute, and second, respectively. The values are then converted into date strings according to the standard date format and output as the converted field values. Execute step S812.

[0047] S81112: Determine whether the field type in the table information is any of the decimal values 1, 8, 23, 24, 58, 96, 112, and 113. If so, execute step S81113; otherwise, execute step S812.

[0048] S81113: Convert the read data into field values of the corresponding format according to the character encoding recorded in the table information.

[0049] Preferably, step S81113 includes the following steps:

[0050] S811131: Determine whether the character code recorded in the table information is a decimal value 852. If so, execute step S811132; otherwise, execute step S811133.

[0051] S811132: The character string of the data read in step S811 is directly output as the converted field value, and step S812 is executed;

[0052] S811133: Determine whether the character code recorded in the table information is a decimal value 871 or 873. If so, execute step S811134; otherwise, execute step S811135.

[0053] S811134: The data read in step S811 is converted from UTF8 encoding to ANSI encoding string and output as the converted field value, and step S812 is executed;

[0054] S811135: Determine whether the character code recorded in the table information is a decimal value 2000. If so, execute step S811136; otherwise, execute step S812.

[0055] S811136: Convert the data read in step S811 from UNICODE encoding to ANSI encoding string and output it as the converted field value.

[0056] Preferably, the method for obtaining the field type and character encoding of the field information in step S600 is:

[0057] Read the XML format data of the table field information of the table information, and use the value of TYPE_NUM in the read XML format data as the field type, and read the value of CHARSETID as the character encoding.

[0058] The beneficial effect of the present invention is that data can be recovered from an Oracle data pump backup in the absence of an Oracle database environment or when the backup suffers from accidental damage. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is the overall flow chart of the present invention;

[0060] Figure 2 This is a diagram showing an example of the data structure of an object block header in a database according to an embodiment of the present invention;

[0061] Figure 3A 、 Figure 3B This is a diagram showing an example of the data structure of table information in an embodiment of the present invention;

[0062] Figure 4A 、 Figure 4B This is a diagram showing an example of the data structure of table data in an embodiment of the present invention;

[0063] Figure 5 is a flow chart of parsing table data and obtaining table records in an embodiment of the present invention;

[0064] Figure 6 This is a flowchart of a method for obtaining a field value in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The present invention will be further described below with reference to the accompanying drawings and examples.

[0066] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0067] S100: Get Oracle Data Pump backup;

[0068] S200: Search for the keyword 0xFFFF2424 in the Oracle Data Pump backup and determine whether the keyword 0xFFFF2424 is found. If so, execute step S300; otherwise, execute step SA00.

[0069] Figure 2 FIG. 1 shows an example of the data structure of the object block header in the database according to an embodiment of the present invention (only part of the data is shown). Figure 2 As shown, 0xFFFF2424 is the keyword being queried;

[0070] S300: Starting from the starting address of the keyword 0xFFFF2424, the address is shifted towards the higher address by 0x06, 0x0E, 0x26, and 0x2E bytes respectively, and 4 bytes of content is read from each of them;

[0071] S400: Determine whether the values of the read 4 bytes are all 0x00000000. If so, it means that the keyword 0xFFFF2424 and the data after it are the object block header, and execute step S500; otherwise, execute step S200;

[0072] like Figure 2 As shown, in this implementation, the 4-byte length contents read at bytes 0x06, 0x0E, 0x26, and 0x2E are all 0, so the keyword 0xFFFF2424 and the data after it are the object block header we need to find.

