Database Reference
In-Depth Information
Pinned Backdoor Packages in the SGA
Pinning is done to ring fence the memory holding a package so that it is not changed, and therefore the database
can use that package more quickly. It is a performance feature. Unfortunately, it could be used to create a bad copy
of a package in memory while the new version on disk could be the known-good, thus fooling anyone checking for
backdoors. This could circumvent our check for the state of the package in the data file. We need a way to check which
packages are pinned, as follows:
set pagesize 60;
column executions format 999,999,999;
column Mem_used format 999,999,999;
SELECT SUBSTR(owner,1,10) Owner,
SUBSTR(type,1,12) Type,
SUBSTR(name,1,20) Name,
executions,
sharable_mem Mem_used,
SUBSTR(kept||' ',1,4) "Kept?"
FROM v$db_object_cache
WHERE type in ('TRIGGER','PROCEDURE','PACKAGE BODY','PACKAGE')
and owner in ('SYS','SYSTEM')
and executions != 0
ORDER BY name;
/
OWNER TYPE NAME EXECUTIONS MEM_USED Kept
---------- ------------ -------------------- ------------ ------------ ----
SYS PROCEDURE AW_DROP_PROC 10 12,264 NO
SYS PROCEDURE AW_TRUNC_PROC 225 8,168 NO
SYS PACKAGE DBMS_ADVISOR 210 94,264 NO
SYS PACKAGE BODY DBMS_ADVISOR 148 60,008 NO
SYS PACKAGE BODY DBMS_APPLICATION_INF 5,108 8,192 NO
SYS PACKAGE DBMS_APP_CONT_PRVT 1 0 NO
SYS PACKAGE BODY DBMS_ASH_INTERNAL 194 230,584 NO
SYS PACKAGE BODY DBMS_ASSERT 493,697 16,408 NO
SYS PACKAGE BODY DBMS_AUTO_REPORT_INT 99 24,680 NO
SYS PACKAGE BODY DBMS_CRYPTO 1 0 NO
SYS PACKAGE BODY DBMS_CRYPTO_FFI 1 0 NO
SYS PACKAGE BODY DBMS_HA_ALERTS_PRVT 7 0 NO
SYS PACKAGE DBMS_HA_ALERTS_PRVT 6 0 NO
SYS PACKAGE BODY DBMS_ISCHED 2,643 354,600 NO
SYS PACKAGE BODY DBMS_LOB 169,279 28,792 NO
SYS PACKAGE BODY STANDARD 144,766 32,880 NO
SYS PACKAGE BODY UTL_COMPRESS 99 8,192 NO
SYS PACKAGE BODY UTL_RAW 347 12,288 NO
SYS PACKAGE BODY UTL_SYS_COMPRESS 99 12,352 NO