[0073] S500: With the starting address of the current keyword 0xFFFF2424 as the first address, offset 0x0A, 0x12, 0x1A, and 0x22 bytes in the direction of higher addresses respectively, and read 4 bytes of content in big-endian format respectively, and use them as the byte length of the table information area, the offset of the table information area relative to the starting address of the current keyword 0xFFFF2424, the byte length of the table data area, and the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 respectively;

[0074] like Figure 2 As shown, in this implementation, the starting address of the current keyword 0xFFFF2424 is used as the first address, and 0x0A, 0x12, 0x1A, and 0x22 bytes are offset in the direction of the higher address, and the 4-byte length content is read in the big-endian format respectively, to obtain the following Figure 2 The 0x00001000 shown in the rectangular box data is used as the byte length of the table information area, and the 0x0000060E shown in the thick black underline data is obtained as the offset of the table information area relative to the starting address of the current keyword 0xFFFF2424. The 0x00001610 shown in the rounded rectangular box data is obtained as the byte length of the table data area, and the 0x00013D12 shown in the thin black underline data is obtained as the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424.

[0075] S600: Using the starting address of the current keyword 0xFFFF2424 as the first address, and the offset 0x0000060E of the table information area relative to the starting address of the current keyword 0xFFFF2424 as the offset, addressing in the direction of the higher address and reading the data as the table information; wherein, the byte length of the read data is the byte length 0x00001000 of the table information area, and the table information includes table field information, wherein the field information includes field type and character encoding.

[0076] Figure 3A 、 Figure 3B An example diagram of the data structure of table information in an embodiment of the invention is shown (only part of the data is shown);

[0077] The method for obtaining the field type and character encoding of the field information in step S600 is:

[0078] In this embodiment, the XML format data of the table field information of the table information is read, and the value 2 of TYPE_NUM in the read XML format data is used as the field type, such as Figure 3B The ANSI ASCII portion is shown in bold black underline.

[0079] For fields with decimal values of 1, 8, 23, 24, 58, 96, 112, or 113, you can read the value of CHARSETID as the character encoding. For details, see the subsequent steps.

[0080] like Figure 3A 、 Figure 3B As shown, the starting address of the current keyword 0xFFFF2424 is used as the first address, and the offset 0x0000060E of the table information area relative to the starting address of the current keyword 0xFFFF2424 is used as the offset for addressing, that is, addressing to Figure 3A The address shown in the black underlined part is 0x0000060E; starting from 0x0000060E, read the byte content of the table information area with a byte length of 0x00001000, which is the table information, that is, Figure 3B The data in the thin black underlined portion indicates address 0x0000160D. In other words, the byte content between addresses 0x0000060E and 0x0000160D, with a byte length of 0x1000, is the table information area. As can be seen from the corresponding ASCII code, the table information in this embodiment is an XML structure.

[0081] S700: Similarly, with the starting address of the current keyword 0xFFFF2424 as the first address, and the offset 0x00001610 of the table data area relative to the starting address of the current keyword 0xFFFF2424 as the offset, addressing is performed in the direction of higher addresses and data is read as table data, wherein the byte length of the read data is the byte length 0x00013D12 of the table data area;

[0082] Figure 4A 、 Figure 4B The following diagram shows an example of the data structure of table data in an embodiment of the present invention (only part of the data is shown).

[0083] The starting address of the current keyword 0xFFFF2424 is used as the first address, and the offset 0x00001610 of the table information area relative to the starting address of the current keyword 0xFFFF2424 is used as the offset for addressing, that is, addressing to Figure 4A The address shown in the black underlined part is 0x00001610; starting from 0x00001610, read the byte content of the table information area with a length of 0x00013D12, which is the table data, that is, addressing to Figure 4B The data in the thin black underlined portion is at address 0x00015321. In other words, the bytes between addresses 0x00001610 and 0x00015321 with a length of 0x00013D12 are the table data area.

[0084] S800: Parse table data and obtain table records;

[0085] Figure 5 FIG. 1 shows a flow chart of parsing table data and obtaining table records in an embodiment of the present invention. Figure 5 As shown, step S800 includes the following steps:

[0086] S801: According to the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 and the byte length of the table data area, obtain the table data and record the starting address of the current table data as the positioning address. At this time, the positioning address is the offset of the table data area. In this embodiment, the current positioning address is 0x00001610. Figure 4A shown.

[0087] S802: Read the 1-byte content at the positioning address as an identifier, positioning address = positioning address + 1;

[0088] At this time, if Figure 4A As shown, read the 1-byte content 0x3C at the positioning address as the identifier, positioning address = positioning address + 1 = 0x00001611;

[0089] S803: Determine whether the fifth bit from the lowest to the highest bit of the identifier is 1. If so, execute step S804; otherwise, the location address remains unchanged and execute step S805;

[0090] In this embodiment, the binary representation of 0x3C is 00111100, and the fifth bit is 1, so step S804 is executed.

[0091] S804: Positioning address = positioning address + 2;

[0092] At this time, if Figure 4A As shown, positioning address = positioning address + 2 = 0x00001613;

[0093] S805: Read the 1-byte content at the positioning address as the field quantity, positioning address = positioning address + 1;

[0094] At this time, if Figure 4A As shown, read the 1-byte content 0x02 at the positioning address 0x00001613 as the field number, positioning address = positioning address + 1 = 0x00001614;

[0095] S806: Read the 1-byte content at the positioning address as the field byte length, positioning address = positioning address + 1;

[0096] At this time, if Figure 4A As shown, read the 1-byte content 0x03 at the positioning address 0x00001614 as the field byte length, positioning address = positioning address + 1 = 0x00001615;

[0097] S807: Determine whether the field byte length is 0xFF. If so, execute step S808; otherwise, execute step S809.

[0098] In this embodiment, the field byte length is 0x03, and step S809 is executed.

[0099] S808: The field byte length is set to 0, and step S811 is executed;

[0100] S809: Determine whether the field byte length is 0xFE. If so, execute step S810. Otherwise, the field byte length remains unchanged and execute step S811.

[0101] In this embodiment, the field byte length is 0x03, and step S811 is executed.

[0102] S810: Read the 2-byte content at the positioning address in big-endian format as the field byte length, positioning address = positioning address + 2, and execute step S811;

[0103] S811: Based on the field type in the table information, the data is read with the positioning address as the first address and the field byte length as the offset. The read data is converted into the field value of the corresponding format according to the method of obtaining the field value. The positioning address = positioning address + field byte length;

[0104] In this embodiment, if Figure 4A As shown, the current positioning address is 0x00001615, the field byte length is 0x03, and the data 0xC25F59 is read. According to the method of obtaining the field value, the read data 0xC25F59 is converted into the field value of the corresponding format. Positioning address = positioning address + field byte length = 0x00001618;

[0105] Figure 6 Flowchart of the method for obtaining field values in an embodiment of the present invention. Specifically, Figure 6 As shown, the method for obtaining the field value in step S811 includes the following steps:

[0106] S81101: Determine whether the field type in the table information is a decimal value 2. If so, execute step S81102; otherwise, execute step S81108. In this embodiment, Figure 3B As shown, the value of the field type (TYPE_NUM) is 2, and the process executes step S81102;

[0107] S81102: Determine whether the first byte of the data read in step S811 is equal to 0x80. If so, execute step S81103; otherwise, execute step S81104. In this embodiment, the first byte is 0xC2, and the process executes step S81104.

[0108] S81103: Set the current field value to zero and execute step S812;

[0109] S81104: Determine whether the first byte of the data read in step S811 is greater than 0x80. If so, execute step S81105; otherwise, execute step S81106. In this embodiment, the first byte is 0xC2, which is greater than 0x80, so the process executes step S81105.

[0110] S81105: If the current field value is a positive number, execute step S81107;

[0111] S81106: The current field value is negative;

[0112] S81107: After the contents of the second byte to the last byte of the data read in step S811, 0x5F and 0x59, are respectively decremented by 1, their values are 0x5E and 0x58 respectively, and the decimal digital string is generated in sequence as 9488 (i.e., 0x5E58 in hexadecimal), and the value of N is calculated and it is determined whether N is greater than 0. If so, N 0x00 is added to the end of the currently generated digital string, and step S812 is executed. Otherwise, the string "00" does not need to be added to the end of the currently generated digital string; wherein N is equal to the sum of the difference between the first byte content of the data read in step S811 and 0xC1 plus 1, minus the difference between the field byte lengths and 1;

[0113] In this embodiment, N=0xC2-0xC1+1-0x03+1=0. Therefore, the digital string is 9488 (i.e., 0x5E58 in hexadecimal), and the string "00" does not need to be added at the end. That is, 9488 is directly output as the converted field value, and step S812 is executed.

[0114] S81108: Determine whether the field type in the table information is a decimal value 100 or 101. If so, execute step S81109; otherwise, execute step S81110.

[0115] S81109: Convert the data format read in step S811 from big-endian to little-endian, then convert it into a digital string and output it as the converted field value, and then execute step S812;

[0116] S81110: Determine whether the field type in the table information is any of the decimal values 12, 180, 181, and 231. If so, execute step S81111; otherwise, execute step S81112.

[0117] S81111: Subtract the decimal value 100 from the first and second bytes of the data read in step S811, and then concatenate the resulting values as the year. The third and fourth bytes are used as the month and day, respectively. The fifth to seventh bytes are each subtracted by 1 as the hour, minute, and second, respectively. The values are then converted into date strings according to the standard date format and output as the converted field values. Execute step S812.

[0118] S81112: Determine whether the field type in the table information is any of the decimal values 1, 8, 23, 24, 58, 96, 112, and 113. If so, execute step S81113; otherwise, execute step S812.

[0119] S81113: Convert the read data into field values of corresponding format according to the character encoding recorded in the aforementioned table information;

[0120] Specifically, step S81113 includes the following steps:

[0121] S811131: Determine whether the character code recorded in the table information is a decimal value 852. If so, execute step S811132; otherwise, execute step S811133.

[0122] S811132: The character string of the data read in step S811 is directly output as the converted field value, and step S812 is executed;

[0123] S811133: Determine whether the character code recorded in the table information is a decimal value 871 or 873. If so, execute step S811134; otherwise, execute step S811135.

[0124] S811134: The data read in step S811 is converted from UTF8 encoding to ANSI encoding string and output as the converted field value, and step S812 is executed;

[0125] S811135: Determine whether the character code recorded in the table information is a decimal value 2000. If so, execute step S811136; otherwise, execute step S812.

[0126] S811136: Convert the data read in step S811 from UNICODE encoding to ANSI encoding string and output it as the converted field value.

[0127] S812: Loop through steps S806 to S811, with the number of loops being the same as the number of fields. After the loop is complete, proceed to step 813.

[0128] S813: Determine whether the third bit from the lowest to the highest bit of the identifier is 0. If so, execute step S802; otherwise, execute step S814.

[0129] In this embodiment, the binary representation of the identifier 0x3C is 00111100, and the third bit from the low order to the high order is 1, and step S814 is executed.

[0130] S814: Merging the field values converted into corresponding formats into a table record, completing the parsing and recovery of the table record;

[0131] S815: Determine whether the addressing reaches the end of the table data. If so, execute step S816; otherwise, execute step S802.

[0132] S816: Output the merged table records, complete the parsing and recovery of the Oracle Data Pump backup, and end the process.

[0133] S900: Address the end of the current object block and execute step S200;

[0134] SA00: Based on the results of parsing the Oracle Data Pump backup, output the restored Oracle data and end the process.

[0135] The above steps are only described for the embodiment with field type 2. Those skilled in the art should understand that for other field types mentioned in the above description, Oracle Data Pump backups can be parsed and restored according to the technical solution of the present application.

[0136] The method provided by the present invention solves the technical problem that there is no method for parsing and restoring Oracle data pump backup in the prior art when there is no Oracle database environment or the backup is accidentally damaged.

[0137] It should be understood that the present invention is not limited to the above examples. Those skilled in the art can make improvements or changes based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for parsing and restoring an Oracle data pump backup, characterized in that The following steps are involved: S100: Get Oracle Data Pump backup; S200: Search for the keyword 0xFFFF2424 in the Oracle Data Pump backup and determine whether the keyword 0xFFFF2424 is found. If so, execute step S300; otherwise, execute step SA00. S300: With the starting address of the keyword 0xFFFF2424 as the first address, shift the first offset, second offset, third offset, and fourth offset bytes in the direction of the higher address and read 4-byte content from each of them; S400: Determine whether the values of the read 4 bytes are all 0x00000000. If so, it means that the keyword 0xFFFF2424 and the data after it are the object block header, and execute step S500; otherwise, execute step S200; S500: Taking the starting address of the current keyword 0xFFFF2424 as the first address, offset the fifth offset, sixth offset, seventh offset, and eighth offset bytes in the direction of the higher address respectively, and read 4 bytes of content in each of the bytes in big-endian format, and use them as the byte length of the table information area, the offset of the table information area relative to the starting address of the current keyword 0xFFFF2424, the byte length of the table data area, and the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 respectively; S600: Using the starting address of the current keyword 0xFFFF2424 as the first address and the offset of the table information area relative to the starting address of the current keyword 0xFFFF2424 as the offset, seek to the higher address direction and read data as table information; wherein the byte length of the read data is the byte length of the table information area, the table information includes table field information, and the field information includes field type and character encoding; S700: Using the starting address of the current keyword 0xFFFF2424 as the first address and the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 as the offset, addressing in the direction of higher addresses and reading data as table data, wherein the byte length of the read data is the byte length of the table data area; S800: Parse table data and obtain table records; S900: Address the end of the current object block and execute step S200; SA00: Based on the results of parsing the Oracle Data Pump backup, output the restored Oracle data and end the process.

2. A method for parsing and restoring an Oracle data pump backup according to claim 1, characterized in that: The first offset, second offset, third offset, and fourth offset are 0x06, 0x0E, 0x26, and 0x2E bytes respectively.

3. A method for parsing and restoring an Oracle data pump backup according to claim 1, characterized in that: The fifth offset, sixth offset, seventh offset, and eighth offset are 0x0A, 0x12, 0x1A, and 0x22 bytes, respectively.

4. A method for parsing and restoring an Oracle data pump backup according to claim 1, characterized in that: It is characterized in that The table information is in XML structure.

5. A method for parsing and restoring an Oracle data pump backup according to claim 1, characterized in that: It is characterized in that Step S800 includes the following steps: S801: According to the offset of the table data area relative to the starting address of the current keyword 0xFFFF2424 and the byte length of the table data area, obtain the table data and record the starting address of the current table data as the positioning address; S802: Read the 1-byte content at the positioning address as an identifier, positioning address = positioning address + 1; S803: Determine whether the fifth bit from the lowest to the highest bit of the identifier is 1. If so, execute step S804; otherwise, the location address remains unchanged and execute step S805; S804: Positioning address = positioning address + 2; S805: Read the 1-byte content at the positioning address as the field quantity, positioning address = positioning address + 1; S806: Read the 1-byte content at the positioning address as the field byte length, positioning address = positioning address + 1; S807: Determine whether the field byte length is 0xFF. If so, execute step S808; otherwise, execute step S809. S808: The field byte length is set to 0, and step S811 is executed; S809: Determine whether the field byte length is 0xFE. If so, execute step S810. Otherwise, the field byte length remains unchanged and execute step S811. S810: Read the 2-byte content at the positioning address in big-endian format as the field byte length, positioning address = positioning address + 2, and execute step S811; S811: Based on the field type in the table information, the data is read with the positioning address as the first address and the field byte length as the offset. The read data is converted into the field value of the corresponding format according to the method of obtaining the field value. The positioning address = positioning address + field byte length; S812: Loop through steps S806 to S811. The number of loop executions is equal to the number of fields. After the loop execution is complete, execute step 813. S813: Determine whether the third bit from the lowest to the highest bit of the identifier is 0. If so, execute step S802; otherwise, execute step S814. S814: Merging the field values converted into corresponding formats into a table record, completing the parsing and recovery of the table record; S815: Determine whether the addressing reaches the end of the table data. If so, execute step S816; otherwise, execute step S802. S816: Output the merged table records.

6. A method for parsing and restoring an Oracle data pump backup according to claim 5, characterized in that: It is characterized in that The method for obtaining the field value in step S811 includes the following steps: S81101: Determine whether the field type in the table information is a decimal value 2. If so, execute step S81102; otherwise, execute step S81108. S81102: Determine whether the first byte of the data read in step S811 is equal to 0x80. If so, execute step S81103; otherwise, execute step S81104. S81103: Set the current field value to zero and execute step S812; S81104: Determine whether the first byte of the data read in step S811 is greater than 0x80. If so, execute step S81105; otherwise, execute step S81106. S81105: If the current field value is a positive number, execute step S81107; S81106: The current field value is negative; S81107: After deducting 1 from the second byte to the last byte of the data read in step S811, the contents are sequentially concatenated to generate a digital string, and the value of N is calculated and determined to be greater than 0. If so, N strings of "00" are added to the end of the currently generated digital string, and step S812 is executed. Otherwise, the string of "00" does not need to be added to the end of the currently generated digital string, and step S812 is executed; wherein N is equal to the sum of the difference between the first byte of the data read in step S811 and 0xC1, plus 1, minus the difference between the field byte lengths, plus 1; S81108: Determine whether the field type in the table information is a decimal value 100 or 101. If so, execute step S81109; otherwise, execute step S81110. S81109: Convert the data format read in step S811 from big-endian to little-endian, then convert it into a digital string and output it as the converted field value, and then execute step S812; S81110: Determine whether the field type in the table information is any of the decimal values 12, 180, 181, and 231. If so, execute step S81111; otherwise, execute step S81112. S81111: Subtract the decimal value 100 from the first and second bytes of the data read in step S811, and then concatenate the resulting values as the year. The third and fourth bytes are used as the month and day, respectively. The fifth to seventh bytes are each subtracted by 1 as the hour, minute, and second, respectively. The values are then converted into date strings according to the standard date format and output as the converted field values. Execute step S812. S81112: Determine whether the field type in the table information is any of the decimal values 1, 8, 23, 24, 58, 96, 112, and 113. If so, execute step S81113; otherwise, execute step S812. S81113: Convert the read data into field values of the corresponding format according to the character encoding recorded in the table information.

7. A method for parsing and restoring an Oracle data pump backup according to claim 6, characterized in that: It is characterized in that Step S81113 includes the following steps: S811131: Determine whether the character code recorded in the table information is a decimal value 852. If so, execute step S811132; otherwise, execute step S811133. S811132: The character string of the data read in step S811 is directly output as the converted field value, and step S812 is executed; S811133: Determine whether the character code recorded in the table information is a decimal value 871 or 873. If so, execute step S811134; otherwise, execute step S811135. S811134: The data read in step S811 is converted from UTF8 encoding to ANSI encoding string and output as the converted field value, and step S812 is executed; S811135: Determine whether the character code recorded in the table information is a decimal value 2000. If so, execute step S811136; otherwise, execute step S812. S811136: Convert the data read in step S811 from UNICODE encoding to ANSI encoding string and output it as the converted field value.

8. A method for parsing and restoring an Oracle data pump backup according to claim 1, characterized in that: It is characterized in that The method for obtaining the field type and character encoding of the field information in step S600 is: Read the XML format data of the table field information of the table information, and use the value of TYPE_NUM in the read XML format data as the field type, and read the value of CHARSETID as the character encoding.

Images